madeby 0.3.14 → 0.3.15

package/README.md

@@ -43,6 +43,7 @@ npm i -g madeby
 ```
 madeby init                    Set MadeBy up: write .madeby/policy.json + the CI disclosure check.
                                --record-model (opt-in) also asks agents to name the model version.
+                               In a repo that uses Claude Code, also turns its commit trailer on.
 madeby check  [<range>]        The gate: do commits meet .madeby/policy.json? (a verdict — exit code
                                gates). <range> e.g. origin/main..HEAD — a PR's own commits. --json too.
 madeby coverage [<range>]      The scoreboard: how much of the repo's authorship is disclosed (known)
@@ -198,6 +199,24 @@ Fail-safe by design: a missing or malformed policy degrades to `advisory`. `made
 on its own error, and never invents a stricter gate than the maintainer wrote. It never passes a
 `required` check it couldn't actually run, either: missing history fails it (see `check` above).
 
+### Claude Code's own trailer
+
+Claude Code adds a `Co-Authored-By` trailer to its commits unless a developer turns it off in their
+personal settings — and then the `AGENTS.md` rule alone may not bring it back. So in a repo that uses
+Claude Code (it has a `CLAUDE.md` or a `.claude/` folder; `--claude-code` to force), `madeby init`
+sets the trailer in the shared `.claude/settings.json`:
+
+```json
+{ "attribution": { "commit": "Co-Authored-By: Claude Code <noreply@anthropic.com>" } }
+```
+
+The shared project file overrides a developer's personal settings, so everyone in the repo gets the
+trailer back. It's fixed text — Claude Code's setting has no placeholder for the model — so to record
+the model use `--record-model`. It merges into an existing file and never changes a value the team
+already set, including turning attribution off on purpose. A developer's own
+`.claude/settings.local.json` or instructions can still turn it off; the `required` check is what
+holds the line.
+
 ## Use it as a PR check
 
 A ready-made GitHub Action, an Azure DevOps Pipelines template, and a GitLab CI job wrap

package/dist/madeby.mjs

@@ -2591,7 +2591,7 @@ import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as rea
 import { dirname as dirname2, join as join8 } from "node:path";
 
 // src/version.ts
-var VERSION = "0.3.14";
+var VERSION = "0.3.15";
 
 // src/init-repo.ts
 var ACO_VERSION = 2;
@@ -2687,6 +2687,31 @@ function ensurePolicy(abs, rel, want, res) {
   }
   return { mode: raise ? "required" : current.mode, recordModel: modelOn || current.recordModel === true, malformed: !isObject };
 }
+var CLAUDE_TRAILER = "Co-Authored-By: Claude Code <noreply@anthropic.com>";
+function ensureClaudeSettings(root, force) {
+  const abs = join8(root, ".claude", "settings.json");
+  const usesClaude = force || existsSync7(join8(root, "CLAUDE.md")) || existsSync7(join8(root, ".claude"));
+  if (!usesClaude) return "not-used";
+  if (!existsSync7(abs)) {
+    mkdirSync2(dirname2(abs), { recursive: true });
+    writeFileSync2(abs, JSON.stringify({ attribution: { commit: CLAUDE_TRAILER } }, null, 2) + "\n");
+    return "created";
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync9(abs, "utf8"));
+  } catch {
+    return "malformed";
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return "malformed";
+  const settings = raw;
+  const attribution = settings.attribution;
+  if (attribution === false || attribution && typeof attribution === "object" && "commit" in attribution) return "kept";
+  if (attribution === void 0 && settings.includeCoAuthoredBy === false) return "kept";
+  const next = { ...settings, attribution: { ...attribution && typeof attribution === "object" ? attribution : {}, commit: CLAUDE_TRAILER } };
+  writeFileSync2(abs, JSON.stringify(next, null, 2) + "\n");
+  return "merged";
+}
 function ensureAco(abs, rel, res, opts) {
   const block = acoBlock(opts.recordModel);
   if (!existsSync7(abs)) {
@@ -2737,6 +2762,8 @@ function initRepo(root, opts = {}) {
   const aco = { update, recordModel: policy.recordModel, modelRequested };
   ensureAco(join8(root, "AGENTS.md"), "AGENTS.md", res, { createIfAbsent: true, ...aco });
   ensureAco(join8(root, "CLAUDE.md"), "CLAUDE.md", res, { createIfAbsent: false, ...aco });
+  const claudeSettings = ensureClaudeSettings(root, opts.claudeCode ?? false);
+  if (claudeSettings === "created") created.push(".claude/settings.json");
   if (host === "github") {
     writeIfAbsent(join8(root, ".github", "workflows", "disclosure.yml"), ".github/workflows/disclosure.yml", GH_WORKFLOW, created, skipped);
   } else if (host === "azure-devops") {
@@ -2773,8 +2800,15 @@ function initRepo(root, opts = {}) {
     nextSteps.push(`When ready to enforce: run 'madeby init --required' (or set "mode": "required" in .madeby/policy.json), then make the check required on the protected branch \u2014 the host's control plane (GitHub: gh api branch protection; Azure: a build-validation policy). See the MCP resource madeby://guide/enforce for exact commands.`);
   }
   nextSteps.push("Contributors disclose origin with a Co-Authored-By / Generated-by trailer (AI), an Authored-by-human trailer ('madeby me'), or an Authored-by-ai trailer ('madeby ai' \u2014 AI authored, committer accountable). A DCO Signed-off-by or a signed commit alone doesn't say who wrote the code, so it counts only if the policy's 'accept' lists it. Evidence upgrade: 'madeby ai --witness' records your own AI session's witnessed spans.");
+  if (claudeSettings === "created" || claudeSettings === "merged") {
+    nextSteps.push(`Claude Code now adds '${CLAUDE_TRAILER}' to its commits in this repo (.claude/settings.json), for everyone \u2014 including developers who turned the trailer off in their personal settings. Their .claude/settings.local.json, or an instruction of their own, can still turn it off; the check is what holds the line.`);
+  } else if (claudeSettings === "kept") {
+    nextSteps.push("This repo's .claude/settings.json already sets Claude Code's commit attribution, so it was left as the team set it. Clear that setting for the default trailer, or set attribution.commit to name the AI.");
+  } else if (claudeSettings === "malformed") {
+    nextSteps.push(".claude/settings.json isn't valid JSON, so Claude Code's commit trailer wasn't set. Fix the file and run 'madeby init' again.");
+  }
   nextSteps.push("Existing history is accounted for honestly, not fabricated: run 'madeby check' over full history to recognize what's already disclosed; pre-adoption commits stay unknown. See madeby://guide/backfill.");
-  return { created, skipped, merged, updated, outdated, raised, modelOn, policyMode: policy.mode, recordModel: policy.recordModel, host, nextSteps };
+  return { created, skipped, merged, updated, outdated, raised, modelOn, policyMode: policy.mode, recordModel: policy.recordModel, claudeSettings, host, nextSteps };
 }
 var GH_WORKFLOW = `name: Disclosure
 on: pull_request
@@ -2823,9 +2857,11 @@ function initCommand(args) {
   const recordModel = args.includes("--record-model");
   const hostIdx = args.indexOf("--host");
   const host = hostIdx >= 0 ? args[hostIdx + 1] : void 0;
-  const r = initRepo(root, { mode, host, update, recordModel });
+  const claudeCode = args.includes("--claude-code");
+  const r = initRepo(root, { mode, host, update, recordModel, claudeCode });
   for (const f of r.created) console.log(`  + ${f}`);
   for (const f of r.merged) console.log(`  ~ ${f} (merged in the ACO rule)`);
+  if (r.claudeSettings === "merged") console.log("  ~ .claude/settings.json (merged in Claude Code's commit trailer)");
   for (const f of r.updated) console.log(`  \u2191 ${f} (ACO convention refreshed to the current version)`);
   for (const f of r.raised) console.log(`  \u2191 ${f} (mode raised to required)`);
   for (const f of r.modelOn) console.log(`  \u2191 ${f} (now records the model version)`);
@@ -2864,14 +2900,16 @@ var TOOLS = [
         mode: { enum: ["advisory", "required"], description: "policy mode to seed (default: advisory)" },
         host: { type: "string", description: "CI host to wire: github (default) or azure-devops" },
         update: { type: "boolean", description: "refresh an outdated ACO convention block in place (drift update); default false (report only)" },
-        record_model: { type: "boolean", description: "opt in: ask AI disclosures to also name the model version (tool:model) \u2014 policy recordModel + an AGENTS.md line. Never turned off by init; default false." }
+        record_model: { type: "boolean", description: "opt in: ask AI disclosures to also name the model version (tool:model) \u2014 policy recordModel + an AGENTS.md line. Never turned off by init; default false." },
+        claude_code: { type: "boolean", description: "set Claude Code's commit trailer in .claude/settings.json even if the repo shows no sign of Claude Code (it is set automatically when there is a CLAUDE.md or .claude/). A value the team already set is never changed." }
       }
     },
     handler: (args) => initRepo(rootFor(args.path), {
       mode: args.mode,
       host: args.host,
       update: args.update,
-      recordModel: args.record_model
+      recordModel: args.record_model,
+      claudeCode: args.claude_code
     })
   },
   {
@@ -3177,6 +3215,8 @@ Usage:
                                  + the CI disclosure check. --update refreshes an outdated ACO block in
                                  place; --required to enforce now; --host azure-devops for Azure Pipelines;
                                  --record-model to also ask agents for the model version (opt-in).
+                                 In a repo that uses Claude Code (CLAUDE.md or .claude/; --claude-code to
+                                 force) it also turns Claude Code's commit trailer on in .claude/settings.json.
   madeby check [<range>]         The gate: do commits meet .madeby/policy.json? (a verdict \u2014 exit
                                  code gates). <range> e.g. origin/main..HEAD; in CI it's auto-detected.
                                  --json for a machine-readable result.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madeby",
-  "version": "0.3.14",
+  "version": "0.3.15",
   "mcpName": "io.github.MadeByFYI/madeby",
   "description": "Disclose AI authorship of code. `npx madeby ai` adds an Authored-by-ai git trailer; AI coding agents disclose per the ACO standard (human/with_ai/ai) from an AGENTS.md convention. Disclosure, not detection. Gate PRs with `madeby check`.",
   "license": "MIT",