madeby 0.3.14 → 0.3.16

package/README.md

@@ -27,6 +27,12 @@ sign-offs, SPDX AI-disclosure tags — and lets a project **gate PRs** on it (`m
 guesses whether code is AI; no tool can do that honestly. It reports only what contributors **put on
 the record**.
 
+The commands `init` writes into `AGENTS.md` pin the exact madeby release (`npx madeby@0.3.16 …`),
+like the CI file does: agents run them on developers' machines, which hold credentials, so they run
+the release the team chose rather than whatever is newest. When a newer release is out, `init`
+reports the rule as outdated, and `npx madeby@latest init --update` moves the pin in one commit to
+review.
+
 Zero hosted infrastructure — runs against your local git history, on a laptop or in any CI. Nothing
 leaves your machine.
 
@@ -43,6 +49,7 @@ npm i -g madeby
 ```
 madeby init                    Set MadeBy up: write .madeby/policy.json + the CI disclosure check.
                                --record-model (opt-in) also asks agents to name the model version.
+                               In a repo that uses Claude Code, also turns its commit trailer on.
 madeby check  [<range>]        The gate: do commits meet .madeby/policy.json? (a verdict — exit code
                                gates). <range> e.g. origin/main..HEAD — a PR's own commits. --json too.
 madeby coverage [<range>]      The scoreboard: how much of the repo's authorship is disclosed (known)
@@ -74,6 +81,11 @@ A commit **discloses who wrote it** if it carries any of:
 - an **affirmative human-authorship trailer** — `Authored-by-human: <you>` (see below);
 - a **`madeby ai`** attestation (your own AI session's witnessed spans).
 
+It checks the same commits `coverage` scores: every non-merge commit, plus any merge where someone
+changed what git would have produced on its own (a conflict resolved by hand). A merge git made by
+itself authors nothing and is never checked. Disclose a resolution like any commit: `madeby me
+--with-ai <tool>` right after committing it, or `--for` later.
+
 A **DCO `Signed-off-by:`** line or a **commit signature** is recognized too, but on its own it says
 who is accountable for the commit, not who wrote it, so it counts only if the policy's `accept`
 lists it. `check` reports commits that carry only one of those apart from those that carry nothing.
@@ -126,9 +138,11 @@ model versions are listed exactly as the AI commits name them — a commit namin
 (`Assisted-by: Claude Code` + `Co-Authored-By: Claude Opus 5.5`) counts under both, so those rows can
 sum past 100%. `--by author` shows one row per commit author (grouped by email): how many of their
 commits disclose, and the mix — who discloses and who never does. `--json` (which includes `byAuthor`) emits
-counts only (percentages are derived at the edge, never stored). A plain merge authors nothing and
-isn't scored; a merge that changes content of its own (a conflict resolution) is, like any other
-commit — chosen by what it changes, never by whether it discloses. Use it to see your gap, then
+counts only (percentages are derived at the edge, never stored). A merge git made on its own authors nothing
+and isn't scored, even when both sides changed the same file; a merge where someone changed what git
+would have produced (a conflict resolved by hand) is, like any other commit — chosen by what it
+changes, never by whether it discloses. That takes git 2.36 or later (`--remerge-diff`); with older
+git, merges git made cleanly may be counted too, and the scope says the count is approximate. Use it to see your gap, then
 `madeby init --required` to close it going forward.
 
 ### `madeby me` — affirm human authorship
@@ -198,6 +212,27 @@ Fail-safe by design: a missing or malformed policy degrades to `advisory`. `made
 on its own error, and never invents a stricter gate than the maintainer wrote. It never passes a
 `required` check it couldn't actually run, either: missing history fails it (see `check` above).
 
+### Claude Code's own trailer
+
+Claude Code adds a `Co-Authored-By` trailer to its commits unless a developer turns it off in their
+personal settings — and then the `AGENTS.md` rule alone may not bring it back. So in a repo that uses
+Claude Code (it has a `CLAUDE.md` or a `.claude/` folder; `--claude-code` to force), `madeby init`
+sets the trailer in the shared `.claude/settings.json`. It looks at any depth: Claude Code reads the
+settings of the folder it's launched from, so a monorepo whose app keeps its `CLAUDE.md` in
+`application/` gets `application/.claude/settings.json`, and the disclosure rule merged into that
+`CLAUDE.md`. If it finds none, it says so.
+
+```json
+{ "attribution": { "commit": "Co-Authored-By: Claude Code <noreply@anthropic.com>" } }
+```
+
+The shared project file overrides a developer's personal settings, so everyone in the repo gets the
+trailer back. It's fixed text — Claude Code's setting has no placeholder for the model — so to record
+the model use `--record-model`. It merges into an existing file and never changes a value the team
+already set, including turning attribution off on purpose. A developer's own
+`.claude/settings.local.json` or instructions can still turn it off; the `required` check is what
+holds the line.
+
 ## Use it as a PR check
 
 A ready-made GitHub Action, an Azure DevOps Pipelines template, and a GitLab CI job wrap

package/dist/madeby.mjs

@@ -59,6 +59,18 @@ function readGitLog(repoPath, limit, range) {
     return [];
   }
 }
+var remergeDiff;
+function supportsRemergeDiff() {
+  if (remergeDiff === void 0) {
+    try {
+      const v = /git version (\d+)\.(\d+)/.exec(execFileSync("git", ["--version"], { encoding: "utf8" }));
+      remergeDiff = !!v && (Number(v[1]) > 2 || Number(v[1]) === 2 && Number(v[2]) >= 36);
+    } catch {
+      remergeDiff = false;
+    }
+  }
+  return remergeDiff;
+}
 function readAuthoredMerges(repoPath, opts = {}) {
   try {
     const args = [
@@ -66,7 +78,7 @@ function readAuthoredMerges(repoPath, opts = {}) {
       repoPath,
       "log",
       "--merges",
-      "--cc",
+      supportsRemergeDiff() ? "--remerge-diff" : "--cc",
       "--name-only",
       `--format=${RECORD}%H${FIELD}%an${FIELD}%ae${FIELD}%G?${FIELD}%B${GROUP}`,
       ...opts.since !== void 0 && !opts.range ? [`--since=@${opts.since}`] : [],
@@ -86,6 +98,14 @@ function commitTime(repoPath, sha) {
     return void 0;
   }
 }
+function readScoredCommits(repoPath, opts) {
+  const limit = opts.range ? void 0 : opts.limit;
+  const authored = readGitLog(repoPath, limit, opts.range);
+  const oldest = authored.at(-1)?.sha;
+  const since = limit && oldest && authored.length >= limit ? commitTime(repoPath, oldest) : void 0;
+  const merges = authored.length > 0 && (!limit || authored.length < limit || since !== void 0) ? readAuthoredMerges(repoPath, { range: opts.range, since }) : [];
+  return { authored, merges };
+}
 
 // ../classify/src/classify.ts
 var AI_PATTERNS = [
@@ -1149,7 +1169,8 @@ function readDisclosures(root, opts = {}) {
 }
 function readDisclosuresWithRejects(root, opts) {
   const late = readDisclosureCommits(root, rangeHead(opts.range));
-  const commits = applyLateDisclosures(readGitLog(root, opts.range ? void 0 : opts.limit ?? 200, opts.range), late);
+  const { authored, merges } = readScoredCommits(root, { range: opts.range, limit: opts.limit ?? 200 });
+  const commits = applyLateDisclosures([...authored, ...merges], late);
   return {
     commits: commits.map((c) => ({
       sha: c.sha ?? "",
@@ -1396,11 +1417,7 @@ function agentName(raw) {
   return name || raw.trim();
 }
 function repoCoverage(root, opts = {}) {
-  const limit = opts.range ? void 0 : opts.limit ?? 500;
-  const authored = readGitLog(root, limit, opts.range);
-  const oldest = authored.at(-1)?.sha;
-  const since = limit && oldest && authored.length >= limit ? commitTime(root, oldest) : void 0;
-  const merges = authored.length > 0 && (!limit || authored.length < limit || since !== void 0) ? readAuthoredMerges(root, { range: opts.range, since }) : [];
+  const { authored, merges } = readScoredCommits(root, { range: opts.range, limit: opts.limit ?? 500 });
   const commits = applyLateDisclosures([...authored, ...merges], readDisclosureCommits(root, rangeHead(opts.range)));
   const byCategory = { human: 0, with_ai: 0, ai: 0, bot: 0 };
   const byTier = { asserted: 0, verified: 0 };
@@ -1440,8 +1457,8 @@ function repoCoverage(root, opts = {}) {
   }
   return {
     isEstimate: true,
-    methodology: "commit-level authorship disclosure (estimate); undisclosed = unknown, never inferred; merges scored only when they change content of their own; a disclosure commit (Discloses:) fills in commits disclosed afterwards and isn't scored itself",
-    scope: (opts.range ? `range ${opts.range}` : `last ${authored.length} commits`) + (merges.length ? ` + ${merges.length} merges with changes of their own` : ""),
+    methodology: "commit-level authorship disclosure (estimate); undisclosed = unknown, never inferred; merges scored only when they change content of their own" + (supportsRemergeDiff() ? " (beyond git's automatic merge)" : " (approximate: this git predates --remerge-diff, so merges git made cleanly may be counted too)") + "; a disclosure commit (Discloses:) fills in commits disclosed afterwards and isn't scored itself",
+    scope: (opts.range ? `range ${opts.range}` : `last ${authored.length} commits`) + (merges.length ? ` + ${merges.length} merges with changes of their own${supportsRemergeDiff() ? "" : " (approximate \u2014 git < 2.36)"}` : ""),
     total: commits.length,
     known,
     unknown: commits.length - known,
@@ -2245,10 +2262,11 @@ function parseFor(args) {
   if (i === -1) return void 0;
   const a = args[i];
   const v = a.startsWith("--for=") ? a.slice("--for=".length) : args[i + 1];
-  return v && !v.startsWith("-") ? v : void 0;
+  return v && !v.startsWith("-") ? v.trim() : "";
 }
 function discloseFor(root, target, opts) {
   const none = { disclosed: [], skipped: [], lines: [] };
+  if (!target.trim()) return { ok: false, reason: "bad-target", ...none };
   let email = "";
   try {
     email = git4(root, ["config", "user.email"]).toLowerCase();
@@ -2298,7 +2316,7 @@ function renderDiscloseFor(cmd2, target, r) {
   if (!r.ok) {
     if (r.reason === "no-identity") console.error(`madeby ${cmd2}: set your git identity first (git config user.name / user.email).`);
     else if (r.reason === "staged-changes") console.error(`madeby ${cmd2}: you have staged changes. A disclosure commit carries no content \u2014 commit or unstage them first.`);
-    else console.error(`madeby ${cmd2}: no commits found for ${target}. Give a commit or a range, e.g. --for origin/dev..HEAD`);
+    else console.error(`madeby ${cmd2}: no commits found for ${target ? `'${target}'` : "an empty --for"}. Give a commit or a range, e.g. --for origin/dev..HEAD. Nothing was changed.`);
     process.exit(1);
     return;
   }
@@ -2328,7 +2346,7 @@ function meCommand(args) {
     return;
   }
   const forTarget = parseFor(args);
-  if (forTarget) {
+  if (forTarget !== void 0) {
     renderDiscloseFor("me", forTarget, discloseFor(root, forTarget, { category: withAi ? "with_ai" : "human", tool, model }));
     return;
   }
@@ -2417,7 +2435,7 @@ function aiCommand(args) {
   }
   const tool = positional[0] || "AI";
   const forTarget = parseFor(args);
-  if (forTarget) {
+  if (forTarget !== void 0) {
     renderDiscloseFor("ai", forTarget, discloseFor(root, forTarget, { category: "ai", tool, model }));
     return;
   }
@@ -2587,37 +2605,40 @@ function coverageCommand(args) {
 }
 
 // src/init-repo.ts
+import { execFileSync as execFileSync7 } from "node:child_process";
 import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join8 } from "node:path";
 
 // src/version.ts
-var VERSION = "0.3.14";
+var VERSION = "0.3.16";
 
 // src/init-repo.ts
-var ACO_VERSION = 2;
+var ACO_VERSION = 3;
 var ACO_OPEN = `<!-- madeby:aco v${ACO_VERSION} -->`;
 var ACO_CLOSE = `<!-- /madeby:aco -->`;
 var ACO_OPEN_RE = /<!-- madeby:aco(?: v(\d+))? -->/;
+var PKG = `madeby@${VERSION}`;
 var ACO_BODY = `## Authorship disclosure (ACO)
 
 When you author or modify content here, **disclose who authored it** \u2014 per
 [ACO, the Authorship Certificate of Origin](https://github.com/MadeByFYI/MadeBy/blob/main/ACO.md).
 After you commit, run the command for the honest category (no install, no setup):
 
-- **ai** \u2014 an AI authored it (the committer stays accountable): \`npx madeby@latest ai [tool]\`
-- **with_ai** \u2014 a human authored it with AI assistance: \`npx madeby@latest me --with-ai [tool]\`
-- **human** \u2014 a human authored it: \`npx madeby@latest me\`
+- **ai** \u2014 an AI authored it (the committer stays accountable): \`npx ${PKG} ai [tool]\`
+- **with_ai** \u2014 a human authored it with AI assistance: \`npx ${PKG} me --with-ai [tool]\`
+- **human** \u2014 a human authored it: \`npx ${PKG} me\`
 
 If your platform makes the commit for you (a cloud coding agent that pushes through its own tool),
 amending afterwards can be lost \u2014 put the disclosure in the message instead, with \`--print\`:
-\`git commit -m "<message>" -m "$(npx madeby@latest ai [tool] --print)"\`.
+\`git commit -m "<message>" -m "$(npx ${PKG} ai [tool] --print)"\`.
 
-Disclose per commit, honestly. Undisclosed content stays *unknown*, never guessed.
+Disclose per commit, honestly. Undisclosed content stays *unknown*, never guessed. (The madeby
+version is pinned on purpose; \`npx madeby@latest init --update\` moves it to the newest release.)
 `;
 var MODEL_LINE = `
 **This repo also records the model.** Name your tool as usual \u2014 madeby reads the model from the
 tool's own record of the session where it can (Cursor, Copilot CLI, Claude Code), e.g.
-\`npx madeby@latest me --with-ai Cursor\` writes \`Assisted-by: Cursor:<model>\`. Elsewhere add
+\`npx ${PKG} me --with-ai Cursor\` writes \`Assisted-by: Cursor:<model>\`. Elsewhere add
 \`--model <version>\` with the exact model you are running as. If you don't know it, leave it off \u2014
 never guess.
 `;
@@ -2644,6 +2665,13 @@ function acoStatus(content) {
   if (!loc) return "absent";
   if (loc.version === null || loc.version < ACO_VERSION) return "outdated";
   if (loc.version > ACO_VERSION) return "newer";
+  const pin = /npx madeby@(\d+)\.(\d+)\.(\d+)/.exec(content.slice(loc.start, loc.end));
+  if (pin) {
+    const [a, b, c] = VERSION.split(".").map(Number);
+    const cmp = Number(pin[1]) - a || Number(pin[2]) - b || Number(pin[3]) - c;
+    if (cmp < 0) return "outdated";
+    if (cmp > 0) return "newer";
+  }
   return "current";
 }
 function replaceAcoBlock(content, loc, block) {
@@ -2687,6 +2715,44 @@ function ensurePolicy(abs, rel, want, res) {
   }
   return { mode: raise ? "required" : current.mode, recordModel: modelOn || current.recordModel === true, malformed: !isObject };
 }
+var CLAUDE_TRAILER = "Co-Authored-By: Claude Code <noreply@anthropic.com>";
+function claudeCodeDirs(root) {
+  const dirs = /* @__PURE__ */ new Set();
+  if (existsSync7(join8(root, "CLAUDE.md")) || existsSync7(join8(root, ".claude"))) dirs.add("");
+  let files = [];
+  try {
+    files = execFileSync7("git", ["-C", root, "-c", "core.quotePath=false", "ls-files", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 256 * 1024 * 1024 }).split("\n");
+  } catch {
+  }
+  for (const f of files) {
+    const parts = f.split("/");
+    const at = parts.indexOf(".claude");
+    if (at >= 0 && at < parts.length - 1) dirs.add(parts.slice(0, at).join("/"));
+    else if (parts[parts.length - 1] === "CLAUDE.md") dirs.add(parts.slice(0, -1).join("/"));
+  }
+  return [...dirs].sort();
+}
+function ensureClaudeSettings(abs) {
+  if (!existsSync7(abs)) {
+    mkdirSync2(dirname2(abs), { recursive: true });
+    writeFileSync2(abs, JSON.stringify({ attribution: { commit: CLAUDE_TRAILER } }, null, 2) + "\n");
+    return "created";
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync9(abs, "utf8"));
+  } catch {
+    return "malformed";
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return "malformed";
+  const settings = raw;
+  const attribution = settings.attribution;
+  if (attribution === false || attribution && typeof attribution === "object" && "commit" in attribution) return "kept";
+  if (attribution === void 0 && settings.includeCoAuthoredBy === false) return "kept";
+  const next = { ...settings, attribution: { ...attribution && typeof attribution === "object" ? attribution : {}, commit: CLAUDE_TRAILER } };
+  writeFileSync2(abs, JSON.stringify(next, null, 2) + "\n");
+  return "merged";
+}
 function ensureAco(abs, rel, res, opts) {
   const block = acoBlock(opts.recordModel);
   if (!existsSync7(abs)) {
@@ -2737,6 +2803,17 @@ function initRepo(root, opts = {}) {
   const aco = { update, recordModel: policy.recordModel, modelRequested };
   ensureAco(join8(root, "AGENTS.md"), "AGENTS.md", res, { createIfAbsent: true, ...aco });
   ensureAco(join8(root, "CLAUDE.md"), "CLAUDE.md", res, { createIfAbsent: false, ...aco });
+  const claudeDirs = claudeCodeDirs(root);
+  if (opts.claudeCode && !claudeDirs.includes("")) claudeDirs.unshift("");
+  const claudeSettings = [];
+  for (const dir of claudeDirs) {
+    const rel = (f) => dir ? `${dir}/${f}` : f;
+    if (dir) ensureAco(join8(root, dir, "CLAUDE.md"), rel("CLAUDE.md"), res, { createIfAbsent: false, ...aco });
+    const file = rel(".claude/settings.json");
+    const status = ensureClaudeSettings(join8(root, file));
+    if (status === "created") created.push(file);
+    claudeSettings.push({ file, status });
+  }
   if (host === "github") {
     writeIfAbsent(join8(root, ".github", "workflows", "disclosure.yml"), ".github/workflows/disclosure.yml", GH_WORKFLOW, created, skipped);
   } else if (host === "azure-devops") {
@@ -2753,7 +2830,7 @@ function initRepo(root, opts = {}) {
     nextSteps.push('.madeby/policy.json is not a valid policy, so the check treats it as advisory. It was left untouched \u2014 fix it (e.g. { "version": 0, "mode": "required" }) to enforce.');
   }
   if (created.includes("AGENTS.md")) {
-    nextSteps.push("An AGENTS.md ACO convention was added \u2014 agents that read it disclose authorship (e.g. 'npx madeby@latest ai [tool]'). Tune it to your repo's tools.");
+    nextSteps.push(`An AGENTS.md ACO convention was added \u2014 agents that read it disclose authorship (e.g. 'npx ${PKG} ai [tool]'), with madeby pinned to this release. Tune it to your repo's tools.`);
   }
   if (merged.length > 0) {
     nextSteps.push(`Merged the ACO disclosure rule into your existing ${merged.join(" + ")} \u2014 review the appended "Authorship disclosure (ACO)" section and tune it to your repo.`);
@@ -2762,7 +2839,7 @@ function initRepo(root, opts = {}) {
     nextSteps.push(`Refreshed an outdated ACO convention in ${updated.join(" + ")} to the current version \u2014 review the change before committing.`);
   }
   if (outdated.length > 0) {
-    nextSteps.push(`${outdated.join(" + ")} carries an OUTDATED ACO convention \u2014 run 'madeby init --update' to refresh it in place (only the ACO block changes).`);
+    nextSteps.push(`${outdated.join(" + ")} carries an OUTDATED ACO convention (an older convention or an older pinned madeby) \u2014 run 'npx madeby@latest init --update' to refresh it in place (only the ACO block changes).`);
   }
   if (host === "azure-devops") {
     nextSteps.push("In Azure DevOps, create a pipeline from .madeby/azure-pipelines.yml (a PR-only pipeline: no credentials kept, madeby pinned) and add it to the protected branch as a build-validation policy.");
@@ -2773,8 +2850,23 @@ function initRepo(root, opts = {}) {
     nextSteps.push(`When ready to enforce: run 'madeby init --required' (or set "mode": "required" in .madeby/policy.json), then make the check required on the protected branch \u2014 the host's control plane (GitHub: gh api branch protection; Azure: a build-validation policy). See the MCP resource madeby://guide/enforce for exact commands.`);
   }
   nextSteps.push("Contributors disclose origin with a Co-Authored-By / Generated-by trailer (AI), an Authored-by-human trailer ('madeby me'), or an Authored-by-ai trailer ('madeby ai' \u2014 AI authored, committer accountable). A DCO Signed-off-by or a signed commit alone doesn't say who wrote the code, so it counts only if the policy's 'accept' lists it. Evidence upgrade: 'madeby ai --witness' records your own AI session's witnessed spans.");
+  const set = claudeSettings.filter((c) => c.status === "created" || c.status === "merged").map((c) => c.file);
+  const kept = claudeSettings.filter((c) => c.status === "kept").map((c) => c.file);
+  const broken = claudeSettings.filter((c) => c.status === "malformed").map((c) => c.file);
+  if (claudeSettings.length === 0) {
+    nextSteps.push("No Claude Code files found (a CLAUDE.md or .claude/ folder, at any depth), so Claude Code's commit trailer wasn't set. If developers use Claude Code here, run 'madeby init --claude-code'.");
+  }
+  if (set.length > 0) {
+    nextSteps.push(`Claude Code now adds '${CLAUDE_TRAILER}' to its commits when launched where ${set.join(", ")} applies, for everyone \u2014 including developers who turned the trailer off in their personal settings. Their .claude/settings.local.json, or an instruction of their own, can still turn it off; the check is what holds the line.`);
+  }
+  if (kept.length > 0) {
+    nextSteps.push(`${kept.join(", ")} already set${kept.length === 1 ? "s" : ""} Claude Code's commit attribution, so it was left as the team set it. Clear that setting for the default trailer, or set attribution.commit to name the AI.`);
+  }
+  if (broken.length > 0) {
+    nextSteps.push(`${broken.join(", ")} isn't valid JSON, so Claude Code's commit trailer wasn't set there. Fix it and run 'madeby init' again.`);
+  }
   nextSteps.push("Existing history is accounted for honestly, not fabricated: run 'madeby check' over full history to recognize what's already disclosed; pre-adoption commits stay unknown. See madeby://guide/backfill.");
-  return { created, skipped, merged, updated, outdated, raised, modelOn, policyMode: policy.mode, recordModel: policy.recordModel, host, nextSteps };
+  return { created, skipped, merged, updated, outdated, raised, modelOn, policyMode: policy.mode, recordModel: policy.recordModel, claudeSettings, host, nextSteps };
 }
 var GH_WORKFLOW = `name: Disclosure
 on: pull_request
@@ -2823,9 +2915,11 @@ function initCommand(args) {
   const recordModel = args.includes("--record-model");
   const hostIdx = args.indexOf("--host");
   const host = hostIdx >= 0 ? args[hostIdx + 1] : void 0;
-  const r = initRepo(root, { mode, host, update, recordModel });
+  const claudeCode = args.includes("--claude-code");
+  const r = initRepo(root, { mode, host, update, recordModel, claudeCode });
   for (const f of r.created) console.log(`  + ${f}`);
   for (const f of r.merged) console.log(`  ~ ${f} (merged in the ACO rule)`);
+  for (const c of r.claudeSettings) if (c.status === "merged") console.log(`  ~ ${c.file} (merged in Claude Code's commit trailer)`);
   for (const f of r.updated) console.log(`  \u2191 ${f} (ACO convention refreshed to the current version)`);
   for (const f of r.raised) console.log(`  \u2191 ${f} (mode raised to required)`);
   for (const f of r.modelOn) console.log(`  \u2191 ${f} (now records the model version)`);
@@ -2838,13 +2932,13 @@ madeby init \u2014 policy: ${r.policyMode}${r.recordModel ? " + records model" :
 }
 
 // src/mcp.ts
-import { execFileSync as execFileSync7 } from "node:child_process";
+import { execFileSync as execFileSync8 } from "node:child_process";
 import { createInterface } from "node:readline";
 var DEFAULT_PROTOCOL = "2024-11-05";
 var SERVER_INFO = { name: "madeby", version: VERSION };
 function rootFor(path) {
   const cwd = path && path.length ? path : process.cwd();
-  return execFileSync7("git", ["-C", cwd, "-c", "core.quotePath=false", "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+  return execFileSync8("git", ["-C", cwd, "-c", "core.quotePath=false", "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
 }
 var repoInput = {
   type: "object",
@@ -2864,14 +2958,16 @@ var TOOLS = [
         mode: { enum: ["advisory", "required"], description: "policy mode to seed (default: advisory)" },
         host: { type: "string", description: "CI host to wire: github (default) or azure-devops" },
         update: { type: "boolean", description: "refresh an outdated ACO convention block in place (drift update); default false (report only)" },
-        record_model: { type: "boolean", description: "opt in: ask AI disclosures to also name the model version (tool:model) \u2014 policy recordModel + an AGENTS.md line. Never turned off by init; default false." }
+        record_model: { type: "boolean", description: "opt in: ask AI disclosures to also name the model version (tool:model) \u2014 policy recordModel + an AGENTS.md line. Never turned off by init; default false." },
+        claude_code: { type: "boolean", description: "set Claude Code's commit trailer in .claude/settings.json even if the repo shows no sign of Claude Code (it is set automatically when there is a CLAUDE.md or .claude/). A value the team already set is never changed." }
       }
     },
     handler: (args) => initRepo(rootFor(args.path), {
       mode: args.mode,
       host: args.host,
       update: args.update,
-      recordModel: args.record_model
+      recordModel: args.record_model,
+      claudeCode: args.claude_code
     })
   },
   {
@@ -2925,9 +3021,9 @@ var TOOLS = [
       const tool = args.tool;
       const model = args.model;
       const category = args.category;
-      if (typeof args.for === "string" && args.for) {
+      if (args.for !== void 0 && args.for !== null) {
         const c = category === "ai" ? "ai" : category === "with_ai" || args.with_ai === true ? "with_ai" : "human";
-        return discloseFor(root, args.for, { category: c, tool, model: c === "human" ? void 0 : model });
+        return discloseFor(root, typeof args.for === "string" ? args.for : "", { category: c, tool, model: c === "human" ? void 0 : model });
       }
       if (args.print === true) {
         const c = category === "ai" ? "ai" : category === "with_ai" || args.with_ai === true ? "with_ai" : "human";
@@ -3177,6 +3273,8 @@ Usage:
                                  + the CI disclosure check. --update refreshes an outdated ACO block in
                                  place; --required to enforce now; --host azure-devops for Azure Pipelines;
                                  --record-model to also ask agents for the model version (opt-in).
+                                 In a repo that uses Claude Code (CLAUDE.md or .claude/; --claude-code to
+                                 force) it also turns Claude Code's commit trailer on in .claude/settings.json.
   madeby check [<range>]         The gate: do commits meet .madeby/policy.json? (a verdict \u2014 exit
                                  code gates). <range> e.g. origin/main..HEAD; in CI it's auto-detected.
                                  --json for a machine-readable result.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madeby",
-  "version": "0.3.14",
+  "version": "0.3.16",
   "mcpName": "io.github.MadeByFYI/madeby",
   "description": "Disclose AI authorship of code. `npx madeby ai` adds an Authored-by-ai git trailer; AI coding agents disclose per the ACO standard (human/with_ai/ai) from an AGENTS.md convention. Disclosure, not detection. Gate PRs with `madeby check`.",
   "license": "MIT",