madeby 0.3.4 → 0.3.6

package/dist/madeby.mjs

@@ -37,6 +37,36 @@ function readGitLog(repoPath, limit, range) {
 }
 
 // ../classify/src/classify.ts
+var AI_PATTERNS = [
+  { re: /claude/i, provider: "anthropic", model: "claude" },
+  { re: /copilot/i, provider: "github-copilot" },
+  { re: /\bcursor(?:agent)?\b/i, provider: "cursor" },
+  { re: /\bdevin\b/i, provider: "cognition" },
+  { re: /gemini/i, provider: "google" },
+  { re: /chatgpt|openai|codex|\bgpt-/i, provider: "openai" },
+  { re: /codeium|windsurf/i, provider: "codeium" },
+  { re: /\baider\b/i, provider: "aider" },
+  { re: /codewhisperer/i, provider: "amazon" },
+  { re: /tabnine/i, provider: "tabnine" }
+];
+function matchAi(text) {
+  for (const p of AI_PATTERNS) {
+    if (p.re.test(text)) return { provider: p.provider, ...p.model ? { model: p.model } : {}, raw: text.trim() };
+  }
+  return null;
+}
+var GENERIC_AI_TRAILER = /^(?:AI|an? AI|AI (?:assistant|tool|pair)|artificial intelligence)$/i;
+function genericAiDisclosure(who) {
+  const w = who.trim();
+  return GENERIC_AI_TRAILER.test(w) ? { provider: "unspecified", raw: w } : null;
+}
+var TRAILER_RE = /^[ \t]*(?:Co-authored-by|Generated-by|Assisted-by):[ \t]*(.+)$/gim;
+var AI_AUTHOR_TRAILER = /^[ \t]*Authored-by-ai:[ \t]*(.+)$/gim;
+var HUMAN_ATTEST = /^[ \t]*(?:Authored-by-human|Human-authored(?:-by)?):/im;
+var CONF_WITH_AI = 0.9;
+var CONF_AI = 0.85;
+var CONF_HUMAN = 0.55;
+var CONF_BOT = 0.95;
 var KNOWN_BOTS = /\b(?:dependabot|renovate(?:-bot)?|greenkeeper|snyk-bot|github-actions|semantic-release-bot|stainless-app|allcontributors|mergify|codecov-commenter|pre-commit-ci|imgbot|whitesource-bot|copybara)\b/i;
 function isBotIdentity(name, email) {
   const n = (name ?? "").trim();
@@ -45,6 +75,60 @@ function isBotIdentity(name, email) {
   if (e === "actions@github.com") return true;
   return KNOWN_BOTS.test(n) || KNOWN_BOTS.test(e);
 }
+function classifyCommit(commit) {
+  const signals = [];
+  const aiContributors = [];
+  if (isBotIdentity(commit.authorName, commit.authorEmail)) {
+    const botText = `${commit.authorName ?? ""} ${commit.authorEmail ?? ""}`.trim();
+    const agentAi = botText ? matchAi(botText) : null;
+    if (agentAi) {
+      return {
+        class: "ai",
+        confidence: CONF_AI,
+        signals: [`author:${agentAi.provider}`],
+        aiContributors: [{ ...agentAi, raw: botText }]
+      };
+    }
+    return { class: "bot", confidence: CONF_BOT, signals: ["author:bot"], aiContributors };
+  }
+  const aiAuthored = [...commit.message.matchAll(AI_AUTHOR_TRAILER)].map((m) => m[1].trim());
+  if (aiAuthored.length > 0 && !HUMAN_ATTEST.test(commit.message)) {
+    const who = aiAuthored[0];
+    const c = matchAi(who) ?? { provider: "unspecified", raw: who };
+    return { class: "ai", confidence: CONF_AI, signals: [`authored-by-ai:${c.provider}`], aiContributors: [c] };
+  }
+  const trailers = [...commit.message.matchAll(TRAILER_RE)].map((m) => m[1].trim());
+  let humanCoAuthors = 0;
+  for (const who of trailers) {
+    const ai = matchAi(who) ?? genericAiDisclosure(who);
+    if (ai) {
+      aiContributors.push(ai);
+      signals.push(`co-authored-by:${ai.provider}`);
+    } else {
+      humanCoAuthors += 1;
+    }
+  }
+  for (const who of aiAuthored) {
+    const ai = matchAi(who) ?? { provider: "unspecified", raw: who };
+    aiContributors.push(ai);
+    signals.push(`authored-by-ai:${ai.provider}`);
+  }
+  const authorText = `${commit.authorName ?? ""} ${commit.authorEmail ?? ""}`.trim();
+  const authorAi = authorText ? matchAi(authorText) : null;
+  if (authorAi) {
+    aiContributors.push({ ...authorAi, raw: authorText });
+    signals.push(`author:${authorAi.provider}`);
+  }
+  const hasAi = aiContributors.length > 0;
+  const humanPresent = authorAi === null || humanCoAuthors > 0;
+  if (!hasAi) {
+    return { class: "human", confidence: CONF_HUMAN, signals, aiContributors };
+  }
+  if (authorAi !== null && !humanPresent) {
+    return { class: "ai", confidence: CONF_AI, signals, aiContributors };
+  }
+  return { class: "with_ai", confidence: CONF_WITH_AI, signals, aiContributors };
+}
 
 // ../classify/src/benchmark/benchmark-v0.json
 var benchmark_v0_default = {
@@ -1091,7 +1175,7 @@ function provenanceMap(root, opts = {}) {
   }
   const commits = readDisclosures(root, { limit: opts.commitLimit ?? 500 });
   const disclosed = commits.filter((c) => c.disclosures.length > 0).length;
-  const pct = commits.length ? Math.round(disclosed / commits.length * 100) : 0;
+  const pct2 = commits.length ? Math.round(disclosed / commits.length * 100) : 0;
   const scope = prefix ?? "repo";
   const allModels = [...new Set(witnessed.flatMap((w) => w.models))];
   let aiDefault;
@@ -1110,11 +1194,39 @@ function provenanceMap(root, opts = {}) {
     witnessed,
     commitCoverage: { disclosed, total: commits.length },
     aiDisclosureDefault: aiDefault,
-    summary: `${scope}: ${trackedFiles} tracked file${trackedFiles === 1 ? "" : "s"}; ${witnessed.length} with witnessed AI provenance${allModels.length ? ` (${allModels.join(", ")})` : ""}; ${pct}% of the last ${commits.length} commits disclose origin.`,
+    summary: `${scope}: ${trackedFiles} tracked file${trackedFiles === 1 ? "" : "s"}; ${witnessed.length} with witnessed AI provenance${allModels.length ? ` (${allModels.join(", ")})` : ""}; ${pct2}% of the last ${commits.length} commits disclose origin.`,
     note: "Witnessed spans are precise (region-level, model-named); commit coverage is commit-level, not per-file authorship. Files without a witnessed span have unknown origin \u2014 disclosure, not detection: we report what's disclosed and never infer origin we can't see. Resolution is a configurable convention (ARCH \xA712)."
   };
 }
 
+// ../analyzer/src/coverage.ts
+function repoCoverage(root, opts = {}) {
+  const commits = readGitLog(root, opts.range ? void 0 : opts.limit ?? 500, opts.range);
+  const byCategory = { human: 0, with_ai: 0, ai: 0, bot: 0 };
+  const byTier = { asserted: 0, verified: 0 };
+  let known = 0;
+  for (const c of commits) {
+    const kinds = commitDisclosureKinds({ message: c.message, signed: c.signed });
+    const cls = classifyCommit({ message: c.message, authorName: c.authorName, authorEmail: c.authorEmail, signed: c.signed, sha: c.sha }).class;
+    const category = cls === "human" && !kinds.includes("human-attestation") ? "unknown" : cls;
+    if (category === "unknown") continue;
+    known += 1;
+    byCategory[category] += 1;
+    if (c.signed) byTier.verified += 1;
+    else byTier.asserted += 1;
+  }
+  return {
+    isEstimate: true,
+    methodology: "commit-level authorship disclosure (estimate); undisclosed = unknown, never inferred",
+    scope: opts.range ? `range ${opts.range}` : `last ${commits.length} commits`,
+    total: commits.length,
+    known,
+    unknown: commits.length - known,
+    byCategory,
+    byTier
+  };
+}
+
 // ../analyzer/src/record-spans.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync, writeFileSync } from "node:fs";
@@ -1658,7 +1770,7 @@ function parseWithAi(args) {
 function git3(root, args) {
   return execFileSync5("git", ["-C", root, ...args], { encoding: "utf8" }).trim();
 }
-var HUMAN_ATTEST = /^[ \t]*(?:Authored-by-human|Human-authored(?:-by)?)[ \t]*:/im;
+var HUMAN_ATTEST2 = /^[ \t]*(?:Authored-by-human|Human-authored(?:-by)?)[ \t]*:/im;
 var ASSIST = /^[ \t]*Assisted-by[ \t]*:/im;
 var AI_AUTHOR = /^[ \t]*Authored-by-ai[ \t]*:/im;
 function attestAiAuthorship(root, opts = {}) {
@@ -1713,7 +1825,7 @@ function affirmAuthorship(root, opts = {}) {
   } catch {
     return { ...base, reason: "no-commit" };
   }
-  const hasHuman = HUMAN_ATTEST.test(message);
+  const hasHuman = HUMAN_ATTEST2.test(message);
   const hasAssist = ASSIST.test(message);
   const trailers = [];
   const added = [];
@@ -1879,61 +1991,101 @@ function whoCommand(args) {
   }
 }
 
+// src/commands/coverage.ts
+var pct = (n, d) => d > 0 ? Math.round(n / d * 100) : 0;
+var bar = (p) => "\u2588".repeat(Math.round(p / 5)) + "\u2591".repeat(20 - Math.round(p / 5));
+function render(r) {
+  const knownPct = pct(r.known, r.total);
+  const unknownPct = 100 - knownPct;
+  console.log(`authorship coverage \u2014 ${r.scope}  (estimate \xB7 disclosure, not detection)`);
+  if (r.total === 0) {
+    console.log("  (no commits to score)");
+    return;
+  }
+  console.log(`  known    ${String(knownPct).padStart(3)}%  ${bar(knownPct)}  disclosed \u2014 on the record`);
+  console.log(`  unknown  ${String(unknownPct).padStart(3)}%  ${bar(unknownPct)}  no disclosure \u2014 origin unknown, never guessed`);
+  if (r.known > 0) {
+    const c = r.byCategory;
+    const parts = [`human ${pct(c.human, r.known)}%`, `with_ai ${pct(c.with_ai, r.known)}%`, `ai ${pct(c.ai, r.known)}%`];
+    if (c.bot > 0) parts.push(`bot ${pct(c.bot, r.known)}%`);
+    console.log(`
+  of the ${r.known} known:  ${parts.join(" \xB7 ")}`);
+    console.log(`  trust:  asserted ${pct(r.byTier.asserted, r.known)}% \xB7 verified ${pct(r.byTier.verified, r.known)}%  \u2014 self-reported; sign commits to verify`);
+  }
+  if (r.unknown > 0) {
+    console.log(`
+  \u2192 ${unknownPct}% unknown. Require disclosure going forward:  madeby init --required`);
+  }
+}
+function coverageCommand(args) {
+  const json = args.includes("--json");
+  const range = args.find((a) => !a.startsWith("--"));
+  const root = repoRoot();
+  if (!root) {
+    console.error("madeby coverage: not a git repository.");
+    process.exit(2);
+    return;
+  }
+  const r = repoCoverage(root, { range });
+  if (json) {
+    console.log(JSON.stringify(r, null, 2));
+    return;
+  }
+  render(r);
+}
+
 // src/init-repo.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join5 } from "node:path";
-var ACO_SENTINEL = "<!-- madeby:aco -->";
-var GH_WORKFLOW = `name: Disclosure
-on: pull_request
-jobs:
-  madeby:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: MadeByFYI/MadeBy/packages/action@v0.2.0
-`;
-var AGENTS_CONVENTION = `# AGENTS.md \u2014 Authorship disclosure convention (ACO)
-${ACO_SENTINEL}
-
-This repository asks any AI agent \u2014 or a human working with one \u2014 to **disclose who authored the
-changes they make**, per **ACO, the Authorship Certificate of Origin**
-(https://github.com/MadeByFYI/MadeBy/blob/main/ACO.md).
-
-## The rule
-
-When you author or modify content here, disclose the authorship **category** on your commit \u2014 one of:
-
-- \`human\` \u2014 a human authored it, no AI involvement.
-- \`with_ai\` \u2014 a human authored it with disclosed AI assistance.
-- \`ai\` \u2014 an AI agent authored it (a human remains accountable).
-
-Disclose **per commit, honestly** \u2014 the category describes what actually happened for that change.
-
-## The one-line way (asserted tier \u2014 no keys, no setup)
-
-After you commit, run the matching command (works with no install via \`npx\`):
+var ACO_VERSION = 1;
+var ACO_OPEN = `<!-- madeby:aco v${ACO_VERSION} -->`;
+var ACO_CLOSE = `<!-- /madeby:aco -->`;
+var ACO_OPEN_RE = /<!-- madeby:aco(?: v(\d+))? -->/;
+var ACO_BODY = `## Authorship disclosure (ACO)
 
-| Category  | Command                          |
-|-----------|----------------------------------|
-| \`human\`   | \`npx madeby@latest me\`                  |
-| \`with_ai\` | \`npx madeby@latest me --with-ai <tool>\` |
-| \`ai\`      | \`npx madeby@latest ai [tool]\`           |
-
-Undisclosed content stays *unknown*, never guessed. See ACO for the standard.
-`;
-var ACO_SECTION = `
-${ACO_SENTINEL}
-## Authorship disclosure (ACO)
-
-Disclose who authored your changes, per [ACO](https://github.com/MadeByFYI/MadeBy/blob/main/ACO.md).
-After committing, run the command for the honest category (no install needed):
+When you author or modify content here, **disclose who authored it** \u2014 per
+[ACO, the Authorship Certificate of Origin](https://github.com/MadeByFYI/MadeBy/blob/main/ACO.md).
+After you commit, run the command for the honest category (no install, no setup):
 
 - **ai** \u2014 an AI authored it (the committer stays accountable): \`npx madeby@latest ai [tool]\`
 - **with_ai** \u2014 a human authored it with AI assistance: \`npx madeby@latest me --with-ai [tool]\`
 - **human** \u2014 a human authored it: \`npx madeby@latest me\`
+
+Disclose per commit, honestly. Undisclosed content stays *unknown*, never guessed.
+`;
+var ACO_BLOCK = `${ACO_OPEN}
+${ACO_BODY}${ACO_CLOSE}
 `;
+var AGENTS_CONVENTION = `# AGENTS.md
+
+${ACO_BLOCK}`;
+var ACO_SECTION = `
+${ACO_BLOCK}`;
+function findAcoBlock(content) {
+  const m = ACO_OPEN_RE.exec(content);
+  if (!m) return null;
+  const start = m.index;
+  const version = m[1] !== void 0 ? Number(m[1]) : null;
+  const closeIdx = content.indexOf(ACO_CLOSE, start);
+  let end;
+  if (closeIdx !== -1) {
+    end = closeIdx + ACO_CLOSE.length;
+    if (content[end] === "\n") end += 1;
+  } else {
+    end = content.length;
+  }
+  return { version, start, end };
+}
+function acoStatus(content) {
+  const loc = findAcoBlock(content);
+  if (!loc) return "absent";
+  if (loc.version === null || loc.version < ACO_VERSION) return "outdated";
+  if (loc.version > ACO_VERSION) return "newer";
+  return "current";
+}
+function replaceAcoBlock(content, loc) {
+  return content.slice(0, loc.start) + ACO_BLOCK + content.slice(loc.end);
+}
 function writeIfAbsent(abs, rel, content, created, skipped) {
   if (existsSync4(abs)) {
     skipped.push(rel);
@@ -1951,25 +2103,36 @@ function ensureAco(abs, rel, res, opts) {
     res.created.push(rel);
     return;
   }
-  const current = readFileSync6(abs, "utf8");
-  if (current.includes(ACO_SENTINEL)) {
+  const content = readFileSync6(abs, "utf8");
+  const status = acoStatus(content);
+  if (status === "absent") {
+    const sep = content.endsWith("\n") ? "" : "\n";
+    writeFileSync2(abs, content + sep + ACO_SECTION);
+    res.merged.push(rel);
+  } else if (status === "outdated") {
+    if (opts.update) {
+      writeFileSync2(abs, replaceAcoBlock(content, findAcoBlock(content)));
+      res.updated.push(rel);
+    } else {
+      res.outdated.push(rel);
+    }
+  } else {
     res.skipped.push(rel);
-    return;
   }
-  const sep = current.endsWith("\n") ? "\n" : "\n\n";
-  writeFileSync2(abs, current + sep + ACO_SECTION);
-  res.merged.push(rel);
 }
 function initRepo(root, opts = {}) {
   const mode = opts.mode ?? "advisory";
   const host = opts.host ?? "github";
+  const update = opts.update ?? false;
   const created = [];
   const skipped = [];
   const merged = [];
-  const res = { created, skipped, merged };
+  const updated = [];
+  const outdated = [];
+  const res = { created, skipped, merged, updated, outdated };
   writeIfAbsent(join5(root, ".madeby", "policy.json"), ".madeby/policy.json", JSON.stringify({ version: 0, mode }, null, 2) + "\n", created, skipped);
-  ensureAco(join5(root, "AGENTS.md"), "AGENTS.md", res, { createIfAbsent: true });
-  ensureAco(join5(root, "CLAUDE.md"), "CLAUDE.md", res, { createIfAbsent: false });
+  ensureAco(join5(root, "AGENTS.md"), "AGENTS.md", res, { createIfAbsent: true, update });
+  ensureAco(join5(root, "CLAUDE.md"), "CLAUDE.md", res, { createIfAbsent: false, update });
   if (host === "github") {
     writeIfAbsent(join5(root, ".github", "workflows", "disclosure.yml"), ".github/workflows/disclosure.yml", GH_WORKFLOW, created, skipped);
   }
@@ -1980,6 +2143,12 @@ function initRepo(root, opts = {}) {
   if (merged.length > 0) {
     nextSteps.push(`Merged the ACO disclosure rule into your existing ${merged.join(" + ")} \u2014 review the appended "Authorship disclosure (ACO)" section and tune it to your repo.`);
   }
+  if (updated.length > 0) {
+    nextSteps.push(`Refreshed an outdated ACO convention in ${updated.join(" + ")} to the current version \u2014 review the change before committing.`);
+  }
+  if (outdated.length > 0) {
+    nextSteps.push(`${outdated.join(" + ")} carries an OUTDATED ACO convention \u2014 run 'madeby init --update' to refresh it in place (only the ACO block changes).`);
+  }
   if (host === "azure-devops") {
     nextSteps.push("Add the Azure Pipelines template (packages/action/azure-pipelines-disclosure.yml) and wire it as a PR build-validation branch policy.");
   } else if (host !== "github") {
@@ -1990,8 +2159,19 @@ function initRepo(root, opts = {}) {
   }
   nextSteps.push("Contributors disclose origin with a Co-Authored-By / Generated-by trailer (AI), an Authored-by-human trailer ('madeby me'), an Authored-by-ai trailer ('madeby ai' \u2014 AI authored, committer accountable), a DCO Signed-off-by, or a signed commit. Evidence upgrade: 'madeby ai --witness' records your own AI session's witnessed spans.");
   nextSteps.push("Existing history is accounted for honestly, not fabricated: run 'madeby check' over full history to recognize what's already disclosed; pre-adoption commits stay unknown. See madeby://guide/backfill.");
-  return { created, skipped, merged, policyMode: mode, host, nextSteps };
+  return { created, skipped, merged, updated, outdated, policyMode: mode, host, nextSteps };
 }
+var GH_WORKFLOW = `name: Disclosure
+on: pull_request
+jobs:
+  madeby:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: MadeByFYI/MadeBy/packages/action@v0.2.0
+`;
 
 // src/commands/init.ts
 function initCommand(args) {
@@ -2002,11 +2182,14 @@ function initCommand(args) {
     return;
   }
   const mode = args.includes("--required") ? "required" : "advisory";
+  const update = args.includes("--update");
   const hostIdx = args.indexOf("--host");
   const host = hostIdx >= 0 ? args[hostIdx + 1] : void 0;
-  const r = initRepo(root, { mode, host });
+  const r = initRepo(root, { mode, host, update });
   for (const f of r.created) console.log(`  + ${f}`);
   for (const f of r.merged) console.log(`  ~ ${f} (merged in the ACO rule)`);
+  for (const f of r.updated) console.log(`  \u2191 ${f} (ACO convention refreshed to the current version)`);
+  for (const f of r.outdated) console.log(`  ! ${f} (ACO convention OUTDATED \u2014 run 'madeby init --update')`);
   for (const f of r.skipped) console.log(`  \xB7 ${f} (exists \u2014 left as-is)`);
   console.log(`
 madeby init \u2014 policy: ${r.policyMode}, host: ${r.host}`);
@@ -2018,7 +2201,7 @@ madeby init \u2014 policy: ${r.policyMode}, host: ${r.host}`);
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createInterface } from "node:readline";
 var DEFAULT_PROTOCOL = "2024-11-05";
-var SERVER_INFO = { name: "madeby", version: "0.3.4" };
+var SERVER_INFO = { name: "madeby", version: "0.3.6" };
 function rootFor(path) {
   const cwd = path && path.length ? path : process.cwd();
   return execFileSync6("git", ["-C", cwd, "-c", "core.quotePath=false", "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
@@ -2033,16 +2216,17 @@ var repoInput = {
 var TOOLS = [
   {
     name: "init",
-    description: "Align a repository with MadeBy in one call: create .madeby/policy.json (advisory by default \u2014 reports, never fails) and the CI disclosure check for the host (github default; azure-devops guided). Idempotent \u2014 never clobbers an existing policy or workflow. Returns the files created/skipped and the recommended next steps. Read the resources: madeby://guide/align (full workflow), madeby://guide/enforce (make the check required \u2014 the host's control plane, exact commands), madeby://guide/backfill (account for existing history honestly \u2014 never fabricate).",
+    description: "Align a repository with MadeBy in one call: create .madeby/policy.json (advisory by default \u2014 reports, never fails) and the CI disclosure check for the host (github default; azure-devops guided). Idempotent \u2014 never clobbers an existing policy or workflow. Returns the files created/skipped and the recommended next steps. Read the resources: madeby://guide/align (full workflow), madeby://guide/enforce (make the check required \u2014 the host's control plane, exact commands), madeby://guide/backfill (account for existing history honestly \u2014 never fabricate). The ACO convention block is versioned: the result flags an `outdated` AGENTS.md/CLAUDE.md (drift); call again with update:true to refresh just that block in place \u2014 how an agent keeps the convention current.",
     inputSchema: {
       type: "object",
       properties: {
         path: { type: "string", description: "path to the repo (default: the server's working directory)" },
         mode: { enum: ["advisory", "required"], description: "policy mode to seed (default: advisory)" },
-        host: { type: "string", description: "CI host to wire: github (default) or azure-devops" }
+        host: { type: "string", description: "CI host to wire: github (default) or azure-devops" },
+        update: { type: "boolean", description: "refresh an outdated ACO convention block in place (drift update); default false (report only)" }
       }
     },
-    handler: (args) => initRepo(rootFor(args.path), { mode: args.mode, host: args.host })
+    handler: (args) => initRepo(rootFor(args.path), { mode: args.mode, host: args.host, update: args.update })
   },
   {
     name: "check",
@@ -2050,6 +2234,12 @@ var TOOLS = [
     inputSchema: repoInput,
     handler: (args) => evaluateRepoDisclosure(rootFor(args.path), { range: args.range })
   },
+  {
+    name: "coverage",
+    description: "Authorship coverage scoreboard for a repo \u2014 the honest estimate of how much of the code's authorship is ON THE RECORD (known) vs undisclosed (unknown \u2014 origin unknown, NEVER guessed), the human/with_ai/ai mix OF THE KNOWN (never of the whole repo), and the asserted-vs-verified trust split. Disclosure, not detection; the report is a labeled estimate (counts only \u2014 derive percents at the edge). Use it to show a maintainer their provenance picture and motivate requiring disclosure.",
+    inputSchema: repoInput,
+    handler: (args) => repoCoverage(rootFor(args.path), { range: args.range })
+  },
   {
     name: "who",
     description: "Made by whom? Read what's ON THE RECORD about who made this. With `path`: one file's origin \u2014 witnessed AI spans (model/tool, precise) where captured, last-touch commit disclosure from git blame elsewhere (approximate, labeled), unknown otherwise. With no `path`: a repo-wide map (the orientation to read BEFORE you work) \u2014 the witnessed AI surface plus commit-level disclosure coverage, cheap (no per-file blame). The universal contract is the line range: for a symbol, turn it into a line range with your own tooling (tree-sitter/LSP/ctags) and pass it \u2014 MadeBy never parses code. Disclosure, not detection: it reports what's disclosed and never asserts 'human'.",
@@ -2305,13 +2495,17 @@ function help() {
   console.log(`madeby \u2014 verifiable content provenance ("made by whom?")
 
 Usage:
-  madeby init                    Set MadeBy up: write .madeby/policy.json + the CI disclosure check.
-                                 --required to enforce now; --host azure-devops for Azure Pipelines.
+  madeby init                    Set MadeBy up: write .madeby/policy.json + the ACO AGENTS.md convention
+                                 + the CI disclosure check. --update refreshes an outdated ACO block in
+                                 place; --required to enforce now; --host azure-devops for Azure Pipelines.
   madeby check [<range>]         The gate: do commits meet .madeby/policy.json? (a verdict \u2014 exit
                                  code gates). <range> e.g. origin/main..HEAD; in CI it's auto-detected.
                                  --json for a machine-readable result.
   madeby who [<path>]            Made by whom? Read what's on the record about who made this \u2014 one
    (alias: whom)                 file's origin, or the whole repo with no path. --lines=A-B to scope.
+  madeby coverage [<range>]      The scoreboard: how much of your repo's authorship is disclosed (known)
+                                 vs unknown, the human/with_ai/ai mix, and the asserted/verified split.
+                                 --json for a machine-readable result.
   madeby ai [<log>] [<ref>]      Made by AI: record your AI session's witnessed spans into .madeby/spans.
                                  <log> defaults to the auto-discovered Claude Code transcript.
   madeby me                      Made by me: affirm you authored HEAD yourself (an Authored-by-human
@@ -2336,6 +2530,9 @@ switch (cmd) {
   case "whom":
     whoCommand(rest);
     break;
+  case "coverage":
+    coverageCommand(rest);
+    break;
   case "ai":
     aiCommand(rest);
     break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madeby",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "mcpName": "io.github.MadeByFYI/madeby",
   "description": "Disclose AI authorship of code. `npx madeby ai` adds an Authored-by-ai git trailer; AI coding agents disclose per the ACO standard (human/with_ai/ai) from an AGENTS.md convention. Disclosure, not detection. Gate PRs with `madeby check`.",
   "license": "MIT",
@@ -47,18 +47,19 @@
     "dist",
     "README.md"
   ],
-  "devDependencies": {
-    "@types/node": "^22.10.0",
-    "esbuild": "^0.25.0",
-    "typescript": "^5.7.0",
-    "vitest": "^4.1.9",
-    "@madeby/analyzer": "0.0.0",
-    "@madeby/core": "0.0.0"
-  },
   "scripts": {
     "build": "esbuild src/madeby.ts --bundle --platform=node --format=esm --target=node20 --outfile=dist/madeby.mjs --banner:js='#!/usr/bin/env node' && chmod +x dist/madeby.mjs",
     "typecheck": "tsc --noEmit",
     "pretest": "pnpm build",
-    "test": "vitest run"
+    "test": "vitest run",
+    "prepublishOnly": "pnpm build"
+  },
+  "devDependencies": {
+    "@madeby/analyzer": "workspace:*",
+    "@madeby/core": "workspace:*",
+    "@types/node": "^22.10.0",
+    "esbuild": "^0.25.0",
+    "typescript": "^5.7.0",
+    "vitest": "^4.1.9"
   }
-}
+}