madeby 0.3.6 → 0.3.8

package/README.md

@@ -44,6 +44,8 @@ npm i -g madeby
 madeby init                    Set MadeBy up: write .madeby/policy.json + the CI disclosure check.
 madeby check  [<range>]        The gate: do commits meet .madeby/policy.json? (a verdict — exit code
                                gates). <range> e.g. origin/main..HEAD — a PR's own commits. --json too.
+madeby coverage [<range>]      The scoreboard: how much of the repo's authorship is disclosed (known)
+                               vs unknown, the human/with_ai/ai mix, and the asserted/verified split.
 madeby who    [<path>]         Made by whom? What's on the record about who made this — one file's
   (alias: whom)                origin, or the whole repo with no path. --lines=A-B to scope. --json too.
 madeby ai     [tool]           Made by AI: attest AI authorship of HEAD (an Authored-by-ai trailer).
@@ -77,6 +79,35 @@ In CI, omit `<range>` — on a pull-request build `madeby check` **auto-scopes t
 commits** from the CI environment (GitHub today; other hosts via their adapter). Pass an explicit
 `<range>` to override.
 
+### `madeby coverage` — the authorship scoreboard
+
+`check` is the gate; `coverage` is the picture. Run it in any repo to see how much of your
+history's authorship is **on the record** — no policy, no config:
+
+```sh
+madeby coverage                 # scores recent history
+madeby coverage origin/main..HEAD   # or a range
+```
+
+```
+authorship coverage — last 500 commits  (estimate · disclosure, not detection)
+  known     62%  ████████████░░░░░░░░  disclosed — on the record
+  unknown   38%  ███████░░░░░░░░░░░░░  no disclosure — origin unknown, never guessed
+
+  of the 310 known:  human 41% · with_ai 38% · ai 21%
+  trust:  asserted 88% · verified 12%  — self-reported; sign commits to verify
+
+  → 38% unknown. Require disclosure going forward:  madeby init --required
+```
+
+It is a **labeled estimate**, honest by construction: an undisclosed commit is **unknown**, never
+inferred as human — disclosure, not detection. The human/with_ai/ai mix is reported *of the known*,
+never of the whole repo, and the asserted-vs-verified split shows how much is signed. `--json` emits
+counts only (percentages are derived at the edge, never stored). A plain merge authors nothing and
+isn't scored; a merge that changes content of its own (a conflict resolution) is, like any other
+commit — chosen by what it changes, never by whether it discloses. Use it to see your gap, then
+`madeby init --required` to close it going forward.
+
 ### `madeby me` — affirm human authorship
 
 Disclosure runs both ways: if you wrote code yourself, affirm it so your work is *disclosed-human*,

package/dist/madeby.mjs

@@ -4,6 +4,18 @@
 import { execFileSync } from "node:child_process";
 var FIELD = "";
 var RECORD = "";
+var GROUP = "";
+var parseMeta = (rec) => {
+  const parts = rec.split(FIELD);
+  const sig = parts[3] ?? "N";
+  return {
+    sha: parts[0] ?? "",
+    authorName: parts[1] ?? "",
+    authorEmail: parts[2] ?? "",
+    signed: sig !== "N" && sig !== "",
+    message: parts.slice(4).join(FIELD).trimEnd()
+  };
+};
 function readGitLog(repoPath, limit, range) {
   try {
     const args = [
@@ -11,7 +23,7 @@ function readGitLog(repoPath, limit, range) {
       repoPath,
       "log",
       "--no-merges",
-      // merge commits aren't authored content — exclude them from attribution
+      // a merge is not authored content by default; readAuthoredMerges finds those that are
       ...limit ? ["-n", String(limit)] : [],
       // %G? is a signature-PRESENCE probe for the Disclosure Score: 'N' = unsigned; any other code
       // (G/U/E/…) = a signature is present (E = present but unverifiable here — no keyring). We only
@@ -22,19 +34,38 @@ function readGitLog(repoPath, limit, range) {
       ...range ? [range] : []
     ];
     const out = execFileSync("git", args, { encoding: "utf8", maxBuffer: 256 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
-    return out.split(RECORD).map((r) => r.replace(/^\s+/, "")).filter((r) => r.length > 0).map((rec) => {
-      const parts = rec.split(FIELD);
-      const sha = parts[0] ?? "";
-      const authorName = parts[1] ?? "";
-      const authorEmail = parts[2] ?? "";
-      const sig = parts[3] ?? "N";
-      const message = parts.slice(4).join(FIELD).trimEnd();
-      return { sha, authorName, authorEmail, signed: sig !== "N" && sig !== "", message };
-    });
+    return out.split(RECORD).map((r) => r.replace(/^\s+/, "")).filter((r) => r.length > 0).map(parseMeta);
   } catch {
     return [];
   }
 }
+function readAuthoredMerges(repoPath, opts = {}) {
+  try {
+    const args = [
+      "-C",
+      repoPath,
+      "log",
+      "--merges",
+      "--cc",
+      "--name-only",
+      `--format=${RECORD}%H${FIELD}%an${FIELD}%ae${FIELD}%G?${FIELD}%B${GROUP}`,
+      ...opts.since !== void 0 && !opts.range ? [`--since=@${opts.since}`] : [],
+      ...opts.range ? [opts.range] : []
+    ];
+    const out = execFileSync("git", args, { encoding: "utf8", maxBuffer: 256 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
+    return out.split(RECORD).filter((r) => r.includes(GROUP)).filter((r) => r.slice(r.lastIndexOf(GROUP) + 1).trim().length > 0).map((r) => parseMeta(r.slice(0, r.lastIndexOf(GROUP))));
+  } catch {
+    return [];
+  }
+}
+function commitTime(repoPath, sha) {
+  try {
+    const t = Number(execFileSync("git", ["-C", repoPath, "log", "-1", "--format=%ct", sha], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim());
+    return Number.isFinite(t) && t > 0 ? t : void 0;
+  } catch {
+    return void 0;
+  }
+}
 
 // ../classify/src/classify.ts
 var AI_PATTERNS = [
@@ -1201,7 +1232,12 @@ function provenanceMap(root, opts = {}) {
 
 // ../analyzer/src/coverage.ts
 function repoCoverage(root, opts = {}) {
-  const commits = readGitLog(root, opts.range ? void 0 : opts.limit ?? 500, opts.range);
+  const limit = opts.range ? void 0 : opts.limit ?? 500;
+  const authored = readGitLog(root, limit, opts.range);
+  const oldest = authored.at(-1)?.sha;
+  const since = limit && oldest && authored.length >= limit ? commitTime(root, oldest) : void 0;
+  const merges = authored.length > 0 && (!limit || authored.length < limit || since !== void 0) ? readAuthoredMerges(root, { range: opts.range, since }) : [];
+  const commits = [...authored, ...merges];
   const byCategory = { human: 0, with_ai: 0, ai: 0, bot: 0 };
   const byTier = { asserted: 0, verified: 0 };
   let known = 0;
@@ -1217,8 +1253,8 @@ function repoCoverage(root, opts = {}) {
   }
   return {
     isEstimate: true,
-    methodology: "commit-level authorship disclosure (estimate); undisclosed = unknown, never inferred",
-    scope: opts.range ? `range ${opts.range}` : `last ${commits.length} commits`,
+    methodology: "commit-level authorship disclosure (estimate); undisclosed = unknown, never inferred; merges scored only when they change content of their own",
+    scope: (opts.range ? `range ${opts.range}` : `last ${authored.length} commits`) + (merges.length ? ` + ${merges.length} merges with changes of their own` : ""),
     total: commits.length,
     known,
     unknown: commits.length - known,
@@ -1992,9 +2028,20 @@ function whoCommand(args) {
 }
 
 // src/commands/coverage.ts
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "node:fs";
+import { join as join5 } from "node:path";
+function policyIsRequired(root) {
+  const p = join5(root, ".madeby", "policy.json");
+  if (!existsSync4(p)) return false;
+  try {
+    return parseDisclosurePolicy(JSON.parse(readFileSync6(p, "utf8"))).mode === "required";
+  } catch {
+    return false;
+  }
+}
 var pct = (n, d) => d > 0 ? Math.round(n / d * 100) : 0;
 var bar = (p) => "\u2588".repeat(Math.round(p / 5)) + "\u2591".repeat(20 - Math.round(p / 5));
-function render(r) {
+function render(r, required) {
   const knownPct = pct(r.known, r.total);
   const unknownPct = 100 - knownPct;
   console.log(`authorship coverage \u2014 ${r.scope}  (estimate \xB7 disclosure, not detection)`);
@@ -2013,8 +2060,11 @@ function render(r) {
     console.log(`  trust:  asserted ${pct(r.byTier.asserted, r.known)}% \xB7 verified ${pct(r.byTier.verified, r.known)}%  \u2014 self-reported; sign commits to verify`);
   }
   if (r.unknown > 0) {
-    console.log(`
-  \u2192 ${unknownPct}% unknown. Require disclosure going forward:  madeby init --required`);
+    console.log(
+      required ? `
+  \u2192 ${unknownPct}% unknown. Disclosure is already required on pull requests \u2014 the unknown is history the gate didn\u2019t cover (e.g. from before it was on).` : `
+  \u2192 ${unknownPct}% unknown. Require disclosure going forward:  madeby init --required`
+    );
   }
 }
 function coverageCommand(args) {
@@ -2031,12 +2081,12 @@ function coverageCommand(args) {
     console.log(JSON.stringify(r, null, 2));
     return;
   }
-  render(r);
+  render(r, policyIsRequired(root));
 }
 
 // src/init-repo.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join6 } from "node:path";
 var ACO_VERSION = 1;
 var ACO_OPEN = `<!-- madeby:aco v${ACO_VERSION} -->`;
 var ACO_CLOSE = `<!-- /madeby:aco -->`;
@@ -2087,7 +2137,7 @@ function replaceAcoBlock(content, loc) {
   return content.slice(0, loc.start) + ACO_BLOCK + content.slice(loc.end);
 }
 function writeIfAbsent(abs, rel, content, created, skipped) {
-  if (existsSync4(abs)) {
+  if (existsSync5(abs)) {
     skipped.push(rel);
     return;
   }
@@ -2095,15 +2145,39 @@ function writeIfAbsent(abs, rel, content, created, skipped) {
   writeFileSync2(abs, content);
   created.push(rel);
 }
+function ensurePolicy(abs, rel, mode, res) {
+  if (!existsSync5(abs)) {
+    mkdirSync2(dirname2(abs), { recursive: true });
+    writeFileSync2(abs, JSON.stringify({ version: 0, mode }, null, 2) + "\n");
+    res.created.push(rel);
+    return { mode, malformed: false };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync7(abs, "utf8"));
+  } catch {
+    res.skipped.push(rel);
+    return { mode: "advisory", malformed: true };
+  }
+  const isObject = !!raw && typeof raw === "object" && !Array.isArray(raw);
+  const current = parseDisclosurePolicy(raw).mode;
+  if (mode === "required" && current !== "required" && isObject) {
+    writeFileSync2(abs, JSON.stringify({ ...raw, mode: "required" }, null, 2) + "\n");
+    res.raised.push(rel);
+    return { mode: "required", malformed: false };
+  }
+  res.skipped.push(rel);
+  return { mode: current, malformed: !isObject };
+}
 function ensureAco(abs, rel, res, opts) {
-  if (!existsSync4(abs)) {
+  if (!existsSync5(abs)) {
     if (!opts.createIfAbsent) return;
     mkdirSync2(dirname2(abs), { recursive: true });
     writeFileSync2(abs, AGENTS_CONVENTION);
     res.created.push(rel);
     return;
   }
-  const content = readFileSync6(abs, "utf8");
+  const content = readFileSync7(abs, "utf8");
   const status = acoStatus(content);
   if (status === "absent") {
     const sep = content.endsWith("\n") ? "" : "\n";
@@ -2129,14 +2203,21 @@ function initRepo(root, opts = {}) {
   const merged = [];
   const updated = [];
   const outdated = [];
-  const res = { created, skipped, merged, updated, outdated };
-  writeIfAbsent(join5(root, ".madeby", "policy.json"), ".madeby/policy.json", JSON.stringify({ version: 0, mode }, null, 2) + "\n", created, skipped);
-  ensureAco(join5(root, "AGENTS.md"), "AGENTS.md", res, { createIfAbsent: true, update });
-  ensureAco(join5(root, "CLAUDE.md"), "CLAUDE.md", res, { createIfAbsent: false, update });
+  const raised = [];
+  const res = { created, skipped, merged, updated, outdated, raised };
+  const policy = ensurePolicy(join6(root, ".madeby", "policy.json"), ".madeby/policy.json", mode, res);
+  ensureAco(join6(root, "AGENTS.md"), "AGENTS.md", res, { createIfAbsent: true, update });
+  ensureAco(join6(root, "CLAUDE.md"), "CLAUDE.md", res, { createIfAbsent: false, update });
   if (host === "github") {
-    writeIfAbsent(join5(root, ".github", "workflows", "disclosure.yml"), ".github/workflows/disclosure.yml", GH_WORKFLOW, created, skipped);
+    writeIfAbsent(join6(root, ".github", "workflows", "disclosure.yml"), ".github/workflows/disclosure.yml", GH_WORKFLOW, created, skipped);
   }
   const nextSteps = ["Commit the created files."];
+  if (raised.length > 0) {
+    nextSteps.push('Raised .madeby/policy.json to "required" \u2014 undisclosed commits now fail the check. To make it block merges, also mark the check required on the protected branch (see madeby://guide/enforce).');
+  }
+  if (policy.malformed) {
+    nextSteps.push('.madeby/policy.json is not a valid policy, so the check treats it as advisory. It was left untouched \u2014 fix it (e.g. { "version": 0, "mode": "required" }) to enforce.');
+  }
   if (created.includes("AGENTS.md")) {
     nextSteps.push("An AGENTS.md ACO convention was added \u2014 agents that read it disclose authorship (e.g. 'npx madeby@latest ai [tool]'). Tune it to your repo's tools.");
   }
@@ -2154,12 +2235,12 @@ function initRepo(root, opts = {}) {
   } else if (host !== "github") {
     nextSteps.push(`Add a CI step that runs 'npx madeby check' on pull requests for ${host}.`);
   }
-  if (mode !== "required") {
-    nextSteps.push(`When ready to enforce: set mode to "required", then make the check required on the protected branch \u2014 the host's control plane (GitHub: gh api branch protection; Azure: a build-validation policy). See the MCP resource madeby://guide/enforce for exact commands.`);
+  if (policy.mode !== "required") {
+    nextSteps.push(`When ready to enforce: run 'madeby init --required' (or set "mode": "required" in .madeby/policy.json), then make the check required on the protected branch \u2014 the host's control plane (GitHub: gh api branch protection; Azure: a build-validation policy). See the MCP resource madeby://guide/enforce for exact commands.`);
   }
   nextSteps.push("Contributors disclose origin with a Co-Authored-By / Generated-by trailer (AI), an Authored-by-human trailer ('madeby me'), an Authored-by-ai trailer ('madeby ai' \u2014 AI authored, committer accountable), a DCO Signed-off-by, or a signed commit. Evidence upgrade: 'madeby ai --witness' records your own AI session's witnessed spans.");
   nextSteps.push("Existing history is accounted for honestly, not fabricated: run 'madeby check' over full history to recognize what's already disclosed; pre-adoption commits stay unknown. See madeby://guide/backfill.");
-  return { created, skipped, merged, updated, outdated, policyMode: mode, host, nextSteps };
+  return { created, skipped, merged, updated, outdated, raised, policyMode: policy.mode, host, nextSteps };
 }
 var GH_WORKFLOW = `name: Disclosure
 on: pull_request
@@ -2189,6 +2270,7 @@ function initCommand(args) {
   for (const f of r.created) console.log(`  + ${f}`);
   for (const f of r.merged) console.log(`  ~ ${f} (merged in the ACO rule)`);
   for (const f of r.updated) console.log(`  \u2191 ${f} (ACO convention refreshed to the current version)`);
+  for (const f of r.raised) console.log(`  \u2191 ${f} (mode raised to required)`);
   for (const f of r.outdated) console.log(`  ! ${f} (ACO convention OUTDATED \u2014 run 'madeby init --update')`);
   for (const f of r.skipped) console.log(`  \xB7 ${f} (exists \u2014 left as-is)`);
   console.log(`
@@ -2201,7 +2283,7 @@ madeby init \u2014 policy: ${r.policyMode}, host: ${r.host}`);
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createInterface } from "node:readline";
 var DEFAULT_PROTOCOL = "2024-11-05";
-var SERVER_INFO = { name: "madeby", version: "0.3.6" };
+var SERVER_INFO = { name: "madeby", version: "0.3.8" };
 function rootFor(path) {
   const cwd = path && path.length ? path : process.cwd();
   return execFileSync6("git", ["-C", cwd, "-c", "core.quotePath=false", "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
@@ -2216,7 +2298,7 @@ var repoInput = {
 var TOOLS = [
   {
     name: "init",
-    description: "Align a repository with MadeBy in one call: create .madeby/policy.json (advisory by default \u2014 reports, never fails) and the CI disclosure check for the host (github default; azure-devops guided). Idempotent \u2014 never clobbers an existing policy or workflow. Returns the files created/skipped and the recommended next steps. Read the resources: madeby://guide/align (full workflow), madeby://guide/enforce (make the check required \u2014 the host's control plane, exact commands), madeby://guide/backfill (account for existing history honestly \u2014 never fabricate). The ACO convention block is versioned: the result flags an `outdated` AGENTS.md/CLAUDE.md (drift); call again with update:true to refresh just that block in place \u2014 how an agent keeps the convention current.",
+    description: 'Align a repository with MadeBy in one call: create .madeby/policy.json (advisory by default \u2014 reports, never fails) and the CI disclosure check for the host (github default; azure-devops guided). Idempotent \u2014 never clobbers an existing policy or workflow; the one change it makes is mode: "required" raising an existing advisory policy to required (it never lowers one). Returns the files created/skipped and the recommended next steps. Read the resources: madeby://guide/align (full workflow), madeby://guide/enforce (make the check required \u2014 the host\'s control plane, exact commands), madeby://guide/backfill (account for existing history honestly \u2014 never fabricate). The ACO convention block is versioned: the result flags an `outdated` AGENTS.md/CLAUDE.md (drift); call again with update:true to refresh just that block in place \u2014 how an agent keeps the convention current.',
     inputSchema: {
       type: "object",
       properties: {
@@ -2300,7 +2382,8 @@ guesses whether code is AI. To align a repo:
 
 1. **Assess** \u2014 call \`check\` (or \`who\` with no path for a repo-wide map) to see current coverage.
 2. **Set up** \u2014 call \`init\`: it writes \`.madeby/policy.json\` (advisory) and the CI disclosure check.
-   Idempotent; it never clobbers an existing policy or workflow. Then commit the created files.
+   Idempotent; it never clobbers an existing policy or workflow (\`mode: "required"\` only ever raises an
+   advisory policy to required). Then commit the created files.
 3. **Disclose going forward** \u2014 contributors disclose origin with a Co-Authored-By / Generated-by
    trailer (AI), an \`Authored-by-human\` trailer (work they wrote themselves \u2014 the symmetric human
    claim; \`madeby me\` adds it), a DCO Signed-off-by, a signed commit, or \`ai\` (record your own AI

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madeby",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "mcpName": "io.github.MadeByFYI/madeby",
   "description": "Disclose AI authorship of code. `npx madeby ai` adds an Authored-by-ai git trailer; AI coding agents disclose per the ACO standard (human/with_ai/ai) from an AGENTS.md convention. Disclosure, not detection. Gate PRs with `madeby check`.",
   "license": "MIT",
@@ -41,7 +41,7 @@
     "node": ">=20"
   },
   "bin": {
-    "madeby": "./dist/madeby.mjs"
+    "madeby": "dist/madeby.mjs"
   },
   "files": [
     "dist",