madeby 0.3.7 → 0.3.8

package/README.md

@@ -103,7 +103,9 @@ authorship coverage — last 500 commits  (estimate · disclosure, not detection
 It is a **labeled estimate**, honest by construction: an undisclosed commit is **unknown**, never
 inferred as human — disclosure, not detection. The human/with_ai/ai mix is reported *of the known*,
 never of the whole repo, and the asserted-vs-verified split shows how much is signed. `--json` emits
-counts only (percentages are derived at the edge, never stored). Use it to see your gap, then
+counts only (percentages are derived at the edge, never stored). A plain merge authors nothing and
+isn't scored; a merge that changes content of its own (a conflict resolution) is, like any other
+commit — chosen by what it changes, never by whether it discloses. Use it to see your gap, then
 `madeby init --required` to close it going forward.
 
 ### `madeby me` — affirm human authorship

package/dist/madeby.mjs

@@ -4,6 +4,18 @@
 import { execFileSync } from "node:child_process";
 var FIELD = "";
 var RECORD = "";
+var GROUP = "";
+var parseMeta = (rec) => {
+  const parts = rec.split(FIELD);
+  const sig = parts[3] ?? "N";
+  return {
+    sha: parts[0] ?? "",
+    authorName: parts[1] ?? "",
+    authorEmail: parts[2] ?? "",
+    signed: sig !== "N" && sig !== "",
+    message: parts.slice(4).join(FIELD).trimEnd()
+  };
+};
 function readGitLog(repoPath, limit, range) {
   try {
     const args = [
@@ -11,7 +23,7 @@ function readGitLog(repoPath, limit, range) {
       repoPath,
       "log",
       "--no-merges",
-      // merge commits aren't authored content — exclude them from attribution
+      // a merge is not authored content by default; readAuthoredMerges finds those that are
       ...limit ? ["-n", String(limit)] : [],
       // %G? is a signature-PRESENCE probe for the Disclosure Score: 'N' = unsigned; any other code
       // (G/U/E/…) = a signature is present (E = present but unverifiable here — no keyring). We only
@@ -22,19 +34,38 @@ function readGitLog(repoPath, limit, range) {
       ...range ? [range] : []
     ];
     const out = execFileSync("git", args, { encoding: "utf8", maxBuffer: 256 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
-    return out.split(RECORD).map((r) => r.replace(/^\s+/, "")).filter((r) => r.length > 0).map((rec) => {
-      const parts = rec.split(FIELD);
-      const sha = parts[0] ?? "";
-      const authorName = parts[1] ?? "";
-      const authorEmail = parts[2] ?? "";
-      const sig = parts[3] ?? "N";
-      const message = parts.slice(4).join(FIELD).trimEnd();
-      return { sha, authorName, authorEmail, signed: sig !== "N" && sig !== "", message };
-    });
+    return out.split(RECORD).map((r) => r.replace(/^\s+/, "")).filter((r) => r.length > 0).map(parseMeta);
+  } catch {
+    return [];
+  }
+}
+function readAuthoredMerges(repoPath, opts = {}) {
+  try {
+    const args = [
+      "-C",
+      repoPath,
+      "log",
+      "--merges",
+      "--cc",
+      "--name-only",
+      `--format=${RECORD}%H${FIELD}%an${FIELD}%ae${FIELD}%G?${FIELD}%B${GROUP}`,
+      ...opts.since !== void 0 && !opts.range ? [`--since=@${opts.since}`] : [],
+      ...opts.range ? [opts.range] : []
+    ];
+    const out = execFileSync("git", args, { encoding: "utf8", maxBuffer: 256 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
+    return out.split(RECORD).filter((r) => r.includes(GROUP)).filter((r) => r.slice(r.lastIndexOf(GROUP) + 1).trim().length > 0).map((r) => parseMeta(r.slice(0, r.lastIndexOf(GROUP))));
   } catch {
     return [];
   }
 }
+function commitTime(repoPath, sha) {
+  try {
+    const t = Number(execFileSync("git", ["-C", repoPath, "log", "-1", "--format=%ct", sha], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim());
+    return Number.isFinite(t) && t > 0 ? t : void 0;
+  } catch {
+    return void 0;
+  }
+}
 
 // ../classify/src/classify.ts
 var AI_PATTERNS = [
@@ -1201,7 +1232,12 @@ function provenanceMap(root, opts = {}) {
 
 // ../analyzer/src/coverage.ts
 function repoCoverage(root, opts = {}) {
-  const commits = readGitLog(root, opts.range ? void 0 : opts.limit ?? 500, opts.range);
+  const limit = opts.range ? void 0 : opts.limit ?? 500;
+  const authored = readGitLog(root, limit, opts.range);
+  const oldest = authored.at(-1)?.sha;
+  const since = limit && oldest && authored.length >= limit ? commitTime(root, oldest) : void 0;
+  const merges = authored.length > 0 && (!limit || authored.length < limit || since !== void 0) ? readAuthoredMerges(root, { range: opts.range, since }) : [];
+  const commits = [...authored, ...merges];
   const byCategory = { human: 0, with_ai: 0, ai: 0, bot: 0 };
   const byTier = { asserted: 0, verified: 0 };
   let known = 0;
@@ -1217,8 +1253,8 @@ function repoCoverage(root, opts = {}) {
   }
   return {
     isEstimate: true,
-    methodology: "commit-level authorship disclosure (estimate); undisclosed = unknown, never inferred",
-    scope: opts.range ? `range ${opts.range}` : `last ${commits.length} commits`,
+    methodology: "commit-level authorship disclosure (estimate); undisclosed = unknown, never inferred; merges scored only when they change content of their own",
+    scope: (opts.range ? `range ${opts.range}` : `last ${authored.length} commits`) + (merges.length ? ` + ${merges.length} merges with changes of their own` : ""),
     total: commits.length,
     known,
     unknown: commits.length - known,
@@ -2247,7 +2283,7 @@ madeby init \u2014 policy: ${r.policyMode}, host: ${r.host}`);
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createInterface } from "node:readline";
 var DEFAULT_PROTOCOL = "2024-11-05";
-var SERVER_INFO = { name: "madeby", version: "0.3.7" };
+var SERVER_INFO = { name: "madeby", version: "0.3.8" };
 function rootFor(path) {
   const cwd = path && path.length ? path : process.cwd();
   return execFileSync6("git", ["-C", cwd, "-c", "core.quotePath=false", "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madeby",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "mcpName": "io.github.MadeByFYI/madeby",
   "description": "Disclose AI authorship of code. `npx madeby ai` adds an Authored-by-ai git trailer; AI coding agents disclose per the ACO standard (human/with_ai/ai) from an AGENTS.md convention. Disclosure, not detection. Gate PRs with `madeby check`.",
   "license": "MIT",