madeby 0.3.9 → 0.3.11

package/README.md

@@ -54,6 +54,9 @@ madeby ai     [tool]           Made by AI: attest AI authorship of HEAD (an Auth
                                `--witness [log]` instead records witnessed spans from a session log.
 madeby me     [--with-ai [t]]  Made by me: affirm you authored HEAD (Authored-by-human); --with-ai adds
                                Assisted-by → with_ai. --model <version> names the model too.
+              --print          (me / ai) print the trailer lines instead of amending HEAD — for a
+                               platform that makes the commit itself (a cloud coding agent):
+                               git commit -m "<msg>" -m "$(madeby ai <tool> --print)".
 madeby mcp                     Run the MCP server (stdio) — the tools, agent-callable.
 madeby help
 ```
@@ -153,7 +156,7 @@ Two modes, nothing more:
 - optional `"recordModel": true` — written by `madeby init --record-model`: the repo asks AI
   disclosures to name the model version as well as the tool. It adds one line to the AGENTS.md rule,
   and `me --with-ai` / `ai` then read the model from the **tool's own record of the session** — Cursor's
-  `CURSOR_MODEL`, the Copilot CLI and Claude Code session logs (locally; only the model id is read) —
+  `CURSOR_MODEL` or its chat store, the Copilot CLI and Claude Code session logs (locally; only the model id is read) —
   which wins over an agent's `--model`, since an agent routed by "Auto" may not know which model served
   it. Elsewhere `--model <version>` is used, never guessed. So `coverage` can list each **agent · model** pairing
   (`Cursor · gpt-5.3-codex` vs `Claude Code · claude-sonnet-5`). A request, not a gate — an AI

package/dist/madeby.mjs

@@ -127,11 +127,12 @@ function classifyCommit(commit) {
     const botText = `${commit.authorName ?? ""} ${commit.authorEmail ?? ""}`.trim();
     const agentAi = botText ? matchAi(botText) : null;
     if (agentAi) {
+      const named = [...commit.message.matchAll(AI_AUTHOR_TRAILER), ...commit.message.matchAll(TRAILER_RE)].map((m) => matchAiTrailer(m[1].trim())).filter((c) => c !== null);
       return {
         class: "ai",
         confidence: CONF_AI,
-        signals: [`author:${agentAi.provider}`],
-        aiContributors: [{ ...agentAi, raw: botText }]
+        signals: [`author:${agentAi.provider}`, ...named.map((c) => `trailer:${c.provider}`)],
+        aiContributors: [{ ...agentAi, raw: botText }, ...named]
       };
     }
     return { class: "bot", confidence: CONF_BOT, signals: ["author:bot"], aiContributors };
@@ -1833,12 +1834,13 @@ To disclose: add a Co-Authored-By / Generated-by trailer, affirm your own author
 
 // src/commands/me.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join6 } from "node:path";
 
 // src/model-source.ts
-import { closeSync, existsSync as existsSync4, openSync, readdirSync as readdirSync3, readSync, statSync as statSync2 } from "node:fs";
+import { createHash } from "node:crypto";
+import { closeSync, existsSync as existsSync4, openSync, readdirSync as readdirSync3, readFileSync as readFileSync6, readSync, statSync as statSync2 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join5 } from "node:path";
 var SESSION_ID = /^[0-9a-f-]{8,64}$/i;
@@ -1859,11 +1861,32 @@ function lastModelIn(path) {
     if (fd !== void 0) closeSync(fd);
   }
 }
+var RECENT_MS = 30 * 60 * 1e3;
+function cursorChatModel(home, cwd) {
+  const dir = join5(home, ".cursor", "chats", createHash("md5").update(cwd).digest("hex"));
+  try {
+    const chats = readdirSync3(dir).map((c) => ({ c, t: statSync2(join5(dir, c)).mtimeMs })).sort((a, b) => b.t - a.t);
+    const newest = chats[0];
+    if (!newest || Date.now() - newest.t > RECENT_MS) return null;
+    const db = join5(dir, newest.c, "store.db");
+    if (!existsSync4(db) || statSync2(db).size > 64 * 1024 * 1024) return null;
+    const names = new Set([...readFileSync6(db).toString("latin1").matchAll(/"modelName"\s*:\s*"([^"]{1,80})"/g)].map((m) => m[1]));
+    return names.size === 1 ? [...names][0] : null;
+  } catch {
+    return null;
+  }
+}
 var MODEL_SOURCES = [
   {
     tool: "Cursor",
     matches: /\bcursor/i,
-    detect: (env) => env.CURSOR_AGENT === "1" && env.CURSOR_MODEL?.trim() ? { model: env.CURSOR_MODEL.trim(), source: "Cursor's CURSOR_MODEL" } : null
+    // Cursor's agent shell sets CURSOR_MODEL — but not always (none of four Auto trials saw it), so its
+    // chat store is the second witness. Either is the tool's record, not the agent's guess.
+    detect: (env, home, cwd) => {
+      if (env.CURSOR_AGENT === "1" && env.CURSOR_MODEL?.trim()) return { model: env.CURSOR_MODEL.trim(), source: "Cursor's CURSOR_MODEL" };
+      const model = cursorChatModel(home, cwd);
+      return model ? { model, source: "Cursor's chat store" } : null;
+    }
   },
   {
     tool: "GitHub Copilot CLI",
@@ -1872,7 +1895,7 @@ var MODEL_SOURCES = [
       const id = env.COPILOT_AGENT_SESSION_ID;
       if (env.COPILOT_CLI !== "1" || !id || !SESSION_ID.test(id)) return null;
       const model = lastModelIn(join5(home, ".copilot", "session-state", id, "events.jsonl"));
-      return model ? { model, source: "Copilot CLI's session log" } : null;
+      return model ? { model, source: "Copilot's session log" } : null;
     }
   },
   {
@@ -1897,11 +1920,11 @@ var MODEL_SOURCES = [
     }
   }
 ];
-function detectAgentModel(tool, env = process.env, home = homedir2()) {
+function detectAgentModel(tool, env = process.env, home = homedir2(), cwd = process.cwd()) {
   const generic = /^(?:AI|an? AI)$/i.test(tool.trim());
   for (const s of MODEL_SOURCES) {
     if (!generic && !s.matches.test(tool)) continue;
-    const hit = s.detect(env, home);
+    const hit = s.detect(env, home, cwd);
     if (hit) return { tool: generic ? s.tool : tool, ...hit };
   }
   return null;
@@ -1938,14 +1961,14 @@ function recordsModel(root) {
   const p = join6(root, ".madeby", "policy.json");
   if (!existsSync5(p)) return false;
   try {
-    return parseDisclosurePolicy(JSON.parse(readFileSync6(p, "utf8"))).recordModel === true;
+    return parseDisclosurePolicy(JSON.parse(readFileSync7(p, "utf8"))).recordModel === true;
   } catch {
     return false;
   }
 }
 function resolveAi(root, o) {
   const tool = o.tool && o.tool.trim() || "AI";
-  const detected = recordsModel(root) ? detectAgentModel(tool, o.env ?? process.env, o.home ?? homedir3()) : null;
+  const detected = recordsModel(root) ? detectAgentModel(tool, o.env ?? process.env, o.home ?? homedir3(), o.cwd ?? process.cwd()) : null;
   if (detected) return { value: aiValue(detected.tool, detected.model), tool: detected.tool, model: detected.model, modelSource: detected.source };
   const model = o.model?.trim() || void 0;
   return { value: aiValue(tool, model), tool, ...model ? { model, modelSource: "as given (--model)" } : {} };
@@ -1979,6 +2002,24 @@ function attestAiAuthorship(root, opts = {}) {
   }
   return { ...base, ok: true, changed: trailers.length > 0, subject, added };
 }
+function disclosureTrailers(root, opts) {
+  if (opts.category === "ai") {
+    const ai2 = resolveAi(root, opts);
+    return { ok: true, lines: [`Authored-by-ai: ${ai2.value}`], model: ai2.model, modelSource: ai2.modelSource };
+  }
+  let name = "";
+  let email = "";
+  try {
+    name = git3(root, ["config", "user.name"]);
+    email = git3(root, ["config", "user.email"]);
+  } catch {
+  }
+  if (!name || !email) return { ok: false, reason: "no-identity", lines: [] };
+  const lines = [`Authored-by-human: ${name} <${email}>`];
+  if (opts.category === "human") return { ok: true, lines };
+  const ai = resolveAi(root, opts);
+  return { ok: true, lines: [...lines, `Assisted-by: ${ai.value}`], model: ai.model, modelSource: ai.modelSource };
+}
 function affirmAuthorship(root, opts = {}) {
   const withAi = opts.withAi ?? false;
   const ai = withAi ? resolveAi(root, opts) : void 0;
@@ -2037,6 +2078,16 @@ function meCommand(args) {
     process.exit(2);
     return;
   }
+  if (args.includes("--print")) {
+    const t = disclosureTrailers(root, { category: withAi ? "with_ai" : "human", tool, model });
+    if (!t.ok) {
+      console.error("madeby me: set your git identity first (git config user.name / user.email).");
+      process.exit(1);
+      return;
+    }
+    console.log(t.lines.join("\n"));
+    return;
+  }
   const r = affirmAuthorship(root, { withAi, tool, model });
   if (!r.ok) {
     if (r.reason === "no-identity") console.error("madeby me: set your git identity first (git config user.name / user.email).");
@@ -2111,6 +2162,10 @@ function aiCommand(args) {
     return;
   }
   const tool = positional[0] || "AI";
+  if (args.includes("--print")) {
+    console.log(disclosureTrailers(root, { category: "ai", tool, model }).lines.join("\n"));
+    return;
+  }
   const r = attestAiAuthorship(root, { tool, model });
   if (!r.ok) {
     if (r.reason === "staged-changes") {
@@ -2181,13 +2236,13 @@ function whoCommand(args) {
 }
 
 // src/commands/coverage.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
 import { join as join7 } from "node:path";
 function policyIsRequired(root) {
   const p = join7(root, ".madeby", "policy.json");
   if (!existsSync6(p)) return false;
   try {
-    return parseDisclosurePolicy(JSON.parse(readFileSync7(p, "utf8"))).mode === "required";
+    return parseDisclosurePolicy(JSON.parse(readFileSync8(p, "utf8"))).mode === "required";
   } catch {
     return false;
   }
@@ -2249,9 +2304,9 @@ function coverageCommand(args) {
 }
 
 // src/init-repo.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, join as join8 } from "node:path";
-var ACO_VERSION = 1;
+var ACO_VERSION = 2;
 var ACO_OPEN = `<!-- madeby:aco v${ACO_VERSION} -->`;
 var ACO_CLOSE = `<!-- /madeby:aco -->`;
 var ACO_OPEN_RE = /<!-- madeby:aco(?: v(\d+))? -->/;
@@ -2265,6 +2320,10 @@ After you commit, run the command for the honest category (no install, no setup)
 - **with_ai** \u2014 a human authored it with AI assistance: \`npx madeby@latest me --with-ai [tool]\`
 - **human** \u2014 a human authored it: \`npx madeby@latest me\`
 
+If your platform makes the commit for you (a cloud coding agent that pushes through its own tool),
+amending afterwards can be lost \u2014 put the disclosure in the message instead, with \`--print\`:
+\`git commit -m "<message>" -m "$(npx madeby@latest ai [tool] --print)"\`.
+
 Disclose per commit, honestly. Undisclosed content stays *unknown*, never guessed.
 `;
 var MODEL_LINE = `
@@ -2321,7 +2380,7 @@ function ensurePolicy(abs, rel, want, res) {
   }
   let raw;
   try {
-    raw = JSON.parse(readFileSync8(abs, "utf8"));
+    raw = JSON.parse(readFileSync9(abs, "utf8"));
   } catch {
     res.skipped.push(rel);
     return { mode: "advisory", recordModel: false, malformed: true };
@@ -2351,7 +2410,7 @@ ${block}`);
     res.created.push(rel);
     return;
   }
-  const content = readFileSync8(abs, "utf8");
+  const content = readFileSync9(abs, "utf8");
   const status = acoStatus(content);
   const loc = findAcoBlock(content);
   if (status === "absent") {
@@ -2470,7 +2529,7 @@ madeby init \u2014 policy: ${r.policyMode}${r.recordModel ? " + records model" :
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createInterface } from "node:readline";
 var DEFAULT_PROTOCOL = "2024-11-05";
-var SERVER_INFO = { name: "madeby", version: "0.3.9" };
+var SERVER_INFO = { name: "madeby", version: "0.3.11" };
 function rootFor(path) {
   const cwd = path && path.length ? path : process.cwd();
   return execFileSync6("git", ["-C", cwd, "-c", "core.quotePath=false", "rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
@@ -2544,6 +2603,7 @@ var TOOLS = [
         category: { enum: ["human", "with_ai", "ai"], description: "the honest authorship category (see the description). Defaults from with_ai if omitted." },
         with_ai: { type: "boolean", description: "legacy shorthand: true \u21D2 category with_ai, false \u21D2 human. Prefer `category`." },
         tool: { type: "string", description: "the AI tool to name (Assisted-by for with_ai, Authored-by-ai for ai). Default: AI." },
+        print: { type: "boolean", description: "return the disclosure trailer lines instead of amending HEAD \u2014 for platforms that make the commit themselves; put them in the commit message's last paragraph" },
         model: { type: "string", description: "the model version you are running as, e.g. claude-sonnet-5 \u2014 written as tool:model. Give it when the repo's AGENTS.md asks; omit it rather than guess." }
       }
     },
@@ -2552,6 +2612,10 @@ var TOOLS = [
       const tool = args.tool;
       const model = args.model;
       const category = args.category;
+      if (args.print === true) {
+        const c = category === "ai" ? "ai" : category === "with_ai" || args.with_ai === true ? "with_ai" : "human";
+        return disclosureTrailers(root, { category: c, tool, model });
+      }
       if (category === "ai") return attestAiAuthorship(root, { tool, model });
       const withAi = category === "with_ai" || args.with_ai === true;
       return affirmAuthorship(root, { withAi, tool, model: withAi ? model : void 0 });
@@ -2793,6 +2857,8 @@ Usage:
   madeby me --with-ai [tool]     Made by me, with AI: also disclose AI assistance (Assisted-by:
                                  <tool>, default "AI") \u2014 the assisted middle state, classified with_ai.
                                  --model <version> names the model too (Assisted-by: <tool>:<version>).
+                                 --print (me / ai) prints the trailer lines instead of amending HEAD,
+                                 for the commit message itself: git commit -m <msg> -m "$(madeby ai <tool> --print)".
   madeby mcp                     Run the MCP server (stdio) \u2014 the tools, agent-callable.
   madeby help                    Show this help.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madeby",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "mcpName": "io.github.MadeByFYI/madeby",
   "description": "Disclose AI authorship of code. `npx madeby ai` adds an Authored-by-ai git trailer; AI coding agents disclose per the ACO standard (human/with_ai/ai) from an AGENTS.md convention. Disclosure, not detection. Gate PRs with `madeby check`.",
   "license": "MIT",