MergeWarden v0.6.0

v0.5.0 made agent detection work. This release fixes what that exposed.

With detection live, contract/missing fires on nearly every agent pull request — and it was hardcoded to error.

error blocks. Our own adoption path tells teams to graduate to mode: block at step 4, which would then have rejected every agent pull request — no coding agent emits a scope contract by default, and the scan study measured 0 of 2,204. Nothing a reviewer does to the change can resolve it.

It also ranked a missing declaration exactly as severe as workflow/permission-escalation, which fires when a workflow actually moves from contents: read to contents: write plus id-token: write. One is the absence of a convention almost nobody has adopted; the other is a privilege boundary moving.

The change

contract:
  missing_severity: warn # or: error

contract was the only rule family without severity control, so this closes an inconsistency rather than adding a special case.

Verified on real agent pull requests at mode: block:

Pull request	Before	After
Agent PR, no contract, nothing dangerous	block	warn
Agent PR, no contract, edits an agent instruction file	block	block

The tool now blocks on what a pull request did, not on a convention it did not follow.

contract/invalid, contract/out-of-scope and contract/blocked-path stay error — each fires on something a pull request did against its own declaration.

Breaking

No API breaks, but the default decision changes in one case, which is why this is a minor bump:

• On mode: block, an agent PR whose only issue is a missing contract no longer blocks. Restore with contract.missing_severity: error.
• On the default mode: warn, the decision is unchanged. Only the reported severity moves from error to warning.

Also fixed

Three strings said "an mergewarden contract", left from the v0.4.0 rename — the sentence most new installs would read first.

Full notes: docs/release-notes-v0.6.0.md

Published from signed tag v0.6.0 (verified=true) with npm provenance.

MergeWarden v0.5.1

v0.5.0 shipped working agent-detection defaults. One of them did not work.

Claude Code appends this footer to a pull request body:

🤖 Generated with [Claude Code](https://claude.com/claude-code)

The product name sits inside a Markdown link, and body markers are matched as case-insensitive substrings — so the default Generated with Claude Code could never match a real body. It came from the scan study's search query, and GitHub's search index tokenises, so the query finds these pull requests even though a literal match does not.

Measured against 13 real Claude Code pull requests from the study corpus:

Marker	Matches
Generated with Claude Code (v0.5.0 default)	0 of 13
Generated with [Claude Code] (v0.5.1 default)	12 of 13

The one miss had its footer edited out before merge. Nothing detects that from the artifact, and the docs do not claim otherwise.

Why this marker carries more weight than the others: Codex, Cursor, Copilot and Devin open pull requests from their own bot accounts or branch prefixes, so authors and branch_patterns catch them. Claude Code usually runs on a developer's own machine and pushes to an ordinary branch name — so for that cohort the footer is frequently the only signal there is.

Also in this release

The scan study's methodology now states which of its rates carry across engine versions. The per-rule boundary rates (3.9%, 12.9%, 17.5%, 22.1%) are unaffected by v0.5.0's detection fix — verified by re-scanning a 66-PR stratified sample of the dataset under the new defaults, which produced identical boundary findings on 66 of 66. The "at least one finding" rate is a boundary-crossing rate and is not comparable to a v0.5.0+ run.

Upgrading

- uses: sjh9714/mergewarden@v0.5.1

No configuration change required. A repository that sets body_patterns explicitly is unaffected; if you copied the old value, change it to ["Generated with [Claude Code]"].

Full notes: docs/release-notes-v0.5.1.md

Published from signed tag v0.5.1 (verified=true) with npm provenance.

MergeWarden v0.5.0

A zero-configuration install used to report nothing. This release fixes that.

agent_detection.authors, branch_patterns and body_patterns all defaulted to empty arrays, so agent detection could never fire — and because contract.required_for defaults to [agent], the project's headline check was unreachable without configuration nobody knew to write.

Measured, not suspected: 14 of 14 recent merged pull requests from next.js, react, vscode, deno, vite, ruff, prettier and vue returned 0 error, 0 warning, 0 info under the shipped defaults.

Try it

npx --yes mergewarden@0.5.0 demo

No token, no network, no repository — and 13 findings from the default policy.

Highlights

• Working agent-detection defaults, taken from the 2,204-PR study rather than guessed.
• Gemini and Qwen control planes — GEMINI.md, QWEN.md, .gemini/**. GitHub indexes 8,208 GEMINI.md files; a PR steering every future Gemini run was invisible.
• mergewarden demo — an example PR bundled in the CLI, run against the default policy so its output is a verifiable claim rather than a showcase.
• A shorter PR comment — 5 lines above the fold instead of 30, from maintainer feedback.
• The terminal report no longer hides errors behind warnings when truncating.

Breaking

No API breaks, but default behaviour changes:

• Agent PRs now produce agent/origin-detected and, without a contract, contract/missing — needs-review in the default warn mode, not a block.
• PRs touching GEMINI.md or QWEN.md produce an error-severity control-plane finding.
• Human PRs are unaffected.

Restore the previous behaviour by setting agent_detection keys explicitly to [].

Full notes: docs/release-notes-v0.5.0.md · CHANGELOG

Published from signed tag v0.5.0 (verified=true) with npm provenance.

v0.4.1

MergeWarden v0.4.1 adds commit trailer rules and makes the pull request comment short enough to live with.

Both changes came from reading and using the thing: one from surveying the AI-contribution policies MergeWarden is meant to enforce, the other from the first outside maintainer who tried the Action and said the bot comment was too long.

No policy behaviour changes for an existing repository until it opts in.

npx --yes mergewarden@0.4.1 scan owner/repo#123

Commit trailer rules

commit/trailer-missing and commit/trailer-forbidden, under a new commit_trailers key. Real AI-contribution policies express disclosure as a commit trailer and disagree on which one — Fedora and Mesa require Assisted-by:, Kubernetes forbids it, QEMU and FreeBSD require a DCO Signed-off-by: — and every one of those clauses is decidable from commit metadata alone, with no heuristics and no model.

commit_trailers:
  required:
    - any_of: [Assisted-by, Generated-by]
      applies_to: agent # agent | all — `all` is what a DCO rule needs
      severity: warn
  forbidden:
    - name: Co-authored-by
      value_patterns: ["*claude*", "*copilot*"]
      severity: error

Both lists default to empty. See the rule guide.

A pull request comment you can read

Detailed findings now sit behind a <details> fold in the PR comment. A 12-finding report goes from 371 rendered lines to 33 before the fold. The findings, evidence snapshots, finding IDs and remediation are all still there, one click away; report files, job summaries and the CLI are unchanged.

New documentation

What a checker can actually enforce — real policy clauses mapped to what is decidable, including the clauses MergeWarden does not and will not attempt.

Compatibility

• The default policy digest changed because the config schema gained the commit_trailers key. Digests recorded against v0.4.0 will differ. No finding IDs changed, so existing waivers remain valid.
• The collector now enumerates PR commits. GitHub caps that listing at 250; when MergeWarden cannot collect all of them it omits commits entirely and the trailer rules stay inert rather than run against a partial list that could only under-report.
• Trust boundary unchanged: one additional read-only API call, no checkout, no execution of PR code, no head-branch policy loading, no LLM.

Full changelog and release notes.

MergeWarden v0.4.0

MergeWarden v0.4.0 Release Notes

MergeWarden v0.4.0 renames the project from Agent Gate and publishes the CLI
under the unscoped npm name mergewarden. The GitHub repository is now
sjh9714/mergewarden; old repository URLs redirect. The scoped package
@jinhyuk9714/agent-gate remains at v0.3.1 and is deprecated.

Try It

npx --yes mergewarden@0.4.0 scan owner/repo#123

The CLI analyzes public pull requests without cloning, checking out,
installing, or executing target-repository code. Private repositories and
higher GitHub API limits use GH_TOKEN, with GITHUB_TOKEN as the fallback.

Highlights

• Rename the base-branch policy file to mergewarden.yml and the PR body
  contract marker to mergewarden-contract. This is a clean break with no
  compatibility alias; see the v0.4.0 migration guide.
• Rename default report outputs to mergewarden-report.json and
  mergewarden-report.md. Finding IDs keep the agf_ prefix so existing
  waivers remain valid.
• Reposition the README around agent-specific boundaries: declared PR scope,
  agent-control-plane drift, and agentic workflow injection.
• Add integration guides for gating Claude Code
  and Codex pull requests.
• Publish the AI-agent PR scan methodology used for the
  v0.4.0 launch study.

The signed v0.3.x tags remain immutable. v0.4.0 is a new source, tarball, and
provenance identity under the MergeWarden name.

See the v0.4.0 migration guide,
CLI reference, and release checklist.

Agent Gate v0.3.1

Agent Gate v0.3.1 Release Notes

Agent Gate v0.3.1 is the first public CLI release of the v0.3 line. The npm
package is scoped as @jinhyuk9714/agent-gate; the executable and product name
remain agent-gate and Agent Gate.

Try It

npx --yes @jinhyuk9714/agent-gate@0.3.1 scan owner/repo#123

The CLI analyzes public pull requests without cloning, checking out, installing,
or executing target-repository code. Private repositories and higher GitHub API
limits use GH_TOKEN, with GITHUB_TOKEN as the fallback.

Highlights

• Shared API-only PR collection for the CLI and GitHub Action.
• Fail-closed file-list and content integrity checks.
• Differential GitHub Actions privilege and supply-chain findings.
• Exact expiring waivers and deterministic finding IDs.
• Narrow, explainable agentic workflow injection detection.
• Bounded, sanitized human, Markdown, JSON, summary, and comment reports.
• Signed release tags and npm provenance for the exact tested tarball.

The v0.3.0 tag remains immutable. npm rejected its unscoped agent-gate
package name as too similar to the existing agentgate package, so v0.3.1
records the scoped package identity in source before publication.

See the v0.3 migration guidance, CLI reference,
and release checklist.

Agent Gate v0.2.6

Agent Gate v0.2.6 enriches workflow/permission-escalation evidence so reviewers can understand permission boundary changes more quickly.

Changed:

• Adds workflow/job scope context to workflow permission escalation findings.
• Detects job-level permission escalation, including restrictive job permission removal that exposes broader workflow permissions.
• Adds stable affected-capability evidence for escalated permissions.
• Keeps human-readable affected-area prose in report messages.
• Keeps the existing workflow/permission-escalation rule ID.
• Aligns package/report metadata to 0.2.6.

Not included:

• Permission necessity auto-detection.
• CODEOWNERS/reviewer sign-off evidence.
• History replay/audit mode.
• npm publish or Marketplace settings changes.

Recommended rollout remains warn mode first.

Agent Gate v0.2.5

v0.2.5 improves first-run onboarding.

Added:

• Added a tag-pinned observe-mode workflow template for faster first installs.
• Added a 30-second install path that downloads a pinned workflow YAML without executing a remote script.
• Added package lifecycle script drift triage guidance.

Runtime rule behavior and package/report metadata remain unchanged from v0.2.4.

Not included:

• runtime rule changes
• npm publishing
• Marketplace settings changes
• repository or workflow settings changes

Agent Gate v0.2.4

v0.2.4 adds warning-mode package lifecycle script drift checks.

Changed:

• Added dependency/lifecycle-script-added for newly introduced risky lifecycle scripts.
• Added dependency/package-script-drift for changed risky lifecycle scripts.
• Added package_scripts config for paths, lifecycle scripts, severity, and disabling the rule.
• Unavailable package manifest content is surfaced as analysis/content-unavailable instead of silently skipping lifecycle drift analysis.
• Package/report metadata is aligned to 0.2.4.

Not included:

• dependency additions
• lockfile mismatch
• CODEOWNERS / reviewer evidence
• maintainer override storage
• npm publishing
• Marketplace settings changes

Agent Gate v0.2.3

v0.2.3 adds zero-config observe-mode onboarding while keeping policy retrieval fail-closed.

Changed:

• First-run installs can use the built-in default policy when the default base-branch agent-gate.yml is confirmed absent.
• Other policy retrieval failures remain fatal, including custom config path misses, permission errors, rate limits, server/API failures, malformed content responses, and invalid YAML/schema.
• Reports record default-policy fallback as configSource: default.
• Markdown reports and job summaries include a human-readable policy source, such as Policy source: built-in default.
• The security model now documents the built-in default policy as trusted input bundled with the pinned Action ref.

Not included:

• npm publishing
• Marketplace settings changes
• repository or workflow settings changes