fix: PR fingerprint check blocks plain-text mentions of Cursor/Copilot

[c-vigo]

Description

The PR fingerprint check (check-pr-agent-fingerprints) produces false positives when normal prose mentions AI tool names like "Cursor" or "Copilot". The root cause is case-insensitive substring matching of names against the entire PR title+body.

This PR narrows name matching to attribution-context lines only and wires up the previously unused allow_patterns from agent-blocklist.toml.

Type of Change

• feat -- New feature
• fix -- Bug fix
• docs -- Documentation only
• chore -- Maintenance task (deps, config, etc.)
• refactor -- Code restructuring (no behavior change)
• test -- Adding or updating tests
• ci -- CI/CD pipeline changes
• build -- Build system or dependency changes
• revert -- Reverts a previous commit
• style -- Code style (formatting, whitespace)

Modifiers

• Breaking change (!) -- This change breaks backward compatibility

Changes Made

• packages/vig-utils/src/vig_utils/utils.py
  • load_blocklist: now loads allow_patterns from TOML as compiled regexes
  • contains_agent_fingerprint: strips allow_patterns matches from content before checking; restricts names matching to lines containing attribution-context phrases (authored by, generated by, powered by, bot, agent, etc.)
  • New module-level _ATTRIBUTION_CONTEXT_RE compiled regex
• packages/vig-utils/tests/test_utils.py
  • 8 new tests in TestAgentBlocklistHelpers: allow_patterns loading, plain-prose pass-through, attribution-context blocking, allow_patterns stripping, combined stripping+attribution, email unconditional matching
• CHANGELOG.md
  • Added entry under ### Fixed in [0.3.0]

Changelog Entry

Fixed

• PR fingerprint check false positives on plain-text AI tool mentions (#274)
  • contains_agent_fingerprint now restricts name matching to attribution-context lines (e.g. "generated by", "authored by") instead of scanning the entire content
  • Wire up allow_patterns from agent-blocklist.toml to strip known-safe text (dotfile paths, doc filenames) before checking

Testing

• Tests pass locally (just test)
• Manual testing performed (describe below)

Manual Testing Details

N/A

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have updated the documentation accordingly (edit docs/templates/, then run just docs)
• I have updated CHANGELOG.md in the [Unreleased] section (and pasted the entry above)
• My changes generate no new warnings or errors
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Additional Notes

N/A

Refs: #221, #274

[Copilot]

Pull request overview

Adjusts the PR title/body AI-agent fingerprint detection used by check-pr-agent-fingerprints to avoid false positives from plain-prose mentions of tool names (e.g., “Cursor”, “Copilot”), and activates the previously-configured allow_patterns support from the blocklist TOML.

Changes:

• Load allow_patterns from agent-blocklist.toml and apply them by stripping known-safe text before scanning.
• Restrict names matching to lines that appear to be attribution/agent-identity context (instead of scanning the entire content).
• Add unit tests covering allow-pattern loading/stripping and attribution-vs-prose behavior; add changelog entry for the fix.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
packages/vig-utils/src/vig_utils/utils.py	Loads/uses allow_patterns and narrows name matching to attribution-context lines via a new regex.
packages/vig-utils/tests/test_utils.py	Adds tests to prevent regressions for plain-prose mentions and verify allow-pattern stripping behavior.
CHANGELOG.md	Documents the fix under the current release’s “Fixed” section.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.