Agent Gate

A zero-configuration install used to report nothing. This release fixes that.

agent_detection.authors, branch_patterns and body_patterns all defaulted to empty arrays, so agent detection could never fire — and because contract.required_for defaults to [agent], the project's headline check was unreachable without configuration nobody knew to write.

Measured, not suspected: 14 of 14 recent merged pull requests from next.js, react, vscode, deno, vite, ruff, prettier and vue returned 0 error, 0 warning, 0 info under the shipped defaults.

Try it

npx --yes [email protected] demo

No token, no network, no repository — and 13 findings from the default policy.

Highlights

• Working agent-detection defaults, taken from the 2,204-PR study rather than guessed.
• Gemini and Qwen control planes — GEMINI.md, QWEN.md, .gemini/**. GitHub indexes 8,208 GEMINI.md files; a PR steering every future Gemini run was invisible.
• mergewarden demo — an example PR bundled in the CLI, run against the default policy so its output is a verifiable claim rather than a showcase.
• A shorter PR comment — 5 lines above the fold instead of 30, from maintainer feedback.
• The terminal report no longer hides errors behind warnings when truncating.

Breaking

No API breaks, but default behaviour changes:

• Agent PRs now produce agent/origin-detected and, without a contract, contract/missing — needs-review in the default warn mode, not a block.
• PRs touching GEMINI.md or QWEN.md produce an error-severity control-plane finding.
• Human PRs are unaffected.

Restore the previous behaviour by setting agent_detection keys explicitly to [].

Full notes: docs/release-notes-v0.5.0.md · CHANGELOG

Published from signed tag v0.5.0 (verified=true) with npm provenance.