Add support to detect Assisted-By trailer

[omkar-foss]

Closes #28.

This PR adds support for detecting one or more Assisted-By trailers in git commit message. Also includes tests for supported cases.

Changes (updated as per suggestions here):

• Added a new package assistedby alongside coauthor
• Parser for Assisted-By will read trailer value, detect tool name and return it
• Parser will return one Finding per detected tool
• Added some test cases in scan_test.go to cover cases where Co-Authored-By and Assisted-By occur together. See this comment on PR below.
• This new assistedby detector added to detectors list in cmd/cmd.go, this is required for the new detector to get recognized and used by the commands.

[MoralCode]

This change diff feels like it is rewriting lots of the other functions that are checking for signs of other AI related uses besides Assisted-By trailiers.

I like the additional unit tests, but If theres additional formatting/refactoring changes that need to be made, I'd like those to be explained in the PR description or discussed beforehand.

Is there anything preventing this change from being a handful of lines of new unit tests and a smaller handful of lines to add a new entry to the commitMessagePatterns list that satisfies the unit tests?

[omkar-foss]

Thanks Adrian, I've added a Changes list to PR description above, which should hopefully answer all questions related to other function changes. Kindly go through it and let me know if you've any follow-up questions.

[andrew]

Thanks for the detailed writeup. I agree with Adrian that the diff is larger than it needs to be.

The root issue is that Finding.Tool is being used to carry a comma-joined list which then gets split apart again in scan.go and output.go. Detect() already returns []Finding, so the cleaner fix is to emit one finding per Assisted-By line. That removes the scan.go and output.go changes entirely and means the existing checkers don't need to be rewritten.

A few other things:

• Assisted-By: Kimi K2.6 is silently dropped because it's not in SupportedTools. An explicit Assisted-By trailer is itself the disclosure, so we should report it with the verbatim tool name even if we don't recognise it.
• message importing toolmention couples two sibling detectors. If the tool list needs sharing it should move somewhere neutral first, but per the point above I'm not sure it's needed here at all.
• Adding bare "Gemini" to the tools list changes the behaviour of the toolmention detector, which is out of scope for this PR.
• Minor: var getMatchedTools = func(...) can be a plain func; matches == nil || len(matches) == 0 reduces to len(matches) == 0; strings.Index(toolName, ",") >= 1 should be strings.Contains.

I'd suggest making Assisted-By its own detector package alongside coauthor, emitting one finding per trailer, and not gating on a known-tools list. That should come out to roughly 40 lines plus the tests you've already written, with no changes to the existing checkers.

[omkar-foss]

Thanks for the detailed review, I'll update the PR accordingly.

[omkar-foss]

@andrew I've updated the PR as per your suggestions here. Please find all changes in description here. Thanks.

[MoralCode]

i see this new version adds an entirely new type of detector for assisted by trailers. I dont see why this needs to be a whole new detector.

Assisted-By is a trailer, which means its something that is added to the end of a commit message. Id like to reuse the existing detector we have for commit messages.

[MoralCode]

This does not require a new detector, we already have a detector for commit messages

[omkar-foss]

Tool has been changed to Cursor here as commit 4 (instead of 2) is being read now, see this updated test commit which has both Co-Authored-By and multiple Assisted-By.

[omkar-foss]

This does not require a new detector, we already have a detector for commit messages

I see two main reasons why we should keep it in a separate detector:

1. separate detector design has a cleaner way to have one Finding per tool detected. adding it to commit messages' detector is cluttering things and increasing diff, as we saw in my previous changes in this PR.
2. we'll be able to keep scoring separate for each detector as we discussed few days back in Refactor confidence scoring to be based on a numeric system #12.

Also this was suggested in @andrew's suggestions comment which I've fully incorporated:

I'd suggest making Assisted-By its own detector package alongside coauthor, emitting one finding per trailer, and not gating on a known-tools list. That should come out to roughly 40 lines plus the tests you've already written, with no changes to the existing checkers.

[omkar-foss]

Additionally I think Assisted-By and Co-authored-by should have their own detectors since they're more widely available trailers and becoming standard (and so are more prone to format iterations in near future). While the others (Replit, EntireIO, etc) are tool-specific.

So these are separate concerns and we should try to keep them separate to encourage the fact that newcomers can easily develop and maintain them separately.