diff --git a/CHANGELOG.md b/CHANGELOG.md
index bb2d8fb..3c1e0b6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ### Added
 
+- `invocations(cmd, command)` — lists each command a line certainly runs with its words as the shell passes them and
+  what it reads from a here-document or here-string; a word that is one whole `$(cat <<'EOF' … EOF)` resolves to the
+  here-document.
+- Authorship checks: `authorshipViolations(cmd, options?)` reports AI signatures, non-Conventional commit subjects and
+  non-Conventional branch names in what a line writes; built on `authoredMessages(cmd)` (commit and `gh pr` text),
+  `branchNames(cmd)`, `aiSignatures(text)`, `isConventionalCommit(message, types?)`,
+  `isConventionalBranch(name, types?)`, `COMMIT_TYPES` and `BRANCH_TYPES`.
 - `deniedBy(cmd, deny)` — checks a command line against word-prefix patterns and fails closed: returns the matched
   pattern, a `DENY_REASONS` value when what the line runs cannot be known, or `null`.
 - `runsCommand(cmd, command)` — tells whether a line certainly runs a program or subcommand, reading it only as bash
@@ -42,4 +49,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
   operands, versioned interpreters (`python3.12`), and `gtimeout`, `fakeroot`, `unshare` and `sandbox-exec`.
 - Zero runtime dependencies, ESM only, TypeScript declarations, Node 20+.
 
-[0.1.0]: https://github.com/devmaxxx/shell-command-guard/releases/tag/v0.1.0
+[0.1.0]: https://github.com/devmaxxx/shell-guards/releases/tag/v0.1.0
diff --git a/README.md b/README.md
index 947f7b5..9b2a59c 100644
--- a/README.md
+++ b/README.md
@@ -1,17 +1,17 @@
 <div align="center">
 
-# shell-command-guard
+# shell-guards
 
 **Tell whether a shell command line really runs a program — the way bash would read it.**
 
 Sees through `sudo`/`env`/`xargs`/`bash -c`/heredocs/`$(…)` and fails closed — zero dependencies.
 
-[![npm version](https://img.shields.io/npm/v/shell-command-guard)](https://www.npmjs.com/package/shell-command-guard)
-[![npm downloads](https://img.shields.io/npm/dm/shell-command-guard)](https://www.npmjs.com/package/shell-command-guard)
-[![CI](https://img.shields.io/github/actions/workflow/status/devmaxxx/shell-command-guard/ci.yml?branch=main&label=CI)](https://github.com/devmaxxx/shell-command-guard/actions/workflows/ci.yml)
-[![types included](https://img.shields.io/npm/types/shell-command-guard)](https://www.npmjs.com/package/shell-command-guard)
+[![npm version](https://img.shields.io/npm/v/shell-guards)](https://www.npmjs.com/package/shell-guards)
+[![npm downloads](https://img.shields.io/npm/dm/shell-guards)](https://www.npmjs.com/package/shell-guards)
+[![CI](https://img.shields.io/github/actions/workflow/status/devmaxxx/shell-guards/ci.yml?branch=main&label=CI)](https://github.com/devmaxxx/shell-guards/actions/workflows/ci.yml)
+[![types included](https://img.shields.io/npm/types/shell-guards)](https://www.npmjs.com/package/shell-guards)
 [![zero dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](./package.json)
-[![bundle size](https://img.shields.io/bundlephobia/minzip/shell-command-guard)](https://bundlephobia.com/package/shell-command-guard)
+[![bundle size](https://img.shields.io/bundlephobia/minzip/shell-guards)](https://bundlephobia.com/package/shell-guards)
 [![license MIT](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)
 
 [Install](#install) · [Quick start](#quick-start) · [API](#api) · [Recipes](#recipes) · [FAQ](#faq) ·
@@ -31,7 +31,13 @@ Sees through `sudo`/`env`/`xargs`/`bash -c`/heredocs/`$(…)` and fails closed 
 - [API](#api)
   - [`deniedBy`](#deniedbycmd-deny) · [`runsCommand`](#runscommandcmd-command) ·
     [`commandSegments`](#commandsegmentscmd) · [`effectiveDeny`](#effectivedenypolicy-extra) ·
-    [`DEFAULT_DENY`](#default_deny) · [`DENY_REASONS`](#deny_reasons)
+    [`DEFAULT_DENY`](#default_deny) · [`DENY_REASONS`](#deny_reasons) ·
+    [`invocations`](#invocationscmd-command)
+- [Authorship](#authorship)
+  - [`authorshipViolations`](#authorshipviolationscmd-options) ·
+    [`authoredMessages`](#authoredmessagescmd) · [`branchNames`](#branchnamescmd) ·
+    [`aiSignatures`](#aisignaturestext) · [`isConventionalCommit`](#isconventionalcommitmessage-types) ·
+    [`isConventionalBranch`](#isconventionalbranchname-types)
 - [Recipes](#recipes)
 - [How it works](#how-it-works)
 - [Comparison](#comparison)
@@ -61,7 +67,7 @@ mention the words.
 | `python3 -c "import os; os.system('git push')"` | allowed | `'git push'` |
 | `grep "git push" notes.md` | allowed (`includes` would block it) | `null` — it only mentions it |
 
-`shell-command-guard` parses the line instead. Quoted strings, comments and quoted here-document bodies are data; every
+`shell-guards` parses the line instead. Quoted strings, comments and quoted here-document bodies are data; every
 command the line could run is checked; and anything it cannot read is denied rather than guessed.
 
 ## Features
@@ -75,6 +81,8 @@ command the line could run is checked; and anything it cannot read is denied rat
   `pnpm exec`, `npm exec`, `yarn exec`, `bun x`, `git -C dir`, and zsh's `=cmd`, `noglob` and `nocorrect`.
 - ⏱️ **Catches commands set up to run later** — `trap '…' EXIT`, `alias`, `git rebase -x`, `git bisect run`,
   `git submodule foreach`, `git filter-branch`, and a pager, editor or ssh command set with `git -c`.
+- ✍️ **Checks what a line writes** — commit messages, `gh pr` text and new branch names, read from `-m`, `--trailer`,
+  `-F -` here-documents and `$(cat <<'EOF' …)`, checked for AI signatures, Conventional Commits and Conventional Branch.
 - 🔒 **Fails closed** — an expansion in command position, unbalanced quoting, a stdin-fed shell or `source`, a script
   file, a `git -c alias.*` or `git config alias.*`, and a line nested deeper than the stack return a reason instead
   of `null` — never a throw.
@@ -89,16 +97,16 @@ command the line could run is checked; and anything it cannot read is denied rat
 ## Install
 
 ```sh
-npm install shell-command-guard
-pnpm add shell-command-guard
-yarn add shell-command-guard
-bun add shell-command-guard
+npm install shell-guards
+pnpm add shell-guards
+yarn add shell-guards
+bun add shell-guards
 ```
 
 ## Quick start
 
 ```ts
-import { DEFAULT_DENY, deniedBy, runsCommand } from 'shell-command-guard'
+import { DEFAULT_DENY, deniedBy, runsCommand } from 'shell-guards'
 
 deniedBy('pnpm test && sudo -u ci git push origin', ['git push']) // 'git push'
 deniedBy('grep "git push" notes.md', ['git push']) // null
@@ -122,6 +130,14 @@ runsCommand('echo "then git commit"', 'git commit') // false
 | [`DEFAULT_DENY`](#default_deny) | `readonly string[]` |
 | [`DENY_REASONS`](#deny_reasons) | `{ expansion, unbalanced, gitAlias, stdinScript, scriptFile }` |
 | `DenyPolicy` (type) | `{ deny: readonly string[] }` |
+| [`invocations`](#invocationscmd-command) | `(cmd: string, command: string \| readonly string[]) => Invocation[]` |
+| [`authorshipViolations`](#authorshipviolationscmd-options) | `(cmd: string, options?: AuthorshipOptions) => string[]` |
+| [`authoredMessages`](#authoredmessagescmd) | `(cmd: string) => AuthoredMessage[]` |
+| [`branchNames`](#branchnamescmd) | `(cmd: string) => (string \| null)[]` |
+| [`aiSignatures`](#aisignaturestext) | `(text: string) => { line: number, text: string }[]` |
+| [`isConventionalCommit`](#isconventionalcommitmessage-types) | `(message: string, types?: readonly string[]) => boolean` |
+| [`isConventionalBranch`](#isconventionalbranchname-types) | `(name: string, types?: readonly string[]) => boolean` |
+| `COMMIT_TYPES`, `BRANCH_TYPES` | `readonly string[]` |
 
 ### `deniedBy(cmd, deny)`
 
@@ -199,6 +215,62 @@ folded away.
 | `stdinScript` | `'shell reads script from stdin'` | a shell runs without `-c` and without a script file (`echo … \| sh`, `bash -s`), `source` reads stdin or a process substitution, or `parallel` reads its commands from stdin |
 | `scriptFile` | `'shell runs a script file'` | a shell runs a script file (`bash deploy.sh`) this reading cannot see |
 
+### `invocations(cmd, command)`
+
+Lists every command a line certainly runs that starts with one of the patterns, read the way `runsCommand` reads it.
+Each entry has the command's words as the shell passes them (wrappers off, quotes removed, `null` for a word that
+depends on what runs) and what it reads on stdin from a here-document or here-string. A word that is one whole
+`$(cat <<'EOF' … EOF)` resolves to the here-document.
+
+```ts
+invocations('sudo git -C repo commit -m "fix: x" <<< y', 'git commit')
+// [{ args: ['git', 'commit', '-m', 'fix: x'], stdin: 'y\n' }]
+```
+
+## Authorship
+
+Checks for what a command line *writes*: commit messages, pull-request text and branch names. Commands are found with
+`invocations`, so a message that only appears in an `echo` or a heredoc body is never read, and one behind `env`,
+`sudo` or `bash -c` always is.
+
+### `authorshipViolations(cmd, options?)`
+
+Returns one line per violation: an AI signature in any `git commit` or `gh pr create|edit|comment|review|merge`
+(message, `--trailer`, title, body or file), a commit subject that is not Conventional Commits, or a new branch that
+is not Conventional Branch. What the line does not show (an editor, `-C HEAD`, `$MSG`) is not a violation. Message
+files are read only through `options.readFile`; `commitTypes` and `branchTypes` replace the defaults.
+
+```ts
+authorshipViolations('git switch -c Fix_Login && git commit -m "fixed it"')
+// ['branch "Fix_Login" is not a Conventional Branch', 'commit subject "fixed it" is not a Conventional Commit']
+```
+
+### `authoredMessages(cmd)`
+
+One `{ kind: 'commit' | 'pull-request', text, file }` per `git commit` or `gh pr …` the line runs. `text` joins
+`-m` paragraphs and `--trailer` lines, or a title and body; it reads `-F -` / `--body-file -` from a here-document.
+`file` names a message file, which is not opened.
+
+### `branchNames(cmd)`
+
+The branches a line creates or renames: `git checkout -b`, `git switch -c`, `git branch <name>`, `git branch -m`,
+`git worktree add -b`, and `git worktree add <path>`, which names its branch after the path.
+
+### `aiSignatures(text)`
+
+The 1-based lines that sign a text as AI-written: a `*-By:` / `*-With:` trailer naming an AI tool, its no-reply
+address, a Claude Code session link, a "Generated with …" footer or a leading 🤖. A tool named in prose does not count.
+
+### `isConventionalCommit(message, types?)`
+
+Whether the first non-comment line is `<type>(<scope>)!: <description>` with a lowercase scope. Subjects git writes
+(`Merge …`, `fixup! …`, `Revert "…"`) pass. Types default to `COMMIT_TYPES`.
+
+### `isConventionalBranch(name, types?)`
+
+Whether a name is `<type>/<description>` in lowercase letters, digits and single hyphens, with dots only in a
+`release/` version. `main`, `master` and `develop` pass. Prefixes default to `BRANCH_TYPES`.
+
 ## Recipes
 
 ### Claude Code (or any AI agent) `PreToolUse` hook
@@ -210,13 +282,13 @@ blocks the call and shows stderr to the model.
 // ~/.claude/hooks/guard.mjs
 import { readFileSync } from 'node:fs'
 import process from 'node:process'
-import { deniedBy, effectiveDeny } from 'shell-command-guard'
+import { deniedBy, effectiveDeny } from 'shell-guards'
 
 const { tool_input: input } = JSON.parse(readFileSync(0, 'utf8'))
 const hit = deniedBy(input.command ?? '', effectiveDeny({ deny: ['gh pr merge'] }))
 
 if (hit) {
-  console.error(`Blocked by shell-command-guard: ${hit}`)
+  console.error(`Blocked by shell-guards: ${hit}`)
   process.exit(2)
 }
 ```
@@ -231,6 +303,33 @@ if (hit) {
 }
 ```
 
+### Authorship hook for an AI agent
+
+Block a commit or pull request that an agent signs, or that breaks Conventional Commits or Conventional Branch.
+
+```js
+// ~/.claude/hooks/authorship.mjs
+import { existsSync, readFileSync } from 'node:fs'
+import process from 'node:process'
+import { authorshipViolations } from 'shell-guards'
+
+const { tool_input: input } = JSON.parse(readFileSync(0, 'utf8'))
+function readFile(path) {
+  try {
+    return existsSync(path) ? readFileSync(path, 'utf8') : null
+  }
+  catch {
+    return null
+  }
+}
+const violations = authorshipViolations(input.command ?? '', { readFile })
+
+if (violations.length > 0) {
+  console.error(`Fix and retry:\n- ${violations.join('\n- ')}`)
+  process.exit(2)
+}
+```
+
 ### Pre-exec / CI guard
 
 Check a command before a bot or pipeline hands it to a shell.
@@ -238,7 +337,7 @@ Check a command before a bot or pipeline hands it to a shell.
 ```js
 // guard.mjs — usage: node guard.mjs "$CMD" && sh -c "$CMD"
 import process from 'node:process'
-import { DEFAULT_DENY, deniedBy } from 'shell-command-guard'
+import { DEFAULT_DENY, deniedBy } from 'shell-guards'
 
 const hit = deniedBy(process.argv[2] ?? '', DEFAULT_DENY)
 
@@ -251,7 +350,7 @@ if (hit) {
 ### Custom deny-list, and checks that apply only to one command
 
 ```ts
-import { deniedBy, effectiveDeny, runsCommand } from 'shell-command-guard'
+import { deniedBy, effectiveDeny, runsCommand } from 'shell-guards'
 
 const deny = effectiveDeny({ deny: ['docker', 'kubectl delete', 'terraform apply'] })
 
@@ -278,7 +377,7 @@ Patterns are word prefixes, so deny the program or subcommand (`'git clean'`) wh
 
 ## Comparison
 
-| | shell-command-guard | [unbash](https://www.npmjs.com/package/unbash) | [shell-quote](https://www.npmjs.com/package/shell-quote) | Naive regex / `startsWith` |
+| | shell-guards | [unbash](https://www.npmjs.com/package/unbash) | [shell-quote](https://www.npmjs.com/package/shell-quote) | Naive regex / `startsWith` |
 | --- | --- | --- | --- | --- |
 | Purpose | decide if a line runs a command | full bash AST parser (no policy) | tokenize and quote argv | — |
 | Quotes and comments are data | ✅ | ✅ | ✅ | ❌ |
@@ -333,7 +432,7 @@ when you only need to know what certainly runs.
 `deniedBy` returns the reason as a string, so you decide which ones to let through:
 
 ```ts
-import { deniedBy, DENY_REASONS } from 'shell-command-guard'
+import { deniedBy, DENY_REASONS } from 'shell-guards'
 
 const hit = deniedBy(cmd, deny)
 const trusted = hit === DENY_REASONS.scriptFile && /^bash scripts\/[\w-]+\.sh$/.test(cmd)
@@ -374,9 +473,9 @@ check each one against the list.
 
 - [ ] More launchers: `setpriv`, `xcrun`, `direnv exec`, `mise exec`, `op run`
 - [ ] Resolve `rm` operands above `~` (`rm -rf ~/..`) against the real home directory
-- [ ] A small CLI for shell hooks and CI: `shell-command-guard --deny 'git push' -- "$CMD"`
+- [ ] A small CLI for shell hooks and CI: `shell-guards --deny 'git push' -- "$CMD"`
 
-Found a bypass or a missing wrapper? [Open an issue](https://github.com/devmaxxx/shell-command-guard/issues).
+Found a bypass or a missing wrapper? [Open an issue](https://github.com/devmaxxx/shell-guards/issues).
 
 ## Contributing
 
diff --git a/assets/demo.svg b/assets/demo.svg
index 2a934c1..400b7a8 100644
--- a/assets/demo.svg
+++ b/assets/demo.svg
@@ -1,4 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="760" height="494" viewBox="0 0 760 494" role="img" aria-label="shell-command-guard demo: deniedBy allows commands that only mention git push and denies the ones that run it through env, bash -c, xargs, quoting, a stdin shell or python">
+<svg xmlns="http://www.w3.org/2000/svg" width="760" height="494" viewBox="0 0 760 494" role="img" aria-label="shell-guards demo: deniedBy allows commands that only mention git push and denies the ones that run it through env, bash -c, xargs, quoting, a stdin shell or python">
 <style>
 text{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,"Liberation Mono",monospace;font-size:14px}
 .fade{animation:fade 23.43s infinite}
@@ -62,7 +62,7 @@ text{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,"Liberation Mono",mo
 <rect x="0.5" y="0.5" width="759" height="493" rx="10" fill="#0d1117" stroke="#30363d"/>
 <path d="M0.5 36 V10.5 a10 10 0 0 1 10 -10 H749.5 a10 10 0 0 1 10 10 V36 Z" fill="#161b22"/>
 <circle cx="20" cy="18" r="6" fill="#ff5f57"/><circle cx="40" cy="18" r="6" fill="#febc2e"/><circle cx="60" cy="18" r="6" fill="#28c840"/>
-<text x="380" y="23" fill="#7d8590" text-anchor="middle">shell-command-guard</text>
+<text x="380" y="23" fill="#7d8590" text-anchor="middle">shell-guards</text>
 <g class="fade">
 <text x="20" y="58" fill="#7d8590">// deniedBy(cmd, DEFAULT_DENY) for each line</text>
 <text class="p0" x="20" y="87" fill="#58a6ff">❯</text>
diff --git a/package.json b/package.json
index 8cda011..a8697e4 100644
--- a/package.json
+++ b/package.json
@@ -1,18 +1,18 @@
 {
-  "name": "shell-command-guard",
+  "name": "shell-guards",
   "type": "module",
   "version": "0.1.0",
   "packageManager": "pnpm@10.23.0",
   "description": "Tell whether a shell command really runs a program — a fail-closed deny-list that sees through quotes, here-documents, $(…), bash -c, env, sudo and xargs",
   "author": "arenuzzz",
   "license": "MIT",
-  "homepage": "https://github.com/devmaxxx/shell-command-guard#readme",
+  "homepage": "https://github.com/devmaxxx/shell-guards#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/devmaxxx/shell-command-guard.git"
+    "url": "git+https://github.com/devmaxxx/shell-guards.git"
   },
   "bugs": {
-    "url": "https://github.com/devmaxxx/shell-command-guard/issues"
+    "url": "https://github.com/devmaxxx/shell-guards/issues"
   },
   "keywords": [
     "shell",
diff --git a/scripts/demo.ts b/scripts/demo.ts
index 9b9320b..bbeafa1 100644
--- a/scripts/demo.ts
+++ b/scripts/demo.ts
@@ -108,7 +108,7 @@ function render(): string {
 
   const dots = [['#ff5f57', 20], ['#febc2e', 40], ['#28c840', 60]] as const
 
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${WIDTH}" height="${height}" viewBox="0 0 ${WIDTH} ${height}" role="img" aria-label="shell-command-guard demo: deniedBy allows commands that only mention git push and denies the ones that run it through env, bash -c, xargs, quoting, a stdin shell or python">
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${WIDTH}" height="${height}" viewBox="0 0 ${WIDTH} ${height}" role="img" aria-label="shell-guards demo: deniedBy allows commands that only mention git push and denies the ones that run it through env, bash -c, xargs, quoting, a stdin shell or python">
 <style>
 text{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,"Liberation Mono",monospace;font-size:${FONT_SIZE}px}
 .fade{animation:fade ${total.toFixed(2)}s infinite}
@@ -119,7 +119,7 @@ ${css.join('\n')}
 <rect x="0.5" y="0.5" width="${WIDTH - 1}" height="${height - 1}" rx="10" fill="${COLORS.window}" stroke="${COLORS.border}"/>
 <path d="M0.5 ${TITLE_BAR} V10.5 a10 10 0 0 1 10 -10 H${WIDTH - 10.5} a10 10 0 0 1 10 10 V${TITLE_BAR} Z" fill="${COLORS.bar}"/>
 ${dots.map(([fill, cx]) => `<circle cx="${cx}" cy="${TITLE_BAR / 2}" r="6" fill="${fill}"/>`).join('')}
-<text x="${WIDTH / 2}" y="${TITLE_BAR / 2 + 5}" fill="${COLORS.muted}" text-anchor="middle">shell-command-guard</text>
+<text x="${WIDTH / 2}" y="${TITLE_BAR / 2 + 5}" fill="${COLORS.muted}" text-anchor="middle">shell-guards</text>
 <g class="fade">
 ${lines.join('\n')}
 </g>
diff --git a/src/authorship.ts b/src/authorship.ts
new file mode 100644
index 0000000..20d4813
--- /dev/null
+++ b/src/authorship.ts
@@ -0,0 +1,637 @@
+import type { Invocation } from './judge'
+import { invocations } from './judge'
+
+/** The Conventional Commits types {@link isConventionalCommit} accepts by default. */
+export const COMMIT_TYPES: readonly string[] = [
+  'feat',
+  'fix',
+  'docs',
+  'style',
+  'refactor',
+  'perf',
+  'test',
+  'build',
+  'ci',
+  'chore',
+  'revert',
+]
+
+/** The Conventional Branch prefixes {@link isConventionalBranch} accepts by default. */
+export const BRANCH_TYPES: readonly string[] = ['feature', 'feat', 'bugfix', 'fix', 'hotfix', 'release', 'chore']
+
+/** A commit message or pull-request text a command line writes, as {@link authoredMessages} reads it. */
+export interface AuthoredMessage {
+  /** `'commit'` for `git commit`; `'pull-request'` for `gh pr create`, `edit`, `comment`, `review` and `merge`. */
+  kind: 'commit' | 'pull-request'
+  /**
+   * The text as the line spells it: the `-m` paragraphs and `--trailer` lines of a commit, or a pull request's title
+   * and body. `null` when it comes from an editor, another commit, a file or an expansion; a commit whose first `-m`
+   * is known but a later one is not keeps the paragraphs before the first unknown one.
+   */
+  text: string | null
+  /** The file the text is read from (`-F path`, `--body-file path`), which this reading does not open. */
+  file: string | null
+}
+
+/** Options for {@link authorshipViolations}. */
+export interface AuthorshipOptions {
+  /** Reads a message file named on the line; return `null` when it cannot be read. Without it, files are skipped. */
+  readFile?: (path: string) => string | null
+  commitTypes?: readonly string[]
+  branchTypes?: readonly string[]
+}
+
+const TOOLS = '(?:Claude|Copilot|Codex|Cursor|Gemini|ChatGPT|GPT|OpenAI|Anthropic|AI)'
+
+// Only signatures count: a tool's name in prose is content, while a trailer or footer changes who a host shows as
+// the author of a commit, pull request or document.
+const SIGNATURES: readonly RegExp[] = [
+  new RegExp(`^\\s*[\\w-]+-(?:By|With):.*\\b${TOOLS}\\b`, 'i'),
+  /noreply@anthropic\.com|copilot@github\.com/i,
+  /^\s*Claude-Session:|claude\.ai\/code\/session_/i,
+  new RegExp(`^\\W*Generated (?:with|by) \\[?${TOOLS}\\b`, 'i'),
+  new RegExp(
+    `^\\W*(?:written|created|authored|drafted|made|built|produced|generated) (?:with|by|using) (?:an? )?${TOOLS}\\b`,
+    'i',
+  ),
+  /^\s*🤖/u,
+]
+
+// Git writes these subjects itself, so they pass whatever the convention.
+const GENERATED_SUBJECT = /^(?:Merge |fixup! |squash! |amend! |Revert ")/
+const TRUNKS = new Set(['main', 'master', 'develop'])
+
+interface OptionSpec {
+  // Short letters that take a value, attached or in the next word.
+  short: string
+  // Short letters whose value is only ever attached (`-uno`).
+  attached?: string
+  long: readonly string[]
+  // Long options whose value is only ever given with `=`.
+  optionalLong?: readonly string[]
+  flags: readonly string[]
+  // Git takes any unambiguous prefix of a long option; gh's flag library does not.
+  abbrev?: boolean
+}
+
+interface Parsed {
+  options: [string, string | null][]
+  operands: (string | null)[]
+  // An option this reading cannot place, so what follows it may be misread.
+  unknown: boolean
+}
+
+const GIT_COMMIT: OptionSpec = {
+  short: 'mFCct',
+  attached: 'uS',
+  long: [
+    'message',
+    'file',
+    'reuse-message',
+    'reedit-message',
+    'fixup',
+    'squash',
+    'author',
+    'date',
+    'template',
+    'trailer',
+    'cleanup',
+    'pathspec-from-file',
+  ],
+  optionalLong: ['untracked-files', 'gpg-sign'],
+  flags: [
+    'all',
+    'patch',
+    'reset-author',
+    'short',
+    'branch',
+    'porcelain',
+    'long',
+    'null',
+    'signoff',
+    'verify',
+    'allow-empty',
+    'allow-empty-message',
+    'edit',
+    'amend',
+    'post-rewrite',
+    'include',
+    'only',
+    'pathspec-file-nul',
+    'verbose',
+    'quiet',
+    'dry-run',
+    'status',
+    'interactive',
+    'ahead-behind',
+  ],
+  abbrev: true,
+}
+
+const GH_PR: Readonly<Record<string, OptionSpec>> = {
+  create: {
+    short: 'tbFBHalmprRT',
+    long: [
+      'title',
+      'body',
+      'body-file',
+      'base',
+      'head',
+      'assignee',
+      'label',
+      'milestone',
+      'project',
+      'reviewer',
+      'repo',
+      'template',
+      'recover',
+    ],
+    flags: ['draft', 'fill', 'fill-first', 'fill-verbose', 'web', 'dry-run', 'no-maintainer-edit', 'editor'],
+  },
+  edit: {
+    short: 'tbFBmR',
+    long: [
+      'title',
+      'body',
+      'body-file',
+      'base',
+      'milestone',
+      'repo',
+      'add-label',
+      'remove-label',
+      'add-assignee',
+      'remove-assignee',
+      'add-reviewer',
+      'remove-reviewer',
+      'add-project',
+      'remove-project',
+    ],
+    flags: ['remove-milestone'],
+  },
+  comment: {
+    short: 'bFR',
+    long: ['body', 'body-file', 'repo'],
+    flags: ['editor', 'web', 'edit-last', 'delete-last', 'yes', 'create-if-none'],
+  },
+  review: {
+    short: 'bFR',
+    long: ['body', 'body-file', 'repo'],
+    flags: ['approve', 'request-changes', 'comment'],
+  },
+  merge: {
+    short: 'tbFAR',
+    long: ['subject', 'body', 'body-file', 'author-email', 'match-head-commit', 'repo'],
+    flags: ['admin', 'auto', 'delete-branch', 'disable-auto', 'merge', 'rebase', 'squash'],
+  },
+}
+
+const GIT_CHECKOUT: OptionSpec = {
+  short: 'bB',
+  long: ['orphan', 'conflict', 'pathspec-from-file'],
+  optionalLong: ['track', 'recurse-submodules'],
+  flags: [
+    'quiet',
+    'progress',
+    'force',
+    'ours',
+    'theirs',
+    'merge',
+    'detach',
+    'guess',
+    'overlay',
+    'ignore-skip-worktree-bits',
+    'ignore-other-worktrees',
+    'overwrite-ignore',
+    'patch',
+    'pathspec-file-nul',
+  ],
+  abbrev: true,
+}
+
+const GIT_SWITCH: OptionSpec = {
+  short: 'cC',
+  long: ['create', 'force-create', 'orphan', 'conflict'],
+  optionalLong: ['track', 'recurse-submodules'],
+  flags: ['detach', 'guess', 'discard-changes', 'merge', 'quiet', 'progress', 'force', 'ignore-other-worktrees'],
+  abbrev: true,
+}
+
+const GIT_BRANCH: OptionSpec = {
+  short: 'u',
+  attached: 't',
+  long: ['set-upstream-to', 'sort', 'format', 'points-at'],
+  optionalLong: ['track', 'contains', 'no-contains', 'merged', 'no-merged', 'abbrev', 'color', 'column'],
+  flags: [
+    'delete',
+    'create-reflog',
+    'force',
+    'move',
+    'copy',
+    'list',
+    'all',
+    'remotes',
+    'show-current',
+    'verbose',
+    'quiet',
+    'ignore-case',
+    'unset-upstream',
+    'edit-description',
+    'omit-empty',
+    'recurse-submodules',
+  ],
+  abbrev: true,
+}
+
+const GIT_WORKTREE_ADD: OptionSpec = {
+  short: 'bB',
+  long: ['reason'],
+  flags: ['force', 'detach', 'checkout', 'lock', 'orphan', 'quiet', 'track', 'guess-remote', 'relative-paths'],
+  abbrev: true,
+}
+
+// `git branch` only lists, deletes or configures with any of these, and then names no new branch.
+const BRANCH_NOT_CREATING = new Set([
+  '-d',
+  '-D',
+  '--delete',
+  '-l',
+  '--list',
+  '-a',
+  '--all',
+  '-r',
+  '--remotes',
+  '-v',
+  '--verbose',
+  '--show-current',
+  '--contains',
+  '--no-contains',
+  '--merged',
+  '--no-merged',
+  '--points-at',
+  '-u',
+  '--set-upstream-to',
+  '--unset-upstream',
+  '--edit-description',
+])
+const BRANCH_RENAMING = new Set(['-m', '-M', '--move', '-c', '-C', '--copy'])
+
+function resolveLong(given: string, spec: OptionSpec): string | null {
+  const all = [...spec.long, ...(spec.optionalLong ?? []), ...spec.flags]
+
+  if (all.includes(given)) {
+    return given
+  }
+
+  // Git takes `--no-<flag>` for most flags; the value-taking ones do not matter once negated.
+  if (given.startsWith('no-') && all.includes(given.slice(3))) {
+    return given
+  }
+
+  if (!spec.abbrev) {
+    return null
+  }
+
+  const candidates = all.filter(name => name.startsWith(given))
+  return candidates.length === 1 ? (candidates[0] ?? null) : null
+}
+
+function parseOptions(args: readonly (string | null)[], spec: OptionSpec): Parsed {
+  const parsed: Parsed = { options: [], operands: [], unknown: false }
+  let options = true
+
+  for (let i = 0; i < args.length; i++) {
+    const t = args[i] ?? null
+
+    if (t === null) {
+      // An expansion could be an option as well as an operand.
+      parsed.unknown ||= options
+      parsed.operands.push(null)
+    }
+    else if (!options || !t.startsWith('-') || t === '-') {
+      parsed.operands.push(t)
+    }
+    else if (t === '--') {
+      options = false
+    }
+    else if (t.startsWith('--')) {
+      const eq = t.indexOf('=')
+      const name = resolveLong(eq < 0 ? t.slice(2) : t.slice(2, eq), spec)
+
+      if (name === null) {
+        parsed.unknown = true
+        continue
+      }
+
+      const takesNext = spec.long.includes(name) && eq < 0
+      const value = eq >= 0 ? t.slice(eq + 1) : takesNext ? (args[++i] ?? null) : null
+      parsed.options.push([`--${name}`, value])
+    }
+    else {
+      i = parseCluster(args, i, spec, parsed)
+    }
+  }
+
+  return parsed
+}
+
+// In a cluster such as `-am msg` the first letter that takes a value consumes the rest of the word, or the next word.
+function parseCluster(args: readonly (string | null)[], at: number, spec: OptionSpec, parsed: Parsed): number {
+  const t = args[at] ?? ''
+
+  for (let j = 1; j < t.length; j++) {
+    const letter = t.charAt(j)
+    const rest = t.slice(j + 1)
+
+    if (spec.short.includes(letter)) {
+      parsed.options.push([`-${letter}`, rest === '' ? (args[at + 1] ?? null) : rest])
+      return rest === '' ? at + 1 : at
+    }
+
+    if (spec.attached?.includes(letter)) {
+      parsed.options.push([`-${letter}`, rest === '' ? null : rest])
+      return at
+    }
+
+    parsed.options.push([`-${letter}`, null])
+  }
+
+  return at
+}
+
+function values(parsed: Parsed, ...names: string[]): (string | null)[] {
+  return parsed.options.filter(([name]) => names.includes(name)).map(([, value]) => value)
+}
+
+function knownAll(items: (string | null)[]): items is string[] {
+  return items.every(item => item !== null)
+}
+
+// Git joins `-m` values as paragraphs and appends `--trailer` lines as one block after them.
+function commitMessage(inv: Invocation): AuthoredMessage {
+  const parsed = parseOptions(inv.args.slice(2), GIT_COMMIT)
+  const paragraphs = values(parsed, '-m', '--message')
+  const file = values(parsed, '-F', '--file').at(-1)
+  const trailers = values(parsed, '--trailer').filter(t => t !== null)
+  const unread: AuthoredMessage = { kind: 'commit', text: null, file: null }
+
+  if (parsed.unknown) {
+    return unread
+  }
+
+  let text: string | null = null
+
+  if (paragraphs.length > 0) {
+    // The subject is the first paragraph, so it stays checkable when a later one comes from an expansion.
+    const unknownAt = paragraphs.indexOf(null)
+    const known = unknownAt < 0 ? paragraphs : paragraphs.slice(0, unknownAt)
+    text = known.length > 0 ? known.join('\n\n') : null
+  }
+  else if (file === '-') {
+    text = inv.stdin
+  }
+  else if (file !== undefined) {
+    return { ...unread, file }
+  }
+
+  if (text === null || trailers.length === 0) {
+    return { ...unread, text }
+  }
+
+  return { ...unread, text: `${text.replace(/\n+$/, '')}\n\n${trailers.join('\n')}` }
+}
+
+function pullRequestMessage(inv: Invocation): AuthoredMessage {
+  const subcommand = inv.args[2] ?? ''
+  const spec = Object.hasOwn(GH_PR, subcommand) ? GH_PR[subcommand] : undefined
+  const unread: AuthoredMessage = { kind: 'pull-request', text: null, file: null }
+
+  if (spec === undefined) {
+    return unread
+  }
+
+  const parsed = parseOptions(inv.args.slice(3), spec)
+  const titles = values(parsed, '-t', '--title', '--subject')
+  const bodies = values(parsed, '-b', '--body')
+  const file = values(parsed, '-F', '--body-file').at(-1)
+
+  if (parsed.unknown || !knownAll(titles) || !knownAll(bodies)) {
+    return unread
+  }
+
+  if (file !== undefined && file !== '-') {
+    return { ...unread, file }
+  }
+
+  const body = file === '-' ? inv.stdin : bodies.at(-1)
+  const parts = [titles.at(-1), body].filter(part => part !== undefined)
+
+  if (body === null || parts.length === 0) {
+    return unread
+  }
+
+  return { ...unread, text: parts.join('\n\n') }
+}
+
+const COMMIT_PATTERN = 'git commit'
+const PR_PATTERNS = ['create', 'edit', 'comment', 'review', 'merge'].map(sub => `gh pr ${sub}`)
+
+function readMessages(cmd: string): { message: AuthoredMessage, inv: Invocation }[] {
+  return invocations(cmd, [COMMIT_PATTERN, ...PR_PATTERNS]).map(inv => ({
+    message: inv.args[0] === 'git' ? commitMessage(inv) : pullRequestMessage(inv),
+    inv,
+  }))
+}
+
+/**
+ * Reads the commit messages and pull-request texts a command line writes: what `git commit` takes from `-m`, `-F -`
+ * fed by a here-document or here-string, `-m "$(cat <<'EOF' … EOF)"` and `--trailer`, and what `gh pr create`,
+ * `edit`, `comment`, `review` and `merge` take from `--title`, `--subject`, `--body` and `--body-file`.
+ *
+ * Commands are found the way {@link runsCommand} finds them, through wrappers and nested scripts, so a message that
+ * only appears in an `echo` is not read.
+ *
+ * @param cmd - The command line, as a shell would receive it.
+ * @returns One entry per `git commit` or `gh pr …` the line runs, in source order.
+ *
+ * @example
+ * authoredMessages('git commit -m "fix: tidy" --trailer "Refs: #12"')
+ * // [{ kind: 'commit', text: 'fix: tidy\n\nRefs: #12', file: null }]
+ */
+export function authoredMessages(cmd: string): AuthoredMessage[] {
+  return readMessages(cmd).map(({ message }) => message)
+}
+
+function newBranches(inv: Invocation): (string | null)[] {
+  const [, subcommand] = inv.args
+
+  switch (subcommand) {
+    case 'checkout':
+      return values(parseOptions(inv.args.slice(2), GIT_CHECKOUT), '-b', '-B', '--orphan')
+    case 'switch':
+      return values(parseOptions(inv.args.slice(2), GIT_SWITCH), '-c', '-C', '--create', '--force-create', '--orphan')
+    case 'worktree':
+      return worktreeBranch(parseOptions(inv.args.slice(3), GIT_WORKTREE_ADD))
+    default:
+      return branchCommandBranch(parseOptions(inv.args.slice(2), GIT_BRANCH))
+  }
+}
+
+// Without `-b` or a commit to check out, `git worktree add <path>` creates a branch named after the path.
+function worktreeBranch(parsed: Parsed): (string | null)[] {
+  const named = values(parsed, '-b', '-B')
+
+  if (named.length > 0 || parsed.options.some(([name]) => name === '--detach' || name === '-d')) {
+    return named
+  }
+
+  const [path, commit] = parsed.operands
+
+  if (path === undefined || commit !== undefined) {
+    return []
+  }
+
+  return [path === null ? null : (path.replace(/\/+$/, '').split('/').at(-1) ?? null)]
+}
+
+// `git branch <name>` creates, `git branch -m [<old>] <new>` renames or copies, and every listing option names none.
+function branchCommandBranch(parsed: Parsed): (string | null)[] {
+  const names = parsed.options.map(([name]) => name)
+
+  if (names.some(name => BRANCH_NOT_CREATING.has(name))) {
+    return []
+  }
+
+  if (names.some(name => BRANCH_RENAMING.has(name))) {
+    return parsed.operands.slice(-1)
+  }
+
+  return parsed.operands.slice(0, 1)
+}
+
+/**
+ * Lists the branches a command line creates or renames: `git checkout -b`, `git switch -c`, `git branch <name>`,
+ * `git branch -m [<old>] <new>`, `git worktree add -b` and `git worktree add <path>`, which names its branch after
+ * the path.
+ *
+ * @param cmd - The command line, as a shell would receive it.
+ * @returns Each new branch name in source order; `null` for one that comes from an expansion.
+ *
+ * @example
+ * branchNames('git switch -c feat/login && git branch -m feat/login feat/sign-in') // ['feat/login', 'feat/sign-in']
+ */
+export function branchNames(cmd: string): (string | null)[] {
+  return invocations(cmd, ['git checkout', 'git switch', 'git branch', 'git worktree add']).flatMap(newBranches)
+}
+
+/**
+ * Finds the lines of a text that sign it as written by an AI tool: a `Co-Authored-By:`, `Generated-By:` or other
+ * `*-By:` / `*-With:` trailer naming one, an AI tool's no-reply address, a Claude Code session link, a "Generated with
+ * …" footer, or a leading robot emoji. A tool's name in prose is content and is not matched.
+ *
+ * @param text - A commit message, pull-request body, comment or document.
+ * @returns Each signing line, 1-based, trimmed.
+ *
+ * @example
+ * aiSignatures('fix: tidy\n\nCo-Authored-By: Claude <noreply@anthropic.com>')
+ * // [{ line: 3, text: 'Co-Authored-By: Claude <noreply@anthropic.com>' }]
+ */
+export function aiSignatures(text: string): { line: number, text: string }[] {
+  return text
+    .split('\n')
+    .map((line, i) => ({ line: i + 1, text: line.trim() }))
+    .filter(({ text }) => SIGNATURES.some(re => re.test(text)))
+}
+
+// Git drops `#` lines from a message it cleans up, so the subject is the first line left.
+function subjectOf(message: string): string {
+  return message.split('\n').find(line => line.trim() !== '' && !line.startsWith('#')) ?? ''
+}
+
+/**
+ * Tells whether a commit message's subject follows Conventional Commits: `<type>(<scope>)!: <description>` with a
+ * lowercase scope. The subject is the first line that is neither blank nor a `#` comment. Subjects git writes itself
+ * (`Merge …`, `fixup! …`, `squash! …`, `amend! …`, `Revert "…"`) pass.
+ *
+ * @param message - The whole message or only its subject.
+ * @param types - The accepted types; {@link COMMIT_TYPES} by default.
+ *
+ * @example
+ * isConventionalCommit('feat(api)!: drop v1 routes') // true
+ * isConventionalCommit('Fixed the thing') // false
+ */
+export function isConventionalCommit(message: string, types: readonly string[] = COMMIT_TYPES): boolean {
+  const subject = subjectOf(message)
+  const alternatives = types.map(type => type.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')
+  const pattern = new RegExp(`^(?:${alternatives})(?:\\([a-z0-9][a-z0-9._/-]*\\))?!?: \\S`)
+
+  return GENERATED_SUBJECT.test(subject) || pattern.test(subject)
+}
+
+/**
+ * Tells whether a branch name follows Conventional Branch: `<type>/<description>`, lowercase letters, digits and
+ * single hyphens, with dots allowed only in a `release/` version. `main`, `master` and `develop` pass.
+ *
+ * @param name - The branch name.
+ * @param types - The accepted prefixes; {@link BRANCH_TYPES} by default.
+ *
+ * @example
+ * isConventionalBranch('feat/add-login') // true
+ * isConventionalBranch('release/v1.2.0') // true
+ * isConventionalBranch('Feature/Add_Login') // false
+ */
+export function isConventionalBranch(name: string, types: readonly string[] = BRANCH_TYPES): boolean {
+  if (TRUNKS.has(name)) {
+    return true
+  }
+
+  const slash = name.indexOf('/')
+  const type = name.slice(0, slash)
+  const description = name.slice(slash + 1)
+  const words = type === 'release' ? /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/ : /^[a-z0-9]+(?:-[a-z0-9]+)*$/
+
+  return slash > 0 && types.includes(type) && words.test(description)
+}
+
+/**
+ * Checks what a command line authors against the authorship conventions: no AI signature in any commit message,
+ * pull-request text or other word of those commands, a Conventional Commits subject on every commit, and a
+ * Conventional Branch name on every branch it creates.
+ *
+ * Only what the line shows is checked: a message from an editor, another commit or an expansion, and a branch name
+ * from an expansion, are not violations. A message file is read only through `options.readFile`.
+ *
+ * @param cmd - The command line, as a shell would receive it.
+ * @param options - How to read message files, and the commit types and branch prefixes to accept.
+ * @returns One line per violation, empty when there are none.
+ *
+ * @example
+ * authorshipViolations('git switch -c Fix_Login && git commit -m "fixed it"')
+ * // ['branch "Fix_Login" is not a Conventional Branch', 'commit subject "fixed it" is not a Conventional Commit']
+ */
+export function authorshipViolations(cmd: string, options: AuthorshipOptions = {}): string[] {
+  const violations = new Set<string>()
+
+  for (const name of branchNames(cmd)) {
+    if (name !== null && !isConventionalBranch(name, options.branchTypes)) {
+      violations.add(`branch "${name}" is not a Conventional Branch`)
+    }
+  }
+
+  for (const { message, inv } of readMessages(cmd)) {
+    const fromFile = message.file !== null && options.readFile ? options.readFile(message.file) : null
+    const body = message.text ?? fromFile
+    // `--trailer=…`, `-b"…"` and `--body=…` glue a message to its flag, which hides a signature from a line anchor, so
+    // the parsed text is scanned as well as the raw words.
+    const words = [...inv.args, message.text, inv.stdin, fromFile].filter(word => word !== null)
+
+    for (const { text } of aiSignatures(words.join('\n'))) {
+      violations.add(`AI signature: "${text}"`)
+    }
+
+    if (message.kind === 'commit' && body !== null && !isConventionalCommit(body, options.commitTypes)) {
+      violations.add(`commit subject "${subjectOf(body)}" is not a Conventional Commit`)
+    }
+  }
+
+  return [...violations]
+}
diff --git a/src/index.ts b/src/index.ts
index 55ef8d1..7453e76 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,4 +1,15 @@
+export {
+  aiSignatures,
+  authoredMessages,
+  authorshipViolations,
+  BRANCH_TYPES,
+  branchNames,
+  COMMIT_TYPES,
+  isConventionalBranch,
+  isConventionalCommit,
+} from './authorship'
+export type { AuthoredMessage, AuthorshipOptions } from './authorship'
 export { DEFAULT_DENY } from './defaults'
-export { deniedBy, DENY_REASONS, effectiveDeny, runsCommand } from './judge'
-export type { DenyPolicy } from './judge'
+export { deniedBy, DENY_REASONS, effectiveDeny, invocations, runsCommand } from './judge'
+export type { DenyPolicy, Invocation } from './judge'
 export { commandSegments } from './segments'
diff --git a/src/judge.ts b/src/judge.ts
index 183e3d2..2daf808 100644
--- a/src/judge.ts
+++ b/src/judge.ts
@@ -1,6 +1,6 @@
-import type { Mode } from './types'
+import type { Found, Mode } from './types'
 import { DEFAULT_DENY } from './defaults'
-import { ASSIGNMENT_WORD, LEADING_ASSIGNMENTS, read, READINGS, tokenize } from './segments'
+import { ASSIGNMENT_WORD, BASH, LEADING_ASSIGNMENTS, read, READINGS, resolveWord, stdinOf, tokenize, words } from './segments'
 import { EXP, GLOB } from './word-reader'
 import {
   AWK_OPTS,
@@ -48,19 +48,41 @@ export interface DenyPolicy {
   deny: readonly string[]
 }
 
+/** A command a line certainly runs, as {@link invocations} finds it. */
+export interface Invocation {
+  /**
+   * The words of the command from its program name on, as the shell passes them, with wrappers such as `sudo`, `env`
+   * or `git -C dir` taken off. A word whose text depends on what runs (`$VAR`, most `$(…)`) is `null`.
+   */
+  args: (string | null)[]
+  /** What the command reads on stdin from a here-document or here-string; `null` when that is unknown or absent. */
+  stdin: string | null
+}
+
+// What `invocations` gathers for each match before its words are resolved.
+interface Collected {
+  tokens: string[]
+  stdin: string | null
+}
+
 // `strict` is enforcement: every shell's reading and a quote-blind pass are matched, a pattern an expansion could
 // still complete counts, and a command that cannot be read is denied. Otherwise only what the bash reading shows
-// certainly running counts. `gitAliasEnv` is inherited by every command started under that environment.
+// certainly running counts. `gitAliasEnv` is inherited by every command started under that environment. With
+// `collect`, every certain match is recorded and the reading goes on; `stdin` is what the command being matched
+// reads, and `subs` the $(…) sources of the line and of every script nested in it.
 interface Judge {
   patterns: readonly string[]
   strict: boolean
   gitAliasEnv?: boolean
+  collect?: Collected[]
+  stdin?: string | null
+  subs?: string[]
 }
 
 // What taking one wrapper off leaves: the command it runs, or the final answer.
 type Next = { tokens: string[] } | { verdict: string | null }
 
-const BASH_READING: readonly Mode[] = [{ comments: true, heredocs: 'on' }]
+const BASH_READING: readonly Mode[] = [BASH]
 
 const KEYWORDS = new Set(['!', '{', '}', 'if', 'then', 'do', 'else', 'elif', 'while', 'until'])
 const PARALLEL_SEPARATOR = /^:{3,4}\+?$/
@@ -173,6 +195,11 @@ function matchTokens(start: string[], outer: Judge, depth: number): string | nul
 
     const hit = match(tokens, judge)
 
+    if (hit && judge.collect) {
+      judge.collect.push({ tokens, stdin: judge.stdin ?? null })
+      return null
+    }
+
     if (hit) {
       return hit
     }
@@ -781,20 +808,32 @@ function quoteBlindMatch(cmd: string, judge: Judge): string | null {
 // Under `strict` every reading is matched, so a command only one shell's reading sees is still caught. The scanner
 // gets raw text, because a backslash-newline inside a quoted here-document is data, not a continuation.
 function judgeCommand(cmd: string, judge: Judge, depth: number): string | null {
-  const segments = new Set<string>()
+  const segments = new Map<string, Found>()
+  const subs = judge.subs ?? []
   let complete = false
 
   for (const mode of judge.strict ? READINGS : BASH_READING) {
-    const r = read(cmd, mode)
+    const r = read(cmd, mode, subs)
     complete ||= r.complete
 
-    for (const seg of r.segments) {
-      segments.add(seg)
+    // Readings are merged by text; the one reading `collect` takes keeps two equal commands apart.
+    for (const found of r.found) {
+      const key = judge.collect ? `${found.start}` : found.text
+
+      if (!segments.has(key)) {
+        segments.set(key, found)
+      }
     }
   }
 
-  for (const seg of segments) {
-    const hit = matchTokens(tokenize(seg), judge, depth)
+  // A nested script made of one command reads the stdin of the wrapper that runs it.
+  const commands = [...segments.values()].filter(f => f.text.trim() !== '')
+  const inherited = commands.length === 1 ? (judge.stdin ?? null) : null
+
+  for (const found of commands) {
+    const { tokens, hereString } = words(found.text)
+    const stdin = judge.collect ? (stdinOf(found, hereString, subs) ?? inherited) : null
+    const hit = matchTokens(tokens, judge.collect ? { ...judge, subs, stdin } : judge, depth)
 
     if (hit) {
       return hit
@@ -867,3 +906,27 @@ export function runsCommand(cmd: string, command: string | readonly string[]): b
 export function effectiveDeny(policy: DenyPolicy, extra: readonly string[] = []): string[] {
   return [...DEFAULT_DENY, ...policy.deny, ...extra]
 }
+
+/**
+ * Lists every command a line certainly runs that starts with one of the given word-prefix patterns, with its words as
+ * the shell passes them and what it reads from a here-document or here-string.
+ *
+ * It reads the line the way {@link runsCommand} does: through the same wrappers and substitutions, as bash would,
+ * never guessing. A command whose program name comes from an expansion is not listed.
+ *
+ * @param cmd - The command line, as a shell would receive it.
+ * @param command - One word-prefix pattern (`'git commit'`) or a list of them.
+ * @returns The matching commands in source order, each with its words and stdin.
+ *
+ * @example
+ * invocations('sudo git -C repo commit -m "fix: x" <<< y', 'git commit')
+ * // [{ args: ['git', 'commit', '-m', 'fix: x'], stdin: 'y\n' }]
+ */
+export function invocations(cmd: string, command: string | readonly string[]): Invocation[] {
+  const collect: Collected[] = []
+  const subs: string[] = []
+  const patterns = typeof command === 'string' ? [command] : command
+
+  judgeCommand(cmd, { patterns, strict: false, collect, subs }, 0)
+  return collect.map(({ tokens, stdin }) => ({ args: tokens.map(t => resolveWord(t, subs)), stdin }))
+}
diff --git a/src/segments.ts b/src/segments.ts
index 2ba60a8..07a4a1f 100644
--- a/src/segments.ts
+++ b/src/segments.ts
@@ -1,6 +1,6 @@
-import type { Found, Mode } from './types'
+import type { Found, Mode, Sink } from './types'
 import { Reader } from './shell-reader'
-import { EXP, GLOB, Unreadable } from './word-reader'
+import { EXP, GLOB, SUB, Unreadable } from './word-reader'
 
 // A quoted or escaped value may hold blanks, so the leading assignments are matched as shell words, not as `\S*`.
 const ASSIGNMENT_VALUE = String.raw`(?:[^\s'"\\]|\\[\s\S]|'[^']*'|"(?:[^"\\]|\\[\s\S])*")*`
@@ -10,16 +10,26 @@ export const LEADING_ASSIGNMENTS: RegExp = new RegExp(
 )
 export const ASSIGNMENT_WORD: RegExp = /^[A-Z_]\w*(?:\[[^\]]*\])?\+?=/i
 
+export const BASH: Mode = { comments: true, heredocs: 'on' }
+
 export const READINGS: readonly Mode[] = [true, false].flatMap(comments =>
   (['on', 'bash32', 'off'] as const).map(heredocs => ({ comments, heredocs })),
 )
 
-export function read(cmd: string, mode: Mode): { segments: string[], complete: boolean } {
-  const found: Found[] = []
+// What a $(…) leaves in a segment: its `EXP`, then the index of its source between two `SUB`s.
+export const SUBSTITUTION: RegExp = new RegExp(`${EXP}${SUB}(\\d+)${SUB}`, 'g')
+
+// `subs` is shared with the readings of any script nested in this one, so an index stays valid across them.
+export function read(
+  cmd: string,
+  mode: Mode,
+  subs: string[] = [],
+): { segments: string[], found: Found[], complete: boolean } {
+  const sink: Sink = { found: [], subs }
   let complete = true
 
   try {
-    new Reader(cmd, mode, 0, found).commands(0, false)
+    new Reader(cmd, mode, 0, sink).commands(0, false)
   }
   catch (e) {
     // A line nested deeper than the stack allows cannot be read either, and a throw would let a caller that fails
@@ -31,7 +41,8 @@ export function read(cmd: string, mode: Mode): { segments: string[], complete: b
     complete = false
   }
 
-  return { segments: found.toSorted((a, b) => a.start - b.start).map(f => f.text), complete }
+  const found = sink.found.toSorted((a, b) => a.start - b.start)
+  return { segments: found.map(f => f.text), found, complete }
 }
 
 /**
@@ -46,10 +57,11 @@ export function read(cmd: string, mode: Mode): { segments: string[], complete: b
  * commandSegments('FOO=1 pnpm lint && echo $(gh pr list) | cat') // ['pnpm lint', 'echo', 'gh pr list', 'cat']
  */
 export function commandSegments(cmd: string): string[] {
-  return read(cmd, { comments: true, heredocs: 'on' })
+  return read(cmd, BASH)
     .segments
     .map(s =>
       s
+        .replace(SUBSTITUTION, '')
         .replaceAll(EXP, '')
         .trim()
         .replace(LEADING_ASSIGNMENTS, '')
@@ -63,18 +75,29 @@ const BRACE_EXPANSION = /^\{[^\s,]*,\S*\}|^\{[^\s,.]*\.\.\S*\}/
 const GLOB_START = /^(?:[*?]|\[\S+\])/
 
 export function tokenize(seg: string): string[] {
+  return words(seg).tokens
+}
+
+// The words of a segment, and the word a `<<<` here-string feeds it, which a redirection would otherwise drop.
+export function words(seg: string): { tokens: string[], hereString: string | null } {
   const tokens: string[] = []
+  let hereString: string | null = null
   let cur: string | null = null
   let q: '"' | '\'' | null = null
   let dropNext = false
+  let takeNext = false
 
   function end(): void {
-    if (cur !== null && !dropNext) {
+    if (cur !== null && takeNext) {
+      hereString = cur
+    }
+    else if (cur !== null && !dropNext) {
       tokens.push(cur)
     }
 
     if (cur !== null) {
       dropNext = false
+      takeNext = false
     }
 
     cur = null
@@ -124,12 +147,14 @@ export function tokenize(seg: string): string[] {
       }
 
       end()
+      const op = i
 
       while ('<>&|'.includes(seg[i + 1] ?? ' ')) {
         i++
       }
 
-      dropNext = true
+      takeNext = seg.slice(op, i + 1) === '<<<'
+      dropNext = !takeNext
     }
     else {
       cur = (cur ?? '') + c
@@ -137,5 +162,53 @@ export function tokenize(seg: string): string[] {
   }
 
   end()
-  return tokens
+  return { tokens, hereString }
+}
+
+// A word's text once the shell has expanded it, or null when that depends on what runs. A word that is one whole
+// $(…) is known when the substitution only prints a here-document or here-string, the way a message is passed in
+// `-m "$(cat <<'EOF' … EOF)"`; like any substitution it loses its trailing newlines.
+export function resolveWord(word: string, subs: readonly string[]): string | null {
+  const whole = new RegExp(`^${SUBSTITUTION.source}$`).exec(word)
+
+  if (whole) {
+    const output = substitutionOutput(subs[Number(whole[1])] ?? '')
+    return output === null ? null : output.replace(/\n+$/, '')
+  }
+
+  return word.includes(EXP) ? null : word.replaceAll(GLOB, '')
+}
+
+function substitutionOutput(source: string): string | null {
+  const subs: string[] = []
+  const { found, complete } = read(source, BASH, subs)
+  const commands = found.filter(f => f.text.trim() !== '')
+  const only = commands[0]
+
+  if (!complete || commands.length !== 1 || only === undefined) {
+    return null
+  }
+
+  const { tokens, hereString } = words(only.text)
+
+  if (tokens[0] !== 'cat' || tokens.slice(1).some(t => t !== '-')) {
+    return null
+  }
+
+  return stdinOf(only, hereString, subs) ?? null
+}
+
+// What a command reads on stdin from its own redirections: a here-document body, or a here-string's word and the
+// newline the shell adds. `undefined` when it has neither, null when it has one whose text is unknown.
+export function stdinOf(found: Found, hereString: string | null, subs: readonly string[]): string | null | undefined {
+  if (found.stdin !== undefined) {
+    return found.stdin
+  }
+
+  if (hereString === null) {
+    return undefined
+  }
+
+  const text = resolveWord(hereString, subs)
+  return text === null ? null : `${text}\n`
 }
diff --git a/src/shell-reader.ts b/src/shell-reader.ts
index 284a643..101c7dd 100644
--- a/src/shell-reader.ts
+++ b/src/shell-reader.ts
@@ -1,5 +1,5 @@
-import type { Doc, Found, Mode } from './types'
-import { EXP, Unreadable, WordReader } from './word-reader'
+import type { Doc, Found, Mode, Sink } from './types'
+import { EXP, SUB, Unreadable, WordReader } from './word-reader'
 
 const KEYWORD = String.raw`(?:!|\{|if|then|do|else|elif|while|until|time)[ \t]+`
 // `((` starts arithmetic, and `case` a pattern list, only where a command starts.
@@ -94,6 +94,13 @@ function doubleQuotedDelim(s: string, from: number): [number, string] {
   throw new Unreadable()
 }
 
+// What a command reads from its here-document. An unquoted body expands `$`, backquotes and backslashes, so its text
+// is known only when it holds none of them.
+function bodyText(body: string, doc: Doc): string | null {
+  const text = doc.strip ? body.replace(/^\t+/gm, '') : body
+  return doc.quoted || !/[$`\\]/.test(text) ? text : null
+}
+
 // The state one command list's scan carries from character to character.
 export interface Scan {
   cur: string
@@ -111,16 +118,16 @@ export class Reader extends WordReader {
 
   readonly base: number
 
-  readonly found: Found[]
+  readonly sink: Sink
 
   // bash 3.2 parses the text it cut out of $(…) on its own, so a here-document there may end with that text.
   readonly docsEndAtEof: boolean
 
-  constructor(s: string, mode: Mode, base: number, found: Found[], docsEndAtEof = false) {
+  constructor(s: string, mode: Mode, base: number, sink: Sink, docsEndAtEof = false) {
     super(s)
     this.mode = mode
     this.base = base
-    this.found = found
+    this.sink = sink
     this.docsEndAtEof = docsEndAtEof
   }
 
@@ -151,7 +158,13 @@ export class Reader extends WordReader {
 
   flush(scan: Scan, next: number): void {
     scan.sawCase ||= CASE_START.test(scan.cur)
-    this.found.push({ start: this.base + scan.start, text: scan.cur })
+    const found: Found = { start: this.base + scan.start, text: scan.cur }
+
+    for (const doc of scan.pending) {
+      doc.owner ??= found
+    }
+
+    this.sink.found.push(found)
     scan.cur = ''
     scan.start = next
     scan.atWord = true
@@ -333,7 +346,11 @@ export class Reader extends WordReader {
 
       // A shell runs the substitutions of a body that never closes, so they are read before this reading stops.
       if (!doc.quoted) {
-        new Reader(s.slice(from, to < 0 ? s.length : to), this.mode, this.base + from, this.found).body()
+        new Reader(s.slice(from, to < 0 ? s.length : to), this.mode, this.base + from, this.sink).body()
+      }
+
+      if (to >= 0 && doc.owner) {
+        doc.owner.stdin = bodyText(s.slice(from, to), doc)
       }
 
       if (to < 0 && !this.docsEndAtEof) {
@@ -365,7 +382,7 @@ export class Reader extends WordReader {
       throw new Unreadable()
     }
 
-    new Reader(this.s.slice(i + 1, j).replace(/\\([\\`$])/g, '$1'), this.mode, this.base + i + 1, this.found).commands(
+    new Reader(this.s.slice(i + 1, j).replace(/\\([\\`$])/g, '$1'), this.mode, this.base + i + 1, this.sink).commands(
       0,
       false,
     )
@@ -378,8 +395,13 @@ export class Reader extends WordReader {
       return this.commands(i, true) + 1
     }
 
-    const end = new Reader(this.s, { ...this.mode, heredocs: 'off' }, this.base, []).commands(i, true)
-    new Reader(this.s.slice(i, end), this.mode, this.base + i, this.found, true).commands(0, false)
+    const end = new Reader(this.s, { ...this.mode, heredocs: 'off' }, this.base, { found: [], subs: [] }).commands(i, true)
+    new Reader(this.s.slice(i, end), this.mode, this.base + i, this.sink, true).commands(0, false)
     return end + 1
   }
+
+  substitution(from: number, to: number): string {
+    this.sink.subs.push(this.s.slice(from, to))
+    return `${SUB}${this.sink.subs.length - 1}${SUB}`
+  }
 }
diff --git a/src/types.ts b/src/types.ts
index a974369..9f237c3 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -1,6 +1,11 @@
 // `bash32` is bash 3.2, which finds the end of $(…) without reading the here-documents inside it.
 export interface Mode { comments: boolean, heredocs: 'on' | 'off' | 'bash32' }
 
-export interface Doc { delim: string, strip: boolean, quoted: boolean }
+// `owner` is the command the body feeds; it is set when that command's text ends, before the body is read.
+export interface Doc { delim: string, strip: boolean, quoted: boolean, owner?: Found }
 
-export interface Found { start: number, text: string }
+// `stdin` is the here-document body the command reads, or null when the body holds an expansion.
+export interface Found { start: number, text: string, stdin?: string | null }
+
+// `subs` holds the source of each $(…) in the order read; a segment refers to one by index (see `SUB`).
+export interface Sink { found: Found[], subs: string[] }
diff --git a/src/word-reader.ts b/src/word-reader.ts
index d62f3f0..11bd1f2 100644
--- a/src/word-reader.ts
+++ b/src/word-reader.ts
@@ -7,6 +7,9 @@ export const EXP = '\u0000'
 // Marks an unquoted `*`, `?` or `[…]`: in the command word it is an expansion, elsewhere the matcher reads it as text.
 export const GLOB = '\u0001'
 
+// Brackets the index of a $(…) right after its `EXP`, so the text a substitution holds can still be looked up.
+export const SUB = '\u0002'
+
 // The quotes, escapes and expansions inside a word. Substitutions hold whole command lists, so the reader that scans
 // those supplies them.
 export abstract class WordReader {
@@ -20,6 +23,9 @@ export abstract class WordReader {
 
   abstract comsub(i: number): number
 
+  // The marker a $(…) from `from` to `to` leaves in the segment, after its `EXP`.
+  abstract substitution(from: number, to: number): string
+
   // The quoted string, escape or expansion at i, or null. `dq`: inside double quotes or a here-document body. An
   // expansion is marked, because what it becomes is text the matcher cannot see.
   part(i: number, dq: boolean): [number, string] | null {
@@ -53,7 +59,8 @@ export abstract class WordReader {
     }
 
     if (next === '(') {
-      return [this.comsub(i + 2), '']
+      const end = this.comsub(i + 2)
+      return [end, this.substitution(i + 2, end - 1)]
     }
 
     if (next === '[') {
diff --git a/test/authorship.test.ts b/test/authorship.test.ts
new file mode 100644
index 0000000..e2e7934
--- /dev/null
+++ b/test/authorship.test.ts
@@ -0,0 +1,234 @@
+import { describe, expect, it } from 'vitest'
+import {
+  aiSignatures,
+  authoredMessages,
+  authorshipViolations,
+  branchNames,
+  isConventionalBranch,
+  isConventionalCommit,
+} from '../src'
+
+const TRAILER = 'Co-Authored-By: Claude <noreply@anthropic.com>'
+
+describe('authoredMessages: git commit', () => {
+  it('joins -m values as paragraphs', () => {
+    expect(authoredMessages('git commit -m "fix: a" -m "Body."')).toEqual([
+      { kind: 'commit', text: 'fix: a\n\nBody.', file: null },
+    ])
+  })
+
+  it('reads attached, long, abbreviated and clustered forms', () => {
+    const texts = [
+      'git commit -mfix:\\ a',
+      'git commit --message="fix: a"',
+      'git commit --mess "fix: a"',
+      'git commit -am "fix: a"',
+    ].map(cmd => authoredMessages(cmd)[0]?.text)
+    expect(texts).toEqual(['fix: a', 'fix: a', 'fix: a', 'fix: a'])
+  })
+
+  it('reads -F - from a here-document', () => {
+    expect(authoredMessages('git commit -F - <<\'EOF\'\nfeat: b\nEOF')[0]?.text).toBe('feat: b\n')
+  })
+
+  it('appends --trailer lines as one block', () => {
+    expect(authoredMessages('git commit -m "fix: a" --trailer "Refs: #1" --trailer "Closes: #2"')[0]?.text).toBe(
+      'fix: a\n\nRefs: #1\nCloses: #2',
+    )
+  })
+
+  it('names a message file without opening it', () => {
+    expect(authoredMessages('git commit -F msg.txt')).toEqual([{ kind: 'commit', text: null, file: 'msg.txt' }])
+  })
+
+  it('gives null text when the message comes from an editor, another commit or an expansion', () => {
+    for (const cmd of ['git commit', 'git commit -C HEAD', 'git commit -m "$M"', 'git commit $FLAGS']) {
+      expect(authoredMessages(cmd)[0]?.text).toBeNull()
+    }
+  })
+
+  it('does not take a value-taking option\'s value as a message', () => {
+    expect(authoredMessages('git commit --author "A <a@b>" -m "fix: a"')[0]?.text).toBe('fix: a')
+  })
+})
+
+describe('authoredMessages: gh pr', () => {
+  it('joins title and body', () => {
+    expect(authoredMessages('gh pr create -t "Add login" -b "Adds it."')).toEqual([
+      { kind: 'pull-request', text: 'Add login\n\nAdds it.', file: null },
+    ])
+  })
+
+  it('reads --body-file - from a here-document', () => {
+    expect(authoredMessages('gh pr comment 3 --body-file - <<\'EOF\'\nLooks good.\nEOF')[0]?.text).toBe(
+      'Looks good.\n',
+    )
+  })
+
+  it('names a body file without opening it', () => {
+    expect(authoredMessages('gh pr edit 3 -F body.md')[0]?.file).toBe('body.md')
+  })
+
+  it('reads -t as the merge subject and leaves review -r a flag', () => {
+    expect(authoredMessages('gh pr merge 3 -s -t "Add login" -b "x"')[0]?.text).toBe('Add login\n\nx')
+    expect(authoredMessages('gh pr review 3 -r -b "Fix the test"')[0]?.text).toBe('Fix the test')
+  })
+
+  it('reads no message from a command that only mentions one', () => {
+    expect(authoredMessages('echo "gh pr create -b hi"; grep "git commit" notes.md')).toEqual([])
+  })
+})
+
+describe('branchNames', () => {
+  it('reads every way a branch is created or renamed', () => {
+    expect(
+      branchNames(
+        [
+          'git checkout -b feat/a',
+          'git switch -c feat/b',
+          'git switch --create=feat/c',
+          'git branch feat/d main',
+          'git branch -m feat/d feat/e',
+          'git worktree add -b feat/f ../f',
+          'git worktree add ../feat-g',
+        ].join(' && '),
+      ),
+    ).toEqual(['feat/a', 'feat/b', 'feat/c', 'feat/d', 'feat/e', 'feat/f', 'feat-g'])
+  })
+
+  it('names no branch for listing, deleting, switching to one, or a worktree on a commit', () => {
+    expect(
+      branchNames('git branch; git branch -d old; git branch --list "feat/*"; git switch main; git worktree add ../x main'),
+    ).toEqual([])
+  })
+
+  it('gives null for a name from an expansion', () => {
+    expect(branchNames('git checkout -b "$NAME"')).toEqual([null])
+  })
+})
+
+describe('aiSignatures', () => {
+  it('finds signing trailers, footers and session links', () => {
+    const text = [
+      'fix: tidy',
+      '',
+      TRAILER,
+      'Claude-Session: https://claude.ai/code/session_1',
+      '🤖 Generated with [Claude Code](https://claude.com/claude-code)',
+      'Assisted-by: GitHub Copilot',
+    ].join('\n')
+    expect(aiSignatures(text).map(s => s.line)).toEqual([3, 4, 5, 6])
+  })
+
+  it('ignores a tool named in prose and a human co-author', () => {
+    expect(aiSignatures('docs(claude): explain the .claude folder\n\nCo-authored-by: Ada <ada@example.com>')).toEqual([])
+  })
+})
+
+describe('isConventionalCommit', () => {
+  it('accepts type, lowercase scope and breaking mark', () => {
+    expect(isConventionalCommit('feat(api)!: drop v1')).toBe(true)
+    expect(isConventionalCommit('# comment\n\nfix: a\n\nbody')).toBe(true)
+  })
+
+  it('rejects an unknown type, an uppercase scope or no description', () => {
+    expect(isConventionalCommit('fixed it')).toBe(false)
+    expect(isConventionalCommit('feat(API): x')).toBe(false)
+    expect(isConventionalCommit('fix:')).toBe(false)
+  })
+
+  it('passes subjects git writes itself', () => {
+    expect(isConventionalCommit('Merge branch \'main\'')).toBe(true)
+    expect(isConventionalCommit('fixup! feat: a')).toBe(true)
+  })
+
+  it('takes custom types', () => {
+    expect(isConventionalCommit('wip: a', ['wip'])).toBe(true)
+  })
+})
+
+describe('isConventionalBranch', () => {
+  it('accepts type/description and the trunks', () => {
+    expect(isConventionalBranch('feat/add-login')).toBe(true)
+    expect(isConventionalBranch('release/v1.2.0')).toBe(true)
+    expect(isConventionalBranch('main')).toBe(true)
+  })
+
+  it('rejects uppercase, underscores, dots outside release, and unknown types', () => {
+    for (const name of ['Feat/x', 'feat/add_login', 'feat/v1.2', 'wip/x', 'feat/', 'feat/a--b', 'feat/a/b']) {
+      expect(isConventionalBranch(name)).toBe(false)
+    }
+  })
+})
+
+describe('authorshipViolations', () => {
+  it('reports a signature, a subject and a branch', () => {
+    expect(authorshipViolations(`git switch -c Fix_Login && git commit -m "fixed it" -m "${TRAILER}"`)).toEqual([
+      'branch "Fix_Login" is not a Conventional Branch',
+      `AI signature: "${TRAILER}"`,
+      'commit subject "fixed it" is not a Conventional Commit',
+    ])
+  })
+
+  it('finds a signature passed as --trailer even when the message comes from an editor', () => {
+    expect(authorshipViolations(`git commit --trailer "${TRAILER}"`)).toEqual([`AI signature: "${TRAILER}"`])
+  })
+
+  it('finds a signature in a commit hidden behind a wrapper', () => {
+    expect(authorshipViolations(`env A=1 bash -c 'git commit -m "fix: a" -m "${TRAILER}"'`)).toEqual([
+      `AI signature: "${TRAILER}"`,
+    ])
+  })
+
+  it('finds a pull-request footer', () => {
+    expect(authorshipViolations('gh pr create -t "Add login" -b "Adds it.\n\n🤖 Generated with [Claude Code](x)"')).toEqual(
+      ['AI signature: "🤖 Generated with [Claude Code](x)"'],
+    )
+  })
+
+  it('reads a message file only through readFile', () => {
+    const readFile = (path: string): string | null => (path === 'msg.txt' ? 'fixed it\n' : null)
+    expect(authorshipViolations('git commit -F msg.txt')).toEqual([])
+    expect(authorshipViolations('git commit -F msg.txt', { readFile })).toEqual([
+      'commit subject "fixed it" is not a Conventional Commit',
+    ])
+  })
+
+  it('reports nothing for a clean line or one that only mentions the commands', () => {
+    expect(authorshipViolations('git switch -c feat/login && git commit -m "feat: add login"')).toEqual([])
+    expect(authorshipViolations(`echo "git commit -m 'fixed it' -m '${TRAILER}'"`)).toEqual([])
+  })
+
+  it('takes custom types and prefixes', () => {
+    expect(
+      authorshipViolations('git switch -c claude/x && git commit -m "wip: a"', {
+        commitTypes: ['wip'],
+        branchTypes: ['claude'],
+      }),
+    ).toEqual([])
+  })
+})
+
+describe('authorshipViolations: glued options and partial messages', () => {
+  it('finds a signature glued to its flag', () => {
+    expect(authorshipViolations('git commit -m "feat: a" --trailer="Co-Authored-By: Claude <c@example.com>"')).toEqual([
+      'AI signature: "Co-Authored-By: Claude <c@example.com>"',
+    ])
+    expect(authorshipViolations('gh pr create -t "feat: a" -b"🤖 made it"')).toEqual(['AI signature: "🤖 made it"'])
+  })
+
+  it('checks the subject when a later -m comes from an expansion', () => {
+    expect(authorshipViolations('git commit -m "fixed it" -m "$(date)"')).toEqual([
+      'commit subject "fixed it" is not a Conventional Commit',
+    ])
+    expect(authorshipViolations('git commit -m "$SUBJECT" -m "body"')).toEqual([])
+  })
+
+  it('does not take a tool named in a sentence for a signature', () => {
+    expect(aiSignatures('feat: parse replies generated by OpenAI models')).toEqual([])
+  })
+
+  it('accepts a commit type that holds a regex metacharacter', () => {
+    expect(isConventionalCommit('c++: add a thing', ['c++'])).toBe(true)
+  })
+})
diff --git a/test/invocations.test.ts b/test/invocations.test.ts
new file mode 100644
index 0000000..93c0e9f
--- /dev/null
+++ b/test/invocations.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest'
+import { commandSegments, deniedBy, invocations } from '../src'
+
+describe('invocations', () => {
+  it('returns the words after wrappers come off, quotes removed', () => {
+    expect(invocations('sudo env A=1 git -C repo commit -m "fix: tidy it"', 'git commit')).toEqual([
+      { args: ['git', 'commit', '-m', 'fix: tidy it'], stdin: null },
+    ])
+  })
+
+  it('lists every matching command in source order, equal ones included', () => {
+    expect(invocations('git commit -m a; ls; git commit -m a', 'git commit').map(i => i.args)).toEqual([
+      ['git', 'commit', '-m', 'a'],
+      ['git', 'commit', '-m', 'a'],
+    ])
+  })
+
+  it('reads a command nested in a shell script', () => {
+    expect(invocations('bash -c \'git commit -m "x y"\'', 'git commit')).toEqual([
+      { args: ['git', 'commit', '-m', 'x y'], stdin: null },
+    ])
+  })
+
+  it('lists nothing for a command only mentioned', () => {
+    expect(invocations('echo "git commit -m x" # git commit', 'git commit')).toEqual([])
+    expect(invocations('python3 - <<\'PY\'\nprint("git commit")\nPY', 'git commit')).toEqual([])
+  })
+
+  it('gives null for a word that depends on what runs', () => {
+    expect(invocations('git commit -m "$MSG" -m "fix: $(date)"', 'git commit')[0]?.args).toEqual([
+      'git',
+      'commit',
+      '-m',
+      null,
+      '-m',
+      null,
+    ])
+  })
+
+  it('resolves a word that is a substitution printing a here-document, without its trailing newlines', () => {
+    const cmd = 'git commit -m "$(cat <<\'EOF\'\nfix(api): tidy\n\nWhy it changed.\nEOF\n)"'
+    expect(invocations(cmd, 'git commit')[0]?.args).toEqual(['git', 'commit', '-m', 'fix(api): tidy\n\nWhy it changed.'])
+  })
+
+  it('reads stdin from a quoted here-document as written', () => {
+    const cmd = 'git commit -F - <<\'EOF\'\nfeat: a $HOME\nEOF'
+    expect(invocations(cmd, 'git commit')[0]?.stdin).toBe('feat: a $HOME\n')
+  })
+
+  it('strips leading tabs from a <<- here-document', () => {
+    expect(invocations('git commit -F - <<-EOF\n\tfeat: a\n\tEOF', 'git commit')[0]?.stdin).toBe('feat: a\n')
+  })
+
+  it('gives null stdin for an unquoted here-document that expands', () => {
+    expect(invocations('git commit -F - <<EOF\nfeat: $X\nEOF', 'git commit')[0]?.stdin).toBeNull()
+  })
+
+  it('reads stdin from a here-string, with the newline the shell adds', () => {
+    expect(invocations('git commit -F - <<< "fix: x"', 'git commit')[0]?.stdin).toBe('fix: x\n')
+  })
+
+  it('passes a wrapper\'s here-document to a one-command nested script', () => {
+    expect(invocations('bash -c \'git commit -F -\' <<\'EOF\'\nchore: z\nEOF', 'git commit')[0]?.stdin).toBe(
+      'chore: z\n',
+    )
+  })
+
+  it('does not attribute a pipe\'s input as stdin', () => {
+    expect(invocations('printf "fix: x" | git commit -F -', 'git commit')[0]?.stdin).toBeNull()
+  })
+})
+
+describe('substitution markers stay internal', () => {
+  it('leaves no marker in commandSegments', () => {
+    expect(commandSegments('git commit -m "$(cat <<\'EOF\'\nx\nEOF\n)"')).toEqual(['git commit -m ""', 'cat <<\'EOF\''])
+  })
+
+  it('still denies a command hidden inside a substitution', () => {
+    expect(deniedBy('echo "$(git push)"', ['git push'])).toBe('git push')
+  })
+})