rulereceipt 0.1.21 → 0.1.23

package/dist/checks/classify.js

@@ -31,7 +31,49 @@ const IMPERATIVE_INSTRUCTION = /(?:^|[.;:!?]\s+|^\s*[-*+]\s*|\n\s*[-*+]\s*)(use|
  * with no instruction in it has nothing to check compliance against,
  * whatever its punctuation.
  */
+/**
+ * A section whose TITLE announces a record of something that happened —
+ * an incident, a postmortem, a retrospective. These are written to
+ * explain history, not to instruct the agent.
+ *
+ * Found by running this tool on a real session (2026-08-31): a section
+ * titled "Real incident (2026-08-28): Vercel had the same office/personal
+ * mixup" was enforced as a REQUIRE rule whose pattern was an employer
+ * name pulled out of the narrative, so the report announced FOLLOWED
+ * because that name appeared somewhere in the session. The rule being
+ * "satisfied" was a sentence describing a past mistake.
+ *
+ * The existing directive test cannot catch these, and correctly so: a
+ * good incident note ends with the lesson ("Verify with `vercel whoami`
+ * before every deploy"), so it genuinely does contain a directive. What
+ * the section IS gets announced by its title, which is where this looks.
+ *
+ * Kept to a small closed class of words that name a record of an event,
+ * in the same spirit as DIRECTIVE_LANGUAGE above — a bounded property of
+ * language, not an enumeration of document formats. Enumerating formats
+ * is the mistake this project already made once and wrote up publicly.
+ */
+const EVENT_RECORD_TITLE = /\b(incident|post-?mortem|retro(spective)?|outage|what went wrong)\b/i;
+/**
+ * A title that OPENS with an instruction is a rule, whatever it goes on
+ * to mention. "Never repeat the 2026-08-28 incident" is a directive that
+ * happens to name an incident; "Real incident (2026-08-28): ..." is a
+ * report that happens to contain the word never further along.
+ */
+const TITLE_OPENS_WITH_DIRECTIVE = /^\s*[-*+\d.\s]*(never|always|must|do not|don't|dont|avoid|ensure|prefer|only|make sure|be sure)\b/i;
+function isEventRecord(rule) {
+    if (TITLE_OPENS_WITH_DIRECTIVE.test(rule.title))
+        return false;
+    if (IMPERATIVE_INSTRUCTION.test(rule.title))
+        return false;
+    return EVENT_RECORD_TITLE.test(rule.title);
+}
 function isNotARule(rule) {
+    // Checked before the directive test on purpose: an incident note that
+    // ends with its lesson contains a real directive, and would otherwise
+    // be enforced as though the history itself were the rule.
+    if (isEventRecord(rule))
+        return true;
     const combined = `${rule.title} ${rule.text}`;
     if (DIRECTIVE_LANGUAGE.test(combined))
         return false;

package/dist/cli.js

@@ -116,6 +116,16 @@ function writeHtmlReport(results, meta, cwd, target) {
         writeFileSync(outPath, html, "utf-8");
         console.log(`\nShareable report written to ${outPath}`);
         console.log("Open it in a browser, attach it to an email, or print it to PDF. It's a single self-contained file.");
+        // Found by dogfooding on a real session (2026-08-31): this file
+        // reproduces rule text and quoted evidence verbatim, which is exactly
+        // what makes it useful — and means it inherits whatever is in the
+        // rules file. A real CLAUDE.md turned out to contain an employer
+        // name, an office email, and absolute paths. Home paths are redacted
+        // automatically; nothing else can be, so say so plainly at the moment
+        // the file is created rather than burying it in a policy page.
+        console.log("\n⚠ This report includes your rule text and session evidence VERBATIM.\n" +
+            "  Review it before sharing outside your team — only you know what's in your rules file.\n" +
+            "  Nothing is auto-redacted: this tool cannot tell which of your own rules are sensitive.");
     }
     catch (err) {
         console.log(`\n(--html: couldn't write ${outPath} — ${err instanceof Error ? err.message : String(err)})`);

package/dist/report/generateHtmlReport.js

@@ -1,4 +1,5 @@
 import { basename } from "node:path";
+import { homedir } from "node:os";
 import { computeTranscriptHash } from "./generateReport.js";
 /**
  * Escapes the five characters that can break out of either an HTML text
@@ -21,9 +22,40 @@ function escapeHtml(value) {
 function stripControlChars(value) {
     return value.replace(/[\x00-\x09\x0B-\x1F\x7F-\x9F]/g, "");
 }
+/**
+ * Replaces the user's home directory with `~`.
+ *
+ * Found by dogfooding on a real session (2026-08-31): the shareable
+ * report is the one output explicitly designed to be emailed to someone
+ * else, and it was printing absolute paths like
+ * /Users/<realname>/Desktop/... in both the project header and inside
+ * quoted evidence. For anyone publishing under a pseudonym — or simply
+ * anyone who would rather not hand a stranger their username and
+ * directory layout — that is a leak in the one artifact most likely to
+ * leave the machine.
+ *
+ * This is DISPLAY FORMATTING, not a safety mechanism, and the difference
+ * matters. It is a fixed, deterministic substitution of one known string
+ * — always correct, never guessing — and it makes paths easier to read as
+ * a side benefit. It protects nothing.
+ *
+ * Auto-detecting "sensitive" content and scrubbing it would be a losing
+ * game: it can never catch everything, and a partial scrub is worse than
+ * none because it invites the user to trust the output. Rule text and
+ * evidence are reproduced verbatim on purpose, because that is what makes
+ * the report worth sending. The real safeguard is the warning the CLI
+ * prints at write time, which puts the responsibility where it belongs —
+ * with the person who knows what is in their own rules file.
+ */
+function redactHome(value) {
+    const home = homedir();
+    if (!home || home === "/" || home.length < 4)
+        return value;
+    return value.split(home).join("~");
+}
 /** Single choke point: nothing untrusted reaches the document except through this. */
 function clean(value) {
-    return escapeHtml(stripControlChars(value));
+    return escapeHtml(stripControlChars(redactHome(value)));
 }
 function bucketOf(result) {
     if (result.status === "FAIL")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",