rulereceipt 0.1.22 → 0.1.23

package/dist/checks/classify.js

@@ -31,7 +31,49 @@ const IMPERATIVE_INSTRUCTION = /(?:^|[.;:!?]\s+|^\s*[-*+]\s*|\n\s*[-*+]\s*)(use|
  * with no instruction in it has nothing to check compliance against,
  * whatever its punctuation.
  */
+/**
+ * A section whose TITLE announces a record of something that happened —
+ * an incident, a postmortem, a retrospective. These are written to
+ * explain history, not to instruct the agent.
+ *
+ * Found by running this tool on a real session (2026-08-31): a section
+ * titled "Real incident (2026-08-28): Vercel had the same office/personal
+ * mixup" was enforced as a REQUIRE rule whose pattern was an employer
+ * name pulled out of the narrative, so the report announced FOLLOWED
+ * because that name appeared somewhere in the session. The rule being
+ * "satisfied" was a sentence describing a past mistake.
+ *
+ * The existing directive test cannot catch these, and correctly so: a
+ * good incident note ends with the lesson ("Verify with `vercel whoami`
+ * before every deploy"), so it genuinely does contain a directive. What
+ * the section IS gets announced by its title, which is where this looks.
+ *
+ * Kept to a small closed class of words that name a record of an event,
+ * in the same spirit as DIRECTIVE_LANGUAGE above — a bounded property of
+ * language, not an enumeration of document formats. Enumerating formats
+ * is the mistake this project already made once and wrote up publicly.
+ */
+const EVENT_RECORD_TITLE = /\b(incident|post-?mortem|retro(spective)?|outage|what went wrong)\b/i;
+/**
+ * A title that OPENS with an instruction is a rule, whatever it goes on
+ * to mention. "Never repeat the 2026-08-28 incident" is a directive that
+ * happens to name an incident; "Real incident (2026-08-28): ..." is a
+ * report that happens to contain the word never further along.
+ */
+const TITLE_OPENS_WITH_DIRECTIVE = /^\s*[-*+\d.\s]*(never|always|must|do not|don't|dont|avoid|ensure|prefer|only|make sure|be sure)\b/i;
+function isEventRecord(rule) {
+    if (TITLE_OPENS_WITH_DIRECTIVE.test(rule.title))
+        return false;
+    if (IMPERATIVE_INSTRUCTION.test(rule.title))
+        return false;
+    return EVENT_RECORD_TITLE.test(rule.title);
+}
 function isNotARule(rule) {
+    // Checked before the directive test on purpose: an incident note that
+    // ends with its lesson contains a real directive, and would otherwise
+    // be enforced as though the history itself were the rule.
+    if (isEventRecord(rule))
+        return true;
     const combined = `${rule.title} ${rule.text}`;
     if (DIRECTIVE_LANGUAGE.test(combined))
         return false;

package/dist/cli.js

@@ -123,7 +123,9 @@ function writeHtmlReport(results, meta, cwd, target) {
         // name, an office email, and absolute paths. Home paths are redacted
         // automatically; nothing else can be, so say so plainly at the moment
         // the file is created rather than burying it in a policy page.
-        console.log("Read it before you send it: it quotes your rule text and session evidence verbatim, so anything sensitive in your CLAUDE.md is in there too. (Home paths are shortened to ~.)");
+        console.log("\n⚠ This report includes your rule text and session evidence VERBATIM.\n" +
+            "  Review it before sharing outside your team — only you know what's in your rules file.\n" +
+            "  Nothing is auto-redacted: this tool cannot tell which of your own rules are sensitive.");
     }
     catch (err) {
         console.log(`\n(--html: couldn't write ${outPath} — ${err instanceof Error ? err.message : String(err)})`);

package/dist/report/generateHtmlReport.js

@@ -34,11 +34,18 @@ function stripControlChars(value) {
  * directory layout — that is a leak in the one artifact most likely to
  * leave the machine.
  *
- * This is a mechanical, judgment-free redaction: it removes the home
- * prefix and nothing else. It is NOT a general secret scrubber, and must
- * not be described as one. Rule text and evidence are still reproduced
- * verbatim, because that is what makes the report useful — which is why
- * the CLI warns the user to read the file before sending it.
+ * This is DISPLAY FORMATTING, not a safety mechanism, and the difference
+ * matters. It is a fixed, deterministic substitution of one known string
+ * — always correct, never guessing — and it makes paths easier to read as
+ * a side benefit. It protects nothing.
+ *
+ * Auto-detecting "sensitive" content and scrubbing it would be a losing
+ * game: it can never catch everything, and a partial scrub is worse than
+ * none because it invites the user to trust the output. Rule text and
+ * evidence are reproduced verbatim on purpose, because that is what makes
+ * the report worth sending. The real safeguard is the warning the CLI
+ * prints at write time, which puts the responsibility where it belongs —
+ * with the person who knows what is in their own rules file.
  */
 function redactHome(value) {
     const home = homedir();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",