rulereceipt 0.1.30 → 0.1.32

package/dist/checks/deterministicChecks.js

@@ -18,6 +18,45 @@ function eventSearchText(event) {
     }
     return "";
 }
+/**
+ * Standard short spellings of destructive flags, canonicalised before
+ * matching.
+ *
+ * Without this, a prohibition returned PASS whenever its exact literal was
+ * absent — so a rule banning `git push --force` printed "no occurrence
+ * found" for a session that ran `git push -f`. Found 2026-09-08. That is
+ * the inverse of the false-FAIL problem in the postmortem and the more
+ * dangerous direction: a wrong FAIL sends someone to check the evidence, a
+ * wrong PASS stops them looking.
+ *
+ * Deliberately three entries, not an open-ended table. These are stable
+ * decades-old CLI conventions for the specific destructive operations rules
+ * actually ban. Expansion is gated on the COMMAND CONTEXT, because a bare
+ * `-f` means something different everywhere: `grep -f patterns.txt` is not
+ * forcing anything, and rewriting it would invent a violation.
+ *
+ * `--force-with-lease` must keep passing a `--force` ban — it is the safe
+ * command, and the trailing word boundary in matchesPattern already keeps
+ * the two apart.
+ */
+const FLAG_ALIASES = [
+    { context: /\bgit\s+push\b/, short: /(?:^|\s)-[A-Za-z]*f/, canonical: "git push --force" },
+    { context: /\bgit\s+commit\b/, short: /(?:^|\s)-[A-Za-z]*n/, canonical: "git commit --no-verify" },
+    { context: /\brm\b/, short: /(?:^|\s)-(?:[A-Za-z]*r[A-Za-z]*f|[A-Za-z]*f[A-Za-z]*r)/, canonical: "rm -rf" },
+];
+/**
+ * The text a pattern is matched against: the event's own text, plus the
+ * canonical spelling of any aliased flag it used. Kept separate from the
+ * text quoted back as evidence, so a report always shows what the session
+ * actually ran, never a canonical form it never typed.
+ */
+function searchHaystack(event) {
+    const raw = eventSearchText(event);
+    if (event.kind !== "tool_use")
+        return raw;
+    const extra = FLAG_ALIASES.filter((a) => a.context.test(raw) && a.short.test(raw)).map((a) => a.canonical);
+    return extra.length > 0 ? `${raw} ${extra.join(" ")}` : raw;
+}
 function escapeRegex(literal) {
     return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -56,7 +95,7 @@ export function runDeterministicChecks(classifications, events) {
             let foundEvent;
             let foundPattern;
             for (const event of events) {
-                const haystack = eventSearchText(event);
+                const haystack = searchHaystack(event);
                 for (const pattern of patterns) {
                     if (matchesPattern(haystack, pattern)) {
                         foundEvent = event;
@@ -96,7 +135,7 @@ export function runDeterministicChecks(classifications, events) {
                     ruleTitle: rule.title,
                     ruleSource: rule.source,
                     status: "PASS",
-                    evidence: `no occurrence of ${patterns.map((p) => `"${p}"`).join(" or ")} found in this session`,
+                    evidence: `no occurrence of ${patterns.map((p) => `"${p}"`).join(" or ")} in the commands and messages recorded this session — this is a text scan of the transcript, so it is evidence rather than proof: a spelling this checker does not know would not be caught`,
                 };
             }
             // polarity === "require": absence is the failure, not presence. But

package/dist/report/generateHtmlReport.js

@@ -92,9 +92,12 @@ function ruleLabel(result, all) {
 function countBy(results, status) {
     return results.filter((r) => r.status === status).length;
 }
-function renderResultRow(result, all) {
+function renderResultRow(result, all, hideEvidence) {
     const bucket = bucketOf(result);
     const cls = BUCKET_CLASS[bucket];
+    const evidence = !hideEvidence && result.evidence
+        ? `<p class="result__evidence">${clean(result.evidence)}</p>`
+        : "";
     return `
         <article class="result result--${cls}">
           <div class="result__head">
@@ -102,9 +105,30 @@ function renderResultRow(result, all) {
             <span class="result__id">${clean(ruleLabel(result, all))}</span>
           </div>
           <h3 class="result__title">${clean(result.ruleTitle)}</h3>
-          ${result.evidence ? `<p class="result__evidence">${clean(result.evidence)}</p>` : ""}
+          ${evidence}
         </article>`;
 }
+/**
+ * The explanation every rule in a section shares, or null when they differ.
+ *
+ * Judgment rules all carry the same sentence, because the reason is the
+ * same one every time. Rendered per-rule that produced thirteen copies of
+ * one 300-character paragraph on a real 14-rule file. Fixed in the terminal
+ * report first and missed here, which was the wrong half to miss — this is
+ * the report that gets sent to someone else.
+ *
+ * Conditional on the text being byte-identical: `--llm` gives each judgment
+ * rule its own model opinion, and hoisting those would delete the only
+ * per-rule content the section has.
+ */
+function sharedEvidence(rs) {
+    if (rs.length < 2)
+        return null;
+    const first = rs[0].evidence;
+    if (!first)
+        return null;
+    return rs.every((r) => r.evidence === first) ? first : null;
+}
 function renderSection(bucket, results, all) {
     const inSection = results.filter((r) => bucketOf(r) === bucket);
     if (inSection.length === 0)
@@ -112,11 +136,14 @@ function renderSection(bucket, results, all) {
     const note = bucket === "UNCLEAR_JUDGMENT"
         ? `<p class="section__note">These were never questions a tool could settle — they need someone to read the session and decide. That is expected, not a gap in the check.</p>`
         : "";
+    const shared = sharedEvidence(inSection);
+    const sharedBlock = shared ? `<p class="section__shared">${clean(shared)}</p>` : "";
     return `
       <section class="section">
         <h2 class="section__title">${clean(BUCKET_LABEL[bucket])} <span class="section__count">${inSection.length}</span></h2>
         ${note}
-        ${inSection.map((r) => renderResultRow(r, all)).join("")}
+        ${sharedBlock}
+        ${inSection.map((r) => renderResultRow(r, all, shared !== null)).join("")}
       </section>`;
 }
 /**
@@ -202,6 +229,7 @@ export function generateHtmlReport(results, meta) {
   .result--judgment { border-left-color: #6b6f76; }
   .badge--judgment { background: #f2f3f5; color: #4a4e55; }
   .section__note { font-size: 13px; color: var(--muted); margin: -4px 0 12px; }
+  .section__shared { font-size: 13px; color: var(--muted); margin: 0 0 14px; padding: 10px 12px; border-left: 2px solid var(--line); background: var(--panel); border-radius: 0 6px 6px 0; white-space: pre-wrap; }
   .result__id { font-size: 12px; color: var(--muted); }
   .result__title { font-size: 15px; margin: 0 0 6px; font-weight: 600; }
   .result__evidence { margin: 0; font-size: 14px; color: var(--muted); white-space: pre-wrap; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",