rulereceipt 0.1.36 → 0.1.37

package/dist/checks/classify.js

@@ -264,7 +264,19 @@ function isBranchName(literal) {
 // A function/method-call shape ("print(", "analytics.track(") is a strong,
 // simple signal that a backtick literal names actual CODE, not a CLI
 // command or flag ("git push --force", "npm test" never look like this).
-const CODE_CONSTRUCT_PATTERN = /\(/;
+//
+// It must be a CALL, not merely a parenthesis. The test used to be /\(/,
+// which is true of a great deal of ordinary prose: measured 2026-09-15
+// across 559 rules files, 74 of 1,086 literals reaching content matching
+// (6.8%) were not code — "(e.g.", "(soft)", a markdown link fragment, three
+// whole blocks of accounting formulae. "(in the" produced a real false
+// accusation, reported as having been "actually written into a file", which
+// is true of any file containing that phrase.
+//
+// An identifier immediately before the paren, optionally dotted or scoped,
+// so "console.log(", "std::cout(" and "obj->run(" all qualify and a bare
+// parenthesis does not.
+const CODE_CONSTRUCT_PATTERN = /[A-Za-z_$][A-Za-z0-9_$]*(?:\s*(?:\.|::|->)\s*[A-Za-z_$][A-Za-z0-9_$]*)*\s*\(/;
 // A file-path shape: a known config/source extension, or a path with a
 // directory separator. Deliberately requires no spaces — a real path
 // literal ("`.claude/settings.json`", "`config.yaml`") never has one,

package/dist/checks/codeContent.js

@@ -29,6 +29,37 @@ function editedContentFromEvent(event) {
         return input.new_source;
     return null;
 }
+/**
+ * Whether the content contains this literal AS A CALL, not merely as a
+ * substring of a longer identifier.
+ *
+ * Found 2026-09-15 by checking a corpus FAIL rather than assuming it was
+ * legitimate: a rule forbidding `fetch()` matched a file containing
+ * `_metar_fetch()`. The literal was present verbatim, and entirely the wrong
+ * function. The same bare-substring test makes `main()` match `domain()` and
+ * `run()` match `rerun()`, and short generic call names are exactly what
+ * these rules tend to name.
+ *
+ * Only the LEADING boundary is checked. The trailing side is already pinned
+ * by the pattern itself — every literal reaching this checker ends in an
+ * open paren or a call — so requiring a boundary after it would reject the
+ * arguments.
+ */
+function containsCall(content, pattern) {
+    const leadsWithIdentifier = /^[A-Za-z0-9_$]/.test(pattern);
+    if (!leadsWithIdentifier)
+        return content.includes(pattern);
+    let from = 0;
+    for (;;) {
+        const at = content.indexOf(pattern, from);
+        if (at === -1)
+            return false;
+        const before = at === 0 ? "" : content[at - 1];
+        if (!/[A-Za-z0-9_$.]/.test(before))
+            return true;
+        from = at + 1;
+    }
+}
 export function runCodeContentChecks(classifications, events) {
     const editedContents = [];
     for (const event of events) {
@@ -41,7 +72,7 @@ export function runCodeContentChecks(classifications, events) {
         let foundContent;
         for (const content of editedContents) {
             for (const pattern of patterns) {
-                if (content.includes(pattern)) {
+                if (containsCall(content, pattern)) {
                     foundPattern = pattern;
                     foundContent = content;
                     break;

package/dist/checks/fileLifecycle.js

@@ -1,5 +1,6 @@
 import { violation } from "../types.js";
 import { isProjectPath } from "./projectPaths.js";
+import { withoutHeredocs } from "./shellCommand.js";
 /**
  * Third structured-check primitive: only counts real MUTATIONS of a
  * protected file, never reads of it. Real false-positive this fixes
@@ -43,7 +44,17 @@ function pathPattern(filePath) {
  * it mutates after that is a scratch file, not the project's.
  */
 const CD_INTO_TEMP = /\bcd\s+["']?(?:\/private)?\/(?:tmp|var\/folders)\b|\bcd\s+["']?[^\s"'&|;]*\/(?:scratchpad|node_modules)\b/;
-function mutatesPathInBash(command, filePath) {
+/**
+ * A path named only inside a heredoc body was not touched by the command
+ * that contains it.
+ *
+ * Real case, 2026-09-15: a command editing landing/index.html through a
+ * Python heredoc was reported as modifying `.claude/`, because the HTML it
+ * inserts tells readers to put a hook in `.claude/settings.json`. Writing a
+ * path into a file is not mutating that path.
+ */
+function mutatesPathInBash(rawCommand, filePath) {
+    const command = withoutHeredocs(rawCommand);
     const p = pathPattern(filePath);
     const mutations = [
         // rm / rmdir / unlink targeting the path

package/dist/checks/shellCommand.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Facts about shell command text that more than one checker needs.
+ *
+ * Created 2026-09-15. The heredoc guard below lived in testCommands.ts, was
+ * used only by the test-command matcher, and the file-mutation checker never
+ * saw it — so the same class of false accusation was fixed in one reader and
+ * left standing in the other. Anything that reasons about what a shell
+ * command DID, rather than what it says, belongs here.
+ */
+/**
+ * Removes heredoc bodies from a shell command.
+ *
+ * A command that WRITES a test command is not a command that RUNS one.
+ * Found 2026-09-14 on a real session: two false failures whose "last test
+ * run" was a shell variable assignment. The actual match came from a
+ * heredoc further down, writing a demo fixture whose body contains the
+ * string `npm test`. The literal was being generated, never executed — and
+ * the tool then read its own report output as the failing result.
+ *
+ * Handles both quoted and bare delimiters, and leaves everything after the
+ * closing delimiter intact, because a real test run often follows the
+ * heredoc that set the fixture up.
+ */
+export declare function withoutHeredocs(command: string): string;

package/dist/checks/shellCommand.js

@@ -0,0 +1,43 @@
+/**
+ * Facts about shell command text that more than one checker needs.
+ *
+ * Created 2026-09-15. The heredoc guard below lived in testCommands.ts, was
+ * used only by the test-command matcher, and the file-mutation checker never
+ * saw it — so the same class of false accusation was fixed in one reader and
+ * left standing in the other. Anything that reasons about what a shell
+ * command DID, rather than what it says, belongs here.
+ */
+/**
+ * Removes heredoc bodies from a shell command.
+ *
+ * A command that WRITES a test command is not a command that RUNS one.
+ * Found 2026-09-14 on a real session: two false failures whose "last test
+ * run" was a shell variable assignment. The actual match came from a
+ * heredoc further down, writing a demo fixture whose body contains the
+ * string `npm test`. The literal was being generated, never executed — and
+ * the tool then read its own report output as the failing result.
+ *
+ * Handles both quoted and bare delimiters, and leaves everything after the
+ * closing delimiter intact, because a real test run often follows the
+ * heredoc that set the fixture up.
+ */
+export function withoutHeredocs(command) {
+    const lines = command.split("\n");
+    const out = [];
+    let closing = null;
+    for (const line of lines) {
+        if (closing !== null) {
+            if (line.trim() === closing)
+                closing = null;
+            continue;
+        }
+        const open = line.match(/<<-?\s*(?:'([^']+)'|"([^"]+)"|([A-Za-z_][A-Za-z0-9_]*))/);
+        if (open) {
+            closing = open[1] ?? open[2] ?? open[3];
+            out.push(line.slice(0, open.index));
+            continue;
+        }
+        out.push(line);
+    }
+    return out.join("\n");
+}

package/dist/checks/testCommands.d.ts

@@ -19,21 +19,6 @@ import type { TranscriptEvent } from "../types.js";
  * wrong.
  */
 export declare const TEST_COMMAND: RegExp;
-/**
- * Removes heredoc bodies from a shell command.
- *
- * A command that WRITES a test command is not a command that RUNS one.
- * Found 2026-09-14 on a real session: two false failures whose "last test
- * run" was a shell variable assignment. The actual match came from a
- * heredoc further down, writing a demo fixture whose body contains the
- * string `npm test`. The literal was being generated, never executed — and
- * the tool then read its own report output as the failing result.
- *
- * Handles both quoted and bare delimiters, and leaves everything after the
- * closing delimiter intact, because a real test run often follows the
- * heredoc that set the fixture up.
- */
-export declare function withoutHeredocs(command: string): string;
 /**
  * How many times a single shell command invokes a test suite.
  *
@@ -54,3 +39,4 @@ export declare function withoutHeredocs(command: string): string;
 export declare function countTestRuns(command: string): number;
 /** The first test command run in this session, or null if none ran. */
 export declare function findTestRun(events: TranscriptEvent[]): string | null;
+export { withoutHeredocs } from "./shellCommand.js";

package/dist/checks/testCommands.js

@@ -1,3 +1,4 @@
+import { withoutHeredocs } from "./shellCommand.js";
 /**
  * Commands that run a project's test suite.
  *
@@ -18,40 +19,6 @@
  * wrong.
  */
 export const TEST_COMMAND = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|verify|check|ci)\b|\bnpx\s+(?:vitest|jest|mocha|ava)\b|\b(?:vitest|jest|mocha|pytest|phpunit|rspec|tox)\b|\bcargo\s+test\b|\bgo\s+test\b|\bmvn\s+(?:test|verify)\b|\bgradle\s+test\b|\bdotnet\s+test\b|\bpython\s+-m\s+(?:pytest|unittest)\b/i;
-/**
- * Removes heredoc bodies from a shell command.
- *
- * A command that WRITES a test command is not a command that RUNS one.
- * Found 2026-09-14 on a real session: two false failures whose "last test
- * run" was a shell variable assignment. The actual match came from a
- * heredoc further down, writing a demo fixture whose body contains the
- * string `npm test`. The literal was being generated, never executed — and
- * the tool then read its own report output as the failing result.
- *
- * Handles both quoted and bare delimiters, and leaves everything after the
- * closing delimiter intact, because a real test run often follows the
- * heredoc that set the fixture up.
- */
-export function withoutHeredocs(command) {
-    const lines = command.split("\n");
-    const out = [];
-    let closing = null;
-    for (const line of lines) {
-        if (closing !== null) {
-            if (line.trim() === closing)
-                closing = null;
-            continue;
-        }
-        const open = line.match(/<<-?\s*(?:'([^']+)'|"([^"]+)"|([A-Za-z_][A-Za-z0-9_]*))/);
-        if (open) {
-            closing = open[1] ?? open[2] ?? open[3];
-            out.push(line.slice(0, open.index));
-            continue;
-        }
-        out.push(line);
-    }
-    return out.join("\n");
-}
 /**
  * How many times a single shell command invokes a test suite.
  *
@@ -85,3 +52,4 @@ export function findTestRun(events) {
     }
     return null;
 }
+export { withoutHeredocs } from "./shellCommand.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",