rulereceipt 0.1.45 → 0.1.47

package/dist/report/generateReport.js

@@ -266,3 +266,45 @@ export function generateMarkdownReport(results, meta) {
     lines.push(hash ? `\`verify: sha256:${hash.slice(0, 16)}...\` · checked ${new Date().toISOString()}` : `demo data · checked ${new Date().toISOString()}`);
     return lines.join("\n");
 }
+/**
+ * Machine-readable output for CI, a GitHub Action, or any other consumer.
+ *
+ * `schema` is versioned deliberately: this is a contract other tools will
+ * parse, so a breaking shape change must bump it rather than silently move
+ * fields under callers. The full (untruncated) sha256 is included so a
+ * consumer can `rulereceipt verify` the session independently — the human
+ * reports only show a prefix. Rule text and evidence are sanitized the same
+ * way as every other output: a hostile CLAUDE.md does not get to smuggle
+ * control characters through the JSON either.
+ */
+export function generateJsonReport(results, meta, toolVersion) {
+    const clean = results.map(sanitize);
+    const count = (s) => clean.filter((r) => r.status === s).length;
+    const report = {
+        tool: "rulereceipt",
+        schema: 1,
+        version: toolVersion,
+        generatedAt: new Date().toISOString(),
+        session: {
+            path: meta.sessionFilePath,
+            sha256: computeTranscriptHash(meta.sessionFilePath),
+        },
+        summary: {
+            total: clean.length,
+            pass: count("PASS"),
+            fail: count("FAIL"),
+            unclear: count("UNCLEAR"),
+        },
+        results: clean.map((r) => ({
+            ruleId: r.ruleId,
+            ruleTitle: r.ruleTitle,
+            ruleSource: r.ruleSource,
+            status: r.status,
+            outcome: r.outcome ?? null,
+            method: r.method ?? null,
+            needsHuman: r.needsHuman ?? false,
+            evidence: r.evidence,
+        })),
+    };
+    return JSON.stringify(report, null, 2);
+}

package/dist/types.d.ts

@@ -64,7 +64,7 @@ export type CheckOutcome = "pass" | "fail"
 /** How a verdict was reached. A verdict with no method is a verdict with no standing. */
 export type CheckMethod = "text_scan" | "file_events" | "git_events" | "code_content" | "edit_test_pairing" | "claim_vs_evidence" | "model_judgment"
 /** Nothing ran. */
- | "none" | "emoji_output";
+ | "none" | "emoji_output" | "attribution_scan" | "approval_gate";
 export interface CheckResult {
     ruleId: string;
     ruleTitle: string;

package/dist/updateCheck.d.ts

@@ -0,0 +1,11 @@
+export declare function isUpdateCheckEnabled(flag: boolean): boolean;
+/** True if enough time has passed since the last check (or there was none). */
+export declare function shouldCheckNow(now: number, lastCheck: number | null, intervalMs?: number): boolean;
+/** The nudge, or null if the current version is already latest (or newer). */
+export declare function renderUpdateNudge(current: string, latest: string): string | null;
+/**
+ * Orchestration: only when enabled, only when due, fetch the latest version
+ * and nudge if newer. Records the check time even on failure so a flaky
+ * network does not turn into a ping on every single run.
+ */
+export declare function maybeCheckUpdates(current: string, enabled: boolean, log?: (s: string) => void): Promise<void>;

package/dist/updateCheck.js

@@ -0,0 +1,92 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { compareVersions } from "./whatsNew.js";
+/**
+ * The online complement to the offline "what's new" footer: tell someone on
+ * an old global install that a newer version exists.
+ *
+ * OPT-IN, never by default. RuleReceipt's whole promise is that it makes no
+ * network call you did not ask for — telemetry is opt-in for the same reason,
+ * and an auditing tool that quietly phones a registry is the hypocrisy it
+ * exists to catch. Enabled only by --check-updates or RULERECEIPT_CHECK_UPDATES=1,
+ * cached so it pings at most once a day, and fails open on any error.
+ */
+const REGISTRY = "https://registry.npmjs.org/rulereceipt/latest";
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+function stampPath() {
+    return join(homedir(), ".rulereceipt", "last-update-check");
+}
+export function isUpdateCheckEnabled(flag) {
+    if (flag)
+        return true;
+    const env = process.env.RULERECEIPT_CHECK_UPDATES;
+    return env === "1" || env === "true";
+}
+/** True if enough time has passed since the last check (or there was none). */
+export function shouldCheckNow(now, lastCheck, intervalMs = CHECK_INTERVAL_MS) {
+    if (lastCheck === null)
+        return true;
+    return now - lastCheck >= intervalMs;
+}
+function readLastCheck() {
+    try {
+        const n = parseInt(readFileSync(stampPath(), "utf-8").trim(), 10);
+        return Number.isFinite(n) ? n : null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeLastCheck(now) {
+    try {
+        const dir = join(homedir(), ".rulereceipt");
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        writeFileSync(stampPath(), String(now), "utf-8");
+    }
+    catch {
+        // best-effort
+    }
+}
+/** The nudge, or null if the current version is already latest (or newer). */
+export function renderUpdateNudge(current, latest) {
+    if (compareVersions(latest, current) <= 0)
+        return null;
+    return `\nA newer rulereceipt is available: v${latest} (you have v${current}). Update with: npx rulereceipt@latest`;
+}
+async function fetchLatestVersion() {
+    try {
+        const res = await fetch(REGISTRY, { signal: AbortSignal.timeout(2000) });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        return typeof body.version === "string" ? body.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Orchestration: only when enabled, only when due, fetch the latest version
+ * and nudge if newer. Records the check time even on failure so a flaky
+ * network does not turn into a ping on every single run.
+ */
+export async function maybeCheckUpdates(current, enabled, log = console.log) {
+    try {
+        if (!enabled)
+            return;
+        if (!shouldCheckNow(Date.now(), readLastCheck()))
+            return;
+        writeLastCheck(Date.now());
+        const latest = await fetchLatestVersion();
+        if (!latest)
+            return;
+        const nudge = renderUpdateNudge(current, latest);
+        if (nudge)
+            log(nudge);
+    }
+    catch {
+        // never let an update check affect the run
+    }
+}

package/dist/whatsNew.js

@@ -14,6 +14,14 @@ import { join } from "node:path";
  * overstates is the exact failure this tool exists to catch.
  */
 export const RELEASES = [
+    {
+        version: "0.1.46",
+        highlights: [
+            "Run RuleReceipt in CI: `--json` output, `verify-receipt`, and a GitHub Action (uses: rulereceipt/rulereceipt).",
+            "`rulereceipt init` for guided setup, and per-rule warnings via .rulereceipt/config.json so CI gates on what matters.",
+            "A README status badge (`rulereceipt badge`), and opt-in `--check-updates`.",
+        ],
+    },
     { version: "0.1.45", highlights: ["The tool now shows what's improved since you last ran it, like this note."] },
     { version: "0.1.44", highlights: ["The report now offers to install enforcement, but only when a rule was actually broken."] },
     { version: "0.1.43", highlights: ["New check: a claim to have read or verified something, with nothing in the session behind it."] },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "description": "Checks whether a Claude Code session actually followed your CLAUDE.md / AGENTS.md rules, with evidence.",
   "repository": {
     "type": "git",