rulereceipt 0.1.60 → 0.1.61

package/dist/checks/classify.js

@@ -551,7 +551,11 @@ function isEmojiRule(rule) {
  * rule, so the check is dogfooded on every session here.
  */
 const ATTRIBUTION_SUBJECT = /co-?authored-by|generated with\s*\[?\s*claude|\bai\b[^.\n]{0,20}(?:trace|attribution|authorship)|\battribution\b/i;
-const ATTRIBUTION_CONTEXT = /\b(?:commit|git|pull request|\bpr\b|github|co-?author)\b/i;
+// Plural and verb forms count: "no Co-Authored-By on commits" / "when
+// committing" / "on PRs" are the same rule as the singular. `\bcommit\b` alone
+// missed "commits"/"committing" and left the rule at judgment (KNOWN-GAPS,
+// fixed 2026-09-28).
+const ATTRIBUTION_CONTEXT = /\b(?:commit(?:s|ted|ting|ment|ments)?|git|pull\s+requests?|prs?|github|co-?authors?)\b/i;
 const ATTRIBUTION_FORBID = /\b(?:no|never|don't|do not|without|must not|shall not|not add|zero|forbid)\b/i;
 function isAttributionRule(rule) {
     const text = `${rule.title} ${rule.text}`;

package/dist/checks/selfEditedRules.d.ts

@@ -0,0 +1,3 @@
+import type { TranscriptEvent } from "../types.js";
+/** Rules/settings files the session wrote to, deduped, in first-seen order. */
+export declare function detectSelfEditedRuleFiles(events: TranscriptEvent[]): string[];

package/dist/checks/selfEditedRules.js

@@ -0,0 +1,69 @@
+import { withoutHeredocs } from "./shellCommand.js";
+/**
+ * Did the session EDIT the rules or agent-settings it is being judged by?
+ *
+ * A verdict is about the rules as they are NOW. If the agent rewrote CLAUDE.md,
+ * `.claude/settings.json` or `.rulereceipt/` during the session, the report
+ * should say so out loud — "Claude changed CLAUDE.md this session, then passed
+ * its own rules" is exactly what a reader needs to know. This is a NOTE, never a
+ * FAIL: editing a rules file is not itself a violation, and plenty of legitimate
+ * work does it (a session that adds a rule, `init`, a settings tweak). Added
+ * 2026-09-28. Reading a rules file (Read / `cat` / `grep`) is not editing and
+ * never warns — only a write whose target is a rules/settings file counts.
+ */
+/** A rules or agent-settings file, matched by path suffix. */
+const RULE_FILE = /(?:^|[\\/])(?:CLAUDE(?:\.local)?\.md|AGENTS(?:\.local)?\.md|AGENT\.md|GEMINI\.md|\.cursorrules|\.windsurfrules|copilot-instructions\.md|settings(?:\.local)?\.json)$|(?:^|[\\/])\.claude[\\/]rules[\\/][^\\/]+$|(?:^|[\\/])\.cursor[\\/]rules[\\/][^\\/]+$|(?:^|[\\/])\.agents[\\/]rules[\\/][^\\/]+$|(?:^|[\\/])\.rulereceipt[\\/].+$/i;
+function editTargetPath(input) {
+    const o = input;
+    const p = o?.file_path ?? o?.notebook_path ?? o?.path;
+    return typeof p === "string" ? p : "";
+}
+/**
+ * Rules files a shell command WRITES to: a `>`/`>>`/`tee` target, a `sed -i`
+ * file argument, or a `cp`/`mv`/`install` destination. A rules file that is only
+ * read (`cat f`, `grep x f`, `sed -n p f`) is never a write target and does not
+ * match — the same read-vs-write distinction the code checks already draw.
+ */
+function shellWriteTargets(command) {
+    const cmd = withoutHeredocs(command);
+    const hits = new Set();
+    // redirect / tee target
+    for (const m of cmd.matchAll(/(?:>>?|\btee\s+(?:-a\s+)?)\s*("?)([^\s"'|;&<>()]+)\1/g)) {
+        if (RULE_FILE.test(m[2]))
+            hits.add(m[2]);
+    }
+    // sed -i edits its file argument(s) in place
+    if (/\bsed\s+-i/.test(cmd)) {
+        for (const m of cmd.matchAll(/(\S+)/g))
+            if (RULE_FILE.test(m[1]))
+                hits.add(m[1]);
+    }
+    // cp / mv / install: the destination is the last non-option argument
+    for (const m of cmd.matchAll(/\b(?:cp|mv|install)\b([^|;&]*)/g)) {
+        const args = m[1].trim().split(/\s+/).filter((a) => a && !a.startsWith("-"));
+        const dest = args[args.length - 1];
+        if (dest && RULE_FILE.test(dest))
+            hits.add(dest);
+    }
+    return [...hits];
+}
+/** Rules/settings files the session wrote to, deduped, in first-seen order. */
+export function detectSelfEditedRuleFiles(events) {
+    const found = new Set();
+    for (const e of events) {
+        if (e.kind !== "tool_use")
+            continue;
+        if (e.toolName === "Write" || e.toolName === "Edit" || e.toolName === "MultiEdit" || e.toolName === "NotebookEdit") {
+            const p = editTargetPath(e.input);
+            if (p && RULE_FILE.test(p))
+                found.add(p);
+        }
+        else if (e.toolName === "Bash") {
+            const c = e.input?.command;
+            if (typeof c === "string")
+                for (const f of shellWriteTargets(c))
+                    found.add(f);
+        }
+    }
+    return [...found];
+}

package/dist/cli.js

@@ -15,6 +15,7 @@ import { auditSessions, renderComplianceReport } from "./report/complianceReport
 import { auditProject, renderProjectAudit } from "./audit.js";
 import { evaluateSession } from "./evaluate.js";
 import { buildWrongReport, findTarget } from "./wrong.js";
+import { detectSelfEditedRuleFiles } from "./checks/selfEditedRules.js";
 import { loadOverrides, saveOverride, clearOverride, staleOverrides, ruleFingerprint, OVERRIDES_PATH } from "./overrides.js";
 import { runHook } from "./hook.js";
 import { runGuard } from "./guard.js";
@@ -232,13 +233,24 @@ async function runCheck(opts) {
     const blockingFails = blockingFailures(results, projectConfig, handleFor);
     const warnedFails = warningFailures(results, projectConfig, handleFor);
     const meta = { sessionFilePath, ruleCount: results.length };
+    // A NOTE, never a verdict: if the session rewrote the rules or settings it is
+    // being judged by, say so at the top. "Claude changed CLAUDE.md this session,
+    // then passed its own rules" is exactly what a reader needs to know.
+    const editedRuleFiles = detectSelfEditedRuleFiles(events);
+    const editedNote = editedRuleFiles.length > 0
+        ? `Note: the agent changed ${editedRuleFiles.length === 1 ? "a rules/settings file" : `${editedRuleFiles.length} rules/settings files`} during this session (${editedRuleFiles
+            .map((f) => f.replace(`${cwd}/`, ""))
+            .join(", ")}). The verdicts below are against the rules as they are now.`
+        : "";
     // Kept in human/markdown form for --email and any other reader below, even
     // when stdout is JSON — a manager gets a readable report, not raw JSON.
     const reportText = markdown ? generateMarkdownReport(results, meta) : generateReport(results, meta);
     if (json) {
-        console.log(generateJsonReport(results, meta, pkg.version));
+        console.log(generateJsonReport(results, meta, pkg.version, editedRuleFiles));
     }
     else {
+        if (editedNote)
+            console.log(`${editedNote}\n`);
         console.log(reportText);
         // Name the tool when it is not the default Claude Code, so a Codex run is
         // not silently reported as if it were a Claude session.

package/dist/report/generateReport.d.ts

@@ -24,4 +24,4 @@ export declare function generateMarkdownReport(results: CheckResult[], meta: Rep
  * way as every other output: a hostile CLAUDE.md does not get to smuggle
  * control characters through the JSON either.
  */
-export declare function generateJsonReport(results: CheckResult[], meta: ReportMeta, toolVersion: string): string;
+export declare function generateJsonReport(results: CheckResult[], meta: ReportMeta, toolVersion: string, editedRuleFiles?: string[]): string;

package/dist/report/generateReport.js

@@ -277,7 +277,7 @@ export function generateMarkdownReport(results, meta) {
  * way as every other output: a hostile CLAUDE.md does not get to smuggle
  * control characters through the JSON either.
  */
-export function generateJsonReport(results, meta, toolVersion) {
+export function generateJsonReport(results, meta, toolVersion, editedRuleFiles = []) {
     const clean = results.map(sanitize);
     const count = (s) => clean.filter((r) => r.status === s).length;
     const report = {
@@ -289,6 +289,9 @@ export function generateJsonReport(results, meta, toolVersion) {
             path: meta.sessionFilePath,
             sha256: computeTranscriptHash(meta.sessionFilePath),
         },
+        // Rules/settings files the session itself edited (a NOTE, not a verdict):
+        // the verdicts are against the rules as they are now.
+        agentEditedRuleFiles: editedRuleFiles,
         summary: {
             total: clean.length,
             pass: count("PASS"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.60",
+  "version": "0.1.61",
   "description": "Checks whether your AI coding agent followed your rules, with evidence. Works with Claude Code (Codex in testing); reads CLAUDE.md, AGENTS.md, Cursor, Copilot and Windsurf rules.",
   "repository": {
     "type": "git",