rulereceipt 0.1.60 → 0.1.62

package/dist/checks/classify.js

@@ -551,7 +551,11 @@ function isEmojiRule(rule) {
  * rule, so the check is dogfooded on every session here.
  */
 const ATTRIBUTION_SUBJECT = /co-?authored-by|generated with\s*\[?\s*claude|\bai\b[^.\n]{0,20}(?:trace|attribution|authorship)|\battribution\b/i;
-const ATTRIBUTION_CONTEXT = /\b(?:commit|git|pull request|\bpr\b|github|co-?author)\b/i;
+// Plural and verb forms count: "no Co-Authored-By on commits" / "when
+// committing" / "on PRs" are the same rule as the singular. `\bcommit\b` alone
+// missed "commits"/"committing" and left the rule at judgment (KNOWN-GAPS,
+// fixed 2026-09-28).
+const ATTRIBUTION_CONTEXT = /\b(?:commit(?:s|ted|ting|ment|ments)?|git|pull\s+requests?|prs?|github|co-?authors?)\b/i;
 const ATTRIBUTION_FORBID = /\b(?:no|never|don't|do not|without|must not|shall not|not add|zero|forbid)\b/i;
 function isAttributionRule(rule) {
     const text = `${rule.title} ${rule.text}`;

package/dist/checks/selfEditedRules.d.ts

@@ -0,0 +1,3 @@
+import type { TranscriptEvent } from "../types.js";
+/** Rules/settings files the session wrote to, deduped, in first-seen order. */
+export declare function detectSelfEditedRuleFiles(events: TranscriptEvent[]): string[];

package/dist/checks/selfEditedRules.js

@@ -0,0 +1,69 @@
+import { withoutHeredocs } from "./shellCommand.js";
+/**
+ * Did the session EDIT the rules or agent-settings it is being judged by?
+ *
+ * A verdict is about the rules as they are NOW. If the agent rewrote CLAUDE.md,
+ * `.claude/settings.json` or `.rulereceipt/` during the session, the report
+ * should say so out loud — "Claude changed CLAUDE.md this session, then passed
+ * its own rules" is exactly what a reader needs to know. This is a NOTE, never a
+ * FAIL: editing a rules file is not itself a violation, and plenty of legitimate
+ * work does it (a session that adds a rule, `init`, a settings tweak). Added
+ * 2026-09-28. Reading a rules file (Read / `cat` / `grep`) is not editing and
+ * never warns — only a write whose target is a rules/settings file counts.
+ */
+/** A rules or agent-settings file, matched by path suffix. */
+const RULE_FILE = /(?:^|[\\/])(?:CLAUDE(?:\.local)?\.md|AGENTS(?:\.local)?\.md|AGENT\.md|GEMINI\.md|\.cursorrules|\.windsurfrules|copilot-instructions\.md|settings(?:\.local)?\.json)$|(?:^|[\\/])\.claude[\\/]rules[\\/][^\\/]+$|(?:^|[\\/])\.cursor[\\/]rules[\\/][^\\/]+$|(?:^|[\\/])\.agents[\\/]rules[\\/][^\\/]+$|(?:^|[\\/])\.rulereceipt[\\/].+$/i;
+function editTargetPath(input) {
+    const o = input;
+    const p = o?.file_path ?? o?.notebook_path ?? o?.path;
+    return typeof p === "string" ? p : "";
+}
+/**
+ * Rules files a shell command WRITES to: a `>`/`>>`/`tee` target, a `sed -i`
+ * file argument, or a `cp`/`mv`/`install` destination. A rules file that is only
+ * read (`cat f`, `grep x f`, `sed -n p f`) is never a write target and does not
+ * match — the same read-vs-write distinction the code checks already draw.
+ */
+function shellWriteTargets(command) {
+    const cmd = withoutHeredocs(command);
+    const hits = new Set();
+    // redirect / tee target
+    for (const m of cmd.matchAll(/(?:>>?|\btee\s+(?:-a\s+)?)\s*("?)([^\s"'|;&<>()]+)\1/g)) {
+        if (RULE_FILE.test(m[2]))
+            hits.add(m[2]);
+    }
+    // sed -i edits its file argument(s) in place
+    if (/\bsed\s+-i/.test(cmd)) {
+        for (const m of cmd.matchAll(/(\S+)/g))
+            if (RULE_FILE.test(m[1]))
+                hits.add(m[1]);
+    }
+    // cp / mv / install: the destination is the last non-option argument
+    for (const m of cmd.matchAll(/\b(?:cp|mv|install)\b([^|;&]*)/g)) {
+        const args = m[1].trim().split(/\s+/).filter((a) => a && !a.startsWith("-"));
+        const dest = args[args.length - 1];
+        if (dest && RULE_FILE.test(dest))
+            hits.add(dest);
+    }
+    return [...hits];
+}
+/** Rules/settings files the session wrote to, deduped, in first-seen order. */
+export function detectSelfEditedRuleFiles(events) {
+    const found = new Set();
+    for (const e of events) {
+        if (e.kind !== "tool_use")
+            continue;
+        if (e.toolName === "Write" || e.toolName === "Edit" || e.toolName === "MultiEdit" || e.toolName === "NotebookEdit") {
+            const p = editTargetPath(e.input);
+            if (p && RULE_FILE.test(p))
+                found.add(p);
+        }
+        else if (e.toolName === "Bash") {
+            const c = e.input?.command;
+            if (typeof c === "string")
+                for (const f of shellWriteTargets(c))
+                    found.add(f);
+        }
+    }
+    return [...found];
+}

package/dist/cli.js

@@ -15,6 +15,7 @@ import { auditSessions, renderComplianceReport } from "./report/complianceReport
 import { auditProject, renderProjectAudit } from "./audit.js";
 import { evaluateSession } from "./evaluate.js";
 import { buildWrongReport, findTarget } from "./wrong.js";
+import { detectSelfEditedRuleFiles } from "./checks/selfEditedRules.js";
 import { loadOverrides, saveOverride, clearOverride, staleOverrides, ruleFingerprint, OVERRIDES_PATH } from "./overrides.js";
 import { runHook } from "./hook.js";
 import { runGuard } from "./guard.js";
@@ -232,13 +233,24 @@ async function runCheck(opts) {
     const blockingFails = blockingFailures(results, projectConfig, handleFor);
     const warnedFails = warningFailures(results, projectConfig, handleFor);
     const meta = { sessionFilePath, ruleCount: results.length };
+    // A NOTE, never a verdict: if the session rewrote the rules or settings it is
+    // being judged by, say so at the top. "Claude changed CLAUDE.md this session,
+    // then passed its own rules" is exactly what a reader needs to know.
+    const editedRuleFiles = detectSelfEditedRuleFiles(events);
+    const editedNote = editedRuleFiles.length > 0
+        ? `Note: the agent changed ${editedRuleFiles.length === 1 ? "a rules/settings file" : `${editedRuleFiles.length} rules/settings files`} during this session (${editedRuleFiles
+            .map((f) => f.replace(`${cwd}/`, ""))
+            .join(", ")}). The verdicts below are against the rules as they are now.`
+        : "";
     // Kept in human/markdown form for --email and any other reader below, even
     // when stdout is JSON — a manager gets a readable report, not raw JSON.
     const reportText = markdown ? generateMarkdownReport(results, meta) : generateReport(results, meta);
     if (json) {
-        console.log(generateJsonReport(results, meta, pkg.version));
+        console.log(generateJsonReport(results, meta, pkg.version, editedRuleFiles));
     }
     else {
+        if (editedNote)
+            console.log(`${editedNote}\n`);
         console.log(reportText);
         // Name the tool when it is not the default Claude Code, so a Codex run is
         // not silently reported as if it were a Claude session.

package/dist/guard.d.ts

@@ -73,6 +73,6 @@ export interface GuardDecision {
  */
 export declare function guardDecision(cwd: string, toolName: string, toolInput: {
     command?: unknown;
-} & Record<string, unknown>, events?: TranscriptEvent[]): GuardDecision;
+} & Record<string, unknown>, events?: TranscriptEvent[], permissionMode?: string): GuardDecision;
 export declare function runGuard(): Promise<void>;
 export {};

package/dist/guard.js

@@ -6,8 +6,39 @@ import { runGitBranchPolicyChecks } from "./checks/gitBranchPolicy.js";
 import { runAttributionChecks } from "./checks/attribution.js";
 import { loadOverrides, ruleFingerprint, ratifiedForbids } from "./overrides.js";
 import { commandRunsLiteral } from "./checks/proposedAction.js";
-import { approvalOccurrences } from "./checks/approvalGate.js";
+import { approvalOccurrences, allowListed } from "./checks/approvalGate.js";
 import { readTranscriptFromFile } from "./parsers/transcriptParser.js";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+ * Modes where Claude Code shows NO permission prompt, so a hook's "ask" is
+ * ignored and the call just runs (Claude Code #89561; "ask" also drops bypass
+ * mode, #37420; headless silently denies, #95726). In these the only thing that
+ * actually stops an unapproved gated action is a real deny.
+ */
+const NO_PROMPT_MODES = new Set(["bypassPermissions", "auto", "dontAsk"]);
+/**
+ * `permissions.deny` from the Claude Code settings that apply here. If the user
+ * already denies a command, the guard must NOT answer "ask" for it — an "ask"
+ * can switch a deny off and let the command run with no prompt (Claude Code
+ * #39344). So a command the user denies is left entirely to Claude Code's own
+ * deny; the guard stands aside.
+ */
+function claudeDenyList(cwd) {
+    const out = [];
+    for (const p of [join(cwd, ".claude", "settings.json"), join(cwd, ".claude", "settings.local.json"), join(homedir(), ".claude", "settings.json")]) {
+        try {
+            const deny = JSON.parse(readFileSync(p, "utf-8")).permissions?.deny;
+            if (Array.isArray(deny))
+                out.push(...deny.filter((x) => typeof x === "string"));
+        }
+        catch {
+            /* absent or unreadable */
+        }
+    }
+    return out;
+}
 function readStdin() {
     return new Promise((resolve) => {
         let data = "";
@@ -148,19 +179,20 @@ function reason(blocks) {
  * The approval half of the guard. Uses the same per-action logic as the report
  * (approvalOccurrences) so the two can never disagree: the proposed call is
  * appended to the session as if no prompt were possible, and if the report
- * would call it unapproved, the guard asks.
+ * would call it unapproved, this returns the rule and action so the caller can
+ * decide — by the current permission mode — whether to ask or to deny.
  */
-function approvalAsk(cwd, command, events) {
+function unapprovedGate(cwd, command, events) {
     const gates = classifyRules(loadRules(cwd)).filter((c) => c.kind === "approvalGate");
     for (const { rule, actions } of gates) {
         const proposed = { role: "assistant", kind: "tool_use", toolName: "Bash", input: { command }, timestamp: "", permissionMode: "dontAsk" };
         const occ = approvalOccurrences([...events, proposed], actions);
         const last = occ[occ.length - 1];
         if (last && last.command === command.replace(/\s+/g, " ").trim().slice(0, 80) && last.verdict !== "approved") {
-            return `RuleReceipt: your rule "${rule.title.slice(0, 120)}" needs your OK for this ${last.action}, and nothing in this session approved it yet.`;
+            return { rule, action: last.action };
         }
     }
-    return "";
+    return null;
 }
 /**
  * The allow/deny decision for one proposed tool call, with no I/O.
@@ -173,7 +205,7 @@ function approvalAsk(cwd, command, events) {
  * thin when it lands. Same reasoning as evaluateSession: one body of code so
  * two callers can never disagree about whether a rule was broken.
  */
-export function guardDecision(cwd, toolName, toolInput, events = []) {
+export function guardDecision(cwd, toolName, toolInput, events = [], permissionMode) {
     const allow = { deny: false, reason: "", blocks: [] };
     if (loadRules(cwd).length === 0)
         return allow;
@@ -197,10 +229,37 @@ export function guardDecision(cwd, toolName, toolInput, events = []) {
     }
     if (blocks.length > 0)
         return { deny: true, reason: reason(blocks), blocks };
+    // Approval gates ("never push/commit without asking"). What we answer depends
+    // on the permission mode, because a hook's "ask" is only honoured in the modes
+    // that actually show a prompt (Claude Code #89561/#37420/#95726):
+    //   - the user already DENIES this command   -> stand aside (never weaken a
+    //     deny with an "ask", #39344); Claude Code's own deny handles it.
+    //   - no-prompt mode (bypass/auto/dontAsk) or headless -> real DENY with a
+    //     reason, because "ask" is ignored there and would let the push run. The
+    //     per-action check clears it after the user says yes in chat and it retries.
+    //   - default/acceptEdits/plan (or unknown) -> "ask": the prompt appears and
+    //     the user decides. Unknown modes ask rather than deny so we never wrongly
+    //     block a legitimate action.
     if (toolName === "Bash" && typeof toolInput.command === "string") {
-        const ask = approvalAsk(cwd, toolInput.command, events);
-        if (ask)
-            return { deny: false, reason: "", blocks: [], ask };
+        const gate = unapprovedGate(cwd, toolInput.command, events);
+        if (gate) {
+            if (allowListed(toolInput.command, claudeDenyList(cwd)))
+                return allow;
+            const title = gate.rule.title.slice(0, 120);
+            if (permissionMode && NO_PROMPT_MODES.has(permissionMode)) {
+                return {
+                    deny: true,
+                    reason: `RuleReceipt: your rule "${title}" needs your OK for this ${gate.action}. Claude Code does not show a prompt in ${permissionMode} mode, so this call is stopped. Ask the user in the chat; after they say yes, run it again.`,
+                    blocks: [{ rule: gate.rule, why: `${gate.action} with no approval, and no prompt would be shown in ${permissionMode} mode` }],
+                };
+            }
+            return {
+                deny: false,
+                reason: "",
+                blocks: [],
+                ask: `RuleReceipt: your rule "${title}" needs your OK for this ${gate.action}, and nothing in this session approved it yet.`,
+            };
+        }
     }
     return allow;
 }
@@ -223,7 +282,7 @@ export async function runGuard() {
                 /* unreadable: judge the call on its own, which can only ask more, never less */
             }
         }
-        const decision = guardDecision(cwd, tool, toolInput, events);
+        const decision = guardDecision(cwd, tool, toolInput, events, input.permission_mode);
         if (!decision.deny && decision.ask) {
             // "ask" is not a refusal: no exit 2. Claude Code shows its permission
             // prompt with this reason; the user's click decides.

package/dist/report/generateReport.d.ts

@@ -24,4 +24,4 @@ export declare function generateMarkdownReport(results: CheckResult[], meta: Rep
  * way as every other output: a hostile CLAUDE.md does not get to smuggle
  * control characters through the JSON either.
  */
-export declare function generateJsonReport(results: CheckResult[], meta: ReportMeta, toolVersion: string): string;
+export declare function generateJsonReport(results: CheckResult[], meta: ReportMeta, toolVersion: string, editedRuleFiles?: string[]): string;

package/dist/report/generateReport.js

@@ -277,7 +277,7 @@ export function generateMarkdownReport(results, meta) {
  * way as every other output: a hostile CLAUDE.md does not get to smuggle
  * control characters through the JSON either.
  */
-export function generateJsonReport(results, meta, toolVersion) {
+export function generateJsonReport(results, meta, toolVersion, editedRuleFiles = []) {
     const clean = results.map(sanitize);
     const count = (s) => clean.filter((r) => r.status === s).length;
     const report = {
@@ -289,6 +289,9 @@ export function generateJsonReport(results, meta, toolVersion) {
             path: meta.sessionFilePath,
             sha256: computeTranscriptHash(meta.sessionFilePath),
         },
+        // Rules/settings files the session itself edited (a NOTE, not a verdict):
+        // the verdicts are against the rules as they are now.
+        agentEditedRuleFiles: editedRuleFiles,
         summary: {
             total: clean.length,
             pass: count("PASS"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.60",
+  "version": "0.1.62",
   "description": "Checks whether your AI coding agent followed your rules, with evidence. Works with Claude Code (Codex in testing); reads CLAUDE.md, AGENTS.md, Cursor, Copilot and Windsurf rules.",
   "repository": {
     "type": "git",