rulereceipt 0.1.67 → 0.1.69

package/dist/browser/evaluateBrowser.js

@@ -11,6 +11,7 @@ import { runEmojiChecks } from "../checks/emojiOutput.js";
 import { runAttributionChecks } from "../checks/attribution.js";
 import { runApprovalGateChecks } from "../checks/approvalGate.js";
 import { touchedPaths, ruleWasLoaded } from "../checks/pathScope.js";
+import { downgradeUserAsked } from "../checks/userAsked.js";
 /**
  * Evaluate a session against rules ENTIRELY in the browser — the same checkers
  * the CLI uses, run on a file the user dropped, with nothing leaving the page.
@@ -62,7 +63,8 @@ export function evaluateBrowserSession(rulesText, sessionText) {
         needsHuman: true,
         evidence: "",
     }));
-    return [...deterministicResults, ...judgmentResults, ...scopeResults];
+    const structural = downgradeUserAsked(deterministicResults, classifications, events);
+    return [...structural, ...judgmentResults, ...scopeResults];
 }
 /** The whole client-side session check: parse, evaluate, and count. */
 export function checkSessionInBrowser(rulesText, sessionText) {

package/dist/checks/claimEvidence.js

@@ -83,7 +83,9 @@ const ACTION_CLAIMS = [
         // Idioms that borrow "pushed" but aren't a git push. "pushed the fix/code/
         // changes/branch to <remote>" stays a claim; effort/figurative senses do
         // not (finding #6, 2026-09-26).
-        exclude: /\bpushed\s+(?:back|for|through|forward|ahead|past|hard|on|myself|ourselves|yourself|themselves|the\s+(?:boundar|button|envelope|limit|deadline|pace)|to\s+(?:get|finish|complete|ship|meet|hit|make|wrap|move))/i,
+        // "pushed nothing/none" is a statement that NO push happened — the opposite
+        // of a push claim (finding 2026-09-29, false-accusation corpus run).
+        exclude: /\bpushed\s+(?:back|for|through|forward|ahead|past|hard|on|nothing|none|myself|ourselves|yourself|themselves|the\s+(?:boundar|button|envelope|limit|deadline|pace)|to\s+(?:get|finish|complete|ship|meet|hit|make|wrap|move))/i,
         command: /\bgit\s+push\b/i,
     },
     {

package/dist/checks/classify.js

@@ -312,6 +312,28 @@ function isContentToken(literal) {
         return false;
     return (literal.match(/[A-Za-z0-9]/g) ?? []).length >= 3;
 }
+/**
+ * A file/directory/route token, as opposed to a code construct or an import
+ * specifier. It names a PATH, so searching file CONTENT for it (codeContent's
+ * job) matches every import, changelog line, package.json entry or prose that
+ * merely MENTIONS the path — a "found `dist/` written into a file" false
+ * accusation. Found in the false-accusation corpus run 2026-09-29: ~30 distinct
+ * FAIL texts were exactly this (`dist/`, `src/`, `README.md`, `AGENTS.md`,
+ * `./types`, `/status`, …). These belong to fileLifecycle (a path mutation) or,
+ * absent a mutation verb, to the deterministic checker, which reports UNCLEAR
+ * rather than fabricating a FAIL.
+ *
+ * Deliberately NARROW so real import specifiers stay checkable: `lucide-react`
+ * and `@scope/pkg` are NOT file tokens (no leading `./` or `/`, no trailing
+ * `/`, no file extension), so a "never import X" rule keeps working.
+ */
+const FILE_EXTENSION = /\.(json|ya?ml|toml|md|mdx|env|lock|ini|cfg|conf|xml|txt|js|jsx|mjs|cjs|ts|tsx|py|rb|go|rs|sh|sql|css|scss|html)$/i;
+function looksLikeFilePathToken(literal) {
+    return (/\/$/.test(literal) || // trailing slash: a directory ("dist/", "src/")
+        /^(?:\.{1,2}\/|\/)/.test(literal) || // leading ./ ../ or /: a path or route
+        FILE_EXTENSION.test(literal) // a bare filename with a known extension
+    );
+}
 // Catches rules like "add tests for every change" or "every new function
 // needs a test" - no literal backtick token to pattern-match, so without
 // this they'd fall all the way through to judgment (an LLM call) even
@@ -743,7 +765,11 @@ export function classifyRule(rule) {
     // only, so this is an action not a mention. Plain words and shell commands
     // are excluded by isContentToken; protected files already routed above.
     if (polarity === "forbid") {
-        const contentTokens = [...patterns].filter(isContentToken);
+        // A file/dir/route token is a path reference, not code to search for inside
+        // file content — routing it to codeContent produces "found `dist/` written
+        // into a file" on any mention. Excluded here; it falls through to the
+        // deterministic checker (UNCLEAR, never a fabricated FAIL).
+        const contentTokens = [...patterns].filter((p) => isContentToken(p) && !looksLikeFilePathToken(p));
         if (contentTokens.length > 0) {
             return { kind: "codeContent", rule, patterns: contentTokens, polarity, polarityInferred };
         }

package/dist/checks/codeContent.js

@@ -47,8 +47,28 @@ function editedContentFromEvent(event) {
  */
 function containsCall(content, pattern) {
     const leadsWithIdentifier = /^[A-Za-z0-9_$]/.test(pattern);
-    if (!leadsWithIdentifier)
-        return content.includes(pattern);
+    if (!leadsWithIdentifier) {
+        // A CALL like `.forEach(` legitimately follows an object (`arr.forEach()`),
+        // so member access before it is fine — bare containment.
+        if (pattern.endsWith("("))
+            return content.includes(pattern);
+        // A punct-leading NON-call token (a dotfile/extension like `.env`, `.log`)
+        // sitting right after an identifier is a property access or the tail of a
+        // longer token, not the token itself: `.env` inside `process.env` is not
+        // the .env file. Require a non-identifier char (or the start) before it.
+        // Found in the false-accusation corpus run 2026-09-29 — a `.env` rule
+        // FAILed every file using `process.env`.
+        let fromPunct = 0;
+        for (;;) {
+            const at = content.indexOf(pattern, fromPunct);
+            if (at === -1)
+                return false;
+            const before = at === 0 ? "" : content[at - 1];
+            if (!/[A-Za-z0-9_$]/.test(before))
+                return true;
+            fromPunct = at + 1;
+        }
+    }
     let from = 0;
     for (;;) {
         const at = content.indexOf(pattern, from);

package/dist/checks/userAsked.d.ts

@@ -0,0 +1,15 @@
+import type { TranscriptEvent, CheckResult } from "../types.js";
+import type { Classification } from "./classify.js";
+/**
+ * The user's quote if a user message in this session explicitly instructed one
+ * of the rule's forbidden subjects; otherwise null. Only user text is read
+ * (never the agent's own words, never tool output).
+ */
+export declare function userAskedFor(events: TranscriptEvent[], subjects: string[]): string | null;
+/**
+ * Downgrades a structured FAIL to "can't tell" when the user explicitly asked
+ * for the rule's forbidden subject. Only ever FAIL -> UNCLEAR, never the
+ * reverse — so it can only remove a false accusation. Shared by the CLI and the
+ * browser evaluator so the two never disagree about it.
+ */
+export declare function downgradeUserAsked(results: CheckResult[], classifications: Classification[], events: TranscriptEvent[]): CheckResult[];

package/dist/checks/userAsked.js

@@ -0,0 +1,122 @@
+/**
+ * "You asked for it" — for every structured rule, not just push/commit/pr.
+ *
+ * If the agent did the thing a rule forbids, but the USER explicitly told it to
+ * in this session, that is the user overriding their own rule, not the agent
+ * breaking it. The report must not accuse the agent of it. approvalGate already
+ * does this for push/commit/pr/delete; this generalises it to the other
+ * structured checkers (a forbidden branch, file, or code token).
+ *
+ * It ONLY ever downgrades a FAIL to "can't tell" (with the user's quote) — it
+ * can never create a FAIL — so, like every other moat fix, it can only remove
+ * a false accusation. It is deliberately conservative to protect DETECTION: the
+ * user's message must name the rule's specific subject, not be negated, and not
+ * be a question about it. A vague "ship it" is not "push to `main`", so a real
+ * violation there still stands.
+ */
+/** The forbidden thing was named, not negated ("don't edit .env" is not a yes). */
+function negatedBefore(text, at) {
+    const before = text.slice(Math.max(0, at - 32), at);
+    return /\b(?:don'?t|do\s+not|never|no|not\s+yet|without|avoid|stop|hold\s+off(?:\s+on)?|refrain\s+from)\b[\s\w'-]{0,16}$/i.test(before);
+}
+/** A clause that only ASKS about the subject ("should we edit .env?") is not an instruction. */
+function isQuestionClause(clause) {
+    return /\?/.test(clause) || /^\s*(?:should|could|would|why|what|whether|is|are|do|does|can|shall|may)\b/i.test(clause.trim());
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * A regex that matches the rule's subject as a whole token, so `.env` does not
+ * match inside `.env.example` and `main` does not match inside `maintain`.
+ * A trailing `(` on a code token (`console.log(`) is dropped for matching.
+ */
+function subjectMatcher(subject) {
+    const bare = subject.replace(/\($/, "").trim();
+    const leadBoundary = /^[\w]/.test(bare) ? "(?<![\\w-])" : "";
+    const trailBoundary = /[\w]$/.test(bare) ? "(?![\\w.-])" : "(?![\\w.-])";
+    return new RegExp(leadBoundary + escapeRegex(bare) + trailBoundary, "i");
+}
+/**
+ * The user's quote if a user message in this session explicitly instructed one
+ * of the rule's forbidden subjects; otherwise null. Only user text is read
+ * (never the agent's own words, never tool output).
+ */
+export function userAskedFor(events, subjects) {
+    const usable = subjects.map((s) => s.replace(/\($/, "").trim()).filter((s) => s.length >= 2);
+    if (usable.length === 0)
+        return null;
+    for (const e of events) {
+        if (e.kind !== "text" || e.role !== "user")
+            continue;
+        // Look clause by clause, so a negation or question in one sentence doesn't
+        // wrongly clear (or wrongly count) another.
+        for (const clause of e.text.split(/(?<=[.!?\n])\s+/)) {
+            if (isQuestionClause(clause))
+                continue;
+            for (const subject of usable) {
+                const m = clause.match(subjectMatcher(subject));
+                if (!m || m.index === undefined)
+                    continue;
+                if (negatedBefore(clause, m.index))
+                    continue;
+                return clause.replace(/\s+/g, " ").trim().slice(0, 160);
+            }
+        }
+    }
+    return null;
+}
+/** The forbidden subject(s) of a structured classification, or null if it has none we can name. */
+function subjectsOf(c) {
+    switch (c.kind) {
+        case "gitBranchPolicy":
+            return [c.branchName];
+        case "fileLifecycle":
+            return [c.filePath];
+        case "codeContent":
+            return c.patterns;
+        case "emojiOutput":
+            return ["emoji"];
+        default:
+            // attribution deliberately excluded: an AI-attribution trailer is never
+            // something a user meaningfully instructs the agent to author as its own,
+            // and it is the project's own hard rule. approvalGate handles its own asks.
+            return null;
+    }
+}
+function ruleKey(source, id, title) {
+    return `${source}\u0000${id}\u0000${title}`;
+}
+/**
+ * Downgrades a structured FAIL to "can't tell" when the user explicitly asked
+ * for the rule's forbidden subject. Only ever FAIL -> UNCLEAR, never the
+ * reverse — so it can only remove a false accusation. Shared by the CLI and the
+ * browser evaluator so the two never disagree about it.
+ */
+export function downgradeUserAsked(results, classifications, events) {
+    const subjects = new Map();
+    for (const c of classifications) {
+        const s = subjectsOf(c);
+        if (s && s.length > 0)
+            subjects.set(ruleKey(c.rule.source, c.rule.id, c.rule.title), s);
+    }
+    if (subjects.size === 0)
+        return results;
+    return results.map((r) => {
+        if (r.status !== "FAIL")
+            return r;
+        const s = subjects.get(ruleKey(r.ruleSource, r.ruleId, r.ruleTitle));
+        if (!s)
+            return r;
+        const quote = userAskedFor(events, s);
+        if (!quote)
+            return r;
+        return {
+            ...r,
+            status: "UNCLEAR",
+            outcome: "inconclusive",
+            reason: "user_asked",
+            evidence: `the agent did this, but you asked for it in this session: "${quote}" — so this is you overriding your own rule, not the agent breaking it. Original finding: ${r.evidence}`,
+        };
+    });
+}

package/dist/evaluate.js

@@ -10,6 +10,7 @@ import { runAttributionChecks } from "./checks/attribution.js";
 import { runApprovalGateChecks } from "./checks/approvalGate.js";
 import { runJudgmentChecks } from "./checks/judgmentChecks.js";
 import { touchedPaths, ruleWasLoaded } from "./checks/pathScope.js";
+import { downgradeUserAsked } from "./checks/userAsked.js";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -98,7 +99,8 @@ export async function evaluateSession(cwd, rules, events, llm, needsLlmResult) {
     const judgmentResults = llm
         ? await runJudgmentChecks(judgment, events)
         : judgment.map(({ rule }) => needsLlmResult(rule));
-    const results = [...deterministicResults, ...judgmentResults, ...scopeResults, ...future.map(futureResult)];
+    const structuralResults = downgradeUserAsked(deterministicResults, classifications, events);
+    const results = [...structuralResults, ...judgmentResults, ...scopeResults, ...future.map(futureResult)];
     return {
         results: attachSourceLocation(results, rules),
         notARule: of("notARule"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.67",
+  "version": "0.1.69",
   "description": "Checks whether your AI coding agent followed your rules, with evidence. Works with Claude Code (Codex in testing); reads CLAUDE.md, AGENTS.md, Cursor, Copilot and Windsurf rules.",
   "repository": {
     "type": "git",
@@ -48,7 +48,7 @@
     "verify": "npm run lint && npm run typecheck && npm test"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {