rulereceipt 0.1.68 → 0.1.70

package/dist/browser/evaluateBrowser.js

@@ -11,6 +11,7 @@ import { runEmojiChecks } from "../checks/emojiOutput.js";
 import { runAttributionChecks } from "../checks/attribution.js";
 import { runApprovalGateChecks } from "../checks/approvalGate.js";
 import { touchedPaths, ruleWasLoaded } from "../checks/pathScope.js";
+import { downgradeUserAsked } from "../checks/userAsked.js";
 /**
  * Evaluate a session against rules ENTIRELY in the browser — the same checkers
  * the CLI uses, run on a file the user dropped, with nothing leaving the page.
@@ -62,7 +63,8 @@ export function evaluateBrowserSession(rulesText, sessionText) {
         needsHuman: true,
         evidence: "",
     }));
-    return [...deterministicResults, ...judgmentResults, ...scopeResults];
+    const structural = downgradeUserAsked(deterministicResults, classifications, events);
+    return [...structural, ...judgmentResults, ...scopeResults];
 }
 /** The whole client-side session check: parse, evaluate, and count. */
 export function checkSessionInBrowser(rulesText, sessionText) {

package/dist/checks/classify.js

@@ -243,6 +243,11 @@ function isClaimEvidenceRule(rule) {
     return CLAIM_SHAPE.test(text) && EVIDENCE_NOUN.test(text);
 }
 const BRANCH_WORD = /\bbranch\b/i;
+// A git ref-action verb. "Never push to `main`" / "don't commit to `master`"
+// are branch rules even without the literal word "branch" — found missed in the
+// 2026-09-29 full-tool validation. Paired with a backticked, branch-shaped
+// literal (and NOT a file token), so a bare English "main" is not swept in.
+const GIT_REF_ACTION = /\b(?:push(?:ing|es|ed)?|commit(?:ting|s|ted)?|merg(?:e|ing|es|ed)|rebas(?:e|ing|es|ed)|checkout)\b/i;
 /**
  * A literal that could actually be a git branch name.
  *
@@ -729,8 +734,10 @@ export function classifyRule(rule) {
     // Real rules here name exactly one branch ("the `demo` branch", "never
     // push to the `main` branch"), and a rule that mentions branches while
     // naming a command belongs to whichever checker handles that command.
-    const branchName = [...patterns].find(isBranchName);
-    if (BRANCH_WORD.test(text) && branchName !== undefined) {
+    // A branch name is a backticked, branch-shaped literal that is NOT a file
+    // token (`.env`, `dist/`) — those belong to fileLifecycle, not a ref check.
+    const branchName = [...patterns].find((p) => isBranchName(p) && !looksLikeFilePathToken(p));
+    if ((BRANCH_WORD.test(text) || GIT_REF_ACTION.test(text)) && branchName !== undefined) {
         return { kind: "gitBranchPolicy", rule, branchName, polarity, polarityInferred };
     }
     // A forbid scoped by a condition the literal checkers cannot evaluate.

package/dist/checks/userAsked.d.ts

@@ -0,0 +1,15 @@
+import type { TranscriptEvent, CheckResult } from "../types.js";
+import type { Classification } from "./classify.js";
+/**
+ * The user's quote if a user message in this session explicitly instructed one
+ * of the rule's forbidden subjects; otherwise null. Only user text is read
+ * (never the agent's own words, never tool output).
+ */
+export declare function userAskedFor(events: TranscriptEvent[], subjects: string[]): string | null;
+/**
+ * Downgrades a structured FAIL to "can't tell" when the user explicitly asked
+ * for the rule's forbidden subject. Only ever FAIL -> UNCLEAR, never the
+ * reverse — so it can only remove a false accusation. Shared by the CLI and the
+ * browser evaluator so the two never disagree about it.
+ */
+export declare function downgradeUserAsked(results: CheckResult[], classifications: Classification[], events: TranscriptEvent[]): CheckResult[];

package/dist/checks/userAsked.js

@@ -0,0 +1,122 @@
+/**
+ * "You asked for it" — for every structured rule, not just push/commit/pr.
+ *
+ * If the agent did the thing a rule forbids, but the USER explicitly told it to
+ * in this session, that is the user overriding their own rule, not the agent
+ * breaking it. The report must not accuse the agent of it. approvalGate already
+ * does this for push/commit/pr/delete; this generalises it to the other
+ * structured checkers (a forbidden branch, file, or code token).
+ *
+ * It ONLY ever downgrades a FAIL to "can't tell" (with the user's quote) — it
+ * can never create a FAIL — so, like every other moat fix, it can only remove
+ * a false accusation. It is deliberately conservative to protect DETECTION: the
+ * user's message must name the rule's specific subject, not be negated, and not
+ * be a question about it. A vague "ship it" is not "push to `main`", so a real
+ * violation there still stands.
+ */
+/** The forbidden thing was named, not negated ("don't edit .env" is not a yes). */
+function negatedBefore(text, at) {
+    const before = text.slice(Math.max(0, at - 32), at);
+    return /\b(?:don'?t|do\s+not|never|no|not\s+yet|without|avoid|stop|hold\s+off(?:\s+on)?|refrain\s+from)\b[\s\w'-]{0,16}$/i.test(before);
+}
+/** A clause that only ASKS about the subject ("should we edit .env?") is not an instruction. */
+function isQuestionClause(clause) {
+    return /\?/.test(clause) || /^\s*(?:should|could|would|why|what|whether|is|are|do|does|can|shall|may)\b/i.test(clause.trim());
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * A regex that matches the rule's subject as a whole token, so `.env` does not
+ * match inside `.env.example` and `main` does not match inside `maintain`.
+ * A trailing `(` on a code token (`console.log(`) is dropped for matching.
+ */
+function subjectMatcher(subject) {
+    const bare = subject.replace(/\($/, "").trim();
+    const leadBoundary = /^[\w]/.test(bare) ? "(?<![\\w-])" : "";
+    const trailBoundary = /[\w]$/.test(bare) ? "(?![\\w.-])" : "(?![\\w.-])";
+    return new RegExp(leadBoundary + escapeRegex(bare) + trailBoundary, "i");
+}
+/**
+ * The user's quote if a user message in this session explicitly instructed one
+ * of the rule's forbidden subjects; otherwise null. Only user text is read
+ * (never the agent's own words, never tool output).
+ */
+export function userAskedFor(events, subjects) {
+    const usable = subjects.map((s) => s.replace(/\($/, "").trim()).filter((s) => s.length >= 2);
+    if (usable.length === 0)
+        return null;
+    for (const e of events) {
+        if (e.kind !== "text" || e.role !== "user")
+            continue;
+        // Look clause by clause, so a negation or question in one sentence doesn't
+        // wrongly clear (or wrongly count) another.
+        for (const clause of e.text.split(/(?<=[.!?\n])\s+/)) {
+            if (isQuestionClause(clause))
+                continue;
+            for (const subject of usable) {
+                const m = clause.match(subjectMatcher(subject));
+                if (!m || m.index === undefined)
+                    continue;
+                if (negatedBefore(clause, m.index))
+                    continue;
+                return clause.replace(/\s+/g, " ").trim().slice(0, 160);
+            }
+        }
+    }
+    return null;
+}
+/** The forbidden subject(s) of a structured classification, or null if it has none we can name. */
+function subjectsOf(c) {
+    switch (c.kind) {
+        case "gitBranchPolicy":
+            return [c.branchName];
+        case "fileLifecycle":
+            return [c.filePath];
+        case "codeContent":
+            return c.patterns;
+        case "emojiOutput":
+            return ["emoji"];
+        default:
+            // attribution deliberately excluded: an AI-attribution trailer is never
+            // something a user meaningfully instructs the agent to author as its own,
+            // and it is the project's own hard rule. approvalGate handles its own asks.
+            return null;
+    }
+}
+function ruleKey(source, id, title) {
+    return `${source}\u0000${id}\u0000${title}`;
+}
+/**
+ * Downgrades a structured FAIL to "can't tell" when the user explicitly asked
+ * for the rule's forbidden subject. Only ever FAIL -> UNCLEAR, never the
+ * reverse — so it can only remove a false accusation. Shared by the CLI and the
+ * browser evaluator so the two never disagree about it.
+ */
+export function downgradeUserAsked(results, classifications, events) {
+    const subjects = new Map();
+    for (const c of classifications) {
+        const s = subjectsOf(c);
+        if (s && s.length > 0)
+            subjects.set(ruleKey(c.rule.source, c.rule.id, c.rule.title), s);
+    }
+    if (subjects.size === 0)
+        return results;
+    return results.map((r) => {
+        if (r.status !== "FAIL")
+            return r;
+        const s = subjects.get(ruleKey(r.ruleSource, r.ruleId, r.ruleTitle));
+        if (!s)
+            return r;
+        const quote = userAskedFor(events, s);
+        if (!quote)
+            return r;
+        return {
+            ...r,
+            status: "UNCLEAR",
+            outcome: "inconclusive",
+            reason: "user_asked",
+            evidence: `the agent did this, but you asked for it in this session: "${quote}" — so this is you overriding your own rule, not the agent breaking it. Original finding: ${r.evidence}`,
+        };
+    });
+}

package/dist/evaluate.js

@@ -10,6 +10,7 @@ import { runAttributionChecks } from "./checks/attribution.js";
 import { runApprovalGateChecks } from "./checks/approvalGate.js";
 import { runJudgmentChecks } from "./checks/judgmentChecks.js";
 import { touchedPaths, ruleWasLoaded } from "./checks/pathScope.js";
+import { downgradeUserAsked } from "./checks/userAsked.js";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -98,7 +99,8 @@ export async function evaluateSession(cwd, rules, events, llm, needsLlmResult) {
     const judgmentResults = llm
         ? await runJudgmentChecks(judgment, events)
         : judgment.map(({ rule }) => needsLlmResult(rule));
-    const results = [...deterministicResults, ...judgmentResults, ...scopeResults, ...future.map(futureResult)];
+    const structuralResults = downgradeUserAsked(deterministicResults, classifications, events);
+    const results = [...structuralResults, ...judgmentResults, ...scopeResults, ...future.map(futureResult)];
     return {
         results: attachSourceLocation(results, rules),
         notARule: of("notARule"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.68",
+  "version": "0.1.70",
   "description": "Checks whether your AI coding agent followed your rules, with evidence. Works with Claude Code (Codex in testing); reads CLAUDE.md, AGENTS.md, Cursor, Copilot and Windsurf rules.",
   "repository": {
     "type": "git",
@@ -48,7 +48,7 @@
     "verify": "npm run lint && npm run typecheck && npm test"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {