rulereceipt 0.1.72 → 0.1.73

package/dist/checks/approvalGate.d.ts

@@ -27,11 +27,25 @@ import type { CheckResult, TranscriptEvent } from "../types.js";
  * permission UI, which the transcript never records.
  */
 type Action = "push" | "commit" | "pr" | "delete";
+/** The canonical short form of a command, for matching a proposed call to its occurrence. */
+export declare function approvalCommandShort(command: string): string;
+/**
+ * The branch a "push/commit … to <branch>" approval rule is scoped to, if any.
+ * "Never push to main without asking" is about MAIN — it must not gate a push to
+ * a feature branch. Found by a real test 2026-09-29: the guard asked on every
+ * push. Returns undefined for a generic "never push without asking" (all pushes).
+ */
+export declare function approvalScopedBranch(rule: {
+    title: string;
+    text: string;
+}): string | undefined;
 /** `Bash(git push:*)`, `Bash(git:*)`, `Bash` style allow entries. */
 export declare function allowListed(command: string, allow: string[]): boolean;
 export interface ApprovalOptions {
     /** `permissions.allow` entries from the project's and user's Claude Code settings. */
     allow?: string[];
+    /** When set, a `push` action is only gated if it targets this branch (or its target is unknown). */
+    scopedBranch?: string;
 }
 interface Occurrence {
     action: Action;

package/dist/checks/approvalGate.js

@@ -1,5 +1,14 @@
 import { violation } from "../types.js";
-import { withoutHeredocs, withoutQuotedMentions, unwrapShellWrappers } from "./shellCommand.js";
+import { withoutHeredocs, withoutQuotedMentions, unwrapShellWrappers, leadingCommand } from "./shellCommand.js";
+/**
+ * Commands that only READ/print/search their arguments — a push/commit named as
+ * an ARGUMENT to one of these is a mention, not the action. Same list the
+ * deterministic checker uses; kept local to avoid a circular import.
+ */
+const MENTION_ONLY = new Set([
+    "echo", "printf", "grep", "rg", "ag", "ack", "egrep", "fgrep", "cat", "bat",
+    "head", "tail", "less", "more", "ls", "find", "fd", "sed", "awk", "cut", "tr",
+]);
 const IN_COMMAND = {
     push: /\bgit\s+(?:\S+\s+){0,4}?push(?![\w-])/,
     commit: /\bgit\s+(?:\S+\s+){0,4}?commit(?![\w-])/,
@@ -32,9 +41,54 @@ function commandOf(e) {
     // Strip heredoc bodies (a heredoc that WRITES "git push" is not a push) and
     // blank quoted/commented mentions (`echo "git push"`, `# git push`), so only
     // a command actually being run is matched.
-    // Unwrap `sh -c '…'` BEFORE blanking quotes, so a push hidden in a wrapper is
-    // exposed as a real command rather than blanked as a quoted mention (#2).
-    return typeof c === "string" ? withoutQuotedMentions(unwrapShellWrappers(withoutHeredocs(c))) : "";
+    if (typeof c !== "string")
+        return "";
+    // Same parser as the check path (one parser, not two): unwrap `sh -c '…'`
+    // BEFORE blanking quotes (so a push hidden in a wrapper is exposed), then keep
+    // ONLY segments that actually RUN a command — a push/commit that is only an
+    // argument to echo/grep/printf/sed is a mention, never the action. This is
+    // what makes `echo git push is bad` not read as a push in the guard.
+    const exposed = withoutQuotedMentions(unwrapShellWrappers(withoutHeredocs(c)));
+    return exposed
+        .split(/\n|&&|\|\||[;|]/)
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0 && !MENTION_ONLY.has(leadingCommand(s)))
+        .join("\n");
+}
+/** The canonical short form of a command, for matching a proposed call to its occurrence. */
+export function approvalCommandShort(command) {
+    return commandOf({ role: "assistant", kind: "tool_use", toolName: "Bash", input: { command }, timestamp: "" }).replace(/\s+/g, " ").trim().slice(0, 80);
+}
+/**
+ * The branch a "push/commit … to <branch>" approval rule is scoped to, if any.
+ * "Never push to main without asking" is about MAIN — it must not gate a push to
+ * a feature branch. Found by a real test 2026-09-29: the guard asked on every
+ * push. Returns undefined for a generic "never push without asking" (all pushes).
+ */
+export function approvalScopedBranch(rule) {
+    const m = `${rule.title} ${rule.text}`.match(/\b(?:push(?:ing)?|commit(?:ting)?|merg(?:e|ing))\b[^.\n]*?\b(main|master|develop|trunk|release)\b/i);
+    return m ? m[1].toLowerCase() : undefined;
+}
+/**
+ * Whether a `git push` command targets `branch` (or its target is unknown — a
+ * bare `git push`, which could be main, so it is gated to be safe). An explicit
+ * push to a DIFFERENT branch returns false, so a feature-branch push is not
+ * gated by a rule that names main.
+ */
+function pushTargetsBranch(command, branch) {
+    const m = command.match(/\bgit\s+(?:\S+\s+){0,4}?push\b(.*)/i);
+    if (!m)
+        return true;
+    const args = m[1];
+    const refspec = args.match(/[\w./-]+:([\w./-]+)/); // src:dst -> dst is the target
+    if (refspec)
+        return refspec[1] === branch || refspec[1].endsWith(`/${branch}`);
+    const tokens = args.split(/\s+/).filter((t) => t && !t.startsWith("-"));
+    if (tokens.length >= 2) {
+        const b = tokens[tokens.length - 1];
+        return b === branch || b.endsWith(`/${branch}`);
+    }
+    return true; // bare `git push` / `git push origin` — unknown target, gate to be safe
 }
 /** The result for the call at `i`: matched by id when present, else the next result. */
 function resultOf(events, i) {
@@ -72,6 +126,10 @@ export function approvalOccurrences(events, actions, opts = {}) {
         for (const action of actions) {
             if (!IN_COMMAND[action].test(command))
                 continue;
+            // A branch-scoped push rule ("push to main") does not gate a push to a
+            // different branch — only main (or a bare push whose target is unknown).
+            if (action === "push" && opts.scopedBranch && !pushTargetsBranch(command, opts.scopedBranch))
+                continue;
             const res = resultOf(events, i);
             if (res && res.kind === "tool_result" && res.isError)
                 continue; // rejected in the prompt, or it never went through
@@ -125,7 +183,7 @@ export function approvalOccurrences(events, actions, opts = {}) {
 }
 export function runApprovalGateChecks(classifications, events, opts = {}) {
     return classifications.map(({ rule, actions, polarity }) => {
-        const occ = approvalOccurrences(events, actions, opts);
+        const occ = approvalOccurrences(events, actions, { ...opts, scopedBranch: approvalScopedBranch(rule) });
         const base = { ruleId: rule.id, ruleTitle: rule.title, ruleSource: rule.source, method: "approval_gate" };
         if (occ.length === 0) {
             return { ...base, status: "UNCLEAR", outcome: "not_applicable", evidence: `no ${actions.join("/")} went through this session, so the rule never applied` };

package/dist/checks/shellCommand.js

@@ -103,7 +103,10 @@ export function unwrapShellWrappers(command) {
         const m = out.match(SHELL_WRAPPER);
         if (!m || m.index === undefined)
             break;
-        out = out.slice(0, m.index) + ` ; ${m[2]} ; ` + out.slice(m.index + m[0].length);
+        // Hoist with NEWLINES, not `; … ;`: segments() splits on both, but a newline
+        // collapses away in evidence display (\s+ -> " ") whereas literal `;` leaked
+        // into a quoted-back command as `"; git push ;"` (found by a real test).
+        out = out.slice(0, m.index) + `\n${m[2]}\n` + out.slice(m.index + m[0].length);
     }
     return out;
 }

package/dist/cli.js

@@ -81,13 +81,31 @@ async function shareResults(results) {
 // promise, and the demo is the first thing people run. (A judgment rule shown
 // Broken here was found by a real test 2026-09-29 and was exactly the kind of
 // over-claim this product exists to catch.)
+/** Add an entry to .gitignore (best-effort, git repos only) so a written file can't be committed by accident. */
+function ensureGitignored(cwd, entry) {
+    try {
+        if (!existsSync(join(cwd, ".git")))
+            return;
+        const gi = join(cwd, ".gitignore");
+        const current = existsSync(gi) ? readFileSync(gi, "utf-8") : "";
+        const want = entry.replace(/\/$/, "");
+        if (current.split(/\r?\n/).some((l) => l.trim() === want || l.trim() === entry))
+            return;
+        const prefix = current.length > 0 && !current.endsWith("\n") ? "\n" : "";
+        writeFileSync(gi, `${current}${prefix}${entry}\n`);
+        console.log(`(added ${entry} to .gitignore so it isn't committed)`);
+    }
+    catch {
+        /* best-effort — a card that isn't gitignored is a minor issue, not a failure */
+    }
+}
 const DEMO_RESULTS = [
     { ruleId: "1", ruleTitle: "Never push to `main`", ruleSource: "project", status: "FAIL", outcome: "fail", method: "git_events",
         evidence: 'a git command actually targeted the "main" branch: git push origin main' },
     { ruleId: "2", ruleTitle: "Evidence or it didn't happen", ruleSource: "global", status: "FAIL", outcome: "fail", method: "claim_vs_evidence",
         evidence: 'the session stated "All tests pass ✅" but the last test run before it, `npm test`, reported "1 failed"' },
-    { ruleId: "3", ruleTitle: "Never edit `.env`", ruleSource: "project", status: "PASS", outcome: "pass", method: "file_events",
-        evidence: "no write, edit, or delete of `.env` this session" },
+    { ruleId: "3", ruleTitle: "Never edit `.env`", ruleSource: "project", status: "UNCLEAR", outcome: "not_applicable", method: "file_events",
+        evidence: "the `.env` file was never written to, deleted, or moved this session — a forbid rule that never came up, not a pass" },
     { ruleId: "4", ruleTitle: "Surface bad news first", ruleSource: "global", status: "UNCLEAR", needsHuman: true,
         evidence: "" },
 ];
@@ -1157,7 +1175,7 @@ program
 program
     .command("card")
     .description("Make a shareable image and pre-filled share links from your last 30 days of sessions — counts only, no code, paths or rule text (add rule names to the copy-text with --show-rules). Saves an SVG locally and prints X/LinkedIn/Bluesky/Reddit compose links. Nothing is posted and nothing is uploaded.")
-    .option("--out <path>", "where to write the SVG card", "rulereceipt-card.svg")
+    .option("--out <path>", "where to write the SVG card", join(".rulereceipt", "card.svg"))
     .option("--show-rules", "include the broken rule names in the copy-text (never in the image)")
     .option("--days <n>", "how many days back to summarize", "30")
     .action(async (opts) => {
@@ -1184,7 +1202,11 @@ program
         who: s.tools.length === 1 && s.tools[0] === "claude-code" ? "Claude" : "the agent",
         brokenTitles: s.breaks.map((b) => b.ruleTitle),
     };
-    const outPath = resolve(cwd, opts.out ?? "rulereceipt-card.svg");
+    const outPath = resolve(cwd, opts.out ?? join(".rulereceipt", "card.svg"));
+    mkdirSync(dirname(outPath), { recursive: true });
+    // Keep the card out of the repo: it lives under .rulereceipt/, which we add
+    // to .gitignore on first write so it can't be committed by accident.
+    ensureGitignored(cwd, ".rulereceipt/");
     writeFileSync(outPath, cardSvg(data));
     console.log(renderCardShare(data, outPath, Boolean(opts.showRules)));
 });

package/dist/guard.js

@@ -6,7 +6,7 @@ import { runGitBranchPolicyChecks } from "./checks/gitBranchPolicy.js";
 import { runAttributionChecks } from "./checks/attribution.js";
 import { loadOverrides, ruleFingerprint, ratifiedForbids } from "./overrides.js";
 import { commandRunsLiteral } from "./checks/proposedAction.js";
-import { approvalOccurrences, allowListed } from "./checks/approvalGate.js";
+import { approvalOccurrences, allowListed, approvalCommandShort, approvalScopedBranch } from "./checks/approvalGate.js";
 import { readTranscriptFromFile } from "./parsers/transcriptParser.js";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -204,9 +204,12 @@ function unapprovedGate(cwd, command, events) {
     const gates = classifyRules(loadRules(cwd)).filter((c) => c.kind === "approvalGate");
     for (const { rule, actions } of gates) {
         const proposed = { role: "assistant", kind: "tool_use", toolName: "Bash", input: { command }, timestamp: "", permissionMode: "dontAsk" };
-        const occ = approvalOccurrences([...events, proposed], actions);
+        const occ = approvalOccurrences([...events, proposed], actions, { scopedBranch: approvalScopedBranch(rule) });
         const last = occ[occ.length - 1];
-        if (last && last.command === command.replace(/\s+/g, " ").trim().slice(0, 80) && last.verdict !== "approved") {
+        // Compare against the SAME canonical short the occurrence uses (mention
+        // segments dropped, `sh -c` unwrapped) — a raw-string compare missed a
+        // wrapped push and mis-fired on a mention (found by a real test).
+        if (last && last.command === approvalCommandShort(command) && approvalCommandShort(command) !== "" && last.verdict !== "approved") {
             return { rule, action: last.action };
         }
     }

package/dist/historyReport.js

@@ -16,6 +16,16 @@ export async function scanHistory(cwd, rules, days = 30, now = Date.now(), sessi
     const rules_ = new Map();
     const tools = new Set();
     let sessionsScanned = 0;
+    /** The latest event timestamp in a session, or null if none parse. */
+    const lastEventMs = (events) => {
+        let max = 0;
+        for (const e of events) {
+            const t = Date.parse(e.timestamp);
+            if (!Number.isNaN(t) && t > max)
+                max = t;
+        }
+        return max > 0 ? max : null;
+    };
     for (const { adapter, file } of sessions) {
         let ms;
         try {
@@ -37,6 +47,11 @@ export async function scanHistory(cwd, rules, days = 30, now = Date.now(), sessi
             continue;
         sessionsScanned++;
         tools.add(adapter.tool);
+        // The DATE shown is the session's own last timestamp, not the file's mtime —
+        // a file touched today can hold a session from last week, and showing "last:
+        // today" for it is wrong (found by a real test, 2026-09-29). Falls back to
+        // the mtime only when the transcript carries no usable timestamp.
+        const sessionMs = lastEventMs(events) ?? ms;
         const { results } = await evaluateSession(cwd, rules, events, false, needsLlmResult);
         for (const r of results) {
             const k = key(r);
@@ -46,7 +61,7 @@ export async function scanHistory(cwd, rules, days = 30, now = Date.now(), sessi
                 rules_.set(k, a);
             }
             if (r.status === "FAIL")
-                a.breaks.push({ ms, quote: r.evidence });
+                a.breaks.push({ ms: sessionMs, quote: r.evidence });
             else if (r.status === "PASS")
                 a.passed = true;
             else if (r.status === "UNCLEAR" && r.needsHuman)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.72",
+  "version": "0.1.73",
   "description": "Checks whether your AI coding agent followed your rules, with evidence. Works with Claude Code (Codex in testing); reads CLAUDE.md, AGENTS.md, Cursor, Copilot and Windsurf rules.",
   "repository": {
     "type": "git",