rulereceipt 0.1.73 → 0.1.74

package/dist/checks/approvalGate.d.ts

@@ -46,6 +46,8 @@ export interface ApprovalOptions {
     allow?: string[];
     /** When set, a `push` action is only gated if it targets this branch (or its target is unknown). */
     scopedBranch?: string;
+    /** The current git branch (guard only), so a bare `git push` from a feature branch is not gated by a "push to main" rule. */
+    currentBranch?: string;
 }
 interface Occurrence {
     action: Action;

package/dist/checks/approvalGate.js

@@ -75,7 +75,7 @@ export function approvalScopedBranch(rule) {
  * push to a DIFFERENT branch returns false, so a feature-branch push is not
  * gated by a rule that names main.
  */
-function pushTargetsBranch(command, branch) {
+function pushTargetsBranch(command, branch, currentBranch) {
     const m = command.match(/\bgit\s+(?:\S+\s+){0,4}?push\b(.*)/i);
     if (!m)
         return true;
@@ -88,7 +88,13 @@ function pushTargetsBranch(command, branch) {
         const b = tokens[tokens.length - 1];
         return b === branch || b.endsWith(`/${branch}`);
     }
-    return true; // bare `git push` / `git push origin` — unknown target, gate to be safe
+    // Bare `git push` / `git push origin` — the target is the CURRENT branch. When
+    // the guard can tell us that branch, gate only if it is the scoped branch (a
+    // bare push from a feature branch is not a push to main). When it is unknown
+    // (the check path, or git unavailable), gate to be safe.
+    if (currentBranch)
+        return currentBranch === branch || currentBranch.endsWith(`/${branch}`);
+    return true;
 }
 /** The result for the call at `i`: matched by id when present, else the next result. */
 function resultOf(events, i) {
@@ -128,7 +134,7 @@ export function approvalOccurrences(events, actions, opts = {}) {
                 continue;
             // A branch-scoped push rule ("push to main") does not gate a push to a
             // different branch — only main (or a bare push whose target is unknown).
-            if (action === "push" && opts.scopedBranch && !pushTargetsBranch(command, opts.scopedBranch))
+            if (action === "push" && opts.scopedBranch && !pushTargetsBranch(command, opts.scopedBranch, opts.currentBranch))
                 continue;
             const res = resultOf(events, i);
             if (res && res.kind === "tool_result" && res.isError)

package/dist/guard.js

@@ -8,6 +8,23 @@ import { loadOverrides, ruleFingerprint, ratifiedForbids } from "./overrides.js"
 import { commandRunsLiteral } from "./checks/proposedAction.js";
 import { approvalOccurrences, allowListed, approvalCommandShort, approvalScopedBranch } from "./checks/approvalGate.js";
 import { readTranscriptFromFile } from "./parsers/transcriptParser.js";
+import { execFileSync } from "node:child_process";
+/**
+ * The current git branch in `cwd`, or undefined if it can't be determined —
+ * so a bare `git push` from a feature branch is not gated by a "push to main"
+ * rule. Fails open (never throws, never blocks) if git is unavailable.
+ */
+function gitCurrentBranch(cwd) {
+    try {
+        // `symbolic-ref --short HEAD` gives the branch name even on an unborn branch
+        // (no commits yet); `rev-parse --abbrev-ref` returns "HEAD" there.
+        const b = execFileSync("git", ["symbolic-ref", "--short", "HEAD"], { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 1000 }).trim();
+        return b && b !== "HEAD" ? b : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -204,7 +221,7 @@ function unapprovedGate(cwd, command, events) {
     const gates = classifyRules(loadRules(cwd)).filter((c) => c.kind === "approvalGate");
     for (const { rule, actions } of gates) {
         const proposed = { role: "assistant", kind: "tool_use", toolName: "Bash", input: { command }, timestamp: "", permissionMode: "dontAsk" };
-        const occ = approvalOccurrences([...events, proposed], actions, { scopedBranch: approvalScopedBranch(rule) });
+        const occ = approvalOccurrences([...events, proposed], actions, { scopedBranch: approvalScopedBranch(rule), currentBranch: gitCurrentBranch(cwd) });
         const last = occ[occ.length - 1];
         // Compare against the SAME canonical short the occurrence uses (mention
         // segments dropped, `sh -c` unwrapped) — a raw-string compare missed a

package/dist/historyReport.js

@@ -1,6 +1,18 @@
 import { statSync } from "node:fs";
 import { listAllSessions } from "./adapters/index.js";
 import { evaluateSession } from "./evaluate.js";
+/**
+ * One-line clip that ends on a whole word with an ellipsis, never mid-sentence.
+ * Found by a real test 2026-09-29: a break quote was cut as "...so no prompt was".
+ */
+function clip(s, n) {
+    const one = s.replace(/\s+/g, " ").trim();
+    if (one.length <= n)
+        return one;
+    const cut = one.slice(0, n);
+    const lastSpace = cut.lastIndexOf(" ");
+    return `${(lastSpace > n * 0.6 ? cut.slice(0, lastSpace) : cut).replace(/[\s,;:.—-]+$/, "")}…`;
+}
 function needsLlmResult(rule) {
     return { ruleId: rule.id, ruleTitle: rule.title, ruleSource: rule.source, status: "UNCLEAR", needsHuman: true, evidence: "" };
 }
@@ -125,11 +137,11 @@ export function renderHistory(s, projectName, now = Date.now()) {
         out.push(`${who} broke your rules ${s.totalBrokenCount} time${s.totalBrokenCount === 1 ? "" : "s"}.`);
         out.push("");
         for (const b of s.breaks.slice(0, 10)) {
-            const title = b.ruleTitle.replace(/\s+/g, " ").trim().slice(0, 60);
+            const title = clip(b.ruleTitle, 60);
             const when = relDate(b.lastMs, now);
             out.push(`  x  ${title}    ${b.count} time${b.count === 1 ? "" : "s"}   last: ${when}`);
             if (b.quote)
-                out.push(`       ${b.quote.replace(/\s+/g, " ").trim().slice(0, 100)}`);
+                out.push(`       ${clip(b.quote, 100)}`);
         }
     }
     out.push("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.73",
+  "version": "0.1.74",
   "description": "Checks whether your AI coding agent followed your rules, with evidence. Works with Claude Code (Codex in testing); reads CLAUDE.md, AGENTS.md, Cursor, Copilot and Windsurf rules.",
   "repository": {
     "type": "git",