rulereceipt 0.1.74 → 0.1.76

package/dist/parsers/transcriptParser.js

@@ -1,6 +1,6 @@
-import { readFileSync, readdirSync, statSync } from "node:fs";
+import { readFileSync, readdirSync, statSync, realpathSync, existsSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, dirname, basename } from "node:path";
+import { join, dirname, basename, sep } from "node:path";
 import { parseTranscriptText } from "./transcriptLine.js";
 /**
  * Claude Code stores each session as a JSONL file at:
@@ -32,8 +32,80 @@ import { parseTranscriptText } from "./transcriptLine.js";
  * generalizes to variants never seen on this machine, at the cost of one
  * extra readdir() of the home directory per check — negligible.
  */
-function encodeProjectPath(cwd) {
-    return cwd.replace(/\//g, "-");
+/**
+ * Claude Code names the per-project directory by mangling the cwd, but the exact
+ * rule is not stable or documented across versions: at minimum "/" becomes "-",
+ * and observed builds also turn "." "_" and space (every non-alphanumeric) into
+ * "-". Guessing the encoding is therefore fragile — a project at
+ * /Users/john.doe/my.app, my_project or "My Work" would silently find zero
+ * sessions (found by independent test on 0.1.74, 2026-09-29; the whole first
+ * screen — check, history, list-sessions, card — showed "No sessions found").
+ *
+ * So encoding is only a FAST-PATH hint. The source of truth is the `cwd` field
+ * every Claude session line carries: this reads the real cwd out of each folder
+ * and matches on it (realpath-compared, so symlinks and dotted paths just work),
+ * which also survives any future encoding change Claude Code makes.
+ */
+function encodeCandidates(cwd) {
+    const slashOnly = cwd.replace(/\//g, "-");
+    const allNonAlnum = cwd.replace(/[^A-Za-z0-9]/g, "-");
+    return [...new Set([slashOnly, allNonAlnum])];
+}
+function realpathOr(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+/** The cwd a session folder belongs to, read from the first line that carries it. */
+function sessionCwdOf(sessionFile) {
+    let text;
+    try {
+        text = readFileSync(sessionFile, "utf-8");
+    }
+    catch {
+        return null;
+    }
+    // The cwd is on every line; scan only until the first hit (usually line 1).
+    let from = 0;
+    for (let i = 0; i < 200; i++) {
+        const nl = text.indexOf("\n", from);
+        const line = text.slice(from, nl === -1 ? undefined : nl);
+        if (line.includes('"cwd"')) {
+            try {
+                const cwd = JSON.parse(line).cwd;
+                if (typeof cwd === "string" && cwd.length > 0)
+                    return cwd;
+            }
+            catch {
+                /* partial/garbled line: keep scanning */
+            }
+        }
+        if (nl === -1)
+            break;
+        from = nl + 1;
+    }
+    return null;
+}
+/** A cwd looks like a real project root, so descendant (monorepo) sessions are safe to pull in. */
+function looksLikeProjectRoot(cwd) {
+    return [".git", "CLAUDE.md", "AGENTS.md", "GEMINI.md", ".claude", ".cursor", ".github/copilot-instructions.md"].some((marker) => existsSync(join(cwd, marker)));
+}
+/** Absolute paths of every Claude-Code-style home to search, including CLAUDE_CONFIG_DIR. */
+function claudeHomeDirs() {
+    const dirs = new Set();
+    for (const name of findClaudeHomeDirNames())
+        dirs.add(join(homedir(), name));
+    const cfg = process.env.CLAUDE_CONFIG_DIR;
+    if (cfg)
+        for (const part of cfg.split(",")) {
+            const p = part.trim();
+            if (p)
+                dirs.add(p);
+        }
+    return [...dirs];
 }
 function listSessionFiles(projectDir) {
     let entries;
@@ -70,12 +142,61 @@ export function findClaudeHomeDirNames() {
         return [];
     }
 }
-/** Every session file for this project, newest first. */
+/**
+ * Every session file that belongs to this project, newest first.
+ *
+ * A folder matches when the real cwd stored in its sessions is THIS directory
+ * (encoding-independent — handles dots, underscores, spaces, symlinks), or when
+ * this directory is a project root and the session's cwd is inside it (a
+ * monorepo subfolder like packages/api, so the root check sees that work too).
+ * Encoding candidates are only a fallback for folders whose stored cwd can't be
+ * read.
+ */
 export function listAllSessionFiles(cwd) {
-    const encoded = encodeProjectPath(cwd);
-    const sessionFiles = findClaudeHomeDirNames().flatMap((dirName) => listSessionFiles(join(homedir(), dirName, "projects", encoded)));
-    sessionFiles.sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs);
-    return sessionFiles;
+    const target = realpathOr(cwd);
+    const candidates = new Set(encodeCandidates(cwd));
+    const allowDescendants = looksLikeProjectRoot(cwd);
+    const files = [];
+    const seen = new Set();
+    for (const home of claudeHomeDirs()) {
+        const projectsDir = join(home, "projects");
+        let folders;
+        try {
+            folders = readdirSync(projectsDir);
+        }
+        catch {
+            continue;
+        }
+        for (const folder of folders) {
+            const dir = join(projectsDir, folder);
+            const folderFiles = listSessionFiles(dir);
+            if (folderFiles.length === 0)
+                continue;
+            const storedCwd = sessionCwdOf(folderFiles[0]);
+            let matches = false;
+            if (storedCwd) {
+                const real = realpathOr(storedCwd);
+                if (real === target)
+                    matches = true;
+                else if (allowDescendants && real.startsWith(target + sep))
+                    matches = true;
+            }
+            else {
+                // No readable cwd (older/garbled file): fall back to the name encoding.
+                matches = candidates.has(folder);
+            }
+            if (!matches)
+                continue;
+            for (const f of folderFiles) {
+                if (!seen.has(f)) {
+                    seen.add(f);
+                    files.push(f);
+                }
+            }
+        }
+    }
+    files.sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs);
+    return files;
 }
 export function findLatestSessionFile(cwd) {
     const all = listAllSessionFiles(cwd);

package/dist/rules.js

@@ -4,6 +4,7 @@ import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { parseClaudeMd } from "./parsers/readClaudeMd.js";
 import { findClaudeHomeDirNames } from "./parsers/transcriptParser.js";
 import { loadMemoryRules } from "./parsers/readMemory.js";
+import { resolveImports } from "./parsers/imports.js";
 /**
  * Every place Claude Code actually reads a rule from, at one directory
  * level. Order mirrors the documented load order, broadest first.
@@ -135,6 +136,42 @@ function ruleSourcesAtLevel(dir) {
     }
     // Gemini CLI: single rules file (its AGENTS.md equivalent).
     loaded("GEMINI.md", "Gemini");
+    return applyImports(out);
+}
+/**
+ * Claude Code follows @imports: a loaded rules file that says `@AGENTS.md` (or
+ * `@docs/rules.md`) makes that file part of what the agent reads. So an imported
+ * file is NOT shadowed, and its rules ARE checked. This reconciles `out` with
+ * that: any file imported by a loaded file is promoted to loaded (a shadowed
+ * AGENTS.md a CLAUDE.md imports flips to loaded), and any imported file not
+ * already listed is added as a loaded source. Without imports, `out` is
+ * unchanged, so existing projects keep their exact rule order and ids.
+ */
+function applyImports(out) {
+    const imported = new Set();
+    for (const src of out) {
+        if (src.status !== "loaded")
+            continue;
+        for (const target of resolveImports(src.path))
+            imported.add(resolve(target));
+    }
+    if (imported.size === 0)
+        return out;
+    const present = new Set(out.map((s) => resolve(s.path)));
+    for (const src of out) {
+        if (src.status === "shadowed" && imported.has(resolve(src.path))) {
+            src.status = "loaded";
+            src.note = "imported by a loaded CLAUDE.md (@import), so the agent does read it";
+        }
+    }
+    // Imported files that were not otherwise candidates at this level (e.g. a
+    // @docs/rules.md), in a stable order so rule ids stay deterministic.
+    for (const path of [...imported].sort()) {
+        if (present.has(path))
+            continue;
+        present.add(path);
+        out.push({ path, status: "loaded", format: "imported (@import)" });
+    }
     return out;
 }
 /** Every rules file at one directory level that the agent actually loads. */

package/dist/shadowedAgents.js

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, dirname, parse } from "node:path";
+import { join, dirname, parse, resolve } from "node:path";
+import { resolveImports } from "./parsers/imports.js";
 /** Directory-level pairs where a CLAUDE.md shadows an AGENTS.md. */
 const SHADOW_PAIRS = [
     { claude: "CLAUDE.md", agents: "AGENTS.md" },
@@ -24,7 +25,11 @@ export function shadowedAgentsMd(cwd) {
             const claudePath = join(dir, claude);
             const agentsPath = join(dir, agents);
             if (existsSync(claudePath) && existsSync(agentsPath)) {
-                found.push({ agents: agentsPath, shadowedBy: claudePath });
+                // If the CLAUDE.md @imports the AGENTS.md, the agent DOES read it — it
+                // is not shadowed, and warning that it is would itself be untrue.
+                const importedByClaude = resolveImports(claudePath).some((p) => resolve(p) === resolve(agentsPath));
+                if (!importedByClaude)
+                    found.push({ agents: agentsPath, shadowedBy: claudePath });
             }
         }
         if (existsSync(join(dir, ".git")))

package/dist/why.d.ts

@@ -0,0 +1,61 @@
+import { type BlockHint } from "./blockHint.js";
+import type { Rule } from "./types.js";
+export interface WhyRule {
+    id: string;
+    title: string;
+    source: "global" | "project";
+    location: string;
+    loaded: boolean;
+    loadNote?: string;
+    pathScoped?: string;
+    checkable: boolean;
+    kind: string;
+    suggestion?: string;
+    named?: {
+        kind: "command" | "file";
+        name: string;
+        exists: boolean;
+    };
+    /** How (and whether) this rule can actually be blocked/checked — see blockHint.ts. */
+    block?: BlockHint;
+    brokenCount: number;
+    brokenDates: string[];
+    sessionsScanned: number;
+}
+export interface WhyResult {
+    query: string;
+    matches: number;
+    rule?: WhyRule;
+    candidates?: {
+        title: string;
+        location: string;
+    }[];
+}
+/** Fuzzy-match a rule by the query appearing in its title/body, or the query being the title. */
+export declare function findRules(rules: Rule[], query: string): Rule[];
+export declare function explainRule(cwd: string, query: string): Promise<WhyResult>;
+export interface WhyAll {
+    rules: WhyRule[];
+    sessionsScanned: number;
+}
+/**
+ * `why --all` — the same facts for every loaded rule, problems first (not loaded, then a
+ * named command/file missing, then broken recently, then judgment-only, then the rest).
+ * Read-only, facts only, no verdicts. Order within a rank is the rule's own order.
+ */
+export declare function explainAll(cwd: string): Promise<WhyAll>;
+/** The no-argument help: how to use `why`, plus every rule with its id, so people can pick. */
+export declare function whyList(cwd: string): {
+    id: string;
+    title: string;
+    location: string;
+}[];
+export declare function renderWhy(r: WhyResult): string;
+/** No-argument output: how to use `why`, then every rule with its id so you can pick one. */
+export declare function renderWhyList(list: {
+    id: string;
+    title: string;
+    location: string;
+}[]): string;
+/** One short line per rule for `why --all`, problems first. */
+export declare function renderAllWhy(all: WhyAll): string;

package/dist/why.js

@@ -0,0 +1,255 @@
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { homedir } from "node:os";
+import { loadRules, describeRuleSources } from "./rules.js";
+import { classifyRule } from "./checks/classify.js";
+import { adviseRule } from "./checkability.js";
+import { scanHistory } from "./historyReport.js";
+import { blockHintFor } from "./blockHint.js";
+/**
+ * `rulereceipt why "<rule text>"` — everything the tool already knows about ONE
+ * rule, in one place: where it lives, whether the agent even loads it, whether a
+ * command/path it names exists, whether it is mechanically checkable (and if
+ * not, the smallest edit that would make it), and how it has done in the last 30
+ * days. It answers the exact question people ask — "why isn't THIS rule
+ * working?" — and it invents nothing: every line is combined from data the
+ * engine already produces. Read-only; no verdict is created here.
+ */
+const CHECKABLE_KINDS = new Set([
+    "gitBranchPolicy", "fileLifecycle", "codeContent", "approvalGate",
+    "claimEvidence", "deterministic", "attribution", "emojiOutput", "ifEditThenTest",
+]);
+/** Fuzzy-match a rule by the query appearing in its title/body, or the query being the title. */
+export function findRules(rules, query) {
+    // Normalize both sides to lowercase words separated by single spaces, so
+    // punctuation the user won't type (commas, backticks, dashes) doesn't block a
+    // match: "clean elegant maintainable" finds "clean, elegant, maintainable".
+    const clean = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+    const q = clean(query);
+    if (q.length === 0)
+        return [];
+    const exact = rules.filter((r) => clean(r.title) === q);
+    if (exact.length > 0)
+        return exact;
+    return rules.filter((r) => {
+        const hay = clean(`${r.title} ${r.text}`);
+        if (hay.includes(q))
+            return true;
+        // Reverse direction (query IS roughly the title) only for a title long
+        // enough to be distinctive — otherwise a 1-char heading like "A" matches
+        // any query that happens to contain that letter.
+        const title = clean(r.title);
+        return title.length >= 6 && q.includes(title);
+    });
+}
+/** A `npm run <script>` or a backtick file path the rule names, and whether it exists. */
+function namedCommandOrPath(rule, cwd) {
+    const text = `${rule.title} ${rule.text}`;
+    const script = text.match(/\b(?:npm|pnpm|yarn)\s+run\s+([\w:-]+)/);
+    if (script) {
+        let exists = false;
+        try {
+            const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf-8"));
+            exists = Boolean(pkg.scripts && script[1] in pkg.scripts);
+        }
+        catch {
+            /* no package.json: report not found */
+        }
+        return { kind: "command", name: `${script[1]}`, exists };
+    }
+    const path = text.match(/`([^`\s]+\.[a-z0-9]{1,6})`/i);
+    if (path && !path[1].includes("://")) {
+        const p = isAbsolute(path[1]) ? path[1] : join(cwd, path[1]);
+        return { kind: "file", name: path[1], exists: existsSync(p) };
+    }
+    return undefined;
+}
+async function historyLookup(cwd, rules) {
+    try {
+        const hist = await scanHistory(cwd, rules, 30);
+        const byRule = new Map();
+        for (const b of hist.breaks)
+            byRule.set(`${b.ruleId}\u0000${b.ruleTitle}`, { count: b.count, lastMs: b.lastMs });
+        return { sessionsScanned: hist.sessionsScanned, byRule };
+    }
+    catch {
+        return { sessionsScanned: 0, byRule: new Map() };
+    }
+}
+/** Build the WhyRule facts for one rule, reusing an already-computed load graph and history. */
+function ruleFacts(cwd, rule, graph, hist) {
+    const src = rule.sourcePath ? graph.find((e) => e.path === rule.sourcePath) : undefined;
+    const cls = classifyRule(rule);
+    const checkable = CHECKABLE_KINDS.has(cls.kind);
+    const advice = checkable ? null : adviseRule(rule);
+    const b = hist.byRule.get(`${rule.id}\u0000${rule.title}`);
+    return {
+        id: rule.id,
+        title: rule.title,
+        source: rule.source,
+        location: locationOf(rule),
+        loaded: src ? src.status === "loaded" : true,
+        loadNote: src?.note,
+        pathScoped: rule.paths ? rule.paths.join(", ") : undefined,
+        checkable,
+        kind: cls.kind,
+        suggestion: advice?.suggestion,
+        named: namedCommandOrPath(rule, cwd),
+        block: blockHintFor(cls),
+        brokenCount: b?.count ?? 0,
+        brokenDates: b ? [new Date(b.lastMs).toISOString().slice(0, 10)] : [],
+        sessionsScanned: hist.sessionsScanned,
+    };
+}
+export async function explainRule(cwd, query) {
+    const rules = loadRules(cwd);
+    const matches = findRules(rules, query);
+    if (matches.length === 0)
+        return { query, matches: 0 };
+    if (matches.length > 1) {
+        return {
+            query,
+            matches: matches.length,
+            candidates: matches.slice(0, 12).map((r) => ({ title: r.title, location: locationOf(r) })),
+        };
+    }
+    const graph = describeRuleSources(cwd);
+    const hist = await historyLookup(cwd, rules);
+    return { query, matches: 1, rule: ruleFacts(cwd, matches[0], graph, hist) };
+}
+/** A "problem" rank so `why --all` can put the ones that need attention first. */
+function problemRank(w) {
+    if (!w.loaded)
+        return 0; // the agent never sees it
+    if (w.named && !w.named.exists)
+        return 1; // names a command/file that does not exist
+    if (w.brokenCount > 0)
+        return 2; // broken recently
+    if (!w.checkable)
+        return 3; // needs judgment
+    return 4; // fine
+}
+/**
+ * `why --all` — the same facts for every loaded rule, problems first (not loaded, then a
+ * named command/file missing, then broken recently, then judgment-only, then the rest).
+ * Read-only, facts only, no verdicts. Order within a rank is the rule's own order.
+ */
+export async function explainAll(cwd) {
+    const rules = loadRules(cwd);
+    const graph = describeRuleSources(cwd);
+    const hist = await historyLookup(cwd, rules);
+    const facts = rules.map((r) => ruleFacts(cwd, r, graph, hist));
+    const ranked = facts
+        .map((w, i) => ({ w, i }))
+        .sort((a, b) => problemRank(a.w) - problemRank(b.w) || a.i - b.i)
+        .map((x) => x.w);
+    return { rules: ranked, sessionsScanned: hist.sessionsScanned };
+}
+/** The no-argument help: how to use `why`, plus every rule with its id, so people can pick. */
+export function whyList(cwd) {
+    return loadRules(cwd).map((r) => ({ id: r.id, title: r.title, location: locationOf(r) }));
+}
+function locationOf(rule) {
+    if (!rule.sourcePath)
+        return "unknown";
+    const home = homedir();
+    const p = rule.sourcePath.startsWith(home) ? `~${rule.sourcePath.slice(home.length)}` : rule.sourcePath;
+    return rule.sourceLine ? `${p}:${rule.sourceLine}` : p;
+}
+export function renderWhy(r) {
+    if (r.matches === 0)
+        return `No rule matched "${r.query}". Try a distinctive phrase from the rule, or run \`rulereceipt audit\` to list what loads.`;
+    if (r.candidates) {
+        const lines = r.candidates.map((c) => `  • ${c.title}   (${c.location})`);
+        return `"${r.query}" matched ${r.matches} rules — narrow it down:\n${lines.join("\n")}`;
+    }
+    const w = r.rule;
+    const out = [];
+    out.push(`Rule ${w.id} — ${w.title}`);
+    out.push(`  at ${w.location}  (${w.source})`);
+    out.push("");
+    out.push(w.loaded ? `  ✓ loaded — the agent reads this file` : `  ✗ NOT loaded — ${w.loadNote ?? "the agent never sees this file"}`);
+    if (w.pathScoped)
+        out.push(`  • path-scoped: only loads when the session touches ${w.pathScoped}`);
+    if (w.named)
+        out.push(w.named.exists ? `  ✓ names a ${w.named.kind} that exists: ${w.named.name}` : `  ✗ names a ${w.named.kind} that does NOT exist here: ${w.named.name}`);
+    out.push(w.checkable
+        ? `  ✓ mechanically checkable (${w.kind}) — a session is judged against it with quoted evidence`
+        : `  • needs your judgment${w.suggestion ? ` — ${w.suggestion}` : ` — no command or file to check it by; a human decides`}`);
+    renderBlockHint(w.block, out);
+    out.push("");
+    if (w.brokenCount > 0)
+        out.push(`  last 30 days: broken ${w.brokenCount}× (last: ${w.brokenDates[0]}) across ${w.sessionsScanned} session${w.sessionsScanned === 1 ? "" : "s"}`);
+    else
+        out.push(`  last 30 days: no proven break across ${w.sessionsScanned} session${w.sessionsScanned === 1 ? "" : "s"}`);
+    return out.join("\n");
+}
+/**
+ * How to actually enforce this rule, appended to the single-rule view. Prints
+ * only what the tool truly does: a native Claude Code permissions rule where one
+ * can genuinely express it (with its honest limitation), RuleReceipt's own guard
+ * where it covers the rule pre-flight, and — for rules judged only after the run —
+ * the after-the-fact path. Nothing here claims a block the guard doesn't make.
+ */
+function renderBlockHint(block, out) {
+    if (!block)
+        return;
+    out.push("");
+    if (block.preventable) {
+        out.push("  To stop this before it runs:");
+        if (block.native) {
+            const entries = block.native.entries.map((e) => `"${e}"`).join(", ");
+            out.push(`    • Claude Code settings (.claude/settings.json), no extra tool:`);
+            out.push(`        { "permissions": { "${block.native.kind}": [${entries}] } }`);
+            out.push(`      ${block.native.note}`);
+        }
+        else if (block.nativeImpossibleReason) {
+            out.push(`    • A Claude Code permission rule can't express this — ${block.nativeImpossibleReason}.`);
+        }
+        if (block.guardCovers) {
+            out.push(`    • RuleReceipt's own guard checks this exact rule: run \`rulereceipt protect\``);
+            out.push(`      (adds a PreToolUse deny hook + a Stop hook, shown before it writes anything).`);
+        }
+    }
+    else {
+        out.push("  Can't be blocked before an action — this rule is judged after the run.");
+        out.push("  Run `rulereceipt check` after a session; `rulereceipt protect` also adds a Stop");
+        out.push("  hook that won't let a session end on a broken rule.");
+    }
+}
+/** No-argument output: how to use `why`, then every rule with its id so you can pick one. */
+export function renderWhyList(list) {
+    if (list.length === 0)
+        return "No rules file found here. Run `rulereceipt init` to add one, then `rulereceipt why \"<rule>\"`.";
+    const out = ['Explain one rule:  rulereceipt why "<some words from the rule>"', "Or all of them:    rulereceipt why --all", "", "Rules found:"];
+    for (const r of list)
+        out.push(`  ${r.id.padEnd(6)}  ${r.title.replace(/\s+/g, " ").slice(0, 72)}`);
+    return out.join("\n");
+}
+/** One short line per rule for `why --all`, problems first. */
+export function renderAllWhy(all) {
+    if (all.rules.length === 0)
+        return "No rules file found here. Run `rulereceipt init` to add one.";
+    const out = [];
+    for (const w of all.rules) {
+        let mark = "  ✓";
+        let note = w.checkable ? `checkable (${w.kind})` : "needs your judgment";
+        if (!w.loaded) {
+            mark = "  ✗";
+            note = `NOT loaded — ${w.loadNote ?? "the agent never sees this file"}`;
+        }
+        else if (w.named && !w.named.exists) {
+            mark = "  ✗";
+            note = `names a ${w.named.kind} that does not exist: ${w.named.name}`;
+        }
+        else if (w.brokenCount > 0) {
+            mark = "  ✗";
+            note = `broken ${w.brokenCount}× (last: ${w.brokenDates[0]})`;
+        }
+        out.push(`${mark} ${w.id.padEnd(6)} ${w.title.replace(/\s+/g, " ").slice(0, 60)}`);
+        out.push(`         ${note}`);
+    }
+    out.push("");
+    out.push(`across ${all.sessionsScanned} session${all.sessionsScanned === 1 ? "" : "s"} · run \`rulereceipt why "<rule>"\` for one rule in full`);
+    return out.join("\n");
+}

package/dist/wrong.js

@@ -27,12 +27,25 @@ export function reportedLabel(r) {
     return "Couldn't tell";
 }
 const SECRET_PATTERNS = [
+    // Private key blocks and passwords inside URLs go FIRST — before the email
+    // rule, which would otherwise partially rewrite a user:pass@host authority.
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "<redacted-private-key>"],
+    [/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^\s:/@]+:)[^\s:/@]+(@)/g, "$1<redacted>$2"],
     [/\bsk-[A-Za-z0-9_-]{16,}/g, "<redacted-key>"],
     [/\b(?:ghp|gho|ghu|ghs|github_pat)_[A-Za-z0-9_]{16,}/g, "<redacted-token>"],
     [/\bxox[abprs]-[A-Za-z0-9-]{10,}/g, "<redacted-token>"],
+    // Stripe secret/publishable/restricted/webhook keys.
+    [/\b(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g, "<redacted-stripe-key>"],
+    [/\bwhsec_[A-Za-z0-9]{16,}/g, "<redacted-stripe-secret>"],
     [/\bAKIA[0-9A-Z]{16}\b/g, "<redacted-aws-key>"],
-    [/\b(?:Bearer|token|apikey|api_key|password|passwd|secret)(\s*[:=]\s*|\s+)["']?[^\s"']{6,}/gi, "$1<redacted>"],
-    [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "<redacted-private-key>"],
+    // JSON Web Tokens: header.payload.signature, each base64url.
+    [/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, "<redacted-jwt>"],
+    // The value excludes a leading "<" so this never re-clobbers a more specific
+    // placeholder an earlier rule already inserted (e.g. "token <redacted-jwt>").
+    [/\b(?:Bearer|token|apikey|api_key|password|passwd|secret)(\s*[:=]\s*|\s+)["']?(?!<redacted)[^\s"']{6,}/gi, "$1<redacted>"],
+    // .env-style KEY=value: an UPPERCASE_KEY assigned a non-trivial value. A short
+    // value (DISABLE_LOCKS=1) is left alone so ordinary flags are not mangled.
+    [/\b([A-Z][A-Z0-9_]{2,})=(["']?)[^\s"']{8,}\2/g, "$1=<redacted>"],
     [/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, "<email>"],
 ];
 /** Masks the things most likely to be private. Not a guarantee — the user is told to read it. */
@@ -91,6 +104,7 @@ export function buildWrongReport(input) {
         "",
         "> Read this before sharing. Obvious secrets, your home path and email addresses were masked,",
         "> but rule text and session lines are quoted as they are. Edit anything private.",
+        "> Masking catches common formats only. Read before sending.",
         "",
         `**Rule handle:** \`${handle}\`  (id ${result.ruleId}, ${result.ruleSource})`,
         "",

package/dist/wrongSubmit.d.ts

@@ -0,0 +1,24 @@
+import { type SpawnSyncReturns } from "node:child_process";
+/**
+ * The two ways to send a wrong-verdict report, kept as pure, testable pieces so
+ * the command wiring in cli.ts stays thin. Nothing here sends on its own: it
+ * builds the exact `gh issue create` argv and the exact mailto: URL, and the
+ * caller only runs them AFTER an explicit yes (see cli.ts). `--yes` never skips
+ * that preview+confirm — the report is public, so the default answer is No.
+ */
+export declare const SUPPORT_EMAIL = "hello@rulereceipt.dev";
+export declare const REPO = "rulereceipt/rulereceipt";
+export declare const ISSUE_LABEL = "wrong-verdict";
+type Runner = (cmd: string, args: string[]) => SpawnSyncReturns<Buffer>;
+/** True only if `gh` is installed AND logged in. No issue is offered otherwise. */
+export declare function ghReady(run?: Runner): boolean;
+export declare function issueTitle(reported: string, ruleTitle: string): string;
+/** argv for `gh issue create`. The label is included only when withLabel. */
+export declare function issueCreateArgs(title: string, body: string, withLabel: boolean): string[];
+export declare const MAILTO_MAX = 1800;
+export declare function mailtoSubject(ruleTitle: string): string;
+export declare function buildMailto(subject: string, body: string): {
+    url: string;
+    trimmed: boolean;
+};
+export {};

package/dist/wrongSubmit.js

@@ -0,0 +1,50 @@
+import { spawnSync } from "node:child_process";
+/**
+ * The two ways to send a wrong-verdict report, kept as pure, testable pieces so
+ * the command wiring in cli.ts stays thin. Nothing here sends on its own: it
+ * builds the exact `gh issue create` argv and the exact mailto: URL, and the
+ * caller only runs them AFTER an explicit yes (see cli.ts). `--yes` never skips
+ * that preview+confirm — the report is public, so the default answer is No.
+ */
+export const SUPPORT_EMAIL = "hello@rulereceipt.dev";
+export const REPO = "rulereceipt/rulereceipt";
+export const ISSUE_LABEL = "wrong-verdict";
+const defaultRun = (cmd, args) => spawnSync(cmd, args, { stdio: "ignore" });
+/** True only if `gh` is installed AND logged in. No issue is offered otherwise. */
+export function ghReady(run = defaultRun) {
+    try {
+        if (run("gh", ["--version"]).status !== 0)
+            return false;
+        return run("gh", ["auth", "status"]).status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+export function issueTitle(reported, ruleTitle) {
+    const t = ruleTitle.replace(/\s+/g, " ").trim().slice(0, 60);
+    return `Wrong verdict: ${reported} on ${t}`;
+}
+/** argv for `gh issue create`. The label is included only when withLabel. */
+export function issueCreateArgs(title, body, withLabel) {
+    const args = ["issue", "create", "--repo", REPO, "--title", title, "--body", body];
+    if (withLabel)
+        args.push("--label", ISSUE_LABEL);
+    return args;
+}
+// A conservative cap so the mailto: fits what mail clients accept; a longer body
+// is trimmed and the user is told to attach the saved .md file instead.
+export const MAILTO_MAX = 1800;
+export function mailtoSubject(ruleTitle) {
+    return `RuleReceipt wrong verdict: ${ruleTitle.replace(/\s+/g, " ").trim().slice(0, 80)}`;
+}
+export function buildMailto(subject, body) {
+    let b = body;
+    let trimmed = false;
+    if (b.length > MAILTO_MAX) {
+        b = b.slice(0, MAILTO_MAX) + "\n\n[Report trimmed to fit email — attach the saved .md file instead.]";
+        trimmed = true;
+    }
+    const url = `mailto:${SUPPORT_EMAIL}?subject=${encodeURIComponent(subject)}&body=${encodeURIComponent(b)}`;
+    return { url, trimmed };
+}