rulereceipt 0.1.77 → 0.1.78

package/README.md

@@ -17,7 +17,7 @@ npx rulereceipt
 Runs entirely on your machine. Plain `rulereceipt check` makes zero network
 calls — [Trust, privacy and licensing](#trust-privacy-and-licensing) has the full
 detail, including the three off-by-default opt-ins. Works with Claude Code today
-(OpenAI Codex CLI in testing); reads rules from CLAUDE.md, AGENTS.md, Cursor
+(OpenAI Codex CLI supported); reads rules from CLAUDE.md, AGENTS.md, Cursor
 (`.cursor/rules`), GitHub Copilot, Windsurf, Gemini (`GEMINI.md`), Google's
 `.agents/rules`, and Claude Code memory. [Accuracy](https://rulereceipt.dev/accuracy)
 · [Known gaps](KNOWN-GAPS.md) · Source-available, not OSI — see [LICENSE](LICENSE).
@@ -77,7 +77,7 @@ Published and live on npm, actively developed.
    current project directory and your global rules file.
 2. Reads your most recent agent session transcript — Claude Code today
    (including hosted/enterprise variants under a different directory), and
-   OpenAI Codex CLI (in testing); newest session across tools wins.
+   OpenAI Codex CLI (supported); newest session across tools wins.
 3. Routes each rule to the narrowest check that can actually answer it:
    - **Structured checks** read what the session really did — an actual
      git command's branch argument, actual file edits, actual file

package/dist/checks/gitBranchPolicy.js

@@ -158,7 +158,14 @@ export function runGitBranchPolicyChecks(classifications, events) {
             allTargets.push({ branch: hit.branch, command, kind: hit.kind });
         }
     }
-    const anyGitCommand = events.some((e) => e.kind === "tool_use" && /\bgit\s/.test(JSON.stringify(e.input ?? "")));
+    // "Did a git command actually run?" — tested on the real command segments, not
+    // JSON.stringify(input). Two bugs that caused: (1) a newline before `git`
+    // becomes the two chars `\n` once stringified, so `\bgit` lost its word
+    // boundary and a `git push` on the line after a heredoc was missed entirely
+    // (check AND guard reported "didn't apply"); (2) a mere mention in a quote or
+    // heredoc body counted as a git command. leadingCommand over heredoc-stripped
+    // segments answers the real question: a git invocation in an executable segment.
+    const anyGitCommand = commands.some((c) => segments(c).some((seg) => leadingCommand(seg) === "git"));
     return classifications.map(({ rule, branchName, polarity, polarityInferred }) => {
         // No git command ran, so a git rule never had a situation to govern.
         // Calling that "followed" is how an empty session produced 2,770 green

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rulereceipt",
-  "version": "0.1.77",
+  "version": "0.1.78",
   "description": "Checks whether your AI coding agent followed your rules, with evidence. Works with Claude Code (Codex in testing); reads CLAUDE.md, AGENTS.md, Cursor, Copilot and Windsurf rules.",
   "repository": {
     "type": "git",