@cejel/cejel 0.2.1 → 0.2.2

package/README.md

@@ -49,6 +49,29 @@ chmod +x cejel
 ./cejel .
 ```
 
+**Windows x86_64 (PowerShell).**
+
+```powershell
+$asset = "cejel-Windows-x86_64.exe"
+Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/$asset" -OutFile $asset
+Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/SHA256SUMS" -OutFile SHA256SUMS
+$expected = ((Select-String -Path SHA256SUMS -Pattern "  $([regex]::Escape($asset))$").Line -split "\s+")[0]
+$actual = (Get-FileHash -Algorithm SHA256 $asset).Hash.ToLowerInvariant()
+if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
+  throw "SHA-256 verification failed for $asset"
+}
+.\cejel-Windows-x86_64.exe .
+```
+
+> **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
+> 0.2.2 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
+> it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
+> GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
+> own-platform verification receipt covering `--version`, `--help`, a real scan,
+> source/binary parity, and a network-denied scan. If your policy requires Authenticode,
+> use the npm package or the OCI image until a human-approved signing path is available.
+
 **Don't take the offline claim on trust — check it.** Turn your network off, then run the
 binary. It will score your repository and write you a certificate anyway. That is the whole
 product, and you can falsify it in ten seconds:
@@ -61,7 +84,17 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 **npm.**
 
 ```bash
-npx @cejel/cejel .
+npx @cejel/cejel@latest .
+```
+
+> **Distribution note:** Cejel `0.2.2` is the coordinated release version for npm,
+> standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
+
+`npx` can reuse a stale cached package. Force the current npm release with the `@latest`
+specifier above, and check the version that will run before comparing certificates:
+
+```bash
+npx @cejel/cejel@latest --version
 ```
 
 If a root `package.json` still carries a template name, override only the certificate display
@@ -89,30 +122,30 @@ pnpm install && pnpm build
 node dist/index.js .
 ```
 
-Released binaries: `cejel-Darwin-arm64`, `cejel-Darwin-x86_64`, `cejel-Linux-aarch64`, and
-`cejel-Linux-x86_64`. The release also carries `SHA256SUMS`; each binary is executed against
-the source build and with networking denied before attachment. Releases from v0.1.6 also
-carry a Sigstore bundle containing GitHub's signed build-provenance attestation for all four
-binaries. Verify a downloaded binary with:
+Released binaries: `cejel-Darwin-arm64`, `cejel-Darwin-x86_64`, `cejel-Linux-aarch64`,
+`cejel-Linux-x86_64`, and `cejel-Windows-x86_64.exe`. The release also carries
+`SHA256SUMS`, a per-binary SPDX SBOM, and an own-platform verification receipt. Each binary
+is executed against the source build and with networking denied before attachment. Releases
+from v0.1.6 also carry a Sigstore bundle containing GitHub's signed build-provenance
+attestation for the release set. Verify a downloaded binary with:
 
 ```bash
-gh attestation verify ./cejel-Darwin-arm64 -R BargLabs/cejel
+gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 ```
 
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.2.0` (container releases are
-versioned independently from npm-only patches):
+**Docker / OCI.** The current container release is `0.2.2`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.2.0
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.2.2
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.2.0 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.2.2 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -360,6 +393,46 @@ The server exposes one tool and two resources:
 Like the CLI, scoring over MCP is fully offline: no network calls, no telemetry, no signup,
 and the server writes no files.
 
+## Install on OpenClaw
+
+OpenClaw stores outbound MCP servers under `mcp.servers`. Add Cejel with the npm package's
+shipped `cejel-mcp` bin:
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "cejel": {
+        "command": "npx",
+        "args": ["-y", "--package=@cejel/cejel", "cejel-mcp"]
+      }
+    }
+  }
+}
+```
+
+The equivalent OpenClaw command is:
+
+```bash
+openclaw mcp add cejel --command npx --arg -y --arg --package=@cejel/cejel --arg cejel-mcp
+openclaw mcp doctor cejel --probe
+```
+
+The OCI image is an alternative when Docker is the preferred execution boundary. Replace
+the host path with the repository OpenClaw should allow Cejel to read:
+
+```bash
+openclaw mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.2.2"]}'
+openclaw mcp doctor cejel-oci --probe
+```
+
+Cejel is active in the Official MCP Registry as `io.github.BargLabs/cejel`. The explicit
+OpenClaw configuration above works independently of catalog indexing.
+
+Cejel scans code you point it at. This free adoption surface does **not** watch, intercept,
+or govern an agent's runtime actions. Runtime-action governance is a separate boundary for
+the future paid Agent Pack.
+
 ## What "offline" means here
 
 Scoring a repo — `cejel scan .` itself, and the Action's scoring step — makes zero network

package/dist/{chunk-BR2DO4QJ.js → chunk-SNDRU52Z.js}

@@ -4544,7 +4544,7 @@ function formatMetricValue(value) {
 }
 
 // src/witan/html.ts
-function renderWitanHtmlReport(report) {
+function renderWitanHtmlReport(report, options = {}) {
   const codeCriteria = criteriaByCategory(report, "code_trust");
   const processCriteria = criteriaByCategory(report, "process_trust");
   const verifiedEvidence = report.criteria.flatMap(
@@ -4555,6 +4555,7 @@ function renderWitanHtmlReport(report) {
   const externalSourceSummaries = summarizeExternalSources(report.consumedSignals ?? []);
   const externalFindings = collectExternalFindings(report.consumedSignals ?? []);
   const coverage = computeMeasuredCoverage(report);
+  const gitHistoryUnavailable = !report.repo.headSha;
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -4577,6 +4578,7 @@ function renderWitanHtmlReport(report) {
           <dl class="meta">
             <div><dt>Date</dt><dd>${escapeHtml(formatDate(report.generatedAt))}</dd></div>
             <div><dt>Run</dt><dd>${escapeHtml(renderRepo(report))}</dd></div>
+            <div><dt>CLI</dt><dd>${escapeHtml(options.cliVersion ? `Cejel ${options.cliVersion}` : "Not recorded")}</dd></div>
             <div><dt>Rubric</dt><dd>${escapeHtml(report.rubricVersion)}</dd></div>
             ${contributingSources.length > 0 ? `<div><dt>Sources</dt><dd>Incorporates findings from: ${escapeHtml(contributingSources.join(", "))}<ul class="source-counts">${externalSourceSummaries.map((s) => `<li>${escapeHtml(formatExternalSourceLine(s))}</li>`).join("")}</ul></dd></div>` : ""}
           </dl>
@@ -4597,8 +4599,8 @@ function renderWitanHtmlReport(report) {
     </header>
 
     <section class="trust-grid" aria-label="Rubric criteria">
-      ${renderCriterionColumn("Code trust", codeCriteria)}
-      ${renderCriterionColumn("Process trust", processCriteria)}
+      ${renderCriterionColumn("Code trust", codeCriteria, gitHistoryUnavailable)}
+      ${renderCriterionColumn("Process trust", processCriteria, gitHistoryUnavailable)}
     </section>
 
     <section class="evidence-grid" aria-label="Evidence and gaps">
@@ -4641,7 +4643,7 @@ function renderExternalFindingItems(findings) {
 function criteriaByCategory(report, category) {
   return report.criteria.filter((criterion) => criterion.category === category);
 }
-function renderCriterionColumn(title, criteria) {
+function renderCriterionColumn(title, criteria, gitHistoryUnavailable) {
   const applicable = criteria.filter((criterion) => criterion.status !== "not_applicable");
   const notApplicable = criteria.filter((criterion) => criterion.status === "not_applicable");
   const notApplicableGroup = notApplicable.length > 0 ? `
@@ -4649,7 +4651,7 @@ function renderCriterionColumn(title, criteria) {
   return `<section class="criteria-column">
         <h2>${escapeHtml(title)}</h2>
         <div class="criteria-list">
-          ${applicable.map(renderCriterionCard).join("")}
+          ${applicable.map((criterion) => renderCriterionCard(criterion, gitHistoryUnavailable)).join("")}
         </div>${notApplicableGroup}
       </section>`;
 }
@@ -4665,12 +4667,14 @@ function renderNotApplicableItem(criterion) {
   const reason = criterion.notes ?? "Not applicable to this repository.";
   return `<li><span class="na-id">${escapeHtml(criterion.id)}</span> ${escapeHtml(criterion.title)} \u2014 <span class="na-reason">${escapeHtml(reason)}</span></li>`;
 }
-function renderCriterionCard(criterion) {
+function renderCriterionCard(criterion, gitHistoryUnavailable) {
   const evidence = [
     ...criterion.evidence.map(renderEvidencePointer),
     ...criterion.findings.map((finding) => renderFindingEvidence(criterion, finding))
   ];
   const metrics = criterion.metrics.map(renderMetric);
+  const statusReconciliation = renderStatusReconciliation(criterion);
+  const historyWarning = gitHistoryUnavailable && criterion.metrics.some((metric2) => metric2.name === "pr_merge_ratio") ? `<p class="scan-warning"><strong>Scan limitation:</strong> Git history was unavailable (for example, this may be a source tarball), so the recent PR merge ratio is not a measured repository outcome and its displayed zero may undercount ${escapeHtml(criterion.id)}. Re-scan a full Git clone for this signal.</p>` : "";
   return `<article class="criterion">
             <div class="criterion-top">
               <div>
@@ -4680,6 +4684,8 @@ function renderCriterionCard(criterion) {
               ${renderStatusChip(criterion.status)}
             </div>
             <div class="criterion-score">${criterion.status === "not_applicable" ? "N/A" : criterion.status === "insufficient_data" ? "No data" : formatScore(criterion.score)}</div>
+            ${statusReconciliation}
+            ${historyWarning}
             <ul class="criterion-metrics">
               ${metrics.length > 0 ? metrics.map((item) => `<li>${item}</li>`).join("") : "<li>No measured depth metrics supplied.</li>"}
             </ul>
@@ -4688,6 +4694,20 @@ function renderCriterionCard(criterion) {
             </ul>
           </article>`;
 }
+function renderStatusReconciliation(criterion) {
+  if (criterion.status === "not_applicable" || criterion.status === "insufficient_data" || criterion.status === "unverified") {
+    return "";
+  }
+  const numericBand = scoreBandForPresentation(criterion.score);
+  if (numericBand === criterion.status) return "";
+  return `<p class="status-explanation"><strong>Why the labels differ:</strong> the ${escapeHtml(criterion.status)} dimension band is calibrated from criterion evidence thresholds and findings, independently of the ${formatScore(criterion.score)}/4.0 weighted score (which falls in the ${numericBand} numeric band).</p>`;
+}
+function scoreBandForPresentation(score) {
+  if (score >= 3.5) return "verified";
+  if (score >= 2.5) return "info";
+  if (score >= 1.5) return "warning";
+  return "critical";
+}
 function renderMetric(metric2) {
   const unit = metric2.unit ? ` ${escapeHtml(metric2.unit)}` : "";
   if (metric2.kind === "saturating_count" && metric2.max !== void 0 && metric2.value > metric2.max) {
@@ -4860,6 +4880,12 @@ h2 { font-family: var(--serif); font-size: 30px; font-weight: 400; letter-spacin
 .criterion-id { color: var(--periwinkle); font-family: var(--mono); font-size: 12px; margin-bottom: 4px; }
 h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
 .criterion-score { margin-top: 12px; color: var(--text); font-family: var(--mono); font-size: 24px; }
+.status-explanation, .scan-warning {
+  margin: 10px 0 0; border-left: 3px solid var(--periwinkle); padding: 8px 10px;
+  background: var(--periwinkle-weak); color: var(--muted); font-size: 12px; line-height: 1.5;
+}
+.scan-warning { border-left-color: var(--warn); background: var(--warn-weak); }
+.status-explanation strong, .scan-warning strong { color: var(--text); }
 .criterion-metrics { display: grid; gap: 7px; margin-top: 10px; padding: 0; list-style: none; font-size: 12px; }
 .criterion-metrics li { display: flex; justify-content: space-between; gap: 12px; border-bottom: 1px solid rgba(238, 244, 247, .08); padding-bottom: 6px; }
 .criterion-metrics strong { color: var(--text); font-weight: 650; }

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-BR2DO4QJ.js";
+} from "./chunk-SNDRU52Z.js";
 
 // src/index.ts
 import { createHash } from "crypto";
@@ -224,7 +224,11 @@ async function runWitanFreeCli(args) {
     JSON.stringify(attestation, null, 2),
     "utf8"
   );
-  writeFileSync(join(options.outDir, "certificate.html"), renderWitanHtmlReport(report), "utf8");
+  writeFileSync(
+    join(options.outDir, "certificate.html"),
+    renderWitanHtmlReport(report, { cliVersion: cliVersion() }),
+    "utf8"
+  );
   writeFileSync(
     join(options.outDir, "badge.json"),
     JSON.stringify(renderWitanBadgeEndpoint(report), null, 2),

package/dist/mcp/index.js

@@ -10,7 +10,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-BR2DO4QJ.js";
+} from "../chunk-SNDRU52Z.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -17097,7 +17097,11 @@ function createCejelMcpServer(identity) {
       if (!lastScan) throw new Error("No scan has run yet \u2014 call the scan tool first.");
       return {
         contents: [
-          { uri: uri.href, mimeType: "text/html", text: renderWitanHtmlReport(lastScan.report) }
+          {
+            uri: uri.href,
+            mimeType: "text/html",
+            text: renderWitanHtmlReport(lastScan.report, { cliVersion: identity.version })
+          }
         ]
       };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {