@cejel/cejel 0.2.1 → 0.3.1

package/README.md

@@ -11,6 +11,10 @@ a trust certificate + badge. Especially valuable when AI wrote a lot of the code
 exactly when you can't eyeball trust. Built on a deterministic, no-LLM scoring core — the
 free path makes zero network calls and requires no account.
 
+**Claim boundary:** Cejel scores engineering-trust signals; it does not claim to detect software
+defects or prove that code is safe. Defect and vulnerability scanners remain evidence producers
+that Cejel can aggregate into a trust certificate.
+
 Cejel is not another point scanner competing with the one you already run — it's the open,
 portable, offline trust certificate that aggregates them. Pipe in SARIF-compatible output
 (MunaTrust, Snyk, Semgrep, CodeQL, Codex) plus OpenSSF Scorecard, and get one shareable
@@ -49,6 +53,29 @@ chmod +x cejel
 ./cejel .
 ```
 
+**Windows x86_64 (PowerShell).**
+
+```powershell
+$asset = "cejel-Windows-x86_64.exe"
+Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/$asset" -OutFile $asset
+Invoke-WebRequest "https://github.com/BargLabs/cejel/releases/latest/download/SHA256SUMS" -OutFile SHA256SUMS
+$expected = ((Select-String -Path SHA256SUMS -Pattern "  $([regex]::Escape($asset))$").Line -split "\s+")[0]
+$actual = (Get-FileHash -Algorithm SHA256 $asset).Hash.ToLowerInvariant()
+if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
+  throw "SHA-256 verification failed for $asset"
+}
+.\cejel-Windows-x86_64.exe .
+```
+
+> **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
+> 0.3.1 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
+> it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
+> GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
+> own-platform verification receipt covering `--version`, `--help`, a real scan,
+> source/binary parity, and a network-denied scan. If your policy requires Authenticode,
+> use the npm package or the OCI image until a human-approved signing path is available.
+
 **Don't take the offline claim on trust — check it.** Turn your network off, then run the
 binary. It will score your repository and write you a certificate anyway. That is the whole
 product, and you can falsify it in ten seconds:
@@ -61,7 +88,17 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 **npm.**
 
 ```bash
-npx @cejel/cejel .
+npx @cejel/cejel@latest .
+```
+
+> **Distribution note:** Cejel `0.3.1` is the coordinated release version for npm,
+> standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
+
+`npx` can reuse a stale cached package. Force the current npm release with the `@latest`
+specifier above, and check the version that will run before comparing certificates:
+
+```bash
+npx @cejel/cejel@latest --version
 ```
 
 If a root `package.json` still carries a template name, override only the certificate display
@@ -89,30 +126,30 @@ pnpm install && pnpm build
 node dist/index.js .
 ```
 
-Released binaries: `cejel-Darwin-arm64`, `cejel-Darwin-x86_64`, `cejel-Linux-aarch64`, and
-`cejel-Linux-x86_64`. The release also carries `SHA256SUMS`; each binary is executed against
-the source build and with networking denied before attachment. Releases from v0.1.6 also
-carry a Sigstore bundle containing GitHub's signed build-provenance attestation for all four
-binaries. Verify a downloaded binary with:
+Released binaries: `cejel-Darwin-arm64`, `cejel-Darwin-x86_64`, `cejel-Linux-aarch64`,
+`cejel-Linux-x86_64`, and `cejel-Windows-x86_64.exe`. The release also carries
+`SHA256SUMS`, a per-binary SPDX SBOM, and an own-platform verification receipt. Each binary
+is executed against the source build and with networking denied before attachment. Releases
+from v0.1.6 also carry a Sigstore bundle containing GitHub's signed build-provenance
+attestation for the release set. Verify a downloaded binary with:
 
 ```bash
-gh attestation verify ./cejel-Darwin-arm64 -R BargLabs/cejel
+gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 ```
 
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.2.0` (container releases are
-versioned independently from npm-only patches):
+**Docker / OCI.** The current container release is `0.3.1`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.2.0
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.3.1
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.2.0 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.3.1 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -360,12 +397,61 @@ The server exposes one tool and two resources:
 Like the CLI, scoring over MCP is fully offline: no network calls, no telemetry, no signup,
 and the server writes no files.
 
+## Install on OpenClaw
+
+OpenClaw stores outbound MCP servers under `mcp.servers`. Add Cejel with the npm package's
+shipped `cejel-mcp` bin:
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "cejel": {
+        "command": "npx",
+        "args": ["-y", "--package=@cejel/cejel", "cejel-mcp"]
+      }
+    }
+  }
+}
+```
+
+The equivalent OpenClaw command is:
+
+```bash
+openclaw mcp add cejel --command npx --arg -y --arg --package=@cejel/cejel --arg cejel-mcp
+openclaw mcp doctor cejel --probe
+```
+
+The OCI image is an alternative when Docker is the preferred execution boundary. Replace
+the host path with the repository OpenClaw should allow Cejel to read:
+
+```bash
+openclaw mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.3.1"]}'
+openclaw mcp doctor cejel-oci --probe
+```
+
+Cejel is active in the Official MCP Registry as `io.github.BargLabs/cejel`. The explicit
+OpenClaw configuration above works independently of catalog indexing.
+
+Cejel scans code you point it at. This free adoption surface does **not** watch, intercept,
+or govern an agent's runtime actions. Runtime-action governance is a separate boundary for
+the future paid Agent Pack.
+
 ## What "offline" means here
 
 Scoring a repo — `cejel scan .` itself, and the Action's scoring step — makes zero network
-calls: no telemetry, no signup, no model call. Fetching the `@cejel/cejel` package the
-first time (like any npm-distributed CLI, including this Action's own dependency install)
-does need network; that's a one-time install cost, not part of the scoring guarantee.
+calls: no telemetry, no signup, no model call. The scanner does invoke your local `git`
+binary through one hardened subprocess chokepoint: fixed argv only (never a shell), an
+explicit timeout and output bound, prompts and network transports disabled, proxy variables
+removed, and repository-controlled filesystem monitoring neutralized. A static CI guard
+allows `node:child_process` in that one module only and rejects direct network primitives
+everywhere, while each release binary is also scanned with outbound networking denied.
+
+Fetching the `@cejel/cejel` package the first time (like any npm-distributed CLI, including
+this Action's own dependency install) does need network; that's a one-time install cost, not
+part of the scoring guarantee. If the tracked-file inventory fails unexpectedly, the JSON,
+HTML, and markdown certificates declare that the scanner used its bounded directory fallback
+instead of silently presenting the two inventories as equivalent.
 
 ## Help validate Cejel
 

package/dist/chunk-LZVKQV3R.js

@@ -0,0 +1,360 @@
+#!/usr/bin/env node
+import { createRequire as __cejelCreateRequire } from 'node:module';
+const require = __cejelCreateRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// node_modules/.pnpm/tsup@8.5.1_postcss@8.5.19_tsx@4.23.1_typescript@5.9.3/node_modules/tsup/assets/esm_shims.js
+import path from "path";
+import { fileURLToPath } from "url";
+var getFilename, getDirname, __dirname, __filename;
+var init_esm_shims = __esm({
+  "node_modules/.pnpm/tsup@8.5.1_postcss@8.5.19_tsx@4.23.1_typescript@5.9.3/node_modules/tsup/assets/esm_shims.js"() {
+    "use strict";
+    getFilename = () => fileURLToPath(import.meta.url);
+    getDirname = () => path.dirname(getFilename());
+    __dirname = /* @__PURE__ */ getDirname();
+    __filename = /* @__PURE__ */ getFilename();
+  }
+});
+
+// src/witan/content-reads.ts
+init_esm_shims();
+import { closeSync, lstatSync, openSync, readFileSync, readSync } from "fs";
+import { resolve } from "path";
+var activeSession;
+function errnoClass(error) {
+  if (typeof error !== "object" || error === null || !("code" in error)) return null;
+  const code = error.code;
+  return typeof code === "string" && /^E[A-Z0-9_]+$/.test(code) ? code : null;
+}
+function recordSkip(path2, reason, errno, affectsCurrentCriterion = false, deduplicate = false) {
+  const session = activeSession;
+  if (!session) return;
+  if (affectsCurrentCriterion && session.criterion) {
+    session.affectedCriteria.add(session.criterion);
+  }
+  if (deduplicate) {
+    const key = `${resolve(path2)}\0${reason}\0${errno ?? ""}`;
+    if (session.deduplicatedSkips.has(key)) return;
+    session.deduplicatedSkips.add(key);
+  }
+  session.counts[reason] += 1;
+  if (reason === "unreadable" && errno) {
+    session.unreadableByErrno.set(errno, (session.unreadableByErrno.get(errno) ?? 0) + 1);
+  }
+}
+function summaryFor(session) {
+  const byReason = {
+    unreadable: session.counts.unreadable,
+    tooLarge: session.counts.too_large,
+    excludedByExtension: session.counts.excluded_by_extension,
+    deniedPath: session.counts.denied_path,
+    nonRegularFile: session.counts.non_regular_file
+  };
+  const sortedErrnos = Object.fromEntries(
+    [...session.unreadableByErrno.entries()].sort(([left], [right]) => left.localeCompare(right))
+  );
+  return {
+    skipped: Object.values(session.counts).reduce((total, count) => total + count, 0),
+    byReason,
+    unreadableByErrno: sortedErrnos,
+    affectedCriteria: [...session.affectedCriteria].sort()
+  };
+}
+function trackContentReads(_repoPath, collect) {
+  const existing = activeSession;
+  if (existing) {
+    return {
+      value: collect(),
+      summary: summaryFor(existing),
+      affectedCriteria: existing.affectedCriteria
+    };
+  }
+  const session = {
+    counts: {
+      unreadable: 0,
+      too_large: 0,
+      excluded_by_extension: 0,
+      denied_path: 0,
+      non_regular_file: 0
+    },
+    unreadableByErrno: /* @__PURE__ */ new Map(),
+    deduplicatedSkips: /* @__PURE__ */ new Set(),
+    affectedCriteria: /* @__PURE__ */ new Set()
+  };
+  activeSession = session;
+  try {
+    const value = collect();
+    return {
+      value,
+      summary: summaryFor(session),
+      affectedCriteria: session.affectedCriteria
+    };
+  } finally {
+    activeSession = void 0;
+  }
+}
+function withContentReadCriterion(criterion, collect) {
+  const session = activeSession;
+  if (!session) return collect();
+  const previous = session.criterion;
+  session.criterion = criterion;
+  try {
+    return collect();
+  } finally {
+    session.criterion = previous;
+  }
+}
+function recordContentSkip(path2, reason, deduplicate = false) {
+  recordSkip(path2, reason, void 0, false, deduplicate);
+}
+function recordFilesystemSkip(path2, error, deniedContext = false, deduplicate = true) {
+  const errno = errnoClass(error);
+  if (!errno) throw error;
+  if (deniedContext && (errno === "EACCES" || errno === "EPERM")) {
+    recordSkip(path2, "denied_path", errno, false, deduplicate);
+    return;
+  }
+  recordSkip(path2, "unreadable", errno, true, deduplicate);
+}
+function readRepoText(path2, encoding = "utf8") {
+  try {
+    const stat = lstatSync(path2);
+    if (!stat.isFile()) {
+      recordSkip(path2, "non_regular_file", void 0, true, true);
+      return "";
+    }
+  } catch (error) {
+    recordFilesystemSkip(path2, error);
+    return "";
+  }
+  try {
+    return readFileSync(path2, encoding);
+  } catch (error) {
+    recordFilesystemSkip(path2, error);
+    return "";
+  }
+}
+function readRepoTextPrefix(path2, byteLimit) {
+  try {
+    const stat = lstatSync(path2);
+    if (!stat.isFile()) {
+      recordSkip(path2, "non_regular_file", void 0, true, true);
+      return "";
+    }
+  } catch (error) {
+    recordFilesystemSkip(path2, error);
+    return "";
+  }
+  let descriptor = null;
+  try {
+    descriptor = openSync(path2, "r");
+    const buffer = Buffer.allocUnsafe(byteLimit);
+    const bytesRead = readSync(descriptor, buffer, 0, byteLimit, 0);
+    return buffer.subarray(0, bytesRead).toString("utf8");
+  } catch (error) {
+    recordFilesystemSkip(path2, error);
+    return "";
+  } finally {
+    if (descriptor !== null) {
+      try {
+        closeSync(descriptor);
+      } catch (error) {
+        recordFilesystemSkip(path2, error);
+      }
+    }
+  }
+}
+
+// src/witan/git-exec.ts
+init_esm_shims();
+import { execFileSync } from "child_process";
+var GIT_EXEC_MAX_BUFFER_BYTES = 8 * 1024 * 1024;
+var GIT_EXEC_TIMEOUT_MS = 3e4;
+var HARDENED_GIT_ARGUMENTS = [
+  "--no-pager",
+  "-c",
+  "core.fsmonitor=false",
+  "-c",
+  "core.pager=",
+  "-c",
+  "core.editor=false",
+  "-c",
+  "core.sshCommand=false",
+  "-c",
+  "diff.external=false",
+  "-c",
+  "credential.helper=",
+  "-c",
+  "log.showSignature=false",
+  "-c",
+  "gpg.program=false",
+  "-c",
+  "gpg.openpgp.program=false",
+  "-c",
+  "gpg.x509.program=false",
+  "-c",
+  "gpg.ssh.program=false",
+  "-c",
+  "core.quotePath=false",
+  "-c",
+  "protocol.allow=never",
+  "-c",
+  "protocol.ext.allow=never",
+  "-c",
+  "protocol.file.allow=never",
+  "-c",
+  "protocol.git.allow=never",
+  "-c",
+  "protocol.http.allow=never",
+  "-c",
+  "protocol.https.allow=never",
+  "-c",
+  "protocol.ssh.allow=never"
+];
+function hardenedGitEnvironment() {
+  const environment = {};
+  for (const key of ["PATH", "HOME", "TZ"]) {
+    const entry = Object.entries(process.env).find(
+      ([candidate, value]) => candidate.toUpperCase() === key && value !== void 0
+    );
+    if (entry?.[1] !== void 0) environment[key] = entry[1];
+  }
+  if (environment.HOME === void 0 && process.env.USERPROFILE !== void 0) {
+    environment.HOME = process.env.USERPROFILE;
+  }
+  return {
+    ...environment,
+    LC_ALL: "C",
+    LANG: "C",
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "true",
+    GIT_OPTIONAL_LOCKS: "0",
+    GIT_PAGER: "cat",
+    PAGER: "cat"
+  };
+}
+function errorField(error, key) {
+  if (typeof error !== "object" || error === null) return void 0;
+  return error[key];
+}
+function errorText(error) {
+  const stderr = errorField(error, "stderr");
+  const stderrText = typeof stderr === "string" ? stderr : Buffer.isBuffer(stderr) ? stderr.toString("utf8") : "";
+  const message = error instanceof Error ? error.message : "";
+  return `${stderrText}
+${message}`;
+}
+function classifyGitFailure(error) {
+  const code = errorField(error, "code");
+  const signal = errorField(error, "signal");
+  const text = errorText(error);
+  if (code === "ENOENT") return "git_absent";
+  if (code === "ENOBUFS" || /maxBuffer|ENOBUFS/i.test(text)) return "buffer_exceeded";
+  if (code === "ETIMEDOUT" || signal === "SIGTERM" || /timed?\s*out|ETIMEDOUT/i.test(text)) {
+    return "timeout";
+  }
+  if (/not a git repository|not inside a work tree|not in a git directory|unknown revision.*HEAD|ambiguous argument ['"]?HEAD|does not have any commits yet|needed a single revision/i.test(
+    text
+  )) {
+    return "not_a_repo";
+  }
+  return "exec_failed";
+}
+function execGit(argv, options) {
+  try {
+    const stdout = execFileSync("git", [...HARDENED_GIT_ARGUMENTS, ...argv], {
+      cwd: options.cwd,
+      encoding: "utf8",
+      env: hardenedGitEnvironment(),
+      input: options.input,
+      maxBuffer: options.maxBufferBytes ?? GIT_EXEC_MAX_BUFFER_BYTES,
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: GIT_EXEC_TIMEOUT_MS
+    });
+    return { ok: true, stdout };
+  } catch (error) {
+    const status = errorField(error, "status");
+    return {
+      ok: false,
+      reason: classifyGitFailure(error),
+      ...typeof status === "number" ? { exitCode: status } : {}
+    };
+  }
+}
+function isExpectedGitAbsence(result) {
+  return result.reason === "git_absent" || result.reason === "not_a_repo";
+}
+function describeGitFailure(reason, operation, maxBufferBytes = GIT_EXEC_MAX_BUFFER_BYTES) {
+  if (reason === "buffer_exceeded") {
+    const outputLimit = maxBufferBytes % (1024 * 1024) === 0 ? `${maxBufferBytes / (1024 * 1024)} MiB` : `${Math.ceil(maxBufferBytes / 1024)} KiB`;
+    return `Cejel: local git ${operation} exceeded the ${outputLimit} output limit.`;
+  }
+  if (reason === "timeout") {
+    return `Cejel: local git ${operation} exceeded the 30 second timeout.`;
+  }
+  if (reason === "git_absent") {
+    return `Cejel: local git is unavailable while running ${operation}.`;
+  }
+  if (reason === "not_a_repo") {
+    return `Cejel: ${operation} requires a usable Git work tree.`;
+  }
+  return `Cejel: local git ${operation} failed.`;
+}
+
+export {
+  __require,
+  __commonJS,
+  __export,
+  __toESM,
+  __dirname,
+  __filename,
+  init_esm_shims,
+  trackContentReads,
+  withContentReadCriterion,
+  recordContentSkip,
+  recordFilesystemSkip,
+  readRepoText,
+  readRepoTextPrefix,
+  execGit,
+  isExpectedGitAbsence,
+  describeGitFailure
+};