@cejel/cejel 0.3.2 → 0.4.1

package/README.md

@@ -68,7 +68,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.3.2 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.1 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -91,7 +91,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.3.2` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.1` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -140,16 +140,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.3.2`:
+**Docker / OCI.** The current container release is `0.4.1`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.3.2
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.1
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.3.2 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.1 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -426,7 +426,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-openclaw mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.3.2"]}'
+openclaw mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.1"]}'
 openclaw mcp doctor cejel-oci --probe
 ```
 

package/dist/{chunk-XB65L6WE.js → chunk-HG5NAFH5.js}

@@ -4236,12 +4236,12 @@ var WitanContentReadSummarySchema = external_exports.object({
   }
 });
 var WitanRepoRefSchema = external_exports.object({
+  // Retained for backward-compatible verification of reports emitted through v0.4.0.
+  // New reports omit the checkout path so their bytes are independent of run location.
   path: external_exports.string().min(1).max(700).optional(),
   url: external_exports.string().url().optional(),
   headSha: external_exports.string().min(7).max(64).optional()
-}).strict().refine((value) => Boolean(value.path ?? value.url), {
-  message: "Witan repo reference must include a path or url."
-});
+}).strict();
 var WitanReportInputSchema = external_exports.object({
   productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
   productDisplayName: external_exports.string().min(1).max(120),
@@ -4875,7 +4875,7 @@ function renderPathEvidenceTarget(evidence) {
   return [pathTarget, hashTarget].filter(Boolean).join(" \xB7 ");
 }
 function renderRepo(report) {
-  const repo = report.repo.path ?? report.repo.url ?? "unknown";
+  const repo = report.repo.path ?? report.repo.url ?? report.productSlug;
   return report.repo.headSha ? `${repo} @ ${report.repo.headSha}` : repo;
 }
 function renderVerdict(score) {
@@ -5269,10 +5269,11 @@ var WITAN_RUBRIC_VERSION_V15 = "witan-rubric-v15-2026-07-24";
 var WITAN_RUBRIC_VERSION_V16 = "witan-rubric-v16-2026-07-24";
 var WITAN_RUBRIC_VERSION_V17 = "witan-rubric-v17-2026-07-24";
 var WITAN_RUBRIC_VERSION_V18 = "witan-rubric-v18-prospective-2026-07-25";
+var WITAN_RUBRIC_VERSION_V19 = "witan-rubric-v19-prospective-2026-08-09";
 
 // src/witan/repo-signals.ts
 function usesV17DetectorClosure(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19;
 }
 function buildWitanInputFromRepo(options) {
   const tracked = trackContentReads(options.repoPath, () => buildWitanInputFromRepoUntracked(options));
@@ -5312,7 +5313,8 @@ function buildWitanInputFromRepoUntracked(options) {
   const inventoryFiles = fileInventory.inventoryFiles;
   const ignoredTargetReason = repoFiles.length === 0 ? explainIgnoredScanTarget(options.repoPath) : void 0;
   const usesV17Detectors = usesV17DetectorClosure(rubricVersion);
-  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18;
+  const usesV18NativeRls = rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19;
+  const usesV19CommitYear = rubricVersion === WITAN_RUBRIC_VERSION_V19;
   const structuralArchetype = classifyRepoArchetype(inventoryFiles, rubricVersion);
   const readableArchetype = rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || usesV17DetectorClosure(rubricVersion) ? applyReadableSourceRepresentationGate(
     options.repoPath,
@@ -5344,6 +5346,7 @@ function buildWitanInputFromRepoUntracked(options) {
     usesV39Detectors,
     usesV47Detectors,
     usesV18NativeRls,
+    usesV19CommitYear,
     reviewableSourceProof,
     scanLimitations
   );
@@ -5356,7 +5359,6 @@ function buildWitanInputFromRepoUntracked(options) {
     productSlug: options.productSlug,
     productDisplayName: options.productDisplayName,
     repo: {
-      path: options.repoPath,
       ...headSha ? { headSha } : {}
     },
     generatedAt,
@@ -5952,7 +5954,7 @@ function buildNotApplicableSignal(criterionId, reason) {
     notApplicable: true
   };
 }
-function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, reviewableSourceProof, scanLimitations = /* @__PURE__ */ new Set()) {
+function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, useV33Detectors, useV36Detectors, useV39Detectors, useV47Detectors, useV18NativeRls, useV19CommitYear, reviewableSourceProof, scanLimitations = /* @__PURE__ */ new Set()) {
   const signals = [];
   const mono = resolveMonorepoContext(repoPath, scanLimitations);
   const collectCriterion = (criterionId, collect) => withContentReadCriterion(criterionId, collect);
@@ -6010,7 +6012,13 @@ function collectRepoSignals(repoPath, generatedAt, repoFiles, useV27Detectors, u
   );
   const b4Signal = collectCriterion(
     "B4",
-    () => collectB4AuditEvidence(repoPath, repoFiles, generatedAt)
+    () => collectB4AuditEvidence(
+      repoPath,
+      repoFiles,
+      generatedAt,
+      useV19CommitYear,
+      scanLimitations
+    )
   );
   const b5Signal = buildNotApplicableSignal(
     "B5",
@@ -7214,7 +7222,31 @@ function collectB3CiDisciplineEvidence(repoPath, repoFiles, mono) {
     ]
   };
 }
-function collectB4AuditEvidence(repoPath, repoFiles, generatedAt) {
+function auditFreshnessCommitterYearFromGitResult(result, scanLimitations) {
+  if (!result.ok) {
+    if (!isExpectedGitAbsence(result)) {
+      scanLimitations.add(
+        `${describeGitFailure(result.reason, "HEAD committer-date discovery")} Cejel omitted the numeric B4 freshness year and retained only static freshness markers.`
+      );
+    }
+    return null;
+  }
+  const year = /^([0-9]{4})-/.exec(result.stdout.trim())?.[1];
+  if (!year) {
+    scanLimitations.add(
+      "Cejel: local git HEAD committer-date discovery returned a malformed date. Cejel omitted the numeric B4 freshness year and retained only static freshness markers."
+    );
+    return null;
+  }
+  return year;
+}
+function readAuditFreshnessCommitterYear(repoPath, scanLimitations) {
+  return auditFreshnessCommitterYearFromGitResult(
+    execGit(["show", "-s", "--format=%cI", "HEAD"], { cwd: repoPath }),
+    scanLimitations
+  );
+}
+function collectB4AuditEvidence(repoPath, repoFiles, generatedAt, useV19CommitYear = false, scanLimitations = /* @__PURE__ */ new Set()) {
   const evidence = [];
   const auditFiles = repoFiles.filter(isAuditFile);
   for (const file of auditFiles.slice(0, 5)) {
@@ -7233,8 +7265,11 @@ function collectB4AuditEvidence(repoPath, repoFiles, generatedAt) {
       "Only a static security-policy artifact (e.g. SECURITY.md) was detected \u2014 no committed CHANGELOG/CHANGES/HISTORY/NEWS/AUDIT/STATUS/release-notes/runbook/provenance file to rate for an audit trail. The project may publish release history outside the repository (e.g. GitHub Releases). B4 has no ratable surface here; it is excluded rather than scored."
     );
   }
-  const runYear = new Date(generatedAt).getFullYear();
-  const freshnessPattern = new RegExp(`${runYear}|recent|latest|current`, "i");
+  const referenceYear = useV19CommitYear ? readAuditFreshnessCommitterYear(repoPath, scanLimitations) : String(new Date(generatedAt).getFullYear());
+  const freshnessPattern = new RegExp(
+    `${referenceYear ? `${referenceYear}|` : ""}recent|latest|current`,
+    "i"
+  );
   return {
     criterionId: "B4",
     positiveEvidence: evidence,
@@ -7265,7 +7300,7 @@ function collectB4AuditEvidence(repoPath, repoFiles, generatedAt) {
         Math.max(auditFiles.length, 1),
         0.2,
         "ratio",
-        "Credits audit artifacts that carry freshness/current-state markers."
+        useV19CommitYear ? "Credits audit artifacts that carry the scanned HEAD committer year or static freshness/current-state markers." : "Credits audit artifacts that carry freshness/current-state markers."
       )
     ]
   };
@@ -10192,7 +10227,7 @@ var WITAN_RUBRIC = [
 
 // src/witan/scoring.ts
 function usesV17DetectorClosure2(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19;
 }
 var MAX_SIGNAL_ADJUSTMENT = 0.8;
 function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC) {
@@ -10351,7 +10386,7 @@ function statusForScore(score) {
 }
 function statusAfterInputAdjustment(nativeStatus, nativeScore, adjustment, rubricVersion) {
   if (adjustment === 0) return nativeStatus;
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19) {
     return statusForScore(roundScore(Math.max(0, nativeScore - adjustment)));
   }
   const statusFloor = {
@@ -10396,7 +10431,7 @@ function mergeSignalsByCriterion(signals) {
   return merged;
 }
 function usesMetricScoring(rubricVersion) {
-  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
+  return rubricVersion === WITAN_RUBRIC_VERSION_V1 || rubricVersion === WITAN_RUBRIC_VERSION_V2 || rubricVersion === WITAN_RUBRIC_VERSION_V3 || rubricVersion === WITAN_RUBRIC_VERSION_V4 || rubricVersion === WITAN_RUBRIC_VERSION_V5 || rubricVersion === WITAN_RUBRIC_VERSION_V6 || rubricVersion === WITAN_RUBRIC_VERSION_V7 || rubricVersion === WITAN_RUBRIC_VERSION_V8 || rubricVersion === WITAN_RUBRIC_VERSION_V9 || rubricVersion === WITAN_RUBRIC_VERSION_V10 || rubricVersion === WITAN_RUBRIC_VERSION_V11 || rubricVersion === WITAN_RUBRIC_VERSION_V12 || rubricVersion === WITAN_RUBRIC_VERSION_V13 || rubricVersion === WITAN_RUBRIC_VERSION_V14 || rubricVersion === WITAN_RUBRIC_VERSION_V15 || rubricVersion === WITAN_RUBRIC_VERSION_V16 || rubricVersion === WITAN_RUBRIC_VERSION_V17 || rubricVersion === WITAN_RUBRIC_VERSION_V18 || rubricVersion === WITAN_RUBRIC_VERSION_V19 || rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0;
 }
 function unmeasuredStatus(rubricVersion) {
   return rubricVersion === WITAN_TRADING_RUBRIC_VERSION_V0 ? "unverified" : "insufficient_data";
@@ -10772,7 +10807,7 @@ function calibratedCriterionStateV11(criterionId, metrics) {
   return void 0;
 }
 function ensureFindingsExplainStatus(criterionId, score, status, findings, evidence, rubricVersion) {
-  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && findings.length > 0) {
+  if (rubricVersion !== WITAN_RUBRIC_VERSION_V8 && rubricVersion !== WITAN_RUBRIC_VERSION_V9 && rubricVersion !== WITAN_RUBRIC_VERSION_V10 && rubricVersion !== WITAN_RUBRIC_VERSION_V11 && rubricVersion !== WITAN_RUBRIC_VERSION_V12 && rubricVersion !== WITAN_RUBRIC_VERSION_V13 && rubricVersion !== WITAN_RUBRIC_VERSION_V14 && rubricVersion !== WITAN_RUBRIC_VERSION_V15 && rubricVersion !== WITAN_RUBRIC_VERSION_V16 && rubricVersion !== WITAN_RUBRIC_VERSION_V17 && rubricVersion !== WITAN_RUBRIC_VERSION_V18 && rubricVersion !== WITAN_RUBRIC_VERSION_V19 && findings.length > 0) {
     return [...findings];
   }
   if (status !== "critical" && status !== "warning") return [...findings];

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-XB65L6WE.js";
+} from "./chunk-HG5NAFH5.js";
 import {
   init_esm_shims
 } from "./chunk-LZVKQV3R.js";

package/dist/mcp/index.js

@@ -9,7 +9,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-XB65L6WE.js";
+} from "../chunk-HG5NAFH5.js";
 import {
   __commonJS,
   __export,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.3.2",
+  "version": "0.4.1",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {