@cejel/cejel 0.4.0 → 0.4.1

package/README.md

@@ -68,7 +68,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.0 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.1 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -91,7 +91,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.0` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.1` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -140,16 +140,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.0`:
+**Docker / OCI.** The current container release is `0.4.1`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.0
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.1
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.0 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.1 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -426,7 +426,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-openclaw mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.0"]}'
+openclaw mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.1"]}'
 openclaw mcp doctor cejel-oci --probe
 ```
 

package/dist/{chunk-PSYXFAVU.js → chunk-HG5NAFH5.js}

@@ -4236,12 +4236,12 @@ var WitanContentReadSummarySchema = external_exports.object({
   }
 });
 var WitanRepoRefSchema = external_exports.object({
+  // Retained for backward-compatible verification of reports emitted through v0.4.0.
+  // New reports omit the checkout path so their bytes are independent of run location.
   path: external_exports.string().min(1).max(700).optional(),
   url: external_exports.string().url().optional(),
   headSha: external_exports.string().min(7).max(64).optional()
-}).strict().refine((value) => Boolean(value.path ?? value.url), {
-  message: "Witan repo reference must include a path or url."
-});
+}).strict();
 var WitanReportInputSchema = external_exports.object({
   productSlug: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/),
   productDisplayName: external_exports.string().min(1).max(120),
@@ -4875,7 +4875,7 @@ function renderPathEvidenceTarget(evidence) {
   return [pathTarget, hashTarget].filter(Boolean).join(" \xB7 ");
 }
 function renderRepo(report) {
-  const repo = report.repo.path ?? report.repo.url ?? "unknown";
+  const repo = report.repo.path ?? report.repo.url ?? report.productSlug;
   return report.repo.headSha ? `${repo} @ ${report.repo.headSha}` : repo;
 }
 function renderVerdict(score) {
@@ -5359,7 +5359,6 @@ function buildWitanInputFromRepoUntracked(options) {
     productSlug: options.productSlug,
     productDisplayName: options.productDisplayName,
     repo: {
-      path: options.repoPath,
       ...headSha ? { headSha } : {}
     },
     generatedAt,

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-PSYXFAVU.js";
+} from "./chunk-HG5NAFH5.js";
 import {
   init_esm_shims
 } from "./chunk-LZVKQV3R.js";

package/dist/mcp/index.js

@@ -9,7 +9,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-PSYXFAVU.js";
+} from "../chunk-HG5NAFH5.js";
 import {
   __commonJS,
   __export,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {