@cejel/cejel 0.6.1 → 0.6.2

package/README.md

@@ -92,7 +92,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.6.1 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.6.2 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM (the packages
@@ -116,7 +116,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.6.1` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.6.2` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry. A GitLab CI
 > template and Code Quality export live in [`docs/gitlab-ci.md`](./docs/gitlab-ci.md).
 
@@ -149,11 +149,17 @@ The npm package is scoped as `@cejel/cejel`; its executable remains the short co
 **GitHub Action** — score every PR and publish the badge:
 
 ```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0     # full history: A2 and B2 read commit history
 - uses: BargLabs/cejel/action@v1
   with:
     min-score: "2.5"   # optional: fail the build below this
 ```
 
+`actions/checkout` fetches one commit by default. On a shallow clone, A2 and B2 see only that
+commit, and the certificate says so under "History limitations".
+
 For an executed public example that binds a release artifact to the same commit named by its
 Cejel certificate, see [Certified releases with GitHub build provenance](./docs/certified-release-example.md).
 
@@ -181,16 +187,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.6.1`:
+**Docker / OCI.** The current container release is `0.6.2`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.1
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.2
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.1 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.2 .
 ```
 
 The OCI image carries an SBOM of its base-image packages, maximum-mode build provenance, and a
@@ -429,11 +435,51 @@ a configurable `min-score` threshold. The scoring step makes no network calls an
 secrets.
 
 ```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0 # full history: A2 and B2 read commit history
 - uses: BargLabs/cejel/action@v1
   with:
     min-score: '2.5' # optional; omit to never fail the check
 ```
 
+Check out with `fetch-depth: 0`: the default depth of 1 truncates the history A2 and B2 read, and
+the certificate then lists a history limitation.
+
+## Use with Claude
+
+Cejel ships as a Claude Code plugin in [`plugins/cejel/`](./plugins/cejel/). The plugin gives
+Claude the `scan` tool below, started through `npx` and pinned to this release, plus a
+`cejel-scan` skill. The skill tells Claude when a scan answers the question and how to read the
+certificate. It also tells Claude to present a score as evidence for your own judgment, never as
+an audit or a guarantee.
+
+Install it from this repository's marketplace, inside Claude Code:
+
+```text
+/plugin marketplace add BargLabs/cejel
+/plugin install cejel@cejel
+```
+
+From a shell, the same two steps are `claude plugin marketplace add BargLabs/cejel` and
+`claude plugin install cejel@cejel`.
+
+Scanning stays offline: the `scan` tool makes no network calls and writes no files. The first
+time the server starts, `npx` fetches the pinned `@cejel/cejel` package from npm. When you name
+a repository that isn't on your machine, Claude asks before cloning it with your `git`. Neither
+fetch is part of the scan.
+
+Example prompts that work on a public repository:
+
+- "Clone https://github.com/BargLabs/cejel into a temporary folder and give me its Cejel trust
+  score."
+- "Scan https://github.com/BargLabs/cejel with Cejel and explain the top findings and the criteria
+  they come from."
+- "Run Cejel on https://github.com/BargLabs/cejel and save its trust badge to ./cejel-badge.svg."
+
+Support: [GitHub issues](https://github.com/BargLabs/cejel/issues). Privacy policy:
+<https://barglabs.ai/privacy>. Terms: <https://barglabs.ai/terms>.
+
 ## MCP server (for agents)
 
 The same package ships a second bin, `cejel-mcp` — a thin MCP (Model Context Protocol)
@@ -521,7 +567,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.1"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.2"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,7 +5,7 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-UBU3PP7P.js";
+} from "../chunk-KG62JCJZ.js";
 import {
   listCejelLlmPackFiles
 } from "../chunk-M6YYPJSN.js";

package/dist/{chunk-UBU3PP7P.js → chunk-KG62JCJZ.js}

@@ -345,6 +345,10 @@ var WitanReportCommonSchema = external_exports.object({
   consumedSignals: external_exports.array(WitanConsumedSignalSummarySchema).optional(),
   archetype: WitanRepoArchetypeSchema.optional(),
   scanLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(16).optional(),
+  // Additive-optional (report format 1.5, issue #428): disclosures about the commit history the
+  // scan read, such as a shallow clone. Declared, never scored: unlike scanLimitations it gates
+  // nothing (no score, abstention, badge or --min-score effect). Absent when history is complete.
+  historyLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(4).optional(),
   contentReadSummary: WitanContentReadSummarySchema.optional(),
   // Additive-optional (report format 1.3): absent means a report produced before this field
   // existed, never "nothing withheld" — createWitanReport always sets it (possibly to []) on any
@@ -397,7 +401,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
-var WITAN_REPORT_FORMAT_VERSION = "1.4";
+var WITAN_REPORT_FORMAT_VERSION = "1.5";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -2179,6 +2183,13 @@ function renderWitanHtmlReport(report, options = {}) {
   ).join("")}</ul>
     </section>` : ""}
 
+    ${(report.historyLimitations?.length ?? 0) > 0 ? `<section class="scan-limitations-section evidence-section" aria-label="History limitations">
+      <h2>History limitations</h2>
+      <ul>${(report.historyLimitations ?? []).map(
+    (limitation) => `<li class="scan-warning"><strong>History limitation</strong><span>${escapeHtml(limitation)}</span></li>`
+  ).join("")}</ul>
+    </section>` : ""}
+
     ${renderContentReadSummary(report)}
 
     <section class="trust-grid" aria-label="Rubric criteria">
@@ -9218,6 +9229,15 @@ function hasEnvPathInGitHistory(repoPath, scanLimitations) {
 // src/witan/public-scan.ts
 init_esm_shims();
 
+// src/witan/history-depth.ts
+init_esm_shims();
+var SHALLOW_HISTORY_LIMITATION = "This repository is a shallow clone (git rev-parse --is-shallow-repository reports true), so its commit history is truncated. A2 (credentials and .env files in earlier commits) and B2 (pull-request merge ratio over recent commits) read history and saw only the commits present; on a full clone their results may differ. Scores are computed exactly as for any other scan. Re-scan a full clone (for actions/checkout, set fetch-depth: 0).";
+function detectHistoryLimitations(repoPath) {
+  const result = execGit(["rev-parse", "--is-shallow-repository"], { cwd: repoPath });
+  if (!result.ok || result.stdout.trim() !== "true") return void 0;
+  return [SHALLOW_HISTORY_LIMITATION];
+}
+
 // src/witan/ingest.ts
 init_esm_shims();
 import { lstatSync as lstatSync3, opendirSync, readFileSync as readFileSync4, realpathSync as realpathSync3 } from "fs";
@@ -9755,12 +9775,14 @@ function scoreRepoWithPublicCejel(options) {
     ...options.rubricVersion ? { rubricVersion: options.rubricVersion } : {}
   });
   const inputSignals = resolvePublicIngestSignals(options);
-  const report = createWitanReport(
+  const scored = createWitanReport(
     input,
     inputSignals.length > 0 ? inputSignals : void 0,
     void 0,
     options.toolVersion
   );
+  const historyLimitations = detectHistoryLimitations(options.repoPath);
+  const report = historyLimitations ? { ...scored, historyLimitations } : scored;
   if (report.verdict !== "insufficient_source" || !isWitanNoMeasurementAbstention(report)) {
     return report;
   }
@@ -9982,6 +10004,7 @@ function buildWitanCliSummary(report) {
     externalFindingCount: allExternalFindings.length,
     topExternalFindings: allExternalFindings.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT),
     scanLimitations: [...report.scanLimitations ?? []],
+    ...report.historyLimitations?.length ? { historyLimitations: [...report.historyLimitations] } : {},
     ...report.contentReadSummary ? { contentReadSummary: report.contentReadSummary } : {}
   };
   if (report.verdict === "insufficient_source") {