@cejel/cejel 0.6.11 → 0.7.0-rc.2

package/dist/calibration/llm-detector.js

@@ -5,7 +5,7 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-4YOIR3E6.js";
+} from "../chunk-G6AN4EDL.js";
 import {
   listCejelLlmPackFiles
 } from "../chunk-RRPQHEBU.js";
@@ -4855,8 +4855,27 @@ var CejelLlmPackStatusSchema = external_exports.enum([
   "assessed_with_limitations",
   "not_applicable"
 ]);
+var CEJEL_LLM_EVIDENCE_PATH_MAX = 700;
+var CEJEL_LLM_OVER_LIMIT_EVIDENCE = Object.freeze({
+  path: ".",
+  line: null,
+  label: `Path longer than the artifact's ${CEJEL_LLM_EVIDENCE_PATH_MAX}-character limit; not cited`
+});
+function cejelLlmOverLimitPathsLimitation(count) {
+  const one = count === 1;
+  return `Cejel did not cite ${count} repository ${one ? "path" : "paths"} because ${one ? "it is" : "they are"} longer than the artifact's ${CEJEL_LLM_EVIDENCE_PATH_MAX}-character path limit. Every finding that cited ${one ? "it" : "one"} is kept, with its rule, severity, confidence and summary, anchored on the repository ('.') instead. No path is shortened, since a shortened path would name a file that does not exist.`;
+}
+function fitCejelLlmFindingPaths(findings) {
+  const dropped = /* @__PURE__ */ new Set();
+  const fitted = findings.map((finding5) => {
+    if (finding5.evidence.path.length <= CEJEL_LLM_EVIDENCE_PATH_MAX) return finding5;
+    dropped.add(finding5.evidence.path);
+    return { ...finding5, evidence: { ...CEJEL_LLM_OVER_LIMIT_EVIDENCE } };
+  });
+  return dropped.size === 0 ? { findings, droppedPaths: 0 } : { findings: fitted, droppedPaths: dropped.size };
+}
 var CejelLlmEvidenceSchema = external_exports.object({
-  path: external_exports.string().min(1).max(700).refine(
+  path: external_exports.string().min(1).max(CEJEL_LLM_EVIDENCE_PATH_MAX).refine(
     (path) => !path.startsWith("/") && !/^[A-Za-z]:[\\/]/.test(path) && !path.split(/[\\/]/).some((member) => member === ".."),
     { message: "Evidence paths must be repository-relative and cannot traverse parents." }
   ),
@@ -5112,7 +5131,7 @@ function collectCejelLlmPack(repoPath, repoFiles) {
     (rule) => (rule.id === "LLM-AGY-002" ? sourceFiles.filter((file) => isPythonSource(file)) : pythonLlmFiles).flatMap((file) => rule.detect(file))
   );
   const applicable = javascriptLlmFiles.length > 0 || pythonLlmFiles.length > 0 || actionSurfaceFiles.length > 0 || hasEvaluationSurface || pythonLineageFindings.length > 0 || pythonRuleFindings.length > 0;
-  const findings = applicable ? [
+  const detectedFindings = applicable ? [
     ...CEJEL_LLM_V1_RULES.flatMap(
       (rule) => (rule.id === "LLM-IOH-001" ? javascriptUnsafeSinkFiles : javascriptLlmFiles).flatMap((file) => rule.detect(file))
     ),
@@ -5129,6 +5148,7 @@ function collectCejelLlmPack(repoPath, repoFiles) {
     // evidence that an unrelated metrics writer is an LLM evaluation.
     ...detectCejelLlmEvaluationRules(sourceFiles)
   ] : [];
+  const { findings, droppedPaths } = fitCejelLlmFindingPaths(detectedFindings);
   const ruleResults = CEJEL_LLM_ENABLED_RULE_IDS.map((ruleId) => {
     const ruleFindings = findings.filter((finding5) => finding5.ruleId === ruleId);
     const confidence = RULE_CONFIDENCE.get(ruleId) ?? "low";
@@ -5182,7 +5202,7 @@ function collectCejelLlmPack(repoPath, repoFiles) {
     ...pythonLlmFiles.map((file) => file.path),
     ...actionSurfaceFiles.map((file) => file.path),
     ...evaluationSurfaceFiles.map((file) => file.path),
-    ...findings.map((finding5) => finding5.evidence.path)
+    ...detectedFindings.map((finding5) => finding5.evidence.path)
   ]);
   const integrationSet = new Set(integrations);
   if (actionSurfaceFiles.length > 0) integrationSet.add("Model-facing tool registration");
@@ -5209,7 +5229,8 @@ function collectCejelLlmPack(repoPath, repoFiles) {
         "Alpha coverage is limited to fixture-backed JavaScript, TypeScript, and Python source patterns in files up to 1 MB.",
         "Rules use bounded, observable source patterns and do not claim whole-program data-flow analysis.",
         "Action-governance and evaluation-hygiene rules require one of the explicitly supported complete local JavaScript, TypeScript, or Python evidence paths.",
-        "No model-quality, factuality, prompt-injection-resistance, or general hallucination rate is measured."
+        "No model-quality, factuality, prompt-injection-resistance, or general hallucination rate is measured.",
+        ...droppedPaths > 0 ? [cejelLlmOverLimitPathsLimitation(droppedPaths)] : []
       ]
     },
     notes: applicable ? "Static LLM application-integrity alpha; findings require calibration before public release." : "No supported LLM application surface was detected; LLM controls were not scored."