@cejel/cejel 0.6.5 → 0.6.6

package/README.md

@@ -92,7 +92,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.6.5 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.6.6 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM (the packages
@@ -116,7 +116,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.6.5` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.6.6` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry. A GitLab CI
 > template and Code Quality export live in [`docs/gitlab-ci.md`](./docs/gitlab-ci.md).
 
@@ -187,16 +187,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.6.5`:
+**Docker / OCI.** The current container release is `0.6.6`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.5
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.6
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.5 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.6 .
 ```
 
 The OCI image carries an SBOM of its base-image packages, maximum-mode build provenance, and a
@@ -571,7 +571,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.5"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.6"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,11 +5,11 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-7XQVE76B.js";
+} from "../chunk-JNTTFAHQ.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-M6YYPJSN.js";
-import "../chunk-63XQDYQ5.js";
+} from "../chunk-5PFYOIOS.js";
+import "../chunk-VGBFZBZQ.js";
 import {
   external_exports
 } from "../chunk-FSMZV3Y6.js";

package/dist/{chunk-M6YYPJSN.js → chunk-5PFYOIOS.js}

@@ -5,7 +5,7 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-63XQDYQ5.js";
+} from "./chunk-VGBFZBZQ.js";
 import {
   init_esm_shims
 } from "./chunk-O3MHSK25.js";

package/dist/{chunk-35TRRAEC.js → chunk-BG4ZRBQ5.js}

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-7XQVE76B.js";
+} from "./chunk-JNTTFAHQ.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,

package/dist/{chunk-7XQVE76B.js → chunk-JNTTFAHQ.js}

@@ -5,7 +5,7 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-63XQDYQ5.js";
+} from "./chunk-VGBFZBZQ.js";
 import {
   external_exports
 } from "./chunk-FSMZV3Y6.js";
@@ -8408,22 +8408,7 @@ function packageScriptReferences(command, scripts) {
   const names = /* @__PURE__ */ new Set();
   let dynamic = false;
   for (const segment of splitShellCommandSegments(command)) {
-    for (const match of segment.matchAll(
-      /\bpnpm\s+run\s+\/((?:\\.|[^/])+)\/([dgimsuvy]*)/giu
-    )) {
-      const source = match[1];
-      if (!source) continue;
-      try {
-        const flags = (match[2] ?? "").replace(/[dgy]/g, "");
-        const selector = new RegExp(source, flags);
-        for (const name of scripts.keys()) {
-          if (selector.test(name)) names.add(name);
-          selector.lastIndex = 0;
-        }
-      } catch {
-        dynamic = true;
-      }
-    }
+    if (/\bpnpm\s+run\s+\//iu.test(segment)) dynamic = true;
     for (const match of segment.matchAll(
       /\b(?:npm|pnpm|yarn)\s+(?:run\s+)?([A-Za-z0-9][A-Za-z0-9:._-]*)/giu
     )) {
@@ -9430,19 +9415,19 @@ function findDeclaredWorkspaceManifests(repoPath, repoFiles, rootPackageJson) {
   const exclude = [];
   for (const pattern of patterns) {
     const negated = pattern.startsWith("!");
-    const regex = workspaceGlobToRegExp(negated ? pattern.slice(1) : pattern);
+    const matcher = workspaceGlobMatcher(negated ? pattern.slice(1) : pattern);
     if (negated) {
-      if (regex === null) return NO_DECLARED_WORKSPACE_MANIFESTS;
-      exclude.push(regex);
-    } else if (regex !== null) {
-      include.push(regex);
+      if (matcher === null) return NO_DECLARED_WORKSPACE_MANIFESTS;
+      exclude.push(matcher);
+    } else if (matcher !== null) {
+      include.push(matcher);
     }
   }
   const matched = repoFiles.filter((file) => {
     if (file === rootPackageJson || !file.endsWith("/package.json")) return false;
     if (!isAuthoredProductionPath(file)) return false;
     const dir = file.slice(0, -"/package.json".length);
-    return include.some((regex) => regex.test(dir)) && !exclude.some((regex) => regex.test(dir));
+    return include.some((matches) => matches(dir)) && !exclude.some((matches) => matches(dir));
   }).sort();
   return { read: matched.slice(0, WORKSPACE_PACKAGE_MANIFEST_LIMIT), declared: matched.length };
 }
@@ -9503,27 +9488,69 @@ function yamlScalar(raw) {
   const plain = stripYamlLineComment(raw).trim();
   return plain === "" || /^["'[{&*|>]/.test(plain) ? null : plain;
 }
-function workspaceGlobToRegExp(pattern) {
+var WORKSPACE_GLOB_MAX_LENGTH = 256;
+var WORKSPACE_GLOB_MAX_SEGMENTS = 32;
+function workspaceGlobMatcher(pattern) {
+  if (pattern.length > WORKSPACE_GLOB_MAX_LENGTH) return null;
   const normalised = pattern.trim().replace(/^\.\//, "").replace(/\/+$/, "");
   if (normalised === "" || normalised.startsWith("/") || /(^|\/)\.\.?(\/|$)/.test(normalised) || /[[\]{}()!+@\\]/.test(normalised)) {
     return null;
   }
-  const segments = normalised.split("/").filter((segment, index, all) => !(segment === "**" && all[index - 1] === "**"));
-  const anySegment = "(?!\\.)[^/]+";
-  if (segments.length === 1 && segments[0] === "**") return new RegExp(`^${anySegment}(?:/${anySegment})*$`);
-  let source = "";
-  segments.forEach((segment, index) => {
-    if (segment === "**") {
-      source += index === 0 ? `(?:${anySegment}/)*` : `(?:/${anySegment})*`;
-      return;
+  const split = normalised.split("/");
+  if (split.length > WORKSPACE_GLOB_MAX_SEGMENTS) return null;
+  const segments = split.filter((segment, index, all) => !(segment === "**" && all[index - 1] === "**"));
+  const isAnySegment = (part) => part !== "" && !part.startsWith(".");
+  if (segments.length === 1 && segments[0] === "**") {
+    return (dir) => dir.split("/").every(isAnySegment);
+  }
+  return (dir) => {
+    let reachable = withGlobstarSkips(segments, [true, ...segments.map(() => false)]);
+    for (const part of dir.split("/")) {
+      const next = segments.map(() => false).concat(false);
+      segments.forEach((segment, index) => {
+        if (!reachable[index]) return;
+        if (segment === "**") {
+          if (isAnySegment(part)) next[index] = true;
+        } else if (matchesWildcardSegment(segment, part)) {
+          next[index + 1] = true;
+        }
+      });
+      reachable = withGlobstarSkips(segments, next);
+      if (!reachable.includes(true)) return false;
     }
-    if (index > 0 && !(index === 1 && segments[0] === "**")) source += "/";
-    const body = segment.split("").map(
-      (char) => char === "*" ? "[^/]*" : char === "?" ? "[^/]" : char.replace(/[.^$|]/g, "\\$&")
-    ).join("");
-    source += /^[*?]/.test(segment) ? `(?!\\.)${body}` : body;
+    return reachable[segments.length] === true;
+  };
+}
+function withGlobstarSkips(segments, reachable) {
+  segments.forEach((segment, index) => {
+    if (segment === "**" && reachable[index]) reachable[index + 1] = true;
   });
-  return new RegExp(`^${source}$`);
+  return reachable;
+}
+function matchesWildcardSegment(glob, part) {
+  if ((glob.startsWith("*") || glob.startsWith("?")) && part.startsWith(".")) return false;
+  let g = 0;
+  let p = 0;
+  let starGlob = -1;
+  let starPart = 0;
+  while (p < part.length) {
+    if (g < glob.length && glob[g] === "*") {
+      starGlob = g;
+      starPart = p;
+      g += 1;
+    } else if (g < glob.length && (glob[g] === "?" || glob[g] === part[p])) {
+      g += 1;
+      p += 1;
+    } else if (starGlob !== -1) {
+      g = starGlob + 1;
+      starPart += 1;
+      p = starPart;
+    } else {
+      return false;
+    }
+  }
+  while (g < glob.length && glob[g] === "*") g += 1;
+  return g === glob.length;
 }
 function ciWorkflowCitationLabel(baseLabel, verb, considered, cited, unread, delegated = NO_DELEGATED_CI_STEPS) {
   const unreadTotal = [...unread.values()].reduce((sum, count) => sum + count, 0);

package/dist/{chunk-63XQDYQ5.js → chunk-VGBFZBZQ.js}

@@ -8,7 +8,8 @@ import {
 // src/witan/git-exec.ts
 init_esm_shims();
 import { execFileSync } from "child_process";
-import { resolve } from "path";
+import { realpathSync } from "fs";
+import { dirname, resolve } from "path";
 var GIT_EXEC_MAX_BUFFER_BYTES = 8 * 1024 * 1024;
 var GIT_EXEC_TIMEOUT_MS = 3e4;
 var HARDENED_GIT_ARGUMENTS = [
@@ -52,6 +53,7 @@ var HARDENED_GIT_ARGUMENTS = [
   "-c",
   "protocol.ssh.allow=never"
 ];
+var discoveryCeiling;
 function hardenedGitEnvironment(cwd) {
   const environment = {};
   for (const key of ["PATH", "HOME", "TZ"]) {
@@ -78,7 +80,8 @@ function hardenedGitEnvironment(cwd) {
     // still excluded below.
     GIT_CONFIG_COUNT: "1",
     GIT_CONFIG_KEY_0: "safe.directory",
-    GIT_CONFIG_VALUE_0: cwd
+    GIT_CONFIG_VALUE_0: cwd,
+    ...discoveryCeiling === void 0 ? {} : { GIT_CEILING_DIRECTORIES: discoveryCeiling }
   };
 }
 function errorField(error, key) {

package/dist/index.js

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "./chunk-35TRRAEC.js";
+} from "./chunk-BG4ZRBQ5.js";
 import {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
@@ -29,8 +29,8 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-7XQVE76B.js";
-import "./chunk-63XQDYQ5.js";
+} from "./chunk-JNTTFAHQ.js";
+import "./chunk-VGBFZBZQ.js";
 import {
   external_exports
 } from "./chunk-FSMZV3Y6.js";
@@ -601,19 +601,22 @@ function renderMinScoreCoverageFailure(coverage, minScore) {
   return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because fewer than half of the applicable dimensions were measured in at least one score (${formatCoverageSummary(coverage)}). Resolve the reported evidence gaps and re-scan.
 `;
 }
+function stripTerminalControls(text) {
+  return text.replace(/[\t\n]/g, " ").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+}
 function renderTerminalCertificate(summary, report) {
   const abstained = summary.verdict === "Insufficient source" || summary.verdict === "Insufficient evidence";
   if (!abstained && (summary.overallScore === null || summary.codeTrustScore === null || summary.processTrustScore === null)) {
     throw new Error("A scored Cejel summary must carry numeric headline scores.");
   }
   const lines = abstained ? [
-    `Cejel Trust Certificate \u2014 ${summary.productDisplayName}`,
+    `Cejel Trust Certificate \u2014 ${stripTerminalControls(summary.productDisplayName)}`,
     "",
     `${summary.verdict} to certify.`,
-    `  ${summary.insufficientSourceReason ?? "No ratable source or measurable evidence was found."}`,
+    `  ${summary.insufficientSourceReason === void 0 ? "No ratable source or measurable evidence was found." : stripTerminalControls(summary.insufficientSourceReason)}`,
     ""
   ] : [
-    `Cejel Trust Certificate \u2014 ${summary.productDisplayName}`,
+    `Cejel Trust Certificate \u2014 ${stripTerminalControls(summary.productDisplayName)}`,
     "",
     `Overall: ${formatScore(summary.overallScore)}/4.0 (${summary.verdict})`,
     `  Code trust:    ${formatScore(summary.codeTrustScore)}/4.0`,
@@ -629,7 +632,7 @@ function renderTerminalCertificate(summary, report) {
       2,
       0,
       `Scope: ${relyingPartySummary.scope}`,
-      `What was examined: ${relyingPartySummary.examined}`,
+      `What was examined: ${stripTerminalControls(relyingPartySummary.examined)}`,
       `What was established: ${relyingPartySummary.established}`,
       `What was not established: ${relyingPartySummary.notEstablished}`,
       `What to do next: ${relyingPartySummary.next}`,
@@ -639,14 +642,14 @@ function renderTerminalCertificate(summary, report) {
   if (summary.scanLimitations.length > 0) {
     lines.push(
       "LIMITED EVIDENCE \u2014 the score and verdict are qualified by scan limitations:",
-      ...summary.scanLimitations.map((limitation) => `  - ${limitation}`),
+      ...summary.scanLimitations.map((limitation) => `  - ${stripTerminalControls(limitation)}`),
       ""
     );
   }
   if (summary.historyLimitations?.length) {
     lines.push(
       "HISTORY LIMITATION \u2014 scored as usual, but some criteria read truncated history:",
-      ...summary.historyLimitations.map((limitation) => `  - ${limitation}`),
+      ...summary.historyLimitations.map((limitation) => `  - ${stripTerminalControls(limitation)}`),
       ""
     );
   }
@@ -664,9 +667,11 @@ function renderTerminalCertificate(summary, report) {
     lines.push("");
   }
   if (summary.contributingSources.length > 0) {
-    lines.push(`Incorporates findings from: ${summary.contributingSources.join(", ")}`);
+    lines.push(
+      `Incorporates findings from: ${summary.contributingSources.map(stripTerminalControls).join(", ")}`
+    );
     for (const source of summary.externalSources) {
-      lines.push(`  ${formatExternalSourceLine(source)}`);
+      lines.push(`  ${stripTerminalControls(formatExternalSourceLine(source))}`);
     }
     lines.push("");
   }
@@ -697,7 +702,7 @@ function renderTerminalCertificate(summary, report) {
     );
     for (const finding of summary.topFindings) {
       lines.push(
-        `  [finding severity: ${finding.severity}] ${finding.criterionId} [dimension band: ${finding.dimensionBand}]: ${finding.displaySummary ?? finding.summary}`
+        `  [finding severity: ${finding.severity}] ${finding.criterionId} [dimension band: ${finding.dimensionBand}]: ${stripTerminalControls(finding.displaySummary ?? finding.summary)}`
       );
     }
     const remaining = summary.findingCount - summary.topFindings.length;
@@ -714,7 +719,7 @@ function renderTerminalCertificate(summary, report) {
     );
     for (const finding of summary.topExternalFindings) {
       lines.push(
-        `  [${finding.severity}] ${finding.label} \u2192 ${finding.dimension}: ${finding.ruleId} \u2014 ${finding.message}${finding.location ? ` (${finding.location})` : ""}`
+        `  [${finding.severity}] ${stripTerminalControls(finding.label)} \u2192 ${finding.dimension}: ${stripTerminalControls(finding.ruleId)} \u2014 ${stripTerminalControls(finding.message)}${finding.location ? ` (${stripTerminalControls(finding.location)})` : ""}`
       );
     }
     const remaining = summary.externalFindingCount - summary.topExternalFindings.length;

package/dist/mcp/index.js

@@ -3,9 +3,9 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "../chunk-35TRRAEC.js";
-import "../chunk-7XQVE76B.js";
-import "../chunk-63XQDYQ5.js";
+} from "../chunk-BG4ZRBQ5.js";
+import "../chunk-JNTTFAHQ.js";
+import "../chunk-VGBFZBZQ.js";
 import "../chunk-FSMZV3Y6.js";
 import {
   init_esm_shims

package/dist/packs/d-series/index.js

@@ -3,10 +3,10 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   listCejelLlmPackFiles
-} from "../../chunk-M6YYPJSN.js";
+} from "../../chunk-5PFYOIOS.js";
 import {
   execGit
-} from "../../chunk-63XQDYQ5.js";
+} from "../../chunk-VGBFZBZQ.js";
 import {
   require_typescript
 } from "../../chunk-RH6FKREX.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {