@cejel/cejel 0.6.6 → 0.6.8

package/README.md

@@ -92,7 +92,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.6.6 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.6.8 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM (the packages
@@ -116,7 +116,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.6.6` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.6.8` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry. A GitLab CI
 > template and Code Quality export live in [`docs/gitlab-ci.md`](./docs/gitlab-ci.md).
 
@@ -159,6 +159,10 @@ The npm package is scoped as `@cejel/cejel`; its executable remains the short co
 
 `actions/checkout` fetches one commit by default. On a shallow clone, A2 and B2 see only that
 commit, and the certificate says so under "History limitations".
+Under the prospective v27 rubric (`--rubric-pin witan-rubric-v27-prospective-2026-10-19`), a
+shallow clone goes further. A2 abstains unless a confirmed critical secret finding stands or A2
+does not apply. B2 abstains, where it would be scored, when fewer than 12 commits are visible. Each
+abstention counts as 0 in the composite, so a shallow checkout can lower the v27 score.
 
 For an executed public example that binds a release artifact to the same commit named by its
 Cejel certificate, see [Certified releases with GitHub build provenance](./docs/certified-release-example.md).
@@ -187,16 +191,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.6.6`:
+**Docker / OCI.** The current container release is `0.6.8`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.6
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.8
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.6 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.8 .
 ```
 
 The OCI image carries an SBOM of its base-image packages, maximum-mode build provenance, and a
@@ -296,6 +300,12 @@ prints that boundary on every successful verification.
 - `--ingest <file|glob>` — fold another scanner's output into the score (repeatable). Accepts
   SARIF, OpenSSF Scorecard JSON, or the generic Cejel external-signal shape — format is
   auto-detected. See "Aggregate your scanners" below.
+- `--subject-repository <repo>` — name the scanned repository (`github.com/owner/repo` or a clone
+  URL) so an ingested input that declares another repository is recorded as mismatched. Cejel
+  never infers it from clone state.
+- `--strict-ingest` — refuse, before scoring, an ingested input that declares another repository or
+  commit, was observed before the scanned commit existed, or duplicates another input. Without it,
+  the binding status is recorded and scoring is unchanged. See [input binding](docs/input-binding.md).
 - `--rubric-pin <version>` — Explicit opt-in only: pin an alternate rubric instead of the
   calibrated public default. It
   accepts the calibrated version or any published prospective rubric
@@ -414,7 +424,17 @@ Three ways a scanner's output gets ingested:
    versions rather than guessing. See the [generic ingest contract](docs/ingest-contract.md), its
    [published JSON Schema](docs/schemas/cejel-ingest-v1.schema.json), and the
    [synthetic CI heal-log mapping](docs/heal-log-mapping.md). Output-field stability and version
-   routing are documented in [format stability](docs/format-stability.md).
+   routing are documented in [format stability](docs/format-stability.md). Contract `1.1` adds
+   optional `subject`, `producer` and `observedAt` fields so the input can be bound to a revision.
+
+Every ingested document is also recorded in `report.json` under `inputBinding`: the sha256 of its
+bytes, the producer and subject its own format declares (Scorecard `repo.name`/`repo.commit`/`date`,
+SARIF `versionControlProvenance` and `invocations`, generic `subject`/`observedAt`), and whether that
+subject is the scanned HEAD (`matched`, `mismatched-repository`, `mismatched-commit`, `stale`,
+`unbound`, `unverifiable`). By default this is a record, not a gate: it changes no score.
+`--strict-ingest` refuses mismatched, stale and duplicate inputs instead. `cejel verify ... --input
+<file>` checks a set of input files against the recorded digests, so a swapped input is detected.
+See [input binding](docs/input-binding.md), which carries the conformance table the tests run.
 
 ## Displaying the trust badge
 
@@ -571,7 +591,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.6"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.8"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,20 +5,20 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-JNTTFAHQ.js";
+} from "../chunk-KJVFCZZ3.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-5PFYOIOS.js";
-import "../chunk-VGBFZBZQ.js";
+} from "../chunk-WXPGEQBE.js";
+import "../chunk-NIWSYJ6N.js";
 import {
   external_exports
-} from "../chunk-FSMZV3Y6.js";
+} from "../chunk-AMVP7L26.js";
 import {
   init_esm_shims,
   readRepoText,
   recordContentSkip,
   recordFilesystemSkip
-} from "../chunk-O3MHSK25.js";
+} from "../chunk-AWLKQUI4.js";
 
 // src/calibration/llm-detector.ts
 init_esm_shims();

package/dist/{chunk-RH6FKREX.js → chunk-6LVNNJTG.js}

@@ -7,7 +7,7 @@ import {
   __filename,
   __require,
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS({

package/dist/{chunk-FSMZV3Y6.js → chunk-AMVP7L26.js}

@@ -4,7 +4,7 @@ const require = __cejelCreateRequire(import.meta.url);
 import {
   __export,
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};

package/dist/{chunk-O3MHSK25.js → chunk-AWLKQUI4.js}

@@ -62,7 +62,11 @@ var MAX_REPOSITORY_CONTENT_BYTES = 512e3;
 init_esm_shims();
 import { closeSync, lstatSync, openSync, readFileSync, readSync } from "fs";
 import { resolve } from "path";
-var READ_FAILURE_REASONS = /* @__PURE__ */ new Set(["unreadable", "denied_path"]);
+var READ_FAILURE_REASONS = /* @__PURE__ */ new Set([
+  "unreadable",
+  "denied_path",
+  "lfs_pointer"
+]);
 function isReadFailureReason(reason) {
   return READ_FAILURE_REASONS.has(reason);
 }
@@ -131,7 +135,10 @@ function summaryFor(session) {
     tooLarge: session.counts.too_large,
     excludedByExtension: session.counts.excluded_by_extension,
     deniedPath: session.counts.denied_path,
-    nonRegularFile: session.counts.non_regular_file
+    nonRegularFile: session.counts.non_regular_file,
+    // Present only when non-zero, so every report without an LFS pointer is byte-identical to one
+    // produced before this reason existed (report format 1.6).
+    ...session.counts.lfs_pointer > 0 ? { lfsPointer: session.counts.lfs_pointer } : {}
   };
   const sortedErrnos = Object.fromEntries(
     [...session.unreadableByErrno.entries()].sort(([left], [right]) => left.localeCompare(right))
@@ -143,7 +150,7 @@ function summaryFor(session) {
     affectedCriteria: [...session.affectedCriteria].sort()
   };
 }
-function trackContentReads(_repoPath, collect) {
+function trackContentReads(_repoPath, collect, options = {}) {
   const existing = activeSession;
   if (existing) {
     return {
@@ -162,8 +169,10 @@ function trackContentReads(_repoPath, collect) {
       too_large: 0,
       excluded_by_extension: 0,
       denied_path: 0,
-      non_regular_file: 0
+      non_regular_file: 0,
+      lfs_pointer: 0
     },
+    lfsPointerAbstention: options.lfsPointerAbstention === true,
     unreadableByErrno: /* @__PURE__ */ new Map(),
     deduplicatedSkips: /* @__PURE__ */ new Set(),
     affectedCriteria: /* @__PURE__ */ new Set(),
@@ -218,6 +227,20 @@ function withContentReadSignals(criterionId, signalIds, collect) {
     session.signals = previous;
   }
 }
+function withoutContentReadAttribution(collect) {
+  const session = activeSession;
+  if (!session) return collect();
+  const previousCriterion = session.criterion;
+  const previousSignals = session.signals;
+  session.criterion = void 0;
+  session.signals = void 0;
+  try {
+    return collect();
+  } finally {
+    session.criterion = previousCriterion;
+    session.signals = previousSignals;
+  }
+}
 function recordContentSkip(path2, reason, deduplicate = false) {
   recordSkip(path2, reason, void 0, false, deduplicate);
 }
@@ -287,12 +310,33 @@ function readRepoText(path2, encoding = "utf8") {
     recordFilesystemSkip(path2, error);
     return "";
   }
+  let contents;
   try {
-    return readFileSync(path2, encoding);
+    contents = readFileSync(path2, encoding);
   } catch (error) {
     recordFilesystemSkip(path2, error);
     return "";
   }
+  if (isGitLfsPointerText(contents)) {
+    recordSkip(path2, "lfs_pointer", void 0, activeSession?.lfsPointerAbstention === true, true);
+  }
+  return contents;
+}
+var GIT_LFS_POINTER_MAX_BYTES = 1024;
+var GIT_LFS_POINTER_VERSION_LINE = /^version https:\/\/(?:git-lfs\.github\.com\/spec\/v1|hawser\.github\.com\/spec\/v1)\n/;
+var GIT_LFS_POINTER_OID_LINE = /^oid sha256:[0-9a-f]{64}$/m;
+var GIT_LFS_POINTER_SIZE_LINE = /^size [0-9]+$/m;
+var GIT_LFS_POINTER_KEY_LINE = /^[a-z0-9.-]+ \S[^\n]*$/;
+function isGitLfsPointerText(contents) {
+  if (isLfGitLfsPointerText(contents)) return true;
+  return contents.length < 2 * GIT_LFS_POINTER_MAX_BYTES && contents.includes("\r\n") && !/\r(?!\n)/.test(contents) && !/(?:^|[^\r])\n/.test(contents) && isLfGitLfsPointerText(contents.replaceAll("\r\n", "\n"));
+}
+function isLfGitLfsPointerText(contents) {
+  if (contents.length >= GIT_LFS_POINTER_MAX_BYTES || !contents.startsWith("version ")) return false;
+  if (!GIT_LFS_POINTER_VERSION_LINE.test(contents)) return false;
+  const lines = contents.replace(/\n$/, "").split("\n");
+  if (!lines.slice(1).every((line) => GIT_LFS_POINTER_KEY_LINE.test(line))) return false;
+  return GIT_LFS_POINTER_OID_LINE.test(contents) && GIT_LFS_POINTER_SIZE_LINE.test(contents);
 }
 function readRepoTextPrefix(path2, byteLimit) {
   try {
@@ -310,7 +354,11 @@ function readRepoTextPrefix(path2, byteLimit) {
     descriptor = openSync(path2, "r");
     const buffer = Buffer.allocUnsafe(byteLimit);
     const bytesRead = readSync(descriptor, buffer, 0, byteLimit, 0);
-    return buffer.subarray(0, bytesRead).toString("utf8");
+    const contents = buffer.subarray(0, bytesRead).toString("utf8");
+    if (bytesRead < byteLimit && isGitLfsPointerText(contents)) {
+      recordSkip(path2, "lfs_pointer", void 0, activeSession?.lfsPointerAbstention === true, true);
+    }
+    return contents;
   } catch (error) {
     recordFilesystemSkip(path2, error);
     return "";
@@ -340,11 +388,13 @@ export {
   withContentReadCriterion,
   withContentReadSignal,
   withContentReadSignals,
+  withoutContentReadAttribution,
   recordContentSkip,
   registerWithheldRepoPath,
   withheldRepoPaths,
   abstainSignalOnWithheldPaths,
   recordFilesystemSkip,
   readRepoText,
+  isGitLfsPointerText,
   readRepoTextPrefix
 };