@cejel/cejel 0.6.7 → 0.6.10

package/README.md

@@ -3,6 +3,35 @@
 [![release](https://img.shields.io/github/v/release/BargLabs/cejel)](https://github.com/BargLabs/cejel/releases/latest)
 [![license: AGPL-3.0-only](https://img.shields.io/badge/license-AGPL--3.0--only-blue.svg)](./LICENSE)
 
+<p align="left"><img src="brand/cejel-icon.png" alt="Cejel logo" width="96"></p>
+
+**Evidence about a repository that anyone can rerun.** Cejel reads a repository's own evidence
+(tests that really assert something, committed secrets, CI gating) and writes a certificate
+pinned to one commit. Whoever receives it, a customer, a buyer or an acquirer, can run the same
+Cejel version on the same commit themselves, offline, and get the same result. No LLM, no signup.
+
+Add it to a workflow; the result is posted to the job summary:
+
+```yaml
+on: [pull_request]
+jobs:
+  cejel:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # full history: A2 and B2 read commit history
+      - uses: BargLabs/cejel/action@v1
+```
+
+Keep `fetch-depth: 0`. `actions/checkout` makes a shallow clone by default, and a shallow clone is
+"Unrated: shallow clone", with no score and no verdict, under every rubric, the default included,
+until the full history is checked out. A directory with no `.git` (an uploaded snapshot or an
+archive) is "Unrated: no git history" under every rubric.
+
+Or run it once from a shell: `npx @cejel/cejel@latest .` More on the Action under
+[GitHub Action](#github-action). To read what comes out, see [Reading the result](#reading-the-result).
+
 Cejel (*"SEH-jel"*) — a trust certificate for your codebase.
 
 Free, offline, no-signup CLI that scores the engineering signals that tell you whether to
@@ -51,6 +80,48 @@ untouched holdout, every preregistered gate to pass, and a separately recorded p
 The [defect-class census](docs/defect-class-census.md) publishes the coverage-breadth
 boundary—which defect classes any shipped rule targets—and is explicitly not a recall claim.
 
+## Reading the result
+
+The first page of `certificate.html` (and the block printed after the verdict in the terminal)
+answers four questions in plain words, built only from `report.json`:
+
+- **What holds:** the measured areas the report labels Verified, or Info (one label below, listed
+  as "Partly holds"), each with its score out of 4 and the strongest measurement it saw, for
+  example "Rated Verified, at 1.0 out of 4". Only a score of 4.0 is called the top score. A label
+  and a score are set separately, so a Verified area can have a low score; each area's card in the
+  certificate compares the two. An area Cejel did not examine, or examined with no measurement, is
+  never listed here. When the list is empty, one sentence says why: no overall result, no area
+  labelled Verified or Info, or both.
+- **What is wrong:** every critical and warning-level finding, most serious first, naming the file
+  or area and what is wrong, and every area labelled Critical or Warning that has no critical or
+  warning finding of its own, with its score ("Scored 2.2 out of 4, with no single finding of its own"). A score made
+  up of several measurements is given with its number and level, for example "give 3.1 out of 4,
+  which Cejel counts as a warning".
+- **What is not known:** what the report records it could not establish, from these fields: an
+  overall result it withheld, with its reason restated from a fixed table (a reason the table does
+  not know reads "Cejel could not rate the source here; see the certificate below"); areas that do
+  not apply, have no measurement, or have no score while a finding stands; areas Cejel could not
+  fully read (named in the report's skipped-content summary or by a scan or history limitation),
+  listed as "not read" with the cause the report ties to that area: files that could not be read,
+  Git LFS pointers, files left out under Cejel's size limit or rules, a scan limitation, or a
+  shallow clone; each scan and history limitation, reworded into plain words; files it did not
+  read; a label moved by imported evidence; and each limit a check recorded on what it examined.
+  Anything the report does not record is not listed, so an empty list does not mean nothing is
+  unknown.
+- **What to check next:** one line for each wrong or not-known item, taken from a fixed table of
+  reviewed sentences. The line for an area not read, and for a scan limitation, follows its own
+  cause: `git lfs pull` for Git LFS pointers, making files readable only where they could not be
+  read, and no fix for a size limit or rule. An item with no table entry points to the section of
+  the certificate that holds it.
+
+The first page also says what the result does not cover: Cejel reads files and history and does
+not run the code or its tests. Under a prospective rubric such as
+`witan-rubric-v27-prospective-2026-10-19`, the first page opens, above the verdict line, with the
+same notice the certificate's header carries: the rubric is not calibrated, and its results carry
+no precision or recall claim. Every line links to its source further down; the certificate below
+the first page holds the evidence, unchanged apart from the anchors those links point to.
+`summary.json` carries the same lists under `plainSummary`.
+
 ## Install
 
 No account, no key, no signup.
@@ -92,7 +163,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.6.7 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.6.10 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM (the packages
@@ -116,7 +187,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.6.7` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.6.10` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry. A GitLab CI
 > template and Code Quality export live in [`docs/gitlab-ci.md`](./docs/gitlab-ci.md).
 
@@ -157,8 +228,41 @@ The npm package is scoped as `@cejel/cejel`; its executable remains the short co
     min-score: "2.5"   # optional: fail the build below this
 ```
 
-`actions/checkout` fetches one commit by default. On a shallow clone, A2 and B2 see only that
-commit, and the certificate says so under "History limitations".
+`actions/checkout` fetches one commit by default, so clone in full with `fetch-depth: 0`. Under
+every rubric, the calibrated default included, a shallow clone gets no composite score and no
+verdict until the full history is checked out. The scan abstains (`insufficient_source`), still
+reads and shows each criterion, and says what to do: run `git fetch --unshallow` (or check out with
+full history, for example `fetch-depth: 0` in `actions/checkout`), then scan again. The
+certificate, the badge and the Action's `verdict` output read "Unrated: shallow clone", and the
+Action's `limited` output is `true`. With `--min-score` an abstained scan fails the check, as any
+abstention does, and the message says how to fetch the history. If git cannot report the depth (git
+is not installed, or cannot open the repository), Cejel reads it from the repository's `.git`
+files; if those do not settle it either, the scan abstains the same way as "Unrated: history depth
+unknown". Among the criteria shown on a shallow clone, A2's scans of earlier commits for `.env`
+files and credentials read only the commits it holds, so A2 abstains unless a confirmed critical
+secret finding stands, including where it would otherwise be marked not applicable, since that
+decision also rests on earlier commits; B2 withholds its pull-request merge ratio, or abstains
+where nothing else is left to score it on, saying why in its note. The certificate says so under
+"History limitations". Until 2 November 2026 this held only under the opt-in prospective v27
+rubric (`--rubric-pin witan-rubric-v27-prospective-2026-10-19`; v17 remains the default), and the
+default rubric scored a shallow clone, on which A2 could not see a secret committed and later
+deleted. A complete clone is scored exactly as before.
+
+A directory that is not a git repository gets no composite score and no verdict under every
+rubric, v27 included: "Unrated: no git history". That covers a directory with no `.git`, a
+tarball, an archive export of a commit, and every snapshot uploaded to the HTTP or remote-MCP
+server. A2 abstains, since no commit history was read, unless a confirmed critical secret finding
+stands on the files. Scan a git clone with full history; an uploaded snapshot or archive carries no
+history.
+
+On a clone that is not shallow, A2 abstains under v27 where one of its reads of earlier commits failed:
+for example on a partial clone made with `--filter`, which `fetch-depth: 0` and no `filter` avoid,
+or where a read stops at one of Cejel's own limits: an output limit or the history secret scan's
+cap of 5,000 historical files, which happen on some large complete histories and which a re-scan
+of the same repository does not lift (#567), or the 30-second timeout, which a re-scan may lift.
+It also abstains when it leaves a credential-shaped path in history unread because the path's name
+contains control characters, and when git itself cannot be run on the scanning host. Each of these
+abstentions counts as 0 in the composite, so they can lower the v27 score.
 
 For an executed public example that binds a release artifact to the same commit named by its
 Cejel certificate, see [Certified releases with GitHub build provenance](./docs/certified-release-example.md).
@@ -187,16 +291,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.6.7`:
+**Docker / OCI.** The current container release is `0.6.10`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.7
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.6.10
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.7 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.6.10 .
 ```
 
 The OCI image carries an SBOM of its base-image packages, maximum-mode build provenance, and a
@@ -209,7 +313,7 @@ The [Cejel OSS trust leaderboard](https://cejel.dev/leaderboard/) is hosted on c
 which is the single current board. This repository no longer distributes a second copy of
 its scores or certificates. The board records its producing package version, rubric,
 run date, pinned public revisions, and reproduction instructions for that particular run.
-The private Alfred transparency snapshot is not independently reproducible.
+The board's row for Barg Labs' own private codebase is a transparency snapshot and is not independently reproducible.
 
 The site's History section preserves the **2026-08-18 withdrawal**: the earlier
 sealed-public-scorer reproducibility claim was false. The stale prospective-rubric copy
@@ -296,11 +400,17 @@ prints that boundary on every successful verification.
 - `--ingest <file|glob>` — fold another scanner's output into the score (repeatable). Accepts
   SARIF, OpenSSF Scorecard JSON, or the generic Cejel external-signal shape — format is
   auto-detected. See "Aggregate your scanners" below.
+- `--subject-repository <repo>` — name the scanned repository (`github.com/owner/repo` or a clone
+  URL) so an ingested input that declares another repository is recorded as mismatched. Cejel
+  never infers it from clone state.
+- `--strict-ingest` — refuse, before scoring, an ingested input that declares another repository or
+  commit, was observed before the scanned commit existed, or duplicates another input. Without it,
+  the binding status is recorded and scoring is unchanged. See [input binding](docs/input-binding.md).
 - `--rubric-pin <version>` — Explicit opt-in only: pin an alternate rubric instead of the
   calibrated public default. It
   accepts the calibrated version or any published prospective rubric
-  (`witan-rubric-v18-prospective-*` through `v26`) and fails closed, naming what was accepted, on
-  anything else. `v26` (`witan-rubric-v26-prospective-2026-10-14`) is prospective and uncalibrated:
+  (`witan-rubric-v18-prospective-*` through `v27`) and fails closed, naming what was accepted, on
+  anything else. The GitHub Action takes the same value as its optional `rubric-pin` input. `v26` (`witan-rubric-v26-prospective-2026-10-14`) is prospective and uncalibrated:
   it is the next calibration candidate, inherits v25 complete, inherits neither v23 nor v24, and
   today scores exactly as v25 does. `v25` is prospective and uncalibrated: it inherits v22 and adds only credit for a
   health or readiness route declared inline in an application file (see "What counts as a health or
@@ -382,7 +492,7 @@ Three ways a scanner's output gets ingested:
    `--ingest scorecard.json`; auto-detected by its `checks` array.
 3. **Generic JSON** — for a tool that emits neither, map its output into the minimal shape
    below (or write a small adapter mirroring
-   [`scorecard-adapter.ts`](../witan/src/scorecard-adapter.ts) if the format needs real
+   [`scorecard-adapter.ts`](./src/witan/scorecard-adapter.ts) if the format needs real
    parsing):
 
    ```json
@@ -406,7 +516,7 @@ Three ways a scanner's output gets ingested:
    }
    ```
 
-   `dimension` is one of the Witan rubric criterion ids (`A1`-`A5`, `B1`-`B6`); `weight`
+   `dimension` is one of the rubric criterion ids (`A1`-`A5`, `B1`-`B6`); `weight`
    (0–1, default `0.5`) bounds how much this signal can move that dimension; `severity` is
    `critical` | `warning` | `info`; `location` is optional.
 
@@ -414,7 +524,17 @@ Three ways a scanner's output gets ingested:
    versions rather than guessing. See the [generic ingest contract](docs/ingest-contract.md), its
    [published JSON Schema](docs/schemas/cejel-ingest-v1.schema.json), and the
    [synthetic CI heal-log mapping](docs/heal-log-mapping.md). Output-field stability and version
-   routing are documented in [format stability](docs/format-stability.md).
+   routing are documented in [format stability](docs/format-stability.md). Contract `1.1` adds
+   optional `subject`, `producer` and `observedAt` fields so the input can be bound to a revision.
+
+Every ingested document is also recorded in `report.json` under `inputBinding`: the sha256 of its
+bytes, the producer and subject its own format declares (Scorecard `repo.name`/`repo.commit`/`date`,
+SARIF `versionControlProvenance` and `invocations`, generic `subject`/`observedAt`), and whether that
+subject is the scanned HEAD (`matched`, `mismatched-repository`, `mismatched-commit`, `stale`,
+`unbound`, `unverifiable`). By default this is a record, not a gate: it changes no score.
+`--strict-ingest` refuses mismatched, stale and duplicate inputs instead. `cejel verify ... --input
+<file>` checks a set of input files against the recorded digests, so a swapped input is detected.
+See [input binding](docs/input-binding.md), which carries the conformance table the tests run.
 
 ## Displaying the trust badge
 
@@ -447,8 +567,50 @@ secrets.
     min-score: '2.5' # optional; omit to never fail the check
 ```
 
-Check out with `fetch-depth: 0`: the default depth of 1 truncates the history A2 and B2 read, and
-the certificate then lists a history limitation.
+Check out with `fetch-depth: 0`. The default depth of 1 is a shallow clone, and under every
+rubric, the default included, a shallow checkout gets no composite score and no verdict: the step
+summary, the badge and the `verdict` output read "Unrated: shallow clone", the `limited` output is
+`true` and `limitations` names the cause, and the scan says to run `git fetch --unshallow` (or check
+out with full history, for example `fetch-depth: 0` in `actions/checkout`), then scan again. On a
+shallow clone A2's scans of earlier commits read only the commits present and B2 withholds its
+pull-request merge ratio, each with its reason. A `repo-path` that is not a git repository is
+"Unrated: no git history" under every rubric. The Action does not pin a rubric, so it scores under
+the default.
+
+| Output | What it holds |
+|---|---|
+| `score` | The overall score (0.0–4.0), or empty when Cejel abstains. |
+| `verdict` | The verdict label, or the abstention label (`Insufficient source`, `Insufficient evidence`, `Unrated: shallow clone`, `Unrated: history depth unknown`, `Unrated: no git history`). |
+| `limited` | `true` when scan limitations qualify the result, or when the verdict is Unrated; otherwise `false`. |
+| `limitation-count` | How many limitations qualify the certificate, counting an Unrated verdict as one. |
+| `limitations` | A JSON array of the limitation messages; an Unrated verdict adds one naming its cause. |
+| `artifact-dir` | Where this run's report artifacts were exported. |
+
+| Input | Default | What it does |
+|---|---|---|
+| `repo-path` | the checkout (`$GITHUB_WORKSPACE`) | Path to the repository to score. |
+| `min-score` | empty: never fail | Fails the step below this overall score (0–4), or when Cejel abstains. |
+| `out-dir` | `.cejel` | Empty destination for this run's report artifacts. |
+| `rubric-pin` | empty: the calibrated default | Explicit opt-in only: the same value as the CLI's `--rubric-pin`. An unknown id fails the step with the CLI's message. |
+
+The scoring step is offline whatever the inputs; it never fetches history. To opt in to the
+prospective v27 rubric, pin it and check out in full with `fetch-depth: 0`: v27 reads the commit
+history, so a shallow checkout gets no full v27 result, as under the default. v17 remains the
+calibrated default.
+
+```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0 # full history: A2 and B2 read commit history
+- uses: BargLabs/cejel/action@v1
+  with:
+    rubric-pin: witan-rubric-v27-prospective-2026-10-19
+```
+
+A prospective pin carries no precision/recall claim, and the certificate states that plainly
+whenever one is used. Leave `rubric-pin` empty for the calibrated result every default scan
+produces: an empty input passes no `--rubric-pin`, so the scan, the report and the outputs are
+the same as without the input.
 
 ## Use with Claude
 
@@ -571,7 +733,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.7"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.6.10"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 
@@ -734,7 +896,7 @@ scoring tool that has not been checked:
   the invariant it claimed to be. Rubric v3 removes that second path: every corpus row now
   passes through the same sealed public scorer, every external source is pinned to a commit,
   and a required guard re-scores every row and compares score, verdict, coverage, and
-  evidence. The honest correction moved Alfred's Code score from 2.5 to 2.4 and A5 from 2.9
+  evidence. The honest correction moved our own private codebase's Code score from 2.5 to 2.4 and A5 from 2.9
   to 2.4. It is less flattering and more trustworthy.
 - **A tracked symlink could make evidence depend on files outside the checkout.** Repository
   discovery used a regular-file check that followed symlinks, so a tracked link could escape

package/dist/calibration/llm-detector.js

@@ -5,20 +5,20 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-ZZHQZW26.js";
+} from "../chunk-YHJ7ICL4.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-5PFYOIOS.js";
-import "../chunk-VGBFZBZQ.js";
+} from "../chunk-RRPQHEBU.js";
+import "../chunk-2UMHJ23V.js";
 import {
   external_exports
-} from "../chunk-FSMZV3Y6.js";
+} from "../chunk-AMVP7L26.js";
 import {
   init_esm_shims,
   readRepoText,
   recordContentSkip,
   recordFilesystemSkip
-} from "../chunk-O3MHSK25.js";
+} from "../chunk-AWLKQUI4.js";
 
 // src/calibration/llm-detector.ts
 init_esm_shims();

package/dist/{chunk-VGBFZBZQ.js → chunk-2UMHJ23V.js}

@@ -3,13 +3,13 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // src/witan/git-exec.ts
 init_esm_shims();
 import { execFileSync } from "child_process";
-import { realpathSync } from "fs";
-import { dirname, resolve } from "path";
+import { closeSync, lstatSync, openSync, readSync, realpathSync } from "fs";
+import { dirname, join, resolve } from "path";
 var GIT_EXEC_MAX_BUFFER_BYTES = 8 * 1024 * 1024;
 var GIT_EXEC_TIMEOUT_MS = 3e4;
 var HARDENED_GIT_ARGUMENTS = [
@@ -54,6 +54,59 @@ var HARDENED_GIT_ARGUMENTS = [
   "protocol.ssh.allow=never"
 ];
 var discoveryCeiling;
+var GIT_FILE_PREFIX_BYTES = 4096;
+function fsErrorCode(error) {
+  return typeof error === "object" && error !== null ? error.code : void 0;
+}
+var isDefinitelyAbsent = (error) => fsErrorCode(error) === "ENOENT" || fsErrorCode(error) === "ENOTDIR";
+function isGitMetadataEntry(path) {
+  let link;
+  try {
+    link = lstatSync(path);
+  } catch (error) {
+    return !isDefinitelyAbsent(error);
+  }
+  if (link.isSymbolicLink()) return true;
+  if (link.isDirectory()) {
+    try {
+      lstatSync(join(path, "HEAD"));
+      return true;
+    } catch (error) {
+      return !isDefinitelyAbsent(error);
+    }
+  }
+  if (!link.isFile()) return false;
+  let descriptor;
+  try {
+    descriptor = openSync(path, "r");
+    const buffer = Buffer.alloc(GIT_FILE_PREFIX_BYTES);
+    const length = readSync(descriptor, buffer, 0, GIT_FILE_PREFIX_BYTES, 0);
+    return /^gitdir:/m.test(buffer.subarray(0, length).toString("utf8"));
+  } catch {
+    return true;
+  } finally {
+    if (descriptor !== void 0) closeSync(descriptor);
+  }
+}
+function hasVisibleGitMetadata(repoPath) {
+  return findVisibleGitMetadata(repoPath) !== void 0;
+}
+function findVisibleGitMetadata(repoPath) {
+  let current;
+  try {
+    current = realpathSync(repoPath);
+  } catch {
+    return void 0;
+  }
+  for (; ; ) {
+    if (discoveryCeiling !== void 0 && current === discoveryCeiling) return void 0;
+    const entry = join(current, ".git");
+    if (isGitMetadataEntry(entry)) return entry;
+    const parent = dirname(current);
+    if (parent === current) return void 0;
+    current = parent;
+  }
+}
 function hardenedGitEnvironment(cwd) {
   const environment = {};
   for (const key of ["PATH", "HOME", "TZ"]) {
@@ -88,27 +141,32 @@ function errorField(error, key) {
   if (typeof error !== "object" || error === null) return void 0;
   return error[key];
 }
-function errorText(error) {
+function stderrText(error) {
   const stderr = errorField(error, "stderr");
-  const stderrText = typeof stderr === "string" ? stderr : Buffer.isBuffer(stderr) ? stderr.toString("utf8") : "";
-  const message = error instanceof Error ? error.message : "";
-  return `${stderrText}
-${message}`;
+  return typeof stderr === "string" ? stderr : Buffer.isBuffer(stderr) ? stderr.toString("utf8") : "";
+}
+var GIT_NO_REPOSITORY_DIAGNOSTICS = [
+  /^fatal: not a git repository\b/i,
+  /^fatal: gitfile does not point to a valid repository: /,
+  /^fatal: not in a git directory$/,
+  /^fatal: this operation must be run in a work tree$/,
+  /^fatal: ambiguous argument 'HEAD': unknown revision or path not in the working tree\.$/,
+  /^fatal: needed a single revision$/i
+];
+var GIT_UNBORN_BRANCH_DIAGNOSTIC = /^fatal: your current branch '' does not have any commits yet$/;
+function isNoRepositoryDiagnostic(stderr) {
+  const line = stderr.split("\n").find((candidate) => candidate.startsWith("fatal: "))?.trimEnd();
+  if (line === void 0) return false;
+  if (GIT_NO_REPOSITORY_DIAGNOSTICS.some((pattern) => pattern.test(line))) return true;
+  const branchEmptied = line.replace(/^(fatal: your current branch )'[^'\n]*'/, "$1''");
+  return GIT_UNBORN_BRANCH_DIAGNOSTIC.test(branchEmptied);
 }
 function classifyGitFailure(error) {
   const code = errorField(error, "code");
-  const signal = errorField(error, "signal");
-  const text = errorText(error);
   if (code === "ENOENT") return "git_absent";
-  if (code === "ENOBUFS" || /maxBuffer|ENOBUFS/i.test(text)) return "buffer_exceeded";
-  if (code === "ETIMEDOUT" || signal === "SIGTERM" || /timed?\s*out|ETIMEDOUT/i.test(text)) {
-    return "timeout";
-  }
-  if (/not a git repository|not inside a work tree|not in a git directory|unknown revision.*HEAD|ambiguous argument ['"]?HEAD|does not have any commits yet|needed a single revision/i.test(
-    text
-  )) {
-    return "not_a_repo";
-  }
+  if (code === "ENOBUFS" || code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") return "buffer_exceeded";
+  if (code === "ETIMEDOUT") return "timeout";
+  if (isNoRepositoryDiagnostic(stderrText(error))) return "not_a_repo";
   return "exec_failed";
 }
 function execGit(argv, options) {
@@ -154,6 +212,10 @@ function describeGitFailure(reason, operation, maxBufferBytes = GIT_EXEC_MAX_BUF
 }
 
 export {
+  GIT_EXEC_MAX_BUFFER_BYTES,
+  GIT_EXEC_TIMEOUT_MS,
+  hasVisibleGitMetadata,
+  findVisibleGitMetadata,
   execGit,
   isExpectedGitAbsence,
   describeGitFailure

package/dist/{chunk-RH6FKREX.js → chunk-6LVNNJTG.js}

@@ -7,7 +7,7 @@ import {
   __filename,
   __require,
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS({

package/dist/{chunk-FSMZV3Y6.js → chunk-AMVP7L26.js}

@@ -4,7 +4,7 @@ const require = __cejelCreateRequire(import.meta.url);
 import {
   __export,
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};

package/dist/{chunk-O3MHSK25.js → chunk-AWLKQUI4.js}

@@ -62,7 +62,11 @@ var MAX_REPOSITORY_CONTENT_BYTES = 512e3;
 init_esm_shims();
 import { closeSync, lstatSync, openSync, readFileSync, readSync } from "fs";
 import { resolve } from "path";
-var READ_FAILURE_REASONS = /* @__PURE__ */ new Set(["unreadable", "denied_path"]);
+var READ_FAILURE_REASONS = /* @__PURE__ */ new Set([
+  "unreadable",
+  "denied_path",
+  "lfs_pointer"
+]);
 function isReadFailureReason(reason) {
   return READ_FAILURE_REASONS.has(reason);
 }
@@ -131,7 +135,10 @@ function summaryFor(session) {
     tooLarge: session.counts.too_large,
     excludedByExtension: session.counts.excluded_by_extension,
     deniedPath: session.counts.denied_path,
-    nonRegularFile: session.counts.non_regular_file
+    nonRegularFile: session.counts.non_regular_file,
+    // Present only when non-zero, so every report without an LFS pointer is byte-identical to one
+    // produced before this reason existed (report format 1.6).
+    ...session.counts.lfs_pointer > 0 ? { lfsPointer: session.counts.lfs_pointer } : {}
   };
   const sortedErrnos = Object.fromEntries(
     [...session.unreadableByErrno.entries()].sort(([left], [right]) => left.localeCompare(right))
@@ -143,7 +150,7 @@ function summaryFor(session) {
     affectedCriteria: [...session.affectedCriteria].sort()
   };
 }
-function trackContentReads(_repoPath, collect) {
+function trackContentReads(_repoPath, collect, options = {}) {
   const existing = activeSession;
   if (existing) {
     return {
@@ -162,8 +169,10 @@ function trackContentReads(_repoPath, collect) {
       too_large: 0,
       excluded_by_extension: 0,
       denied_path: 0,
-      non_regular_file: 0
+      non_regular_file: 0,
+      lfs_pointer: 0
     },
+    lfsPointerAbstention: options.lfsPointerAbstention === true,
     unreadableByErrno: /* @__PURE__ */ new Map(),
     deduplicatedSkips: /* @__PURE__ */ new Set(),
     affectedCriteria: /* @__PURE__ */ new Set(),
@@ -218,6 +227,20 @@ function withContentReadSignals(criterionId, signalIds, collect) {
     session.signals = previous;
   }
 }
+function withoutContentReadAttribution(collect) {
+  const session = activeSession;
+  if (!session) return collect();
+  const previousCriterion = session.criterion;
+  const previousSignals = session.signals;
+  session.criterion = void 0;
+  session.signals = void 0;
+  try {
+    return collect();
+  } finally {
+    session.criterion = previousCriterion;
+    session.signals = previousSignals;
+  }
+}
 function recordContentSkip(path2, reason, deduplicate = false) {
   recordSkip(path2, reason, void 0, false, deduplicate);
 }
@@ -287,12 +310,33 @@ function readRepoText(path2, encoding = "utf8") {
     recordFilesystemSkip(path2, error);
     return "";
   }
+  let contents;
   try {
-    return readFileSync(path2, encoding);
+    contents = readFileSync(path2, encoding);
   } catch (error) {
     recordFilesystemSkip(path2, error);
     return "";
   }
+  if (isGitLfsPointerText(contents)) {
+    recordSkip(path2, "lfs_pointer", void 0, activeSession?.lfsPointerAbstention === true, true);
+  }
+  return contents;
+}
+var GIT_LFS_POINTER_MAX_BYTES = 1024;
+var GIT_LFS_POINTER_VERSION_LINE = /^version https:\/\/(?:git-lfs\.github\.com\/spec\/v1|hawser\.github\.com\/spec\/v1)\n/;
+var GIT_LFS_POINTER_OID_LINE = /^oid sha256:[0-9a-f]{64}$/m;
+var GIT_LFS_POINTER_SIZE_LINE = /^size [0-9]+$/m;
+var GIT_LFS_POINTER_KEY_LINE = /^[a-z0-9.-]+ \S[^\n]*$/;
+function isGitLfsPointerText(contents) {
+  if (isLfGitLfsPointerText(contents)) return true;
+  return contents.length < 2 * GIT_LFS_POINTER_MAX_BYTES && contents.includes("\r\n") && !/\r(?!\n)/.test(contents) && !/(?:^|[^\r])\n/.test(contents) && isLfGitLfsPointerText(contents.replaceAll("\r\n", "\n"));
+}
+function isLfGitLfsPointerText(contents) {
+  if (contents.length >= GIT_LFS_POINTER_MAX_BYTES || !contents.startsWith("version ")) return false;
+  if (!GIT_LFS_POINTER_VERSION_LINE.test(contents)) return false;
+  const lines = contents.replace(/\n$/, "").split("\n");
+  if (!lines.slice(1).every((line) => GIT_LFS_POINTER_KEY_LINE.test(line))) return false;
+  return GIT_LFS_POINTER_OID_LINE.test(contents) && GIT_LFS_POINTER_SIZE_LINE.test(contents);
 }
 function readRepoTextPrefix(path2, byteLimit) {
   try {
@@ -310,7 +354,11 @@ function readRepoTextPrefix(path2, byteLimit) {
     descriptor = openSync(path2, "r");
     const buffer = Buffer.allocUnsafe(byteLimit);
     const bytesRead = readSync(descriptor, buffer, 0, byteLimit, 0);
-    return buffer.subarray(0, bytesRead).toString("utf8");
+    const contents = buffer.subarray(0, bytesRead).toString("utf8");
+    if (bytesRead < byteLimit && isGitLfsPointerText(contents)) {
+      recordSkip(path2, "lfs_pointer", void 0, activeSession?.lfsPointerAbstention === true, true);
+    }
+    return contents;
   } catch (error) {
     recordFilesystemSkip(path2, error);
     return "";
@@ -340,11 +388,13 @@ export {
   withContentReadCriterion,
   withContentReadSignal,
   withContentReadSignals,
+  withoutContentReadAttribution,
   recordContentSkip,
   registerWithheldRepoPath,
   withheldRepoPaths,
   abstainSignalOnWithheldPaths,
   recordFilesystemSkip,
   readRepoText,
+  isGitLfsPointerText,
   readRepoTextPrefix
 };

package/dist/{chunk-5PFYOIOS.js → chunk-RRPQHEBU.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-VGBFZBZQ.js";
+} from "./chunk-2UMHJ23V.js";
 import {
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // src/packs/llm/files.ts
 init_esm_shims();

package/dist/{chunk-TOQPQPDF.js → chunk-U2VDSTIT.js}

@@ -5,19 +5,19 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-ZZHQZW26.js";
+} from "./chunk-YHJ7ICL4.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,
   external_exports,
   objectType
-} from "./chunk-FSMZV3Y6.js";
+} from "./chunk-AMVP7L26.js";
 import {
   __commonJS,
   __export,
   __toESM,
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({