Skip to content

Cejel 0.4.4

Choose a tag to compare

View all tags
@houman44 houman44 released this 18 Aug 21:46
v0.4.4
This tag was signed with the committer’s verified signature.
houman44 Houman
SSH Key Fingerprint: Wrz2OHS/4utUI9fHqgzdGjKbx5lo2X6neVfCHeNELeA
Verified
Learn about vigilant mode.
21ae64c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cejel 0.4.4 fixes two install-path bugs found by a new CI check that actually exercises the MCP install routes instead of leaving them offered-but-never-tried: the OpenClaw MCP command now pins openclaw@latest and @cejel/cejel@latest instead of a bare openclaw, which on Node 22.15.0 could silently resolve a release predating the mcp add/mcp doctor subcommands the instructions used; and the Smithery instructions now call out that smithery mcp add requires an account, with the no-login generic MCP client config offered as the alternative.

A certificate integrity gap closes: scoreRepoWithPublicCejel — the sealed scoring path shared by the CLI and every published leaderboard row — now rejects an explicitly supplied but unwired rubricVersion instead of silently falling through and naming a rubric that never actually ran. Found while regenerating the public leaderboard.

The .term-tooltip glossary/metric tooltips on the HTML certificate now wrap safely instead of overflowing their box, for any tooltip text longer than the curated glossary anticipates. Reported by an external reviewer.

execGit — the sole production Git subprocess boundary — now scopes the trusted safe.directory entry to the exact scanned working directory instead of relying on ambient global Git config, closing a cross-UID Docker/CI mount gap without widening trust. The bare-npx-invocation guard now fails closed on any unpinned npx/pnpm dlx/bunx invocation of a public-facing package named in this repository's docs, not just @cejel/cejel itself. The release-currency verifier now checks published content, not just version markers, across every surface including a new twelfth one (cejel.dev/changelog/) — this is what caught the leaderboard's stale scorer version and an unpinned npx hero command before this release. Windows and Linux-aarch64 published binaries are now verified against their real target platforms after each release, alongside the existing per-target smoke checks.

Two new opt-in, uncalibrated scanning surfaces ship behind separate npm subpaths that nothing in the default scan imports: a decision-contract conformance checker (@cejel/cejel/decision-contracts) and a D6 shell-signature rule (@cejel/cejel/d-series). Three prospective rubric versions (v20/v21/v22) are selectable only by an explicit evaluation driver that pins rubricVersion; none carry a calibration claim.

The calibrated public default remains v17. This release does not change scoring, rubric behavior, detectors, or published calibration figures — verified with a paired comparison of published 0.4.3 against this release across 8 pinned repos spanning 8 language ecosystems, default settings, zero differences in any field but version metadata. A new regression test (default-scan-pack-isolation.test.ts) asserts the two new packs stay structurally unreachable from the default scan path going forward.

Full changelog: https://github.com/BargLabs/cejel/blob/v0.4.4/CHANGELOG.md

Assets 14
Loading