@counterfact-labs/cli 0.1.0 → 0.1.2

package/README.md

@@ -25,7 +25,7 @@ The console is at `https://app.counterfactlabs.com`. Sign in again after moving
 Add the local MCP server to Codex:
 
 ```sh
-codex mcp add counterfact -- npx -y @counterfact-labs/cli mcp
+codex mcp add counterfact -- npx -y @counterfact-labs/cli@latest mcp
 ```
 
 Checks can take several minutes. Codex has a [60-second tool timeout by default](https://learn.chatgpt.com/docs/extend/mcp?surface=cli). In `~/.codex/config.toml`, add `tool_timeout_sec = 900` to the existing `[mcp_servers.counterfact]` section. It should look like this; keep any other settings already in that section:
@@ -33,7 +33,7 @@ Checks can take several minutes. Codex has a [60-second tool timeout by default]
 ```toml
 [mcp_servers.counterfact]
 command = "npx"
-args = ["-y", "@counterfact-labs/cli", "mcp"]
+args = ["-y", "@counterfact-labs/cli@latest", "mcp"]
 tool_timeout_sec = 900
 ```
 
@@ -51,7 +51,7 @@ After editing prompts, skills or tool definitions, suggest a check and wait for
 me to ask for it.
 ```
 
-The MCP server reads local files and communicates over stdin and stdout. Its tools are `check_agent(path, confirm?)`, `get_finding(id)` and `get_balance()`. Finding ids accompany completed checks in the tool's structured result. Keep the preview and confirmation in the same MCP session.
+The MCP server reads local files and communicates over stdin and stdout. Its tools are `check_agent(path, confirm?)`, `get_finding(id)` and `get_balance()`. Each result's structured content repeats the tool's text, and completed checks add their finding ids. Keep the preview and confirmation in the same MCP session.
 
 Privacy: only files requested by the server are uploaded. The tool skips `.git`, `node_modules`, `.gitignore` matches, symlinks and secret file names such as `.env` and private keys. Uploaded files are kept with the check while the workspace exists, and deleted with the check or workspace. Sign-in is saved in `~/.config/counterfact-labs/credentials` with owner-only permissions. `logout` removes that local sign-in; revoke the token from your account to disable it elsewhere.
 

package/dist/commands/check.js

@@ -35,9 +35,11 @@ export async function prepareCheck(path, ctx) {
         throw new Error("No agent files were found in this folder.");
     ctx.write(fileText(path, wanted));
     const upload = await readUpload(root, files, plan.wanted);
-    const response = await awaitQuote(await ctx.api.request("checks", { ...facts, files: upload }), ctx);
+    const created = await ctx.api.request("checks", { ...facts, files: upload });
+    ctx.write(`Follow it in the app: ${created.url}\n`);
+    const response = await awaitQuote(created, ctx);
     ctx.write(quoteText(response.quote));
-    return { root, response, files: upload };
+    return { root, response, files: upload, url: created.url };
 }
 /** A confirmed check can keep running and charge while the connection is down. */
 async function pollConfirmed(id, ctx) {

package/dist/commands/login.js

@@ -1,7 +1,8 @@
 import { saveCredentials } from "../credentials.js";
 export async function login(ctx) {
     const device = await ctx.api.request("device", {}, false);
-    ctx.write(`To sign in, open ${device.verificationUri} and enter ${device.userCode}\n`);
+    ctx.write(`1. Open ${device.verificationUri}. If asked, sign in with the code we email you.\n`
+        + `2. Then enter this code on that page: ${device.userCode}\n`);
     const until = ctx.now() + device.expiresIn * 1000;
     while (ctx.now() < until) {
         await ctx.sleep(device.interval * 1000);

package/dist/files.js

@@ -2,10 +2,10 @@ import { constants } from "node:fs";
 import { lstat, open, readdir, realpath } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { ignored, parseIgnore } from "./gitignore.js";
-import { SECRET_FILE_RE } from "./secret-files.js";
+import { isReadableRepoPath } from "./secret-files.js";
 const slash = (path) => path.split(sep).join("/");
 function safe(path) {
-    return !!path && !path.includes("\\") && !path.includes("\0") && !path.startsWith("/") && !SECRET_FILE_RE.test(path)
+    return !!path && !path.includes("\\") && !path.includes("\0") && !path.startsWith("/") && isReadableRepoPath(path)
         && path.split("/").every(part => !["", ".", "..", ".git", "node_modules"].includes(part));
 }
 async function ignoreFile(directory, base) {

package/dist/mcp.js

@@ -1,5 +1,6 @@
 import { createInterface } from "node:readline";
 import { once } from "node:events";
+import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { errorCode, errorText } from "./api.js";
 import { commandContext } from "./context.js";
@@ -27,6 +28,7 @@ class ProtocolError extends Error {
 }
 function object(value) { return value !== null && typeof value === "object" && !Array.isArray(value); }
 export async function serveMcp(input, output, options = {}) {
+    const { version } = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));
     const previews = new Map();
     const requests = new Map();
     let queue = Promise.resolve();
@@ -47,6 +49,7 @@ export async function serveMcp(input, output, options = {}) {
             throw new ProtocolError(-32602, "Provide a finding id.");
         let text = "", exitCode = 0;
         let findingIds;
+        let url;
         try {
             const ctx = commandContext({ ...options, signal, write: chunk => {
                     // Progress is transient terminal text; only the final lines belong in a tool response.
@@ -64,11 +67,16 @@ export async function serveMcp(input, output, options = {}) {
                     previews.delete(path);
                     if (!prepared)
                         throw new Error("Get a preview first. Show the user the price and get their agreement before confirming.");
-                    findingIds = (await confirmPrepared(prepared, ctx)).findingIds;
+                    url = prepared.url;
+                    const result = await confirmPrepared(prepared, ctx);
+                    findingIds = result.findingIds;
+                    url = result.taste.url;
                 }
                 else {
                     previews.delete(path);
-                    previews.set(path, await prepareCheck(args.path, ctx));
+                    const prepared = await prepareCheck(args.path, ctx);
+                    previews.set(path, prepared);
+                    url = prepared.url;
                 }
             }
         }
@@ -76,8 +84,10 @@ export async function serveMcp(input, output, options = {}) {
             text += errorText(error) + "\n";
             exitCode = errorCode(error);
         }
+        // Some clients (Claude Code among them) give the model only the structured result when one is present, so it
+        // repeats the text: without it the model sees no files, price or results.
         return { content: [{ type: "text", text }], isError: exitCode !== 0,
-            structuredContent: { exitCode, ...(findingIds ? { findingIds } : {}) } };
+            structuredContent: { text, exitCode, ...(findingIds ? { findingIds } : {}), ...(url ? { url } : {}) } };
     }
     async function respond(message, id, signal) {
         if (signal.aborted)
@@ -88,7 +98,7 @@ export async function serveMcp(input, output, options = {}) {
             if (message.method === "initialize") {
                 const requested = object(message.params) ? message.params.protocolVersion : undefined;
                 result = { protocolVersion: ["2024-11-05", "2025-03-26", "2025-06-18"].includes(requested) ? requested : "2025-06-18",
-                    capabilities: { tools: {} }, serverInfo: { name: "counterfact-labs", version: "0.1.0" } };
+                    capabilities: { tools: {} }, serverInfo: { name: "counterfact-labs", version } };
             }
             else if (message.method === "ping")
                 result = {};

package/dist/secret-files.js

@@ -1,2 +1,5 @@
-// Copied from src/lib/conventions/file-patterns.ts by the build.
+// Copied from src/lib/conventions/file-admission.ts by the build.
 export const SECRET_FILE_RE = /(^|\/)(\.env(?:\.[^/]*)?|\.(?:npmrc|pypirc|netrc)|(?:credentials|secrets)\.(?:json|ya?ml)|secrets\.toml|[^/]+-credentials\.json|service-account[^/]*\.json|id_(?:rsa|dsa|ecdsa|ed25519)|[^/]+\.(?:pem|key|p12|pfx))$/i;
+export function isReadableRepoPath(path) {
+    return !SECRET_FILE_RE.test(path.replace(/\\/g, "/"));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@counterfact-labs/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "license": "UNLICENSED",
   "description": "Check an agent from your terminal or coding agent",
   "type": "module",