@counterfact-labs/cli 0.1.1 → 0.1.3

package/README.md

@@ -20,6 +20,10 @@ counterfact-labs logout
 
 Checks return exit code 0 on success, 1 on error and 2 when the balance is too low. The server chooses the files, sets the price and writes the result summary. The first eligible check is free. Failed checks are not charged.
 
+By default, results appear as an analysis in a project in your workspace. A matching GitHub repository uses an existing project. Otherwise the check reuses a project from an earlier check of the same folder or creates one. The results link opens the project's findings for that analysis. New and fixed problems are compared with the agents' open findings there, including earlier console results.
+
+The tool sends the branch, full commit and whether the checked folder has local edits when Git can report them. Analysis history shows these details with who ran the check. The analysis reads the uploaded files, so its findings show your local copy. Older tool versions that omit branch, commit or local edits still work.
+
 The console is at `https://app.counterfactlabs.com`. Sign in again after moving from the old address; saved sign-in belongs to the server address.
 
 Add the local MCP server to Codex:
@@ -37,11 +41,13 @@ args = ["-y", "@counterfact-labs/cli@latest", "mcp"]
 tool_timeout_sec = 900
 ```
 
-Cancellation stops the local wait. A confirmed check keeps running on the server after cancellation or a timeout, and its result appears on the console's Checks page.
+Cancellation stops the local wait. A confirmed check keeps running on the server after cancellation or a timeout. Use the project link from the preview to follow it in the console.
 
 Add this to your project's `AGENTS.md`:
 
 ```markdown
+First call sign_in_status; if not signed in, call sign_in and then sign_in_status with wait: true.
+Always show the returned sign-in link and code, so I can sign in on any device.
 When I ask to check an agent, use Counterfact's check_agent tool with its folder path.
 Call it without confirm first. Show me the selected files and price, and get my
 agreement before calling again with confirm: true. If the files or price change,
@@ -51,9 +57,9 @@ After editing prompts, skills or tool definitions, suggest a check and wait for
 me to ask for it.
 ```
 
-The MCP server reads local files and communicates over stdin and stdout. Its tools are `check_agent(path, confirm?)`, `get_finding(id)` and `get_balance()`. Each result's structured content repeats the tool's text, and completed checks add their finding ids. Keep the preview and confirmation in the same MCP session.
+The MCP server reads local files and communicates over stdin and stdout. Its tools are `sign_in_status(wait?)`, `sign_in()`, `check_agent(path, confirm?)`, `get_finding(id)` and `get_balance()`. Sign-in status also reports whether Claude Code settings allow the check tool. Sign-in opens a browser when a local desktop is available and always returns a link and code for signing in on any device. Each result's structured content repeats the tool's text, and completed checks add their finding ids. Keep sign-in and its wait, and the preview and confirmation, in the same MCP session.
 
-Privacy: only files requested by the server are uploaded. The tool skips `.git`, `node_modules`, `.gitignore` matches, symlinks and secret file names such as `.env` and private keys. Uploaded files are kept with the check while the workspace exists, and deleted with the check or workspace. Sign-in is saved in `~/.config/counterfact-labs/credentials` with owner-only permissions. `logout` removes that local sign-in; revoke the token from your account to disable it elsewhere.
+Privacy: only files requested by the server are uploaded. The tool skips `.git`, `node_modules`, `.gitignore` matches, symlinks and secret file names such as `.env` and private keys. Uploaded files are saved with the analysis so findings can show the source that was checked. Sign-in is saved in `~/.config/counterfact-labs/credentials` with owner-only permissions. `logout` removes that local sign-in; revoke the token from your account to disable it elsewhere.
 
 Set `COUNTERFACT_URL` to use another server. It defaults to `https://app.counterfactlabs.com`. Sign-in is tied to the server address; sign in again when changing it.
 

package/dist/browser.js

@@ -0,0 +1,23 @@
+import { spawn } from "node:child_process";
+export async function openBrowser(url, spawner = spawn, platform = process.platform, env = process.env) {
+    try {
+        if (!["http:", "https:"].includes(new URL(url).protocol))
+            return false;
+        // A remote opener cannot reach the user's screen, even when it starts successfully.
+        if (env.SSH_CONNECTION || env.SSH_TTY || (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY))
+            return false;
+        // Windows parses start's arguments as shell text; these links need the caller's fallback.
+        if (platform === "win32" && /[\s"&|<>^()%!]/.test(url))
+            return false;
+        const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+        const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+        return await new Promise(resolve => {
+            const child = spawner(command, args, { detached: true, stdio: "ignore" });
+            child.once("error", () => resolve(false));
+            child.once("spawn", () => { child.unref(); resolve(true); });
+        });
+    }
+    catch {
+        return false;
+    }
+}

package/dist/claude-code-permission.js

@@ -0,0 +1,19 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+const servers = ["mcp__plugin_counterfact_counterfact", "mcp__counterfact"];
+export const CHECK_TOOL_RULE = `${servers[0]}__check_agent`;
+const allowedRules = new Set(servers.flatMap(server => [server, `${server}__*`, `${server}__check_agent`]));
+export async function checkToolAllowed(homeDir, cwd) {
+    const paths = [join(homeDir, ".claude/settings.json"), join(cwd, ".claude/settings.json"), join(cwd, ".claude/settings.local.json")];
+    const matches = await Promise.all(paths.map(async (path) => {
+        try {
+            const settings = JSON.parse(await readFile(path, "utf8"));
+            const allow = settings?.permissions?.allow;
+            return Array.isArray(allow) && allow.some(rule => allowedRules.has(rule));
+        }
+        catch {
+            return false;
+        }
+    }));
+    return matches.some(Boolean);
+}

package/dist/commands/check.js

@@ -35,9 +35,11 @@ export async function prepareCheck(path, ctx) {
         throw new Error("No agent files were found in this folder.");
     ctx.write(fileText(path, wanted));
     const upload = await readUpload(root, files, plan.wanted);
-    const response = await awaitQuote(await ctx.api.request("checks", { ...facts, files: upload }), ctx);
+    const created = await ctx.api.request("checks", { ...facts, files: upload });
+    ctx.write(`Follow it in the app: ${created.url}\n`);
+    const response = await awaitQuote(created, ctx);
     ctx.write(quoteText(response.quote));
-    return { root, response, files: upload };
+    return { root, response, files: upload, url: created.url };
 }
 /** A confirmed check can keep running and charge while the connection is down. */
 async function pollConfirmed(id, ctx) {

package/dist/commands/login.js

@@ -1,20 +1,9 @@
-import { saveCredentials } from "../credentials.js";
+import { startSignIn } from "../sign-in.js";
 export async function login(ctx) {
-    const device = await ctx.api.request("device", {}, false);
-    ctx.write(`To sign in, open ${device.verificationUri} and enter ${device.userCode}\n`);
-    const until = ctx.now() + device.expiresIn * 1000;
-    while (ctx.now() < until) {
-        await ctx.sleep(device.interval * 1000);
-        const poll = await ctx.api.request("device/token", { deviceCode: device.deviceCode }, false);
-        if (poll.status === "ok") {
-            await saveCredentials(ctx.homeDir, ctx.api.baseUrl, poll.token);
-            ctx.write("Signed in.\n");
-            return 0;
-        }
-        if (poll.status === "expired")
-            break;
-        if (poll.status === "denied")
-            throw new Error("Sign-in was cancelled. Run counterfact-labs login to try again.");
-    }
-    throw new Error("The sign-in code expired. Run counterfact-labs login to try again.");
+    const flow = await startSignIn(ctx);
+    ctx.write(`1. Open ${flow.verificationUri}. If asked, sign in with the code we email you.\n`
+        + `2. Then enter this code on that page: ${flow.userCode}\n`);
+    await flow.done;
+    ctx.write("Signed in.\n");
+    return 0;
 }

package/dist/context.js

@@ -2,6 +2,7 @@ import { homedir } from "node:os";
 import { createInterface } from "node:readline/promises";
 import { setTimeout as delay } from "node:timers/promises";
 import { ApiClient, DEFAULT_URL } from "./api.js";
+import { openBrowser } from "./browser.js";
 import { readCredentials } from "./credentials.js";
 export function commandContext(options = {}) {
     const homeDir = options.homeDir ?? homedir();
@@ -9,7 +10,7 @@ export function commandContext(options = {}) {
     const api = new ApiClient(baseUrl, () => readCredentials(homeDir, api.baseUrl), undefined, options.signal);
     const write = options.write ?? (text => { process.stdout.write(text); });
     return {
-        api, homeDir, write,
+        api, homeDir, write, openBrowser: options.openBrowser ?? openBrowser,
         sleep: options.sleep ?? (async (ms) => { await delay(ms, undefined, { signal: options.signal }); }), now: options.now ?? Date.now,
         ask: options.ask ?? (async (question) => {
             if (!process.stdin.isTTY)

package/dist/files.js

@@ -2,10 +2,10 @@ import { constants } from "node:fs";
 import { lstat, open, readdir, realpath } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { ignored, parseIgnore } from "./gitignore.js";
-import { SECRET_FILE_RE } from "./secret-files.js";
+import { isReadableRepoPath } from "./secret-files.js";
 const slash = (path) => path.split(sep).join("/");
 function safe(path) {
-    return !!path && !path.includes("\\") && !path.includes("\0") && !path.startsWith("/") && !SECRET_FILE_RE.test(path)
+    return !!path && !path.includes("\\") && !path.includes("\0") && !path.startsWith("/") && isReadableRepoPath(path)
         && path.split("/").every(part => !["", ".", "..", ".git", "node_modules"].includes(part));
 }
 async function ignoreFile(directory, base) {

package/dist/git.js

@@ -8,7 +8,7 @@ export async function repositoryFacts(root, git = async (args) => (await promisi
         repoRoot = (await git(["rev-parse", "--show-toplevel"])).trim();
     }
     catch {
-        return { remoteUrl: null, relPath: "", folderName };
+        return { remoteUrl: null, relPath: "", folderName, branch: null, commit: null, dirty: null };
     }
     let remoteUrl;
     try {
@@ -17,5 +17,19 @@ export async function repositoryFacts(root, git = async (args) => (await promisi
     catch {
         remoteUrl = null;
     }
-    return { repoRoot, remoteUrl, relPath: relative(repoRoot, root).split(sep).join("/"), folderName };
+    const read = async (args) => {
+        try {
+            return (await git(args)).trim();
+        }
+        catch {
+            return null;
+        }
+    };
+    const [branch, commit, status] = await Promise.all([
+        read(["rev-parse", "--abbrev-ref", "HEAD"]), read(["rev-parse", "HEAD"]),
+        // Include new files even when Git hides them, and exclude sibling folders.
+        read(["status", "--porcelain", "--untracked-files=normal", "--", "."]),
+    ]);
+    return { repoRoot, remoteUrl, relPath: relative(repoRoot, root).split(sep).join("/"), folderName,
+        branch: branch === "HEAD" ? null : branch || null, commit: commit || null, dirty: status === null ? null : status.length > 0 };
 }

package/dist/mcp.js

@@ -1,11 +1,14 @@
 import { createInterface } from "node:readline";
 import { once } from "node:events";
+import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { errorCode, errorText } from "./api.js";
 import { commandContext } from "./context.js";
 import { confirmPrepared, prepareCheck } from "./commands/check.js";
 import { finding } from "./commands/finding.js";
 import { balance } from "./commands/balance.js";
+import { checkToolAllowed } from "./claude-code-permission.js";
+import { signInStatus, startSignIn } from "./sign-in.js";
 const tools = [
     {
         name: "check_agent",
@@ -17,6 +20,8 @@ const tools = [
     },
     { name: "get_finding", description: "Get a finding's explanation, quoted lines and suggested fixes.", inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"], additionalProperties: false } },
     { name: "get_balance", description: "Get the balance and top-up link.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
+    { name: "sign_in_status", description: "Check whether this computer is signed in to Counterfact, and whether the user has allowed the check tool in Claude Code. With wait: true, first wait for a sign-in started by sign_in to finish.", inputSchema: { type: "object", properties: { wait: { type: "boolean" } }, additionalProperties: false } },
+    { name: "sign_in", description: "Open the Counterfact sign-in page in the user's browser. Then call sign_in_status with wait: true.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
 ];
 class ProtocolError extends Error {
     code;
@@ -27,7 +32,10 @@ class ProtocolError extends Error {
 }
 function object(value) { return value !== null && typeof value === "object" && !Array.isArray(value); }
 export async function serveMcp(input, output, options = {}) {
+    const { version } = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));
     const previews = new Map();
+    const cwd = options.cwd ?? process.cwd();
+    let pendingSignIn;
     const requests = new Map();
     let queue = Promise.resolve();
     const lines = createInterface({ input, crlfDelay: Infinity });
@@ -38,15 +46,19 @@ export async function serveMcp(input, output, options = {}) {
         if (!object(args))
             throw new ProtocolError(-32602, "Tool arguments must be an object.");
         const name = params.name;
-        const allowed = name === "check_agent" ? ["path", "confirm"] : name === "get_finding" ? ["id"] : [];
+        const allowed = name === "check_agent" ? ["path", "confirm"] : name === "get_finding" ? ["id"] : name === "sign_in_status" ? ["wait"] : [];
         if (!tools.some(tool => tool.name === name) || Object.keys(args).some(key => !allowed.includes(key)))
             throw new ProtocolError(-32602, "Unknown tool or argument.");
         if (name === "check_agent" && (typeof args.path !== "string" || !args.path.trim() || (args.confirm !== undefined && typeof args.confirm !== "boolean")))
             throw new ProtocolError(-32602, "Provide a path and an optional boolean confirmation.");
         if (name === "get_finding" && (typeof args.id !== "string" || !args.id.trim()))
             throw new ProtocolError(-32602, "Provide a finding id.");
+        if (name === "sign_in_status" && args.wait !== undefined && typeof args.wait !== "boolean")
+            throw new ProtocolError(-32602, "Provide an optional boolean wait.");
         let text = "", exitCode = 0;
         let findingIds;
+        let url;
+        let signIn;
         try {
             const ctx = commandContext({ ...options, signal, write: chunk => {
                     // Progress is transient terminal text; only the final lines belong in a tool response.
@@ -57,6 +69,55 @@ export async function serveMcp(input, output, options = {}) {
                 await finding(args.id, ctx);
             else if (name === "get_balance")
                 await balance(ctx);
+            else if (name === "sign_in_status") {
+                const pending = pendingSignIn;
+                const allowed = await checkToolAllowed(ctx.homeDir, cwd);
+                if (args.wait === true && pending) {
+                    const cancel = () => pending.controller.abort();
+                    signal.addEventListener("abort", cancel, { once: true });
+                    try {
+                        if (signal.aborted)
+                            cancel();
+                        await pending.flow.done;
+                    }
+                    finally {
+                        signal.removeEventListener("abort", cancel);
+                    }
+                }
+                signIn = { ...await signInStatus(ctx), checkToolAllowed: allowed };
+                text = signIn.signedIn ? "Signed in." : "Not signed in.";
+            }
+            else if (name === "sign_in") {
+                if ((await signInStatus(ctx)).signedIn)
+                    text = "Already signed in.";
+                else {
+                    let pending = pendingSignIn;
+                    if (!pending) {
+                        // The flow outlives this call; a later wait call can cancel its polling.
+                        const controller = new AbortController();
+                        const cancel = () => controller.abort();
+                        signal.addEventListener("abort", cancel, { once: true });
+                        try {
+                            signal.throwIfAborted();
+                            const flow = await startSignIn(commandContext({ ...options, homeDir: ctx.homeDir, baseUrl: ctx.api.baseUrl, signal: controller.signal }));
+                            pending = { flow, controller, opened: false };
+                            pendingSignIn = pending;
+                            const current = pending;
+                            const clear = () => { if (pendingSignIn === current)
+                                pendingSignIn = undefined; };
+                            // Handle background failures even when the client never calls wait.
+                            void flow.done.then(clear, clear);
+                            pending.opened = await ctx.openBrowser(flow.pageUrl);
+                        }
+                        finally {
+                            signal.removeEventListener("abort", cancel);
+                        }
+                    }
+                    signIn = { pageUrl: pending.flow.pageUrl, userCode: pending.flow.userCode };
+                    text = pending.opened ? `Opening your browser… If nothing opens, go to ${signIn.pageUrl} on any device and enter ${signIn.userCode}.`
+                        : `Go to ${signIn.pageUrl} on any device and enter ${signIn.userCode}.`;
+                }
+            }
             else {
                 const path = resolve(args.path);
                 if (args.confirm === true) {
@@ -64,11 +125,16 @@ export async function serveMcp(input, output, options = {}) {
                     previews.delete(path);
                     if (!prepared)
                         throw new Error("Get a preview first. Show the user the price and get their agreement before confirming.");
-                    findingIds = (await confirmPrepared(prepared, ctx)).findingIds;
+                    url = prepared.url;
+                    const result = await confirmPrepared(prepared, ctx);
+                    findingIds = result.findingIds;
+                    url = result.taste.url;
                 }
                 else {
                     previews.delete(path);
-                    previews.set(path, await prepareCheck(args.path, ctx));
+                    const prepared = await prepareCheck(args.path, ctx);
+                    previews.set(path, prepared);
+                    url = prepared.url;
                 }
             }
         }
@@ -79,7 +145,7 @@ export async function serveMcp(input, output, options = {}) {
         // Some clients (Claude Code among them) give the model only the structured result when one is present, so it
         // repeats the text: without it the model sees no files, price or results.
         return { content: [{ type: "text", text }], isError: exitCode !== 0,
-            structuredContent: { text, exitCode, ...(findingIds ? { findingIds } : {}) } };
+            structuredContent: { text, exitCode, ...(findingIds ? { findingIds } : {}), ...(url ? { url } : {}), ...signIn } };
     }
     async function respond(message, id, signal) {
         if (signal.aborted)
@@ -90,7 +156,7 @@ export async function serveMcp(input, output, options = {}) {
             if (message.method === "initialize") {
                 const requested = object(message.params) ? message.params.protocolVersion : undefined;
                 result = { protocolVersion: ["2024-11-05", "2025-03-26", "2025-06-18"].includes(requested) ? requested : "2025-06-18",
-                    capabilities: { tools: {} }, serverInfo: { name: "counterfact-labs", version: "0.1.1" } };
+                    capabilities: { tools: {} }, serverInfo: { name: "counterfact-labs", version } };
             }
             else if (message.method === "ping")
                 result = {};
@@ -147,7 +213,12 @@ export async function serveMcp(input, output, options = {}) {
         if (!output.write(JSON.stringify(reply) + "\n"))
             await once(output, "drain");
     }
-    await queue;
+    try {
+        await queue;
+    }
+    finally {
+        pendingSignIn?.controller.abort();
+    }
 }
 function errorReply(id, error) {
     return { jsonrpc: "2.0", id, error: {

package/dist/output.js

@@ -8,7 +8,7 @@ export function fileText(path, files) {
     const bytes = files.reduce((sum, file) => sum + file.size, 0);
     const names = files.slice(0, 3).map(file => file.path).join(", ");
     const more = files.length > 3 ? `, ... ${files.length - 3} more` : "";
-    return `Checking the agent in ${path} (${files.length} files, ${Math.ceil(bytes / 1000)} KB):\n  ${names}${more}\n`;
+    return `These files would be checked in ${path} (${files.length} files, ${Math.ceil(bytes / 1000)} KB):\n  ${names}${more}\n`;
 }
 export function quoteText(quote) {
     if (quote.band === null)

package/dist/secret-files.js

@@ -1,2 +1,5 @@
-// Copied from src/lib/conventions/file-patterns.ts by the build.
+// Copied from src/lib/conventions/file-admission.ts by the build.
 export const SECRET_FILE_RE = /(^|\/)(\.env(?:\.[^/]*)?|\.(?:npmrc|pypirc|netrc)|(?:credentials|secrets)\.(?:json|ya?ml)|secrets\.toml|[^/]+-credentials\.json|service-account[^/]*\.json|id_(?:rsa|dsa|ecdsa|ed25519)|[^/]+\.(?:pem|key|p12|pfx))$/i;
+export function isReadableRepoPath(path) {
+    return !SECRET_FILE_RE.test(path.replace(/\\/g, "/"));
+}

package/dist/sign-in.js

@@ -0,0 +1,36 @@
+import { ApiError } from "./api.js";
+import { readCredentials, saveCredentials } from "./credentials.js";
+async function pollSignIn(ctx, device) {
+    const until = ctx.now() + device.expiresIn * 1000;
+    while (ctx.now() < until) {
+        await ctx.sleep(device.interval * 1000);
+        const poll = await ctx.api.request("device/token", { deviceCode: device.deviceCode }, false);
+        if (poll.status === "ok") {
+            await saveCredentials(ctx.homeDir, ctx.api.baseUrl, poll.token);
+            return "signed_in";
+        }
+        if (poll.status === "expired")
+            break;
+        if (poll.status === "denied")
+            throw new Error("Sign-in was cancelled. Run counterfact-labs login to try again.");
+    }
+    throw new Error("The sign-in code expired. Run counterfact-labs login to try again.");
+}
+export async function startSignIn(ctx) {
+    const device = await ctx.api.request("device", {}, false);
+    return { userCode: device.userCode, verificationUri: device.verificationUri,
+        pageUrl: `${device.verificationUri}?code=${encodeURIComponent(device.userCode)}`, done: pollSignIn(ctx, device) };
+}
+export async function signInStatus(ctx) {
+    if (!await readCredentials(ctx.homeDir, ctx.api.baseUrl))
+        return { signedIn: false };
+    try {
+        await ctx.api.request("balance");
+        return { signedIn: true };
+    }
+    catch (error) {
+        if (error instanceof ApiError && error.status === 401)
+            return { signedIn: false };
+        throw error;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@counterfact-labs/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "license": "UNLICENSED",
   "description": "Check an agent from your terminal or coding agent",
   "type": "module",