@counterfact-labs/cli 0.1.2 → 0.2.3

package/dist/cli/claude-code-permission.js

@@ -0,0 +1,20 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+const servers = ["mcp__plugin_counterfact_counterfact", "mcp__counterfact"];
+export const ANALYZE_TOOL_NAME = "analyze_agent";
+export const ANALYZE_TOOL_RULE = `${servers[0]}__${ANALYZE_TOOL_NAME}`;
+const allowedRules = new Set(servers.flatMap(server => [server, `${server}__*`, `${server}__${ANALYZE_TOOL_NAME}`]));
+export async function analyzeToolAllowed(homeDir, cwd) {
+    const paths = [join(homeDir, ".claude/settings.json"), join(cwd, ".claude/settings.json"), join(cwd, ".claude/settings.local.json")];
+    const matches = await Promise.all(paths.map(async (path) => {
+        try {
+            const settings = JSON.parse(await readFile(path, "utf8"));
+            const allow = settings?.permissions?.allow;
+            return Array.isArray(allow) && allow.some(rule => allowedRules.has(rule));
+        }
+        catch {
+            return false;
+        }
+    }));
+    return matches.some(Boolean);
+}

package/dist/cli/commands/analyze.js

@@ -0,0 +1,73 @@
+import { loadInstalledRelease } from "../../adapters/release.js";
+import { cliRefusals, START_FAILURE_MESSAGE } from "../../contract/cli-refusals.js";
+import { CLI_VERSION } from "../../contract/cli-version.js";
+import { cliApiMessages } from "../../contract/cli-api-messages.js";
+import { ApiError } from "../api.js";
+import { resolveAgentFolder } from "../agent-folder.js";
+import { runRelayCheck } from "../relay-check.js";
+// Only a real pause says "paused"; an unreviewed release or an upload-only server cannot start.
+const unavailable = START_FAILURE_MESSAGE;
+function requireLocal(value) {
+    if (!value || typeof value !== "object" || !("mode" in value) || !("minimumLocalCliVersion" in value)
+        || typeof value.minimumLocalCliVersion !== "string" || !/^\d+\.\d+\.\d+$/.test(value.minimumLocalCliVersion)) {
+        throw new Error(cliApiMessages.invalid_response);
+    }
+    const current = CLI_VERSION.split(".").map(BigInt), minimum = value.minimumLocalCliVersion.split(".").map(BigInt);
+    for (let i = 0; i < current.length; i++) {
+        if (minimum[i] > current[i])
+            throw new ApiError(426, "cli_update_required", cliRefusals.cli_update_required);
+        if (minimum[i] < current[i])
+            break;
+    }
+    if (value.mode === "paused")
+        throw new ApiError(503, "local_checks_paused", cliRefusals.local_checks_paused);
+    // A local-capable client never falls back to sending source files to the hosted upload API.
+    if (value.mode !== "local")
+        throw new ApiError(503, "unavailable", unavailable);
+}
+export async function analyze(path, _options, ctx) {
+    const startup = ctx.startup;
+    requireLocal(await ctx.api.request("checks/mode"));
+    const release = ctx.relayRuntime?.release ?? await loadInstalledRelease();
+    if (release.projectContext !== "checks")
+        throw new Error(unavailable);
+    const token = await ctx.token?.();
+    if (!token)
+        throw new Error("Not signed in. Run counterfact-labs login.");
+    const folder = resolveAgentFolder(path, ctx.cwd);
+    const config = Object.freeze({ ...startup.transport, CF_RELAY_URL: startup.transport.CF_RELAY_URL ?? release.relayUrl,
+        CF_LOCAL_RELAY: "1", CF_CONSOLE_URL: ctx.api.baseUrl, CF_CONSOLE_TOKEN: token });
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    process.once("SIGINT", cancel);
+    process.once("SIGTERM", cancel);
+    let progressShown = false;
+    const clearProgress = () => { if (progressShown) {
+        ctx.write("\r\u001b[2K");
+        progressShown = false;
+    } };
+    try {
+        return await (ctx.relayRuntime?.run ?? runRelayCheck)(folder, {
+            settings: startup.settings, config, release, connect: ctx.relayRuntime?.connect,
+            signal: ctx.signal ? AbortSignal.any([controller.signal, ctx.signal]) : controller.signal,
+            stdout() { }, stderr() { },
+            onStart: () => { ctx.onCheckStart?.(); ctx.write("\r\u001b[2KAnalyzing the agent…"); progressShown = true; },
+            onError: failure => {
+                clearProgress();
+                ctx.write(`${failure.message}\n`);
+            },
+            onSaved: result => {
+                clearProgress();
+                ctx.onCheckComplete?.(result);
+                if (result.findingIds?.length)
+                    ctx.write(`Finding ids: ${result.findingIds.join(", ")}\n`);
+                ctx.write(`Full results: ${result.url}\n`);
+            },
+        });
+    }
+    finally {
+        clearProgress();
+        process.removeListener("SIGINT", cancel);
+        process.removeListener("SIGTERM", cancel);
+    }
+}

package/dist/cli/commands/login.js

@@ -0,0 +1,51 @@
+import { emailSignInMessages } from "../../contract/email-sign-in-messages.js";
+import { EMAIL_SIGN_IN_TERMS, normalizeSignInEmail, signInWithCode, startEmailSignIn } from "../email-sign-in.js";
+import { startSignIn } from "../sign-in.js";
+export function parseLoginOptions(args) {
+    // The router supplies usage for syntax errors without repeating private arguments.
+    const options = {};
+    for (let index = 0; index < args.length; index += 2) {
+        const flag = args[index];
+        const value = args[index + 1];
+        if ((flag !== "--email" && flag !== "--code") || !value?.trim() || value.startsWith("--"))
+            throw new Error();
+        const key = flag === "--email" ? "email" : "code";
+        if (options[key] !== undefined)
+            throw new Error();
+        options[key] = value;
+    }
+    if (options.code !== undefined && options.email === undefined)
+        throw new Error();
+    return options;
+}
+export async function login(ctx, options = {}) {
+    if (options.email !== undefined) {
+        if (!ctx.startup.emailSignIn)
+            throw new Error(emailSignInMessages.email_unavailable);
+        const email = normalizeSignInEmail(options.email);
+        if (!email)
+            throw new Error(emailSignInMessages.invalid_email);
+        ctx.write(EMAIL_SIGN_IN_TERMS + "\n");
+        let code = options.code;
+        if (code === undefined) {
+            await startEmailSignIn(ctx, email);
+            ctx.write(`We sent a sign-in code to ${email}.\n`);
+            if (!ctx.signInInput.isTerminal) {
+                ctx.write(`To finish signing in, run counterfact-labs login --email ${email} --code <code>.\n`);
+                return 0;
+            }
+            code = await ctx.signInInput.readCode("Enter the code from your email: ", ctx.signal);
+            if (code === undefined)
+                throw new Error(emailSignInMessages.cancelled);
+        }
+        await signInWithCode(ctx, email, code);
+        ctx.write("Signed in.\n");
+        return 0;
+    }
+    const flow = await startSignIn(ctx);
+    ctx.write(`1. Open ${flow.verificationUri}. If asked, sign in with the code we email you.\n`
+        + `2. Then enter this code on that page: ${flow.userCode}\n`);
+    await flow.done;
+    ctx.write("Signed in.\n");
+    return 0;
+}

package/dist/cli/completion-recovery.js

@@ -0,0 +1,18 @@
+export const COMPLETION_SETTINGS_MISMATCH_MESSAGE = "This folder has a saved result for a different Counterfact project or address. Run the analysis again with the original settings to save it, or delete .counterfact/completion.json to start a new analysis.";
+export const matchesCheck = (status, identity) => status.checkId === identity.checkId && status.projectId === identity.projectId;
+export function completionRecoveryDecision(input) {
+    if (input.localMismatch)
+        return { finished: false, message: COMPLETION_SETTINGS_MISMATCH_MESSAGE };
+    if (!input.statusSucceeded)
+        return { finished: false };
+    const { status, completedPayload } = input;
+    // A different analysis cannot settle this saved payload, even when submission reports a conflict.
+    if (status && completedPayload && !matchesCheck(status, completedPayload))
+        return { finished: false };
+    // Only trusted terminal status retires unsaved work; outages and closing work remain retryable.
+    if (status?.uploadState === "missing" && (status.state === "closed" || status.state === "expired")
+        && completedPayload && matchesCheck(status, completedPayload))
+        return { finished: true };
+    // A refusal never retires paid work by itself; only the console's own terminal status above can.
+    return { finished: false };
+}

package/dist/cli/context.js

@@ -0,0 +1,22 @@
+import { readCliSettings } from "../adapters/settings.js";
+import { homedir } from "node:os";
+import { setTimeout as delay } from "node:timers/promises";
+import { ApiClient, DEFAULT_URL } from "./api.js";
+import { openBrowser } from "./browser.js";
+import { readCredentials } from "./credentials.js";
+import { userEmail } from "./git.js";
+import { terminalSignInInput } from "./sign-in-input.js";
+export function commandContext(options = {}) {
+    const startup = readCliSettings(options.env, options.emailSignIn);
+    const homeDir = options.homeDir ?? homedir();
+    const baseUrl = (options.baseUrl ?? startup.baseUrl ?? DEFAULT_URL).replace(/\/+$/, "");
+    const api = new ApiClient(baseUrl, () => readCredentials(homeDir, api.baseUrl), undefined, options.signal);
+    const write = options.write ?? (text => { process.stdout.write(text); });
+    return {
+        startup, signal: options.signal, relayRuntime: options.relayRuntime, cwd: options.cwd ?? process.cwd(),
+        token: () => readCredentials(homeDir, api.baseUrl), onCheckComplete: options.onCheckComplete, onCheckStart: options.onCheckStart,
+        api, homeDir, write, openBrowser: options.openBrowser ?? openBrowser,
+        signInInput: options.signInInput ?? terminalSignInInput(), readEmail: options.readEmail ?? userEmail,
+        sleep: options.sleep ?? (async (ms) => { await delay(ms, undefined, { signal: options.signal }); }), now: options.now ?? Date.now,
+    };
+}

package/dist/cli/email-sign-in.js

@@ -0,0 +1,56 @@
+import { emailSignInMessages } from "../contract/email-sign-in-messages.js";
+import { saveCredentials } from "./credentials.js";
+export const EMAIL_SIGN_IN_TERMS = "By signing in, you agree to our Terms of Service (https://counterfactlabs.com/terms) and Privacy Policy (https://counterfactlabs.com/privacy).";
+function hasControlCharacters(value) {
+    return [...value].some(character => {
+        const code = character.charCodeAt(0);
+        return code < 32 || code === 127;
+    });
+}
+export function normalizeSignInEmail(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const email = value.trim().toLowerCase();
+    if (email.length > 320 || !/^[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(email)
+        || /[<>()[\],:;"\\]/.test(email) || hasControlCharacters(email))
+        return undefined;
+    // ASCII domain labels keep the recipient spelling consistent with the console's mailer.
+    const domain = email.split("@")[1];
+    return /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/.test(domain) ? email : undefined;
+}
+export function validSignInCode(value) {
+    return typeof value === "string" && value.trim().length > 0 && !hasControlCharacters(value.trim()) && !/[\u2028\u2029]/.test(value.trim());
+}
+function requireEmail(value) {
+    const email = normalizeSignInEmail(value);
+    if (!email)
+        throw new Error(emailSignInMessages.invalid_email);
+    return email;
+}
+export async function startEmailSignIn(ctx, email) {
+    const value = await ctx.api.request("email/start", { email: requireEmail(email) }, false);
+    if (!value || typeof value !== "object" || Array.isArray(value) || !("expiresIn" in value)
+        || typeof value.expiresIn !== "number" || !Number.isInteger(value.expiresIn) || value.expiresIn <= 0) {
+        throw new Error(emailSignInMessages.invalid_response);
+    }
+    return { expiresIn: value.expiresIn };
+}
+export async function signInWithCode(ctx, email, code) {
+    const normalizedEmail = requireEmail(email);
+    if (!validSignInCode(code))
+        throw new Error(emailSignInMessages.invalid_code);
+    const value = await ctx.api.request("email/verify", { email: normalizedEmail, code: code.trim(), clientName: "Command line" }, false);
+    if (!value || typeof value !== "object" || Array.isArray(value) || !("token" in value)
+        || typeof value.token !== "string" || !value.token.trim())
+        throw new Error(emailSignInMessages.invalid_response);
+    // A request can complete just as the caller cancels; do not replace a saved sign-in then.
+    if (ctx.signal?.aborted)
+        throw new DOMException(emailSignInMessages.cancelled, "AbortError");
+    try {
+        await saveCredentials(ctx.homeDir, ctx.api.baseUrl, value.token);
+    }
+    catch {
+        throw new Error(emailSignInMessages.request_failed);
+    }
+    return "signed_in";
+}

package/dist/cli/git.js

@@ -0,0 +1,39 @@
+import { basename, relative, resolve, sep } from "node:path";
+import { gitRepositoryRoot } from "../adapters/repository-root.js";
+import { runGit } from "../adapters/git.js";
+export async function userEmail(folder, git = async (args) => (await runGit(folder, args, { userConfig: true })).toString("utf8")) {
+    try {
+        return await git(["config", "--get", "user.email"]);
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function repositoryFacts(root, git = async (args) => (await runGit(root, args)).toString("utf8")) {
+    const folderName = basename(resolve(root));
+    const repoRoot = await gitRepositoryRoot(git);
+    if (repoRoot === null)
+        return { remoteUrl: null, relPath: "", folderName, branch: null, commit: null, dirty: null };
+    let remoteUrl;
+    try {
+        remoteUrl = (await git(["config", "--get", "remote.origin.url"])).trim().replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/]*@/i, "$1") || null;
+    }
+    catch {
+        remoteUrl = null;
+    }
+    const read = async (args) => {
+        try {
+            return (await git(args)).trim();
+        }
+        catch {
+            return null;
+        }
+    };
+    const [branch, commit, status] = await Promise.all([
+        read(["rev-parse", "--abbrev-ref", "HEAD"]), read(["rev-parse", "HEAD"]),
+        // Include new files even when Git hides them, and exclude sibling folders.
+        read(["status", "--porcelain=v2", "--no-renames", "--ignore-submodules=all", "--untracked-files=normal", "--", "."]),
+    ]);
+    return { repoRoot, remoteUrl, relPath: relative(repoRoot, root).split(sep).join("/"), folderName,
+        branch: branch === "HEAD" ? null : branch || null, commit: commit || null, dirty: status === null ? null : status.length > 0 };
+}

package/dist/cli/intake-payload.js

@@ -0,0 +1,18 @@
+import { localFindingsPayloadSchema } from "../contract/console.js";
+import { RESULTS_TOO_LARGE_MESSAGE } from "../contract/cli-refusals.js";
+export function buildIntakePayload(identity, agent, report) {
+    const repo = (key) => key === null || key === report.repoKey ? agent.repository : key;
+    const findings = report.findings.map(finding => {
+        // The local report may add presentation fields; the intake accepts cleaned evidence only.
+        const { kind, severity, title, cause, summary, category, question, site, excerpt, otherSites, fixes, sourceNotes } = finding;
+        return { kind, severity, title, cause, summary, category, question, site, excerpt,
+            fixes: fixes.map(({ title, approach, kind, targetFiles, expectedOutcome, summary, impact, confidence, objective, status, blockedBy, alsoFixes, delta }) => ({ title, approach, kind, targetFiles, expectedOutcome, summary, impact, confidence, objective, status, blockedBy, alsoFixes, delta })),
+            siteRepo: repo(finding.siteRepo), otherSites: otherSites.map(site => ({ ...site, repo: repo(site.repo) })),
+            ...(sourceNotes === undefined ? {} : { sourceNotes: sourceNotes && { ...sourceNotes,
+                    counterEvidence: sourceNotes.counterEvidence.map(site => ({ ...site, repo: repo(site.repo) })) } }) };
+    });
+    const result = localFindingsPayloadSchema.safeParse({ ...identity, agent, findings });
+    if (!result.success)
+        throw new Error(RESULTS_TOO_LARGE_MESSAGE);
+    return result.data;
+}

package/dist/{main.js → cli/main.js}

@@ -2,39 +2,50 @@
 import { pathToFileURL } from "node:url";
 import { realpath } from "node:fs/promises";
 import { errorCode, errorText } from "./api.js";
+import { readEmailSignIn } from "../adapters/settings.js";
 import { commandContext } from "./context.js";
-import { check } from "./commands/check.js";
+import { analyze } from "./commands/analyze.js";
 import { finding } from "./commands/finding.js";
 import { balance } from "./commands/balance.js";
-import { login } from "./commands/login.js";
+import { login, parseLoginOptions } from "./commands/login.js";
 import { logout } from "./commands/logout.js";
 import { serveMcp } from "./mcp.js";
-const usage = "Usage: counterfact-labs check [path] [--yes] [--dry-run]\n       counterfact-labs finding <id>\n       counterfact-labs balance | login | logout | mcp\n";
+const usage = "Usage: counterfact-labs analyze [path]\n       counterfact-labs finding <id>\n       counterfact-labs balance | login | logout | mcp\n";
 export async function run(args, options = {}) {
     const write = options.write ?? (text => { process.stdout.write(text); });
+    const emailSignIn = options.emailSignIn ?? readEmailSignIn(options.env);
+    const commandOptions = { ...options, emailSignIn };
     try {
         const [command, ...rest] = args;
         if (["--help", "-h", "help"].includes(command) || !command) {
             write(usage);
             return 0;
         }
-        if (command === "check") {
-            const flags = rest.filter(arg => arg.startsWith("--"));
-            const paths = rest.filter(arg => !arg.startsWith("--"));
-            if (paths.length > 1 || flags.some(flag => !["--yes", "--dry-run"].includes(flag)))
+        if (command === "analyze") {
+            if (rest.length > 1 || rest.some(arg => arg.startsWith("-")))
                 throw new Error(usage.trimEnd());
-            return await check(paths[0] ?? ".", { yes: flags.includes("--yes"), dryRun: flags.includes("--dry-run") }, commandContext(options));
+            return await analyze(rest[0] ?? ".", {}, commandContext(commandOptions));
         }
         if (command === "finding" && rest.length === 1 && !rest[0].startsWith("-"))
-            return await finding(rest[0], commandContext(options));
+            return await finding(rest[0], commandContext(commandOptions));
+        if (command === "login" && emailSignIn) {
+            let parsed;
+            try {
+                parsed = parseLoginOptions(rest);
+            }
+            catch {
+                throw new Error(usage.trimEnd());
+            }
+            return await login(commandContext(commandOptions), parsed);
+        }
         if (rest.length)
             throw new Error(usage.trimEnd());
         if (command === "balance")
-            return await balance(commandContext(options));
+            return await balance(commandContext(commandOptions));
         if (command === "login")
-            return await login(commandContext(options));
+            return await login(commandContext(commandOptions));
         if (command === "logout")
-            return await logout(commandContext(options));
+            return await logout(commandContext(commandOptions));
         if (command === "mcp") {
             await serveMcp(process.stdin, process.stdout, options);
             return 0;