@counterfact-labs/cli 0.1.3 → 0.2.4

package/dist/cli/relay-check.js

@@ -0,0 +1,239 @@
+import { resolveFolderPath } from "../adapters/folder-path.js";
+import { savedAnalysisUrl } from "../contract/console-url.js";
+import { randomUUID } from "node:crypto";
+import { disabledSetupPings } from "../setup-pings/client.js";
+import { saveCompletion, loadCompletion } from "../adapters/completion.js";
+import { saveLocalResults } from "../adapters/results.js";
+import { OutputPathError, outputPaths } from "../adapters/output-paths.js";
+import { validateClientRelease } from "../adapters/release.js";
+import { selectAnalysisExecution } from "../adapters/models.js";
+import { prepareRelayCheck } from "./relay-preparation.js";
+import { cliRefusals, COMMITTED_FILES_MESSAGE, FINISH_FAILURE_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, refusalExitCode } from "../contract/cli-refusals.js";
+import { ConsoleClient, ConsoleError } from "../gatekeeper/console.js";
+import { GatekeeperClient } from "../gatekeeper/client.js";
+import { connectRelay, relayOrigin } from "../gatekeeper/connection.js";
+import productionTrust from "../gatekeeper/trust/production.json" with { type: "json" };
+import { runAnalysisToEnd } from "../core/analysis/run-to-end.js";
+import { formatSummary } from "./summary.js";
+import { buildIntakePayload } from "./intake-payload.js";
+import { completionRecoveryDecision, COMPLETION_SETTINGS_MISMATCH_MESSAGE, matchesCheck } from "./completion-recovery.js";
+const stateLine = (status) => `Reservation ${status.state}; settlement ${status.settlement}; lease ${new Date(status.expiresAt).toLocaleString("en-US", { timeZone: "America/Los_Angeles", timeZoneName: "short" })}.\n`;
+function requireIntakeReservation(status) {
+    if (status.state === "reserved")
+        return;
+    if (status.state === "closing")
+        throw new ConsoleError("reservation_closing");
+    if (status.state === "closed")
+        throw new ConsoleError("reservation_closed");
+    throw new ConsoleError("reservation_expired", "intake");
+}
+/** Retry an exact completed payload; a lost intake response must never purchase another analysis. */
+async function submit(client, payload, signal) {
+    signal.throwIfAborted();
+    const status = await client.status(payload.reservationId);
+    const committed = (value) => ({ checkId: value.checkId, projectId: value.projectId, analysisId: value.analysisId, findingIds: value.findingIds, settlement: value.settlement });
+    if (!matchesCheck(status, payload))
+        throw new ConsoleError("check_conflict");
+    if (status.uploadState === "saved")
+        return committed(status);
+    requireIntakeReservation(status);
+    signal.throwIfAborted();
+    try {
+        return await client.intake(payload);
+    }
+    catch (error) {
+        // Keep the refusal for display; giving up the saved payload requires confirmed recovery status.
+        const after = await client.status(payload.reservationId).catch(() => { throw error; });
+        if (!matchesCheck(after, payload))
+            throw new ConsoleError("check_conflict");
+        if (after.uploadState === "saved")
+            return committed(after);
+        // Exact idempotent retry only; a second uncertainty leaves the completion record for restart.
+        if (error instanceof ConsoleError && error.code === "unavailable") {
+            requireIntakeReservation(after);
+            signal.throwIfAborted();
+            return client.intake(payload);
+        }
+        throw error;
+    }
+}
+export function runRelayCheck(folder, options) {
+    return runRelayLifecycle(folder, options);
+}
+/** The caller supplies the paid reservation; this runner owns its connection through cleanup. */
+export function runReservedRelayCheck(folder, options) {
+    return runRelayLifecycle(folder, options, options);
+}
+async function runRelayLifecycle(folder, options, existing) {
+    const { config, settings, stdout, stderr } = options;
+    let client, reservationId, projectId;
+    let connection = existing?.connection;
+    let identity;
+    let completedPayload;
+    let completionOrigin;
+    let completed = false, uploaded = false, heartbeat;
+    let renewal;
+    const controller = new AbortController();
+    const signal = options.signal ? AbortSignal.any([controller.signal, options.signal]) : controller.signal;
+    const showSaved = (result) => {
+        const url = savedAnalysisUrl(result.projectId, config.CF_CONSOLE_URL);
+        options.onSaved?.({ ...result, url });
+        stdout(`Saved analysis ${result.analysisId}: ${url}\n`);
+    };
+    try {
+        if (!config.CF_CONSOLE_URL || !existing && (!config.CF_RELAY_URL || !config.CF_CONSOLE_TOKEN)) {
+            throw new Error(cliRefusals.release_unavailable);
+        }
+        if (existing) {
+            requireIntakeReservation(existing.reservation);
+            if (existing.reservation.projectId !== existing.expectedProjectId)
+                throw new ConsoleError("check_conflict");
+            reservationId = existing.reservation.reservationId;
+            projectId = existing.reservation.projectId;
+            identity = existing.reservation;
+            client = existing.client;
+        }
+        else {
+            relayOrigin(config.CF_RELAY_URL);
+            client = new ConsoleClient({ url: config.CF_CONSOLE_URL, token: config.CF_CONSOLE_TOKEN });
+        }
+        // Signature verification precedes all folder reads, status calls and spending.
+        const validated = validateClientRelease(options.release, settings);
+        const { bundle } = validated;
+        folder = await resolveFolderPath(folder);
+        signal.throwIfAborted();
+        const prior = await loadCompletion(folder);
+        if (prior && (!prior.uploaded && !prior.finished || options.retryUpload)) {
+            // Recovering another check would leave the caller's paid reservation unexecuted.
+            if (existing && (prior.payload.reservationId !== reservationId || !matchesCheck(prior.payload, existing.reservation))) {
+                throw new ConsoleError("check_conflict");
+            }
+            completedPayload = prior.payload;
+            completionOrigin = prior.consoleOrigin;
+            uploaded = prior.uploaded ?? false;
+            const recovery = completionRecoveryDecision({ statusSucceeded: false,
+                localMismatch: prior.consoleOrigin !== new URL(config.CF_CONSOLE_URL).origin });
+            if (recovery.message)
+                throw new Error(recovery.message);
+            reservationId = prior.payload.reservationId;
+            identity = prior.payload;
+            completed = true;
+            const saved = await submit(client, prior.payload, signal);
+            uploaded = true;
+            await saveCompletion(folder, prior.payload, prior.consoleOrigin, true);
+            showSaved(saved);
+            return 0;
+        }
+        signal.throwIfAborted();
+        if (options.retryUpload)
+            throw new Error("The saved completion record is missing. Keep the local report and check the output directory.");
+        try {
+            await outputPaths(folder, ["findings.json", "summary.md"], options.outputDir);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const { source, provenance, plan, start, startMetadata } = await prepareRelayCheck(folder, { ...options, signal, expectedCommit: existing?.expectedCommit }, validated);
+        let reservation = existing?.reservation;
+        if (!reservation) {
+            const started = await client.start(start, startMetadata);
+            projectId = started.projectId;
+            signal.throwIfAborted();
+            const created = await client.create({ ...started, checkId: randomUUID(), plan });
+            reservationId = created.reservationId;
+            identity = created;
+            signal.throwIfAborted();
+            // Attestation contains no source and precedes reserve, so a bad relay never starts paid work.
+            connection = await (options.connect ?? (url => connectRelay(url, { trust: productionTrust })))(config.CF_RELAY_URL);
+            signal.throwIfAborted();
+            reservation = await client.reserve({ reservationId });
+        }
+        const activeClient = client, activeId = reservationId;
+        let lease = reservation;
+        heartbeat = setInterval(() => {
+            if (renewal)
+                return;
+            renewal = activeClient.heartbeat(activeId).then(status => {
+                if (status.state !== "reserved")
+                    throw new Error();
+                lease = status;
+            }).catch(() => { controller.abort(); }).finally(() => { renewal = undefined; });
+        }, 60000);
+        heartbeat.unref();
+        const execution = await selectAnalysisExecution(config, () => { throw new Error(); }, {
+            client: new GatekeeperClient({ mode: "production", connection: connection,
+                deadlineMs: () => Math.min(Date.parse(lease.expiresAt), lease.absoluteExpiresAt ? Date.parse(lease.absoluteExpiresAt) : Infinity), }), bundleVersion: bundle.version,
+            reservationId: activeId, reservationToken: reservation.reservationToken, instructions: { bundle, verificationKey: options.release.verificationKey }, signal,
+        });
+        options.onStart?.();
+        stderr("Reading the folder and running analysis.\n");
+        (options.setupPings ?? disabledSetupPings).ping("first_analysis_started");
+        const report = await runAnalysisToEnd(source, execution.model, settings, { execution });
+        signal.throwIfAborted();
+        const paths = await saveLocalResults(folder, report, source.skippedFiles, options.outputDir);
+        const payload = buildIntakePayload({ checkId: reservation.checkId, projectId: projectId, reservationId,
+            bundleVersion: bundle.version, relayVersion: options.release.relayVersion, counterfactLocalVersion: options.release.localVersion }, provenance, report);
+        completionOrigin = new URL(config.CF_CONSOLE_URL).origin;
+        await saveCompletion(folder, payload, completionOrigin);
+        completedPayload = payload;
+        completed = true;
+        const saved = await submit(client, payload, signal);
+        uploaded = true;
+        await saveCompletion(folder, payload, completionOrigin, true);
+        stdout(formatSummary(report));
+        stdout(`\nSaved ${paths.findingsPath}\nSaved ${paths.summaryPath}\n`);
+        showSaved(saved);
+        return 0;
+    }
+    catch (error) {
+        let status;
+        if (client && reservationId) {
+            try {
+                status = await (completed || uploaded ? client.status(reservationId) : client.fail(reservationId));
+            }
+            catch {
+                // An uncertain server outcome cannot prove a refund.
+            }
+        }
+        if (status?.uploadState === "saved" && identity && matchesCheck(status, identity)) {
+            if (completedPayload) {
+                try {
+                    await saveCompletion(folder, completedPayload, completionOrigin, true);
+                }
+                catch { /* Committed server state still survives a local write failure. */ }
+            }
+            try {
+                showSaved({ projectId: status.projectId, analysisId: status.analysisId, findingIds: status.findingIds });
+            }
+            catch { /* Output failure must not change a server outcome. */ }
+            return 0;
+        }
+        const recovery = completionRecoveryDecision({ statusSucceeded: status !== undefined, status, completedPayload });
+        if (completedPayload && recovery.finished) {
+            try {
+                await saveCompletion(folder, completedPayload, completionOrigin, false, true);
+            }
+            catch { /* Keep the pending record if the durable write cannot be confirmed. */ }
+        }
+        const known = error instanceof ConsoleError || error instanceof OutputPathError || error instanceof Error && ([cliRefusals.release_unavailable, COMMITTED_FILES_MESSAGE, RESULTS_TOO_LARGE_MESSAGE].includes(error.message)
+            || error.message.startsWith("The saved completion") || error.message === COMPLETION_SETTINGS_MISMATCH_MESSAGE);
+        const message = known ? error.message : FINISH_FAILURE_MESSAGE;
+        try {
+            options.onError?.({ code: error instanceof ConsoleError ? error.code : undefined, message });
+            stderr(`${message}\n`);
+            if (status && !(error instanceof ConsoleError && error.code === "low_balance"))
+                stderr(stateLine(status));
+        }
+        catch { /* Output failure must not change a server outcome. */ }
+        return refusalExitCode(error instanceof ConsoleError ? error.code : undefined);
+    }
+    finally {
+        clearInterval(heartbeat);
+        await renewal;
+        try {
+            connection?.close();
+        }
+        catch { /* A committed intake is already authoritative. */ }
+    }
+}

package/dist/cli/relay-preparation.js

@@ -0,0 +1,33 @@
+import { randomUUID } from "node:crypto";
+import { outsideLoadersEnabled } from "../analysis-core/settings.js";
+import { readLocalFolder } from "../adapters/files.js";
+import { snapshotProvenance } from "../adapters/snapshot.js";
+import { validateClientRelease } from "../adapters/release.js";
+import { prepareRelayPlan } from "../adapters/relay-plan.js";
+import { COMMITTED_FILES_MESSAGE } from "../contract/cli-refusals.js";
+import { repositoryFacts } from "./git.js";
+/** Absolute checkout paths stay local; repository facts own the start's commit. */
+export function buildRelayStartPayload(facts, files) {
+    const { remoteUrl, relPath, folderName, branch, commit, dirty } = facts;
+    return { execution: "local", remoteUrl, relPath, folderName, branch, commit, dirty, files };
+}
+/** Recovery can reuse signature validation without reading the folder again. */
+export async function prepareRelayCheck(folder, options, validated = validateClientRelease(options.release, options.settings)) {
+    const { bundle, tools } = validated;
+    options.signal?.throwIfAborted();
+    // Discovery must agree with Git before publishing repository-relative captures.
+    const earlyFacts = outsideLoadersEnabled(options.settings) ? await (options.facts ?? repositoryFacts)(folder) : undefined;
+    options.signal?.throwIfAborted();
+    const read = await readLocalFolder(options.settings, folder, options.trialAdmission, { captureSnapshot: true,
+        ...(earlyFacts ? { expectedRepositoryRoot: earlyFacts.repoRoot ?? null } : {}) });
+    const source = { ...read, files: Object.freeze({ ...read.files }) };
+    const provenance = await snapshotProvenance(source.sourceBase ?? folder, source.snapshot, source.sourceBase ? { selectionFolder: folder } : undefined);
+    if (options.expectedCommit !== undefined && provenance.commit !== options.expectedCommit)
+        throw new Error(COMMITTED_FILES_MESSAGE);
+    const { plan, files } = prepareRelayPlan({ bundle, tools, settings: options.settings, relayVersion: options.release.relayVersion, source });
+    options.signal?.throwIfAborted();
+    const facts = earlyFacts ?? await (options.facts ?? repositoryFacts)(folder);
+    options.signal?.throwIfAborted();
+    const startMetadata = { analysisSize: source.analysisSize, startAttempt: randomUUID() };
+    return { source, provenance, plan, start: buildRelayStartPayload(source.sourceBase ? { ...facts, relPath: "" } : facts, files), startMetadata };
+}

package/dist/cli/sign-in-input.js

@@ -0,0 +1,97 @@
+import { createInterface } from "node:readline";
+import { PassThrough } from "node:stream";
+export function terminalSignInInput(input = process.stdin, output = process.stdout) {
+    const adapter = {
+        get isTerminal() { return input.isTTY === true && output.isTTY === true; },
+        async readCode(prompt, signal) {
+            if (signal?.aborted || !adapter.isTerminal || input.destroyed || input.readableEnded || output.destroyed || output.writableEnded)
+                return undefined;
+            if (!input.setRawMode)
+                return undefined;
+            const setRawMode = input.setRawMode.bind(input);
+            return new Promise(resolve => {
+                const wasRaw = input.isRaw === true;
+                const wasFlowing = input.readableFlowing === true;
+                // Keep readline's editing and keypress listeners off stdin, with no output to echo a code.
+                const hidden = new PassThrough();
+                const lines = createInterface({ input: hidden, terminal: true, historySize: 0 });
+                let finished = false;
+                let result;
+                const cancel = () => { result = undefined; finish(); };
+                const outputFailed = () => { cancel(); complete(); };
+                const forward = (chunk) => { hidden.write(chunk); };
+                function complete() {
+                    process.removeListener("SIGINT", cancel);
+                    signal?.removeEventListener("abort", cancel);
+                    output.removeListener("error", outputFailed);
+                    output.removeListener("close", outputFailed);
+                    output.removeListener("finish", outputFailed);
+                    resolve(result);
+                }
+                function finish(code) {
+                    if (finished)
+                        return;
+                    finished = true;
+                    result = code;
+                    lines.close();
+                    lines.removeAllListeners();
+                    hidden.destroy();
+                    hidden.removeAllListeners();
+                    input.removeListener("data", forward);
+                    input.removeListener("end", cancel);
+                    input.removeListener("close", cancel);
+                    input.removeListener("error", cancel);
+                    try {
+                        if (!wasRaw)
+                            setRawMode(false);
+                    }
+                    catch {
+                        result = undefined;
+                    }
+                    if (!wasFlowing)
+                        input.pause();
+                    if (output.destroyed || output.writableEnded) {
+                        result = undefined;
+                        return;
+                    }
+                    // Keep the error handler until the write finishes: stream errors usually arrive later.
+                    try {
+                        output.write("\n", error => { if (!error)
+                            complete(); });
+                    }
+                    catch {
+                        result = undefined;
+                        complete();
+                    }
+                }
+                lines.once("line", finish);
+                lines.once("close", finish);
+                lines.once("SIGINT", cancel);
+                lines.once("SIGTSTP", cancel);
+                input.once("end", cancel);
+                input.once("close", cancel);
+                input.once("error", cancel);
+                process.once("SIGINT", cancel);
+                signal?.addEventListener("abort", cancel, { once: true });
+                output.once("error", outputFailed);
+                output.once("close", outputFailed);
+                output.once("finish", outputFailed);
+                try {
+                    if (!wasRaw)
+                        setRawMode(true);
+                    if (finished)
+                        return;
+                    output.write(prompt);
+                    if (finished)
+                        return;
+                    input.on("data", forward);
+                    input.resume();
+                }
+                catch {
+                    finish();
+                }
+            });
+        },
+    };
+    return adapter;
+}

package/dist/{sign-in.js → cli/sign-in.js}

@@ -1,5 +1,6 @@
 import { ApiError } from "./api.js";
 import { readCredentials, saveCredentials } from "./credentials.js";
+import { emailSignInMessages } from "../contract/email-sign-in-messages.js";
 async function pollSignIn(ctx, device) {
     const until = ctx.now() + device.expiresIn * 1000;
     while (ctx.now() < until) {
@@ -12,7 +13,7 @@ async function pollSignIn(ctx, device) {
         if (poll.status === "expired")
             break;
         if (poll.status === "denied")
-            throw new Error("Sign-in was cancelled. Run counterfact-labs login to try again.");
+            throw new Error(emailSignInMessages.cancelled);
     }
     throw new Error("The sign-in code expired. Run counterfact-labs login to try again.");
 }

package/dist/cli/suggested-email.js

@@ -0,0 +1,10 @@
+import { normalizeSignInEmail } from "./email-sign-in.js";
+import { userEmail } from "./git.js";
+export async function suggestedEmail(folder, readEmail = userEmail) {
+    try {
+        return normalizeSignInEmail(await readEmail(folder));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/cli/summary.js

@@ -0,0 +1,30 @@
+import { findingPresentation } from "../analysis-core/findings/presentation.js";
+export function formatSummary(report) {
+    const lines = ["# Counterfact analysis", "",
+        `${report.findings.length} findings; ${report.structures.length} structural proposals.`, ""];
+    if (!report.findings.length)
+        lines.push("No findings.", "");
+    for (const [index, finding] of report.findings.entries()) {
+        const presentation = findingPresentation(finding);
+        lines.push(`## ${index + 1}. ${presentation.displayTitle}`, "");
+        if (presentation.ifLeft)
+            lines.push(`If left: ${presentation.ifLeft}`, "");
+        lines.push(`Severity: ${finding.severity}; category: ${finding.category ?? "unclassified"}.`, "", finding.cause, "");
+        const sites = [...(finding.site ? [finding.site] : []), ...finding.otherSites];
+        if (sites.length)
+            lines.push(`Sources: ${sites.map(site => `${site.path}:${site.line ?? "?"}`).join(", ")}`, "");
+        if (finding.question)
+            lines.push(finding.question, "");
+        if (finding.fixes.length)
+            lines.push(...finding.fixes.map(fix => `- ${fix.title}`), "");
+    }
+    if (report.structures.length)
+        lines.push("## Structural proposals", "", ...report.structures.flatMap(proposal => {
+            const presentation = findingPresentation({ ...proposal, title: proposal.body.title });
+            return [presentation.ifLeft ? `- ${presentation.displayTitle}` : `- ${presentation.displayTitle}: ${proposal.body.cause}`, "",
+                ...(presentation.ifLeft ? [`If left: ${presentation.ifLeft}`, ""] : [])];
+        }));
+    if (report.warnings.length)
+        lines.push("## Reading and analysis notices", "", ...report.warnings.map(warning => `- ${warning}`), "");
+    return lines.join("\n");
+}

package/dist/contract/cli-api-messages.js

@@ -0,0 +1,5 @@
+export const cliApiMessages = Object.freeze({
+    unreachable: "Can't reach Counterfact. Try again shortly.",
+    invalid_response: "Counterfact returned an invalid response. Try again shortly.",
+    request_failed: "The request could not be completed. Try again shortly.",
+});

package/dist/contract/cli-refusals.js

@@ -0,0 +1,24 @@
+import { FOLDER_TOO_LARGE_MESSAGE } from "../analysis-core/errors.js";
+export const START_FAILURE_MESSAGE = "This couldn't start. Try again.";
+export const RESERVATION_EXPIRED_MESSAGE = "This reservation expired. Start a new analysis.";
+export const FINISH_FAILURE_MESSAGE = "The analysis couldn't finish. Try again.";
+export const RESULTS_TOO_LARGE_MESSAGE = "The results were too large to save. Try again.";
+export const COMMITTED_FILES_MESSAGE = "Counterfact analyzes the committed version of the agent's files. Commit your changes, then try again.";
+const unsupportedVersion = "This version of Counterfact can't run analyses. Update it: npm install -g @counterfact-labs/cli@latest.";
+/** Shared public refusals keep mode admission and reservation errors consistent. */
+export const cliRefusals = {
+    folder_too_large: FOLDER_TOO_LARGE_MESSAGE,
+    low_balance: "Your balance doesn't cover this analysis. Add credit at https://app.counterfactlabs.com/account?status=low_balance#balance",
+    local_checks_paused: "Analyses are paused right now. Try again later.",
+    cli_update_required: "Update Counterfact: run npm install -g @counterfact-labs/cli@latest.",
+    release_unavailable: unsupportedVersion,
+    invalid_plan: unsupportedVersion,
+    invalid_body: "Counterfact couldn't read this request. Update Counterfact, then try again.",
+    body_too_large: "This request is too large. The limit is 2 MB.",
+    free_cap_reached: "Free analyses are paused for today. Try again tomorrow, or top up to run a paid analysis.",
+    org_spend_limit: "The workspace spending limit was reached. Ask Counterfact to raise it.",
+    not_reserved: "Start a new analysis.",
+    reservation_expired: "Start a new analysis.",
+    stale_quote: START_FAILURE_MESSAGE,
+};
+export function refusalExitCode(code) { return code === "low_balance" ? 2 : 1; }

package/dist/contract/cli-version.js

@@ -0,0 +1 @@
+export const CLI_VERSION = "0.2.4";

package/dist/contract/console-url.js

@@ -0,0 +1,8 @@
+export function savedAnalysisUrl(projectId, consoleOrigin) {
+    return new URL(`/projects/${projectId}/findings`, consoleOrigin).href;
+}
+import { isLoopbackHost } from "../gatekeeper/loopback.js";
+/** Bearer credentials may use plain HTTP only on this machine. */
+export function consoleSchemeAllowed(url) {
+    return url.protocol === "https:" || url.protocol === "http:" && isLoopbackHost(url.hostname);
+}

package/dist/contract/console.js

@@ -0,0 +1,131 @@
+import { z } from "zod";
+import { fixDeltaSchema, fixFactsSchema } from "../analysis-core/data/finding-types.js";
+import { inspectFixSchema, otherSiteSchema, rawFindingSchema } from "../analysis-core/analysis/schemas.js";
+import { sourceNotesSchema } from "../analysis-core/analysis/source-notes/types.js";
+import { parseAnalysisSize } from "../analysis-core/conventions/analysis-fit.js";
+export const id = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
+const uuid = z.uuid().transform(value => value.toLowerCase());
+const money = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const count = (max) => z.number().int().positive().max(max);
+// These data-only boundaries follow the SaaS local start, reservation and findings owners; see docs/provenance.md.
+export const LOCAL_START_EXECUTION_HEADER = { name: "x-counterfact-execution", value: "local" };
+export const LOCAL_START_BODY_LIMIT = 2 * 1024 * 1024;
+export const ANALYSIS_SIZE_HEADER = "x-counterfact-analysis-size";
+export const START_ATTEMPT_HEADER = "x-counterfact-start-attempt";
+export const ANALYSIS_SIZE_HEADER_LIMIT = 256;
+/** Additive headers let older consoles keep accepting the unchanged, strict start body. */
+export function serializeLocalStartMetadata(metadata) {
+    const size = JSON.stringify(parseAnalysisSize(metadata.analysisSize));
+    if (Buffer.byteLength(size, "utf8") > ANALYSIS_SIZE_HEADER_LIMIT)
+        throw new Error("Invalid analysis size header");
+    return { [ANALYSIS_SIZE_HEADER]: size, [START_ATTEMPT_HEADER]: uuid.parse(metadata.startAttempt) };
+}
+/** Missing measurements preserve old clients; present measurements must be complete. */
+export function parseLocalStartMetadata(headers) {
+    const raw = headers.get(ANALYSIS_SIZE_HEADER);
+    if (raw === null)
+        return undefined;
+    if (Buffer.byteLength(raw, "utf8") > ANALYSIS_SIZE_HEADER_LIMIT)
+        throw new Error("Invalid analysis size header");
+    return { analysisSize: parseAnalysisSize(JSON.parse(raw)), startAttempt: uuid.parse(headers.get(START_ATTEMPT_HEADER)) };
+}
+const localStartPath = z.string().min(1).max(4096).refine(value => !value.includes("\\") && !value.includes("\0") && !value.startsWith("/")
+    && value.split("/").every(part => part !== ".." && part !== "." && part !== ""));
+export const localStartRequestSchema = z.strictObject({
+    execution: z.literal("local"), remoteUrl: z.string().max(4096).nullable(), relPath: z.string().max(4096),
+    folderName: z.string().trim().min(1).max(255), branch: z.string().max(4096).nullable().optional(),
+    commit: z.string().max(4096).nullable().optional(), dirty: z.boolean().nullable().optional(),
+    files: z.array(z.strictObject({ path: localStartPath, size: money })).min(1)
+        .refine(files => new Set(files.map(file => file.path)).size === files.length),
+});
+export const localStartResponseSchema = z.strictObject({ jobId: uuid, projectId: uuid });
+export const relayPlanSchema = z.strictObject({
+    bundleVersion: id, bundleHash: z.string().regex(/^[a-f0-9]{64}$/), relayVersion: id,
+    calls: z.array(z.strictObject({ routeId: id, model: id, calls: count(512), maxInputBytes: count(800_000),
+        maxInputTokens: count(200_000), maxOutputTokens: count(64_000) })).min(1).max(64)
+        .refine(calls => new Set(calls.map(call => call.routeId)).size === calls.length && calls.reduce((sum, call) => sum + call.calls, 0) <= 512),
+});
+export const cliRelayReservationRequestSchema = z.discriminatedUnion("action", [
+    z.strictObject({ action: z.literal("create"), jobId: uuid, checkId: uuid, projectId: uuid, plan: relayPlanSchema }),
+    z.strictObject({ action: z.literal("reserve"), reservationId: uuid }),
+    z.strictObject({ action: z.literal("status"), reservationId: uuid }),
+    z.strictObject({ action: z.literal("heartbeat"), reservationId: uuid }),
+    z.strictObject({ action: z.literal("fail"), reservationId: uuid }),
+]);
+export const consoleCreatedSchema = z.strictObject({ reservationId: uuid, jobId: uuid, projectId: uuid, checkId: uuid, state: z.literal("quoted") });
+export const consoleStatusSchema = z.strictObject({
+    reservationId: uuid, checkId: uuid, projectId: uuid,
+    state: z.enum(["quoted", "reserved", "closing", "closed", "expired"]),
+    settlement: z.enum(["unheld", "held", "charged", "released"]),
+    reason: z.enum(["service_failure", "required_failure", "authorization_refused", "our_deadline_failure",
+        "findings_saved", "required_delivered", "no_required_delivery"]).nullable(),
+    uploadState: z.enum(["saved", "missing"]), analysisId: uuid.optional(), findingIds: z.array(uuid).max(20_000).optional(),
+    quoteId: z.string().min(1).max(256).optional(), priceMicro: money.nullable(), providerBudgetMicro: money,
+    expiresAt: z.iso.datetime(), absoluteExpiresAt: z.iso.datetime().nullable(),
+    deadlineClassification: z.enum(["caller_timeout", "our_deadline_failure"]).nullable(),
+}).refine(value => value.uploadState === "saved"
+    ? value.analysisId !== undefined && value.findingIds !== undefined
+    : value.analysisId === undefined && value.findingIds === undefined);
+export const consoleReservationSchema = consoleStatusSchema.safeExtend({ reservationToken: z.string().min(1).max(256),
+    quoteId: z.string().min(1).max(256) });
+export const consoleIntakeResultSchema = z.strictObject({
+    checkId: uuid, projectId: uuid, analysisId: uuid, findingIds: z.array(uuid).max(20_000),
+    settlement: z.enum(["unheld", "held", "charged", "released"]).optional(),
+});
+export const LOCAL_FINDINGS_BODY_LIMIT = 2 * 1024 * 1024;
+export const LOCAL_FINDINGS_QUOTE_LIMIT = 2000;
+export const LOCAL_FINDINGS_TEXT_LIMIT = 4096;
+function shortFindingFields(value) {
+    if (typeof value === "string")
+        return Buffer.byteLength(value, "utf8") <= LOCAL_FINDINGS_TEXT_LIMIT;
+    return value === null || typeof value !== "object" || Object.values(value).every(shortFindingFields);
+}
+function validIntakeText(value) {
+    if (typeof value === "string")
+        return !value.includes(String.fromCharCode(0)) && !/[\uD800-\uDFFF]/u.test(value);
+    return value === null || typeof value !== "object" || Object.values(value).every(validIntakeText);
+}
+const quote = z.string().refine(value => Buffer.byteLength(value, "utf8") <= LOCAL_FINDINGS_QUOTE_LIMIT);
+const text = z.string().min(1).refine(value => value.trim().length > 0);
+const delta = fixDeltaSchema.extend({
+    nodes: z.array(fixDeltaSchema.shape.nodes.element.strict()),
+    edges: z.array(fixDeltaSchema.shape.edges.element.strict()),
+}).strict();
+const fix = inspectFixSchema.extend({
+    ...fixFactsSchema.shape,
+    targetFiles: z.array(inspectFixSchema.shape.targetFiles.element.strict()),
+    delta: delta.nullable(),
+}).strict();
+const notes = sourceNotesSchema.extend({
+    sites: z.array(sourceNotesSchema.shape.sites.element.extend({ keyPhrase: quote }).strict()),
+    counterEvidence: z.array(sourceNotesSchema.shape.counterEvidence.element.extend({ excerpt: quote }).strict()),
+}).strict();
+const finding = rawFindingSchema.extend({
+    summary: z.string().nullable(),
+    category: rawFindingSchema.shape.category.removeCatch(),
+    question: rawFindingSchema.shape.question.removeCatch().nullable(),
+    siteRepo: text.nullable(),
+    site: rawFindingSchema.shape.site.unwrap().strict().nullable(),
+    excerpt: quote.nullable(),
+    otherSites: z.array(otherSiteSchema.extend({ repo: text, excerpt: otherSiteSchema.shape.excerpt.pipe(quote) }).strict()),
+    fixes: z.array(fix).min(1),
+    sourceNotes: notes.nullable().optional(),
+}).strict().refine(shortFindingFields);
+const payload = z.strictObject({
+    checkId: z.uuid(), projectId: z.uuid(), reservationId: uuid.optional(),
+    agent: z.strictObject({
+        repository: text.max(4096), commit: z.string().regex(/^(?:[a-f\d]{40}|[a-f\d]{64})$/i),
+        files: z.array(z.strictObject({ path: text.max(4096), hash: z.string().regex(/^[a-f\d]{64}$/i) })).min(1),
+    }),
+    findings: z.array(finding), bundleVersion: text.max(128), relayVersion: text.max(128), counterfactLocalVersion: text.max(128),
+}).refine(validIntakeText);
+// Original JSON size is checked before a shared schema can trim text or apply defaults.
+export const localFindingsPayloadSchema = z.unknown().refine(value => {
+    try {
+        const json = JSON.stringify(value);
+        return typeof json === "string" && Buffer.byteLength(json, "utf8") <= LOCAL_FINDINGS_BODY_LIMIT;
+    }
+    catch {
+        return false;
+    }
+}).pipe(payload);

package/dist/contract/email-sign-in-messages.js

@@ -0,0 +1,18 @@
+import { cliApiMessages } from "./cli-api-messages.js";
+const rateLimited = "Too many sign-in requests. Try again later.";
+export const emailSignInMessages = Object.freeze({
+    invalid_email: "Enter a valid email address.",
+    invalid_code: "Enter the code from your email.",
+    wrong_code: "That code didn't work. Try the code from your email again.",
+    expired: "That code expired. Request a new sign-in code.",
+    too_many_attempts: "Too many incorrect codes. Request a new sign-in code.",
+    rate_limited: rateLimited,
+    rate_limited_with_cooldown: (seconds) => seconds === 0 ? rateLimited
+        : `Too many sign-in requests. Try again in ${seconds} ${seconds === 1 ? "second" : "seconds"}.`,
+    email_unavailable: "Email sign-in isn't available. Use browser sign-in instead.",
+    browser_sign_in_pending: "A browser sign-in is still in progress. Finish it before starting email sign-in.",
+    unreachable: cliApiMessages.unreachable,
+    invalid_response: cliApiMessages.invalid_response,
+    request_failed: cliApiMessages.request_failed,
+    cancelled: "Sign-in was cancelled. Run counterfact-labs login to try again.",
+});