@counterfact-labs/cli 0.2.3 → 0.2.5

package/README.md

@@ -16,6 +16,7 @@ Use Node.js 22 or later and install the pinned dependencies:
 
 ```bash
 npm ci
+npm run build:core
 ```
 
 Set `ANTHROPIC_API_KEY` in your shell to your Anthropic development key, then run these commands from this checkout:
@@ -141,8 +142,9 @@ or add both to the sandbox's allowed domains.
 The command uses the existing saved sign-in and sends `X-Counterfact-CLI-Version: 0.2.0`. It asks
 `/api/cli/checks/mode` before reading source or starting paid work. Upload, paused, update-required and unavailable
 responses stop the analysis; the command never falls back to uploading files. Settings are captured at command start.
-The analysis uses a committed Git folder. Admitted files must match that commit; unrelated local output files are ignored.
+An analysis reads the agent's files as they are on disk, including uncommitted changes, and also works in folders without Git.
 The console owns prices, expressed in millionths of a dollar.
+By default, the CLI adds .counterfact/ to the folder's .gitignore when Git doesn't already ignore it. Set CF_LOCAL_GITIGNORE_OUTPUT=0 to turn this off.
 
 The installed command uses the relay address in `bundle/client-release.json` and saved sign-in. The relay runner sends
 repository facts and the admitted file list (paths and sizes, without contents or absolute checkout paths) to
@@ -154,6 +156,10 @@ Release stays blocked while `relayUrl` and `projectContext` are unconfigured in
 `projectContext` to `checks` only after local start support is reviewed. The release validator requires both settings
 along with the signed bundle and trust pins; an environment override cannot bypass the project-context pin.
 
+## Relay privacy
+
+The sealed relay's source is public at [github.com/counterfact-labs/sealed-relay](https://github.com/counterfact-labs/sealed-relay), with a reproducible build of its JavaScript, and the CLI checks the relay's attestation against a pinned image digest before sending it any analysis input.
+
 ## Build and release the customer CLI archive
 
 Generate `bundle/sealed.json` with the existing release tooling and externally supplied release keys. Install the

package/bundle/client-release.json

@@ -1,7 +1,7 @@
 {
   "verificationKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAbBab1PYdmBKXxCvoJ47toJhQvxPevo9nlZnb0zbDWoc=\n-----END PUBLIC KEY-----\n",
   "relayVersion": "relay-1.0.1",
-  "localVersion": "0.2.3",
+  "localVersion": "0.2.5",
   "relayUrl": "https://relay.counterfactlabs.com:8443",
   "projectContext": "checks"
 }

package/dist/adapters/anthropic.js

@@ -5,6 +5,7 @@ import { estimateTokensFromBytes } from "../analysis-core/llm/cost.js";
 import { anthropicStructuredLimit, supportsReasoningControls } from "../analysis-core/llm/output-limit.js";
 import { requestCachesInput, structuredPromptOf } from "./prompt-cache.js";
 import { StructuredOutputError } from "../analysis-core/llm/structured-output-error.js";
+import { THINKING_MODES } from "../analysis-core/llm/types.js";
 export function anthropicLlm(settings, opts = {}) {
     const client = opts.client ?? new Anthropic({ ...(opts.apiKey === undefined ? {} : { apiKey: opts.apiKey }) });
     return { structured: call => structuredCall(settings, client, call, opts.onUsage, opts.sourceRetries) };
@@ -19,6 +20,10 @@ export function anthropicCaptureBackend(client = new Anthropic({ maxRetries: 0 }
 function canceled() {
     return new JobError("canceled", "The model call was canceled.");
 }
+export class ProviderRequestRefused extends Error {
+    name = "ProviderRequestRefused";
+    constructor() { super("Invalid model request"); }
+}
 export class ProviderCallError extends JobError {
     payment;
     constructor(code, message, retryable, payment) {
@@ -34,6 +39,10 @@ function providerFailure(error, signal) {
         return new ProviderCallError("rate_limited", "The model provider is busy. Wait a minute and try again.", true, "unpaid");
     }
     if (error instanceof Anthropic.APIConnectionError) {
+        // The guard rejects before network access, so no provider work can have been paid.
+        if (error.cause instanceof ProviderRequestRefused) {
+            return new ProviderCallError("llm", "Invalid model request", false, "unpaid");
+        }
         return new ProviderCallError("llm", "The model could not be reached. Try again.", true, "unknown");
     }
     const directive = error instanceof Anthropic.APIError ? error.headers?.get("x-should-retry") : undefined;
@@ -66,13 +75,13 @@ function providerRequest(settings, call) {
     const streamed = supportsReasoningControls(call.model);
     const params = {
         model: call.model, max_tokens: anthropicStructuredLimit(call),
-        ...(streamed ? { thinking: { type: call.thinking ?? "adaptive" } } : {}),
+        ...(streamed ? { thinking: { type: call.thinking ?? THINKING_MODES.adaptive } } : {}),
         ...(call.system ? { system: call.system } : {}),
         messages: [{ role: "user", content: structuredPromptOf(settings, call) }],
         output_config: {
             // SDK stream parsing can throw before returning usage for incomplete JSON.
             format: { type: format.type, schema: format.schema },
-            ...(call.effort && streamed && call.thinking !== "disabled" ? { effort: call.effort } : {}),
+            ...(call.effort && streamed && call.thinking !== THINKING_MODES.disabled ? { effort: call.effort } : {}),
         },
     };
     return { params, format, streamed };

package/dist/adapters/completion.js

@@ -104,6 +104,9 @@ export async function loadCompletion(folder) {
             return null;
         throw new Error(INVALID_COMPLETION_MESSAGE);
     }
+    // Released folder-local records always had a Git commit; hashes alone cannot establish their provenance.
+    if (legacy.payload.agent.commit === null)
+        return null;
     if (!await matchesSnapshotProvenance(folder, legacy.payload.agent))
         throw new Error(INVALID_COMPLETION_MESSAGE);
     // Attempt imported recovery once automatically; uncertain legacy data must not block later analyses.

package/dist/adapters/durable-write.js

@@ -1,14 +1,20 @@
 import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
-import { open, rename, rm } from "node:fs/promises";
+import { chmod, mkdir, open, rename, rm } from "node:fs/promises";
 import { dirname } from "node:path";
+export async function preparePrivateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    await chmod(path, 0o700);
+}
 export async function durableWrite(path, bytes) {
     const temporary = `${path}.${randomUUID()}.tmp`;
+    let created = false;
     const permission = process.permission !== undefined;
     // The permission model disables fsync, so sync data on each write and skip the unavailable directory sync.
     const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | (permission ? constants.O_DSYNC : 0);
     try {
         const file = await open(temporary, flags, 0o600);
+        created = true;
         try {
             await file.writeFile(bytes);
             if (!permission)
@@ -29,6 +35,7 @@ export async function durableWrite(path, bytes) {
         }
     }
     finally {
-        await rm(temporary, { force: true });
+        if (created)
+            await rm(temporary, { force: true });
     }
 }

package/dist/adapters/files.js

@@ -1,6 +1,7 @@
 import { opendir, realpath, stat, readFile } from "node:fs/promises";
 import { dirname, join, posix } from "node:path";
-import { admitFile, fileRefusalWarning, localSymlinkGuardEnabled, respectGitignore, readRepoFile, resolveLocalExclusions } from "../analysis-core/conventions/file-admission.js";
+import { admitFile, FileReadRefusal, fileRefusalWarning, localSymlinkGuardEnabled, respectGitignore, readRepoFile, resolveLocalExclusions } from "../analysis-core/conventions/file-admission.js";
+import { assessAnalysisSize, measureAnalysisSize } from "../analysis-core/conventions/analysis-fit.js";
 import { localRepoKeyFor } from "../analysis-core/github/repo-key.js";
 import { fetchLocalSources } from "../analysis-core/index.js";
 import { repoPathFrom } from "../analysis-core/import/outside-loader-sources.js";
@@ -33,12 +34,15 @@ export async function readLocalFolder(settings, folder, admission = {}, options
         }
     });
     const targets = new Map();
-    const snapshot = {};
+    const snapshot = Object.create(null);
+    const snapshotTargets = new Map();
     let visited = 0;
     const targetOf = async (path, purpose, directory = false) => {
         const target = await realpath(join(root, path));
         const result = admitFile(settings, { path, directory }, { purpose, route: "local-folder", ...admission, localTarget: { root, path: target, excludedTargets } });
         if (!result.admitted) {
+            if (purpose === "proposal")
+                throw new FileReadRefusal(result.reason, path);
             refused.push({ path, reason: result.reason });
             if (result.reason === "secret" || result.reason === "out-of-scope")
                 warnings.push({ path, reason: result.reason });
@@ -49,6 +53,8 @@ export async function readLocalFolder(settings, folder, admission = {}, options
         const allowed = admitFile(settings, { path, directory }, { purpose, route: "local-folder", ...admission,
             gitIgnored, localTarget: { root, path: target, parent, excludedTargets } });
         if (!allowed.admitted) {
+            if (purpose === "proposal")
+                throw new FileReadRefusal(allowed.reason, path);
             if (directory)
                 gitSkipped.push(...await ignoredFiles(join(root, path), path));
             else
@@ -117,23 +123,33 @@ export async function readLocalFolder(settings, folder, admission = {}, options
         await walk(root, "", new Set());
     else
         gitSkipped.push(...await ignoredFiles(root, ""));
+    const analysisSize = measureAnalysisSize(settings, entries, admission);
+    // The service makes the final decision; local prediction never changes retained files.
+    const analysisFit = settings.CF_REFUSE_TOO_LARGE === "0" ? undefined : assessAnalysisSize(analysisSize);
     const listing = new Set(entries.map(entry => entry.path));
     const repoKey = localRepoKeyFor(root);
     const repository = createRepositoryFiles(settings, root, admission, options);
-    const discovered = await fetchLocalSources(settings, { repoKey, entries, admission, repository, read: async (entry) => {
-            const target = guarded ? await targetOf(entry.path, "override") : targets.get(entry.path);
-            return target ? readRepoFile(settings, entry, async () => {
-                if (!options.captureSnapshot)
-                    return readFile(target, "utf8");
-                const bytes = snapshot[entry.path] ?? await readFile(target);
-                snapshot[entry.path] = bytes;
-                return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-            }, { ...admission, listing, route: "local-folder", localTarget: { root, path: target, excludedTargets } }) : null;
-        } });
+    const read = async (entry, purpose) => {
+        const target = guarded || purpose === "proposal" ? await targetOf(entry.path, purpose) : targets.get(entry.path);
+        return target ? readRepoFile(settings, entry, async () => {
+            if (!options.captureSnapshot)
+                return readFile(target, "utf8");
+            const cached = purpose !== "proposal" || snapshotTargets.get(entry.path) === target ? snapshot[entry.path] : undefined;
+            const bytes = cached ?? await readFile(target);
+            snapshot[entry.path] = bytes;
+            snapshotTargets.set(entry.path, target);
+            return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        }, { ...admission, listing, route: "local-folder", localTarget: { root, path: target, excludedTargets } }) : null;
+    };
+    const discovered = await fetchLocalSources(settings, { repoKey, entries, admission, repository,
+        proposal: options.proposal, proposalRefusals: [...gitSkipped, ...refused],
+        read: entry => read(entry, "override"), proposalRead: entry => read(entry, "proposal"),
+    });
     const expanded = discovered.root !== undefined;
     const ignored = mergeSkippedFiles(expanded ? gitSkipped.map(file => ({ ...file, path: repoPathFrom(file.path, discovered.root) })) : gitSkipped, repository.skippedFiles.map(file => ({ ...file, path: expanded ? file.path : posix.relative(repository.selectedRoot ?? "", file.path) })));
     const captured = { ...Object.fromEntries(Object.entries(snapshot).map(([path, bytes]) => [repoPathFrom(path, discovered.root), bytes])), ...repository.snapshot };
-    return { repoKey, files: discovered.files, ...(expanded ? { root: discovered.root, sourceBase: repository.sourceBase } : {}),
+    return { repoKey, ...(discovered.agentChoice ? { agentChoice: discovered.agentChoice } : {}), files: discovered.files, analysisSize, ...(analysisFit ? { analysisFit } : {}), ...(expanded ? { root: discovered.root, sourceBase: repository.sourceBase } : {}),
+        ...(discovered.proposalCounts ? { proposalCounts: discovered.proposalCounts } : {}),
         ...(options.captureSnapshot ? { snapshot: Object.fromEntries(Object.keys(discovered.files).map(path => [path, captured[path]])) } : {}), fragment: discovered.fragment, selection: discovered.selection,
         skippedFiles: mergeSkippedFiles(discovered.skippedFiles, ignored, expanded ? refused.map(file => ({ ...file, path: repoPathFrom(file.path, discovered.root) })) : refused),
         warnings: [...new Set(mergeUnlistedFileWarnings([...warnings.map(file => fileRefusalWarning(repoPathFrom(file.path, discovered.root), file.reason)), ...discovered.warnings], ignored.length))] };

package/dist/adapters/git-ignore.js

@@ -2,21 +2,28 @@ import { isAbsolute, relative, resolve, sep } from "node:path";
 import { mapLimit } from "../analysis-core/map-limit.js";
 import { respectGitignore } from "../analysis-core/conventions/file-admission.js";
 import { runGit } from "./git.js";
-import { gitRepositoryRoot, searchBaseMatches, searchBoundary } from "./repository-root.js";
+import { gitRepositoryRoot } from "./repository-root.js";
 /** Query path facts only; admission owns whether an ignored path can be read. */
 export function createGitIgnore(settings, folder) {
+    const query = createGitIgnoreQuery(folder);
+    return (paths) => respectGitignore(settings) ? query(paths) : Promise.resolve(undefined);
+}
+export function createGitIgnoreQuery(folder) {
+    const query = createGitIgnoreFactsQuery(folder);
+    return async (paths) => {
+        const facts = await query(paths);
+        return facts && new Set([...facts].filter(([, fact]) => fact === "ignored").map(([path]) => path));
+    };
+}
+/** Git supplies the last matching rule, including a deliberate negation. */
+export function createGitIgnoreFactsQuery(folder) {
     const cache = new Map();
     let root;
     return async (paths) => {
-        if (!respectGitignore(settings))
-            return undefined;
         if (!paths.length)
-            return new Set();
-        const base = await (root ??= (async () => {
-            const [boundary, reported] = await Promise.all([searchBoundary(folder),
-                gitRepositoryRoot(async (args) => (await runGit(folder, args)).toString("utf8"))]);
-            return boundary && await searchBaseMatches(boundary.base, reported) ? boundary.base : null;
-        })());
+            return new Map();
+        // Git's root owns ignore rules even when discovery stops at a different marker.
+        const base = await (root ??= gitRepositoryRoot(async (args) => (await runGit(folder, args)).toString("utf8"), folder));
         if (!base)
             return undefined;
         const candidates = paths.filter(path => {
@@ -30,20 +37,27 @@ export function createGitIgnore(settings, folder) {
             const input = Buffer.from(batch.map(path => resolve(folder, path)).join("\0") + "\0");
             let output;
             try {
-                output = await runGit(folder, ["check-ignore", "-z", "--stdin"], { userConfig: true, input, maxBuffer: input.length + 1024 });
+                output = await runGit(folder, ["check-ignore", "--verbose", "-z", "--stdin"], { userConfig: true, input, maxBuffer: input.length + 1024 * 1024 });
             }
             catch (error) {
                 if (error.code === 1) {
                     for (const path of batch)
-                        cache.set(path, false);
+                        cache.set(path, null);
                     return;
                 }
                 throw error;
             }
-            const matches = new Set(output.toString("utf8").split("\0"));
+            const fields = output.toString("utf8").split("\0");
+            const matches = new Map();
+            for (let index = 0; index + 3 < fields.length; index += 4) {
+                matches.set(fields[index + 3], fields[index + 2].startsWith("!") ? "included" : "ignored");
+            }
             for (const path of batch)
-                cache.set(path, matches.has(path));
+                cache.set(path, matches.get(path) ?? null);
         });
-        return new Set(candidates.filter(path => cache.get(resolve(folder, path))));
+        return new Map(candidates.flatMap(path => {
+            const fact = cache.get(resolve(folder, path));
+            return fact ? [[path, fact]] : [];
+        }));
     };
 }

package/dist/adapters/git.js

@@ -8,7 +8,7 @@ export async function runGit(folder, args, options = {}) {
             "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", "-c", "core.sshCommand=",
             "-c", "protocol.ext.allow=never", "-c", "diff.external=", "-c", "core.attributesFile=/dev/null",
             ...overrides, "-C", folder, ...command], {
-            encoding: "buffer", timeout: options.timeout ?? 3000, maxBuffer,
+            encoding: "buffer", timeout: options.timeout ?? 3000, maxBuffer, signal: options.signal,
             env: { ...env, GIT_ATTR_NOSYSTEM: "1", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1",
                 GIT_CONFIG_GLOBAL: options.userConfig ? process.env.GIT_CONFIG_GLOBAL : "/dev/null", GIT_PAGER: "cat" },
         });

package/dist/adapters/gitignore-output.js

@@ -0,0 +1,41 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { createGitIgnoreFactsQuery } from "./git-ignore.js";
+import { runGit } from "./git.js";
+import { analysisReadRoots, gitRepositoryRoot } from "./repository-root.js";
+import { DEFAULT_OUTPUT_DIR, outputPaths } from "./output-paths.js";
+const ignoreRule = `${DEFAULT_OUTPUT_DIR}/`;
+export const GITIGNORE_OUTPUT_NOTICE = `Added ${ignoreRule} to .gitignore, so the local report stays out of Git.\n`;
+export const gitignoreOutputEnabled = (settings = process.env) => settings.CF_LOCAL_GITIGNORE_OUTPUT !== "0";
+/** Keep local excerpts out of Git after a successful default report write. */
+export async function ignoreDefaultOutput(folder, outputDir, options = {}) {
+    if (outputDir !== undefined || !gitignoreOutputEnabled(options.settings))
+        return false;
+    try {
+        // Automatic edits need confirmed checkout boundaries even when ignore reads can trust Git alone.
+        const reported = await gitRepositoryRoot(async (args) => (await runGit(folder, args)).toString("utf8"), folder);
+        if (!(await analysisReadRoots(folder, reported)).repository)
+            return false;
+        const facts = await createGitIgnoreFactsQuery(folder)([ignoreRule]);
+        if (!facts || facts.has(ignoreRule))
+            return false;
+        // Appending preserves existing rules, and refusing links keeps this write in the selected folder.
+        const [path] = await outputPaths(folder, [".gitignore"], folder);
+        const file = await open(path, constants.O_RDWR | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o644);
+        try {
+            const info = await file.stat();
+            if (!info.isFile())
+                return false;
+            const last = Buffer.alloc(1);
+            if (info.size)
+                await file.read(last, 0, 1, info.size - 1);
+            await file.writeFile(`${info.size && last[0] !== 10 ? "\n" : ""}${ignoreRule}\n`);
+        }
+        finally {
+            await file.close();
+        }
+        return true;
+    }
+    catch { /* Report delivery must survive an unavailable Git command or ignore file. */ }
+    return false;
+}

package/dist/adapters/models.js

@@ -1,6 +1,4 @@
 import { executeStructuredRequest } from "../analysis-core/llm/execution.js";
-import { findingHeadlinesEnabled } from "../analysis-core/settings.js";
-import { headlineRequest } from "../analysis-core/analysis/headlines/input.js";
 import { retryCalls } from "../analysis-core/llm/slots.js";
 import { relayModel, ModelConfigurationError } from "../gatekeeper/model.js";
 import { readableRequestTools, readableInstructions } from "./instructions.js";
@@ -42,10 +40,7 @@ export async function selectAnalysisExecution(transport, source, relay) {
     return { model: relayModel({ ...relay, bundleVersion: requestTools.bundleVersion }), requestTools,
         instructions: async () => { throw new Error("Readable instructions are unavailable in relay mode"); } };
 }
-export async function analysisExecution(model, options = {}, settings = {}) {
+export async function analysisExecution(model, options = {}) {
     const execution = options.execution ?? await selectAnalysisExecution(options.transport ?? {}, () => "execute" in model ? model : localModel(model), options.relay);
-    // Validate enabled result support before earlier stages can spend, even for supplied executions.
-    if (findingHeadlinesEnabled(settings))
-        execution.requestTools.headlinePlan(headlineRequest([]));
     return execution;
 }

package/dist/adapters/output-paths.js

@@ -1,8 +1,9 @@
-import { lstat, mkdir, realpath } from "node:fs/promises";
+import { chmod, lstat, mkdir, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { FINISH_FAILURE_MESSAGE } from "../contract/cli-refusals.js";
 import { resolveFolderPath } from "./folder-path.js";
 import { durableWrite } from "./durable-write.js";
+export const DEFAULT_OUTPUT_DIR = ".counterfact";
 export class OutputPathError extends Error {
     constructor() {
         super(FINISH_FAILURE_MESSAGE);
@@ -16,7 +17,7 @@ const within = (base, path) => {
 /** Validate the selected anchor and every output component before creating or replacing files. */
 export async function outputPaths(folder, names, outputDir, create = false) {
     const selected = resolve(folder), root = await resolveFolderPath(folder);
-    const requested = resolve(outputDir ?? join(selected, ".counterfact"));
+    const requested = resolve(outputDir ?? join(selected, DEFAULT_OUTPUT_DIR));
     let directory = within(selected, requested) ? resolve(root, relative(selected, requested)) : requested;
     const external = !within(root, directory);
     const userUid = process.getuid?.();
@@ -84,6 +85,8 @@ export async function outputPaths(folder, names, outputDir, create = false) {
 export async function writeOutputFiles(folder, files, outputDir) {
     const names = Object.keys(files);
     const paths = await outputPaths(folder, names, outputDir, true);
+    if (paths.length)
+        await chmod(dirname(paths[0]), 0o700);
     for (let index = 0; index < paths.length; index++) {
         await outputPaths(folder, names, outputDir);
         await durableWrite(paths[index], files[names[index]]);

package/dist/adapters/public-instructions.js

@@ -13,7 +13,7 @@ export function loadPublicRequestTools(value, verificationKey, settings = {}) {
     const renderingUnavailable = () => { throw new Error("Instruction rendering requires the sealed relay"); };
     if (findingHeadlinesEnabled(settings) && bundle.metadata.headlinePlan?.resultVersion !== HEADLINE_RESULT_VERSION)
         renderingUnavailable();
-    return { ...versions, bundleVersion: bundle.version, modelReaderPrompt: renderingUnavailable, callInputBytes, checkDiagnosticsText,
+    return { ...versions, bundleVersion: bundle.version, answerFormats: bundle.answerFormats, modelReaderPrompt: renderingUnavailable, callInputBytes, checkDiagnosticsText,
         buildAnalysisCall: renderingUnavailable,
         headlinePlan(request) {
             const plan = bundle.metadata.headlinePlan;

package/dist/adapters/relay-plan.js

@@ -1,15 +1,12 @@
-import { sealedBundleHash } from "../bundle/seal/signature.js";
+import { bundleContentHash } from "../bundle/seal/signature.js";
 import { checkPlannedCallsAgainstBundle } from "../bundle/seal/planned-calls.js";
-import { localCallPlan } from "../analysis-core/requests/local-plan.js";
+import { localSourcePlan } from "../analysis-core/requests/local-plan.js";
 import { relayPlanSchema } from "../contract/console.js";
 /** Callers authenticate the release before reading files; only this owner turns source facts into a paid plan. */
 export function prepareRelayPlan({ bundle, tools, relayVersion, settings, source }) {
-    const files = Object.entries(source.files).map(([path, text]) => ({ path, size: Buffer.byteLength(text) }));
-    const calls = localCallPlan(settings, files, {
-        structureState: { repos: [{ key: source.repoKey, kind: "fs", files: source.files, ...(source.root !== undefined ? { root: source.root } : {}) }], mapped: [source.fragment] },
-    });
+    const { files, calls } = localSourcePlan(settings, source);
     checkPlannedCallsAgainstBundle(bundle, calls);
     return { files, plan: relayPlanSchema.parse({ bundleVersion: tools.bundleVersion,
-            bundleHash: sealedBundleHash(bundle), relayVersion,
+            bundleHash: bundleContentHash(bundle.sealed), relayVersion,
             calls: calls.map(({ routeId, model, calls, maxInputBytes, maxInputTokens, maxOutputTokens }) => ({ routeId, model, calls, maxInputBytes, maxInputTokens, maxOutputTokens })) }) };
 }

package/dist/adapters/release.js

@@ -1,4 +1,5 @@
 import { createHash, createPublicKey } from "node:crypto";
+import { fileURLToPath } from "node:url";
 import { readFile } from "node:fs/promises";
 import { sealedBundle } from "../contract/messages.js";
 import { loadPublicRequestTools } from "./public-instructions.js";
@@ -6,6 +7,7 @@ import { relayOrigin } from "../gatekeeper/connection.js";
 import { z } from "zod";
 import { cliRefusals } from "../contract/cli-refusals.js";
 import { RELEASE_KEY_SPKI_SHA256 } from "../contract/release-key.js";
+import { findingAudienceSettings } from "../analysis-core/analysis/finding-audience-switch.js";
 const releasePins = z.object({ verificationKey: z.string().min(1), relayVersion: z.string().min(1), localVersion: z.string().min(1),
     relayUrl: z.string().min(1), projectContext: z.literal("checks") });
 export function readClientReleasePins(value) {
@@ -19,7 +21,7 @@ export function validateClientRelease(release, settings = {}) {
     const tools = loadPublicRequestTools(bundle, release.verificationKey, settings);
     if (!bundle.relayVersions.includes(release.relayVersion))
         throw new Error();
-    return { bundle, tools };
+    return { bundle, tools, settings: findingAudienceSettings(settings, bundle) };
 }
 export function readClientReleaseKey(pem) {
     const key = createPublicKey(pem);
@@ -28,6 +30,10 @@ export function readClientReleaseKey(pem) {
         throw new Error(cliRefusals.release_unavailable);
     return key;
 }
+export function installedReleasePaths() {
+    const base = new URL(import.meta.url.endsWith(".ts") ? "../bundle/" : "../../bundle/", import.meta.url);
+    return { bundle: fileURLToPath(new URL("sealed.json", base)), metadata: fileURLToPath(new URL("client-release.json", base)) };
+}
 /** Installed releases always use the separately reviewed signing key. */
 export function loadInstalledRelease(paths) {
     return loadRelease(paths, false);
@@ -38,14 +44,14 @@ export function loadDevelopmentRelease(paths) {
 }
 async function loadRelease(paths, development) {
     try {
-        const base = new URL(import.meta.url.endsWith(".ts") ? "../bundle/" : "../../bundle/", import.meta.url);
-        const metadata = JSON.parse(await readFile(paths?.metadata ?? new URL("client-release.json", base), "utf8"));
+        const location = paths ?? installedReleasePaths();
+        const metadata = JSON.parse(await readFile(location.metadata, "utf8"));
         const pins = paths ? metadata : readClientReleasePins(metadata);
         if (typeof pins.verificationKey !== "string" || typeof pins.relayVersion !== "string" || !pins.relayVersion ||
             typeof pins.localVersion !== "string" || !pins.localVersion)
             throw new Error();
         const verificationKey = development ? createPublicKey(pins.verificationKey) : readClientReleaseKey(pins.verificationKey);
-        const bundle = JSON.parse(await readFile(paths?.bundle ?? new URL("sealed.json", base), "utf8"));
+        const bundle = JSON.parse(await readFile(location.bundle, "utf8"));
         const release = { bundle, verificationKey, relayVersion: pins.relayVersion, localVersion: pins.localVersion,
             relayUrl: pins.relayUrl, projectContext: pins.projectContext };
         validateClientRelease(release);