@counterfact-labs/cli 0.2.3 → 0.2.5

package/dist/cli/relay-check.js

@@ -1,12 +1,14 @@
-import { resolveFolderPath } from "../adapters/folder-path.js";
-import { savedAnalysisUrl } from "../contract/console-url.js";
 import { randomUUID } from "node:crypto";
 import { disabledSetupPings } from "../setup-pings/client.js";
 import { saveCompletion, loadCompletion } from "../adapters/completion.js";
 import { saveLocalResults } from "../adapters/results.js";
+import { GITIGNORE_OUTPUT_NOTICE } from "../adapters/gitignore-output.js";
 import { OutputPathError, outputPaths } from "../adapters/output-paths.js";
 import { validateClientRelease } from "../adapters/release.js";
 import { selectAnalysisExecution } from "../adapters/models.js";
+import { resolveFolderPath } from "../adapters/folder-path.js";
+import { AgentChoiceError } from "../contract/agent-choice.js";
+import { savedAnalysisUrl } from "../contract/console-url.js";
 import { prepareRelayCheck } from "./relay-preparation.js";
 import { cliRefusals, COMMITTED_FILES_MESSAGE, FINISH_FAILURE_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, refusalExitCode } from "../contract/cli-refusals.js";
 import { ConsoleClient, ConsoleError } from "../gatekeeper/console.js";
@@ -14,9 +16,13 @@ import { GatekeeperClient } from "../gatekeeper/client.js";
 import { connectRelay, relayOrigin } from "../gatekeeper/connection.js";
 import productionTrust from "../gatekeeper/trust/production.json" with { type: "json" };
 import { runAnalysisToEnd } from "../core/analysis/run-to-end.js";
+import { findingPresentation } from "../analysis-core/findings/presentation.js";
 import { formatSummary } from "./summary.js";
 import { buildIntakePayload } from "./intake-payload.js";
 import { completionRecoveryDecision, COMPLETION_SETTINGS_MISMATCH_MESSAGE, matchesCheck } from "./completion-recovery.js";
+import { savedFindings } from "./finding-display.js";
+import { INVALID_PROPOSAL_MESSAGE } from "../contract/agent-proposal.js";
+import { readFindingSettings } from "./finding-settings.js";
 const stateLine = (status) => `Reservation ${status.state}; settlement ${status.settlement}; lease ${new Date(status.expiresAt).toLocaleString("en-US", { timeZone: "America/Los_Angeles", timeZoneName: "short" })}.\n`;
 function requireIntakeReservation(status) {
     if (status.state === "reserved")
@@ -31,7 +37,8 @@ function requireIntakeReservation(status) {
 async function submit(client, payload, signal) {
     signal.throwIfAborted();
     const status = await client.status(payload.reservationId);
-    const committed = (value) => ({ checkId: value.checkId, projectId: value.projectId, analysisId: value.analysisId, findingIds: value.findingIds, settlement: value.settlement });
+    const committed = (value) => ({ checkId: value.checkId, projectId: value.projectId, analysisId: value.analysisId, findingIds: value.findingIds,
+        ...(value.findings ? { findings: value.findings } : {}), settlement: value.settlement });
     if (!matchesCheck(status, payload))
         throw new ConsoleError("check_conflict");
     if (status.uploadState === "saved")
@@ -65,11 +72,14 @@ export function runReservedRelayCheck(folder, options) {
     return runRelayLifecycle(folder, options, options);
 }
 async function runRelayLifecycle(folder, options, existing) {
-    const { config, settings, stdout, stderr } = options;
+    const { config, stdout, stderr } = options;
+    let settings = options.settings;
+    const summaryOptions = { audienceEnabled: false };
     let client, reservationId, projectId;
     let connection = existing?.connection;
     let identity;
     let completedPayload;
+    let displayFindings;
     let completionOrigin;
     let completed = false, uploaded = false, heartbeat;
     let renewal;
@@ -77,7 +87,8 @@ async function runRelayLifecycle(folder, options, existing) {
     const signal = options.signal ? AbortSignal.any([controller.signal, options.signal]) : controller.signal;
     const showSaved = (result) => {
         const url = savedAnalysisUrl(result.projectId, config.CF_CONSOLE_URL);
-        options.onSaved?.({ ...result, url });
+        const findings = savedFindings({ findingIds: result.findingIds ?? [], findings: result.findings }, displayFindings ?? completedPayload?.findings ?? []);
+        options.onSaved?.({ ...result, findings, url, audienceEnabled: summaryOptions.audienceEnabled });
         stdout(`Saved analysis ${result.analysisId}: ${url}\n`);
     };
     try {
@@ -100,6 +111,8 @@ async function runRelayLifecycle(folder, options, existing) {
         // Signature verification precedes all folder reads, status calls and spending.
         const validated = validateClientRelease(options.release, settings);
         const { bundle } = validated;
+        settings = validated.settings;
+        summaryOptions.audienceEnabled = readFindingSettings(settings).audienceEnabled;
         folder = await resolveFolderPath(folder);
         signal.throwIfAborted();
         const prior = await loadCompletion(folder);
@@ -134,10 +147,10 @@ async function runRelayLifecycle(folder, options, existing) {
             if (error.code !== "ENOENT")
                 throw error;
         }
-        const { source, provenance, plan, start } = await prepareRelayCheck(folder, { ...options, signal, expectedCommit: existing?.expectedCommit }, validated);
+        const { source, provenance, plan, start, startMetadata } = await prepareRelayCheck(folder, { ...options, signal, expectedCommit: existing?.expectedCommit, expectedFiles: existing?.expectedFiles }, validated);
         let reservation = existing?.reservation;
         if (!reservation) {
-            const started = await client.start(start);
+            const started = await client.start(start, startMetadata);
             projectId = started.projectId;
             signal.throwIfAborted();
             const created = await client.create({ ...started, checkId: randomUUID(), plan });
@@ -171,9 +184,28 @@ async function runRelayLifecycle(folder, options, existing) {
         (options.setupPings ?? disabledSetupPings).ping("first_analysis_started");
         const report = await runAnalysisToEnd(source, execution.model, settings, { execution });
         signal.throwIfAborted();
-        const paths = await saveLocalResults(folder, report, source.skippedFiles, options.outputDir);
-        const payload = buildIntakePayload({ checkId: reservation.checkId, projectId: projectId, reservationId,
-            bundleVersion: bundle.version, relayVersion: options.release.relayVersion, counterfactLocalVersion: options.release.localVersion }, provenance, report);
+        const paths = await saveLocalResults(folder, report, source.skippedFiles, options.outputDir, { ...summaryOptions, settings });
+        try {
+            options.onLocalSaved?.(paths);
+            if (paths.ignoreAdded)
+                stderr(GITIGNORE_OUTPUT_NOTICE);
+        }
+        catch { /* Output failure must not change a server outcome. */ }
+        const { payload, resultCheck, findingIndexes } = buildIntakePayload({ checkId: reservation.checkId, projectId: projectId, reservationId,
+            bundleVersion: bundle.version, relayVersion: options.release.relayVersion, counterfactLocalVersion: options.release.localVersion }, provenance, report, { settings, files: source.snapshot });
+        displayFindings = findingIndexes.map(index => {
+            const finding = report.findings[index];
+            return { title: findingPresentation(finding).displayTitle, audience: finding.audience };
+        });
+        if (resultCheck?.droppedFindings) {
+            const count = resultCheck.droppedFindings;
+            const reason = resultCheck.schemaDroppedFindings || resultCheck.capDroppedFindings
+                ? `${count === 1 ? "it was" : "they were"} too long or not in the expected format` : `${count === 1 ? "its" : "their"} quotes did not match your files`;
+            try {
+                stderr(`${count} ${count === 1 ? "finding was" : "findings were"} not uploaded because ${reason}.\n`);
+            }
+            catch { /* Output failure must not change a server outcome. */ }
+        }
         completionOrigin = new URL(config.CF_CONSOLE_URL).origin;
         await saveCompletion(folder, payload, completionOrigin);
         completedPayload = payload;
@@ -181,7 +213,7 @@ async function runRelayLifecycle(folder, options, existing) {
         const saved = await submit(client, payload, signal);
         uploaded = true;
         await saveCompletion(folder, payload, completionOrigin, true);
-        stdout(formatSummary(report));
+        stdout(formatSummary(report, summaryOptions));
         stdout(`\nSaved ${paths.findingsPath}\nSaved ${paths.summaryPath}\n`);
         showSaved(saved);
         return 0;
@@ -204,7 +236,7 @@ async function runRelayLifecycle(folder, options, existing) {
                 catch { /* Committed server state still survives a local write failure. */ }
             }
             try {
-                showSaved({ projectId: status.projectId, analysisId: status.analysisId, findingIds: status.findingIds });
+                showSaved({ projectId: status.projectId, analysisId: status.analysisId, findingIds: status.findingIds, findings: status.findings });
             }
             catch { /* Output failure must not change a server outcome. */ }
             return 0;
@@ -216,11 +248,12 @@ async function runRelayLifecycle(folder, options, existing) {
             }
             catch { /* Keep the pending record if the durable write cannot be confirmed. */ }
         }
-        const known = error instanceof ConsoleError || error instanceof OutputPathError || error instanceof Error && ([cliRefusals.release_unavailable, COMMITTED_FILES_MESSAGE, RESULTS_TOO_LARGE_MESSAGE].includes(error.message)
+        const known = error instanceof AgentChoiceError || error instanceof ConsoleError || error instanceof OutputPathError || error instanceof Error && ([cliRefusals.release_unavailable, COMMITTED_FILES_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, INVALID_PROPOSAL_MESSAGE].includes(error.message)
             || error.message.startsWith("The saved completion") || error.message === COMPLETION_SETTINGS_MISMATCH_MESSAGE);
         const message = known ? error.message : FINISH_FAILURE_MESSAGE;
         try {
-            options.onError?.({ code: error instanceof ConsoleError ? error.code : undefined, message });
+            options.onError?.({ code: error instanceof ConsoleError ? error.code : undefined, message,
+                ...(error instanceof AgentChoiceError ? { agentChoice: error.agentChoice } : {}) });
             stderr(`${message}\n`);
             if (status && !(error instanceof ConsoleError && error.code === "low_balance"))
                 stderr(stateLine(status));

package/dist/cli/relay-preparation.js

@@ -1,31 +1,56 @@
+import { randomUUID } from "node:crypto";
+import { join, relative, sep } from "node:path";
 import { outsideLoadersEnabled } from "../analysis-core/settings.js";
+import { resolveFolderPath } from "../adapters/folder-path.js";
 import { readLocalFolder } from "../adapters/files.js";
-import { snapshotProvenance } from "../adapters/snapshot.js";
+import { snapshotProvenance, sameFileHashes } from "../adapters/snapshot.js";
 import { validateClientRelease } from "../adapters/release.js";
 import { prepareRelayPlan } from "../adapters/relay-plan.js";
+import { AgentChoiceError } from "../contract/agent-choice.js";
 import { COMMITTED_FILES_MESSAGE } from "../contract/cli-refusals.js";
+import { INVALID_PROPOSAL_MESSAGE } from "../contract/agent-proposal.js";
 import { repositoryFacts } from "./git.js";
 /** Absolute checkout paths stay local; repository facts own the start's commit. */
 export function buildRelayStartPayload(facts, files) {
     const { remoteUrl, relPath, folderName, branch, commit, dirty } = facts;
     return { execution: "local", remoteUrl, relPath, folderName, branch, commit, dirty, files };
 }
+export function committedFilesOnly(settings) {
+    return settings.CF_LOCAL_COMMITTED_ONLY === "1";
+}
 /** Recovery can reuse signature validation without reading the folder again. */
 export async function prepareRelayCheck(folder, options, validated = validateClientRelease(options.release, options.settings)) {
-    const { bundle, tools } = validated;
+    const { bundle, tools, settings } = validated;
     options.signal?.throwIfAborted();
     // Discovery must agree with Git before publishing repository-relative captures.
     const earlyFacts = outsideLoadersEnabled(options.settings) ? await (options.facts ?? repositoryFacts)(folder) : undefined;
     options.signal?.throwIfAborted();
     const read = await readLocalFolder(options.settings, folder, options.trialAdmission, { captureSnapshot: true,
+        proposal: options.proposal,
         ...(earlyFacts ? { expectedRepositoryRoot: earlyFacts.repoRoot ?? null } : {}) });
+    if (read.proposalCounts?.fromProposal === 0 && read.proposalCounts.rejected > 0)
+        throw new Error(INVALID_PROPOSAL_MESSAGE);
+    if (read.agentChoice) {
+        const cwd = await resolveFolderPath(options.cwd ?? process.cwd());
+        const launchPath = (path) => relative(cwd, join(read.sourceBase ?? folder, path)).split(sep).join("/") || ".";
+        throw new AgentChoiceError({ ...read.agentChoice,
+            candidates: read.agentChoice.candidates.map(candidate => ({
+                folder: launchPath(candidate.folder), reason: launchPath(candidate.reason),
+            })),
+        });
+    }
     const source = { ...read, files: Object.freeze({ ...read.files }) };
-    const provenance = await snapshotProvenance(source.sourceBase ?? folder, source.snapshot, source.sourceBase ? { selectionFolder: folder } : undefined);
-    if (options.expectedCommit !== undefined && provenance.commit !== options.expectedCommit)
+    const provenance = await snapshotProvenance(source.sourceBase ?? folder, source.snapshot, { selectionFolder: folder, committedOnly: committedFilesOnly(options.settings) });
+    if (options.expectedCommit === null) {
+        if (!sameFileHashes(options.expectedFiles ?? [], source.snapshot))
+            throw new Error(COMMITTED_FILES_MESSAGE);
+    }
+    else if (options.expectedCommit !== undefined && provenance.commit !== options.expectedCommit)
         throw new Error(COMMITTED_FILES_MESSAGE);
-    const { plan, files } = prepareRelayPlan({ bundle, tools, settings: options.settings, relayVersion: options.release.relayVersion, source });
+    const { plan, files } = prepareRelayPlan({ bundle, tools, settings, relayVersion: options.release.relayVersion, source });
     options.signal?.throwIfAborted();
     const facts = earlyFacts ?? await (options.facts ?? repositoryFacts)(folder);
     options.signal?.throwIfAborted();
-    return { source, provenance, plan, start: buildRelayStartPayload(source.sourceBase ? { ...facts, relPath: "" } : facts, files) };
+    const startMetadata = { analysisSize: source.analysisSize, startAttempt: randomUUID() };
+    return { source, provenance, plan, start: buildRelayStartPayload(source.sourceBase ? { ...facts, relPath: "" } : facts, files), startMetadata };
 }

package/dist/cli/result-check.js

@@ -0,0 +1,68 @@
+import { publicFinding, resultCheckFinding, RESULT_CHECK_LIMITS } from "../analysis-core/contracts/relay-analysis.js";
+import { findingSitesInOrder } from "../analysis-core/findings/sites.js";
+import { localFindingSchema } from "../contract/console.js";
+function evidenceQuotes(finding, repoKey) {
+    const primary = finding.site ? { repo: finding.siteRepo ?? repoKey, ...finding.site, excerpt: finding.excerpt } : null;
+    const sites = findingSitesInOrder(primary, finding.otherSites);
+    const quotes = [];
+    function add(site, text) {
+        if (typeof text === "string")
+            quotes.push({ repo: site.repo, path: site.path, text });
+    }
+    add(primary ?? {}, finding.excerpt);
+    finding.otherSites.forEach(site => add(site, site.excerpt));
+    for (const note of finding.sourceNotes?.sites ?? []) {
+        if (note.keyPhrase !== "")
+            add(sites[note.index] ?? {}, note.keyPhrase);
+    }
+    for (const site of finding.sourceNotes?.counterEvidence ?? [])
+        add(site, site.excerpt);
+    return quotes;
+}
+/** The intake boundary and offline measurement use exactly the same evidence decision. */
+export function checkIntakeFindings(findings, context, onInvalidQuote) {
+    const accepted = [], acceptedIndexes = [];
+    const originals = new Map();
+    function original(path) {
+        if (!originals.has(path)) {
+            const captured = context.files[path];
+            try {
+                originals.set(path, typeof captured === "string" ? captured : new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(captured));
+            }
+            catch {
+                originals.set(path, null);
+            }
+        }
+        return originals.get(path);
+    }
+    let quotes = 0, droppedQuotes = 0, invalidQuotes = 0, schemaDroppedFindings = 0, capDroppedFindings = 0;
+    findings.forEach((finding, index) => {
+        const parsed = publicFinding.safeParse(finding);
+        const evidence = parsed.success ? evidenceQuotes(parsed.data, context.repoKey) : [];
+        quotes += evidence.length;
+        const invalid = evidence.filter(quote => {
+            const source = quote.repo === context.repoKey && typeof quote.path === "string" && Object.hasOwn(context.files, quote.path)
+                ? original(quote.path) : null;
+            const invalid = !quote.text.length || source === null || !source.includes(quote.text);
+            if (invalid)
+                onInvalidQuote?.({ text: quote.text, source });
+            return invalid;
+        }).length;
+        invalidQuotes += invalid;
+        const schemaValid = parsed.success && resultCheckFinding.safeParse(parsed.data).success && localFindingSchema.safeParse(parsed.data).success;
+        if (!schemaValid)
+            schemaDroppedFindings++;
+        if (index >= RESULT_CHECK_LIMITS.findings)
+            capDroppedFindings++;
+        if (!schemaValid || !parsed.success || invalid || index >= RESULT_CHECK_LIMITS.findings) {
+            // Removing one supporting quote could change the claim or invalidate source-note indices.
+            droppedQuotes += evidence.length;
+        }
+        else {
+            accepted.push(parsed.data);
+            acceptedIndexes.push(index);
+        }
+    });
+    return { findings: accepted, acceptedIndexes, droppedFindings: findings.length - accepted.length, quotes, droppedQuotes, invalidQuotes,
+        schemaDroppedFindings, capDroppedFindings };
+}

package/dist/cli/summary.js

@@ -1,12 +1,19 @@
 import { findingPresentation } from "../analysis-core/findings/presentation.js";
-export function formatSummary(report) {
+import { findingDisplayRows, TEAM_WORKFLOW_HEADING } from "./finding-display.js";
+export function formatSummary(report, options) {
     const lines = ["# Counterfact analysis", "",
         `${report.findings.length} findings; ${report.structures.length} structural proposals.`, ""];
     if (!report.findings.length)
         lines.push("No findings.", "");
-    for (const [index, finding] of report.findings.entries()) {
+    const findings = report.findings.map(finding => {
         const presentation = findingPresentation(finding);
-        lines.push(`## ${index + 1}. ${presentation.displayTitle}`, "");
+        return { ...finding, presentation, title: presentation.displayTitle };
+    });
+    for (const { finding, label, startsTeamGroup } of findingDisplayRows(findings, { ...options, labels: "position" })) {
+        const { presentation } = finding;
+        if (startsTeamGroup)
+            lines.push(`## ${TEAM_WORKFLOW_HEADING}`, "");
+        lines.push(`## ${label}`, "");
         if (presentation.ifLeft)
             lines.push(`If left: ${presentation.ifLeft}`, "");
         lines.push(`Severity: ${finding.severity}; category: ${finding.category ?? "unclassified"}.`, "", finding.cause, "");

package/dist/contract/agent-choice.js

@@ -0,0 +1,15 @@
+export const CHOOSE_AGENT_MESSAGE = "Counterfact couldn't tell which folder holds your agent. Run it again on that folder, for example";
+export const NO_AGENT_MESSAGE = "Counterfact couldn't find an agent prompt in this folder. Pass a folder containing an agent prompt or a model call with a system prompt.";
+/** The local importer supplies the choice; transport keeps its data and wording together. */
+export class AgentChoiceError extends Error {
+    agentChoice;
+    constructor(agentChoice) {
+        const folders = [...new Set(agentChoice.candidates.map(candidate => candidate.folder))];
+        super(agentChoice.kind === "choose_agent" ? [`${CHOOSE_AGENT_MESSAGE} counterfact-labs analyze ${shellArgument(folders[0])}.`, "These folders look like agents:", ...folders].join("\n") : NO_AGENT_MESSAGE);
+        this.agentChoice = agentChoice;
+    }
+}
+/** Folder names must remain literal when a user pastes the suggested command. */
+function shellArgument(folder) {
+    return /^[a-zA-Z0-9_./-]+$/.test(folder) ? folder : `'${folder.replaceAll("'", "'\\''")}'`;
+}

package/dist/contract/agent-proposal.js

@@ -0,0 +1,38 @@
+import { z } from "zod";
+import { importProposalEnabled } from "../analysis-core/index.js";
+export const INVALID_PROPOSAL_MESSAGE = "The proposed agent files couldn't be used, because a path is outside the folder or isn't a file Counterfact can read.";
+export const INVALID_PROPOSAL_FORMAT_MESSAGE = "The proposed agent files couldn't be used, because the proposal needs an agent name and a list of files with supported roles.";
+// Check both path separators so a proposal has the same meaning on every host.
+export const agentProposalSchema = z.object({
+    agentName: z.string().min(1).max(200).regex(/^[^\p{C}\p{Zl}\p{Zp}]+$/u),
+    files: z.array(z.object({
+        path: z.string().min(1).max(512).regex(/^(?![A-Za-z]:)(?![/\\])(?!.*(?:^|[/\\])\.\.(?:[/\\]|$))[^\p{C}\p{Zl}\p{Zp}]+$/u)
+            .describe("Paths are relative to the agent folder."),
+        role: z.enum(["prompt", "tools", "model-calling code", "config", "other"]),
+    })).max(200),
+});
+export const agentProposalInputSchema = z.toJSONSchema(agentProposalSchema);
+delete agentProposalInputSchema.$schema;
+function validateAgentProposal(value) {
+    if (value === undefined)
+        return undefined;
+    const parsed = agentProposalSchema.safeParse(value);
+    if (!parsed.success) {
+        const invalidPath = parsed.error.issues.some(issue => issue.path[0] === "files" && issue.path[2] === "path");
+        throw new Error(invalidPath ? INVALID_PROPOSAL_MESSAGE : INVALID_PROPOSAL_FORMAT_MESSAGE);
+    }
+    return parsed.data;
+}
+/** Check the switch before invoking a loader so disabled proposals never open files. */
+export async function loadAgentProposal(load, settings) {
+    if (!importProposalEnabled(settings))
+        return undefined;
+    let value;
+    try {
+        value = await load();
+    }
+    catch {
+        throw new Error("The proposal file couldn't be read as JSON.");
+    }
+    return validateAgentProposal(value);
+}

package/dist/contract/attestation.js

@@ -0,0 +1,106 @@
+import { z } from "zod";
+import { allowsRuntimeOverrides, checkRuntimeEnvironment } from "./runtime-environment.js";
+// Identity contracts stay independent of analysis requests so probes cannot load private rules.
+export const compactJwtPattern = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+export const hexChallenge = z.string().length(64).regex(/^[0-9a-f]+$/);
+export const PRODUCTION_EVIDENCE_VERSION = 1;
+export const RELAY_CHANNEL_AUDIENCE = "https://relay.counterfactlabs.com";
+// Passthrough forwarding keeps the non-root workload's listener port unchanged.
+export const RELAY_PORT = 8443;
+export const RELAY_URL = `${RELAY_CHANNEL_AUDIENCE}:${RELAY_PORT}`;
+export const RELAY_HEALTH_PATH = "/health";
+export const RELAY_HEALTH_URL = `${RELAY_URL}${RELAY_HEALTH_PATH}`;
+export const GOOGLE_ATTESTATION_ISSUER = "https://confidentialcomputing.googleapis.com";
+export const MAX_ATTESTATION_BYTES = 32 * 1024;
+export const attestationChallenge = z.object({
+    version: z.literal(PRODUCTION_EVIDENCE_VERSION),
+    challenge: hexChallenge,
+}).strict();
+export const productionEvidence = z.object({
+    version: z.literal(PRODUCTION_EVIDENCE_VERSION),
+    token: z.string().max(MAX_ATTESTATION_BYTES).regex(compactJwtPattern),
+}).strict();
+/** Google's launcher accepts up to six caller nonces, each at most 74 characters. */
+export const evidenceBinding = z.object({
+    audience: z.string().min(1).max(256).regex(/^[A-Za-z0-9:/._-]+$/),
+    nonces: z.array(z.string().min(1).max(74).regex(/^[A-Za-z0-9_:-]+$/)).min(1).max(6),
+}).strict();
+/** Native claims are interpreted only after the PKI chain and token signature are authenticated. */
+export const googleAttestationClaims = z.object({
+    iss: z.literal(GOOGLE_ATTESTATION_ISSUER),
+    aud: z.string(),
+    sub: z.string(),
+    iat: z.number().int(),
+    nbf: z.number().int(),
+    exp: z.number().int(),
+    eat_nonce: z.union([z.string(), z.array(z.string()).min(1).max(6)]),
+    secboot: z.literal(true),
+    dbgstat: z.literal("disabled-since-boot"),
+    oemid: z.literal(11129),
+    hwmodel: z.string(),
+    swname: z.literal("CONFIDENTIAL_SPACE"),
+    swversion: z.array(z.string()).length(1),
+    google_service_accounts: z.array(z.string()).min(1),
+    development: z.never().optional(),
+    identity: z.never().optional(),
+    submods: z.object({
+        confidential_space: z.object({
+            support_attributes: z.array(z.string()),
+            monitoring_enabled: z.object({ memory: z.literal(false) }).passthrough(),
+        }).passthrough(),
+        container: z.object({
+            image_digest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+            image_signatures: z.array(z.object({
+                key_id: z.string(), signature: z.string().min(1),
+                signature_algorithm: z.literal("RSASSA_PSS_SHA256"),
+            }).passthrough()).min(1),
+            // Google omits override claims when nothing was overridden; only the owned clock rollback setting is allowed.
+            cmd_override: z.array(z.unknown()).length(0).optional(),
+            env_override: z.record(z.string(), z.string()).refine(allowsRuntimeOverrides).optional(),
+            // Real tokens list the container's own environment; the relay's start-up rule decides which settings are allowed.
+            env: z.record(z.string(), z.string()).refine(env => {
+                try {
+                    checkRuntimeEnvironment(env);
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            }),
+        }).passthrough(),
+    }).passthrough(),
+}).passthrough();
+/** Authenticated observations describe a refused workload without granting it an admitted identity. */
+export const observedAttestationClaims = googleAttestationClaims.extend({
+    dbgstat: z.string(),
+    submods: googleAttestationClaims.shape.submods.extend({
+        container: googleAttestationClaims.shape.submods.shape.container.extend({
+            image_signatures: z.array(googleAttestationClaims.shape.submods.shape.container.shape.image_signatures.element),
+            cmd_override: z.array(z.unknown()).optional(),
+            env_override: z.record(z.string(), z.unknown()).optional(),
+        }),
+    }),
+});
+// Intel TDX omits these arrays for unsigned/debug images; only probes may read absence as "none".
+export const probeAttestationClaims = observedAttestationClaims.extend({
+    submods: observedAttestationClaims.shape.submods.extend({
+        confidential_space: observedAttestationClaims.shape.submods.shape.confidential_space.extend({
+            support_attributes: observedAttestationClaims.shape.submods.shape.confidential_space.shape.support_attributes.default([]),
+        }),
+        container: observedAttestationClaims.shape.submods.shape.container.extend({
+            image_signatures: observedAttestationClaims.shape.submods.shape.container.shape.image_signatures.default([]),
+        }),
+    }),
+});
+/**
+ * Local development claims. These cannot establish production identity; production uses native Google claims.
+ */
+export const attestationClaims = z.object({
+    iss: z.string().url(),
+    /** The relay image's digest. Must be one we published. */
+    imageDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+    /** Hash of the relay's channel public key, so the token is bound to this connection. */
+    channelKeyHash: z.string().regex(/^[0-9a-f]{64}$/),
+    exp: z.number().int(),
+    iat: z.number().int(),
+}).passthrough();

package/dist/contract/cli-refusals.js

@@ -1,15 +1,20 @@
+import { FOLDER_TOO_LARGE_MESSAGE } from "../analysis-core/errors.js";
 export const START_FAILURE_MESSAGE = "This couldn't start. Try again.";
 export const RESERVATION_EXPIRED_MESSAGE = "This reservation expired. Start a new analysis.";
 export const FINISH_FAILURE_MESSAGE = "The analysis couldn't finish. Try again.";
 export const RESULTS_TOO_LARGE_MESSAGE = "The results were too large to save. Try again.";
 export const COMMITTED_FILES_MESSAGE = "Counterfact analyzes the committed version of the agent's files. Commit your changes, then try again.";
 const unsupportedVersion = "This version of Counterfact can't run analyses. Update it: npm install -g @counterfact-labs/cli@latest.";
+// The console separates over-limit costs from version or route mismatches, so each code gets its own recovery guidance.
+const analysisTooLarge = "This analysis is too large to run at once. Choose a smaller folder, such as one agent's folder.";
 /** Shared public refusals keep mode admission and reservation errors consistent. */
 export const cliRefusals = {
+    folder_too_large: FOLDER_TOO_LARGE_MESSAGE,
     low_balance: "Your balance doesn't cover this analysis. Add credit at https://app.counterfactlabs.com/account?status=low_balance#balance",
     local_checks_paused: "Analyses are paused right now. Try again later.",
     cli_update_required: "Update Counterfact: run npm install -g @counterfact-labs/cli@latest.",
     release_unavailable: unsupportedVersion,
+    plan_over_limit: analysisTooLarge,
     invalid_plan: unsupportedVersion,
     invalid_body: "Counterfact couldn't read this request. Update Counterfact, then try again.",
     body_too_large: "This request is too large. The limit is 2 MB.",

package/dist/contract/cli-version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.2.3";
+export const CLI_VERSION = "0.2.5";

package/dist/contract/console.js

@@ -1,14 +1,35 @@
 import { z } from "zod";
-import { fixDeltaSchema, fixFactsSchema } from "../analysis-core/data/finding-types.js";
+import { findingAudienceSchema, fixDeltaSchema, fixFactsSchema } from "../analysis-core/data/finding-types.js";
 import { inspectFixSchema, otherSiteSchema, rawFindingSchema } from "../analysis-core/analysis/schemas.js";
 import { sourceNotesSchema } from "../analysis-core/analysis/source-notes/types.js";
+import { parseAnalysisSize } from "../analysis-core/conventions/analysis-fit.js";
+import { canonicalUuidSchema as uuid, matchingFindingNumbers, numberedFindingsSchema } from "./findings.js";
+import { RESULT_CHECK_LIMITS, validIntakeText } from "../analysis-core/contracts/relay-analysis.js";
 export const id = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
-const uuid = z.uuid().transform(value => value.toLowerCase());
 const money = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
 const count = (max) => z.number().int().positive().max(max);
 // These data-only boundaries follow the SaaS local start, reservation and findings owners; see docs/provenance.md.
 export const LOCAL_START_EXECUTION_HEADER = { name: "x-counterfact-execution", value: "local" };
 export const LOCAL_START_BODY_LIMIT = 2 * 1024 * 1024;
+export const ANALYSIS_SIZE_HEADER = "x-counterfact-analysis-size";
+export const START_ATTEMPT_HEADER = "x-counterfact-start-attempt";
+export const ANALYSIS_SIZE_HEADER_LIMIT = 256;
+/** Additive headers let older consoles keep accepting the unchanged, strict start body. */
+export function serializeLocalStartMetadata(metadata) {
+    const size = JSON.stringify(parseAnalysisSize(metadata.analysisSize));
+    if (Buffer.byteLength(size, "utf8") > ANALYSIS_SIZE_HEADER_LIMIT)
+        throw new Error("Invalid analysis size header");
+    return { [ANALYSIS_SIZE_HEADER]: size, [START_ATTEMPT_HEADER]: uuid.parse(metadata.startAttempt) };
+}
+/** Missing measurements preserve old clients; present measurements must be complete. */
+export function parseLocalStartMetadata(headers) {
+    const raw = headers.get(ANALYSIS_SIZE_HEADER);
+    if (raw === null)
+        return undefined;
+    if (Buffer.byteLength(raw, "utf8") > ANALYSIS_SIZE_HEADER_LIMIT)
+        throw new Error("Invalid analysis size header");
+    return { analysisSize: parseAnalysisSize(JSON.parse(raw)), startAttempt: uuid.parse(headers.get(START_ATTEMPT_HEADER)) };
+}
 const localStartPath = z.string().min(1).max(4096).refine(value => !value.includes("\\") && !value.includes("\0") && !value.startsWith("/")
     && value.split("/").every(part => part !== ".." && part !== "." && part !== ""));
 export const localStartRequestSchema = z.strictObject({
@@ -39,32 +60,35 @@ export const consoleStatusSchema = z.strictObject({
     settlement: z.enum(["unheld", "held", "charged", "released"]),
     reason: z.enum(["service_failure", "required_failure", "authorization_refused", "our_deadline_failure",
         "findings_saved", "required_delivered", "no_required_delivery"]).nullable(),
-    uploadState: z.enum(["saved", "missing"]), analysisId: uuid.optional(), findingIds: z.array(uuid).max(20_000).optional(),
+    uploadState: z.enum(["saved", "missing"]), analysisId: uuid.optional(), findingIds: z.array(uuid).max(RESULT_CHECK_LIMITS.findings).optional(),
+    findings: numberedFindingsSchema.optional(),
     quoteId: z.string().min(1).max(256).optional(), priceMicro: money.nullable(), providerBudgetMicro: money,
     expiresAt: z.iso.datetime(), absoluteExpiresAt: z.iso.datetime().nullable(),
     deadlineClassification: z.enum(["caller_timeout", "our_deadline_failure"]).nullable(),
 }).refine(value => value.uploadState === "saved"
     ? value.analysisId !== undefined && value.findingIds !== undefined
-    : value.analysisId === undefined && value.findingIds === undefined);
+    : value.analysisId === undefined && value.findingIds === undefined && value.findings === undefined)
+    .refine(matchingFindingNumbers);
 export const consoleReservationSchema = consoleStatusSchema.safeExtend({ reservationToken: z.string().min(1).max(256),
     quoteId: z.string().min(1).max(256) });
+/**
+ * One findingId per payload finding, in payload order; optional findings maps those ids to project sequences in any order.
+ * Console must send findings in intake replies and saved status (including seq in status) only when
+ * x-counterfact-cli-version is 0.2.5 or later: older CLIs use strict schemas and reject these fields after a paid save.
+ */
 export const consoleIntakeResultSchema = z.strictObject({
-    checkId: uuid, projectId: uuid, analysisId: uuid, findingIds: z.array(uuid).max(20_000),
+    checkId: uuid, projectId: uuid, analysisId: uuid, findingIds: z.array(uuid).max(RESULT_CHECK_LIMITS.findings),
+    findings: numberedFindingsSchema.optional(),
     settlement: z.enum(["unheld", "held", "charged", "released"]).optional(),
-});
+}).refine(matchingFindingNumbers);
 export const LOCAL_FINDINGS_BODY_LIMIT = 2 * 1024 * 1024;
-export const LOCAL_FINDINGS_QUOTE_LIMIT = 2000;
-export const LOCAL_FINDINGS_TEXT_LIMIT = 4096;
+export const LOCAL_FINDINGS_QUOTE_LIMIT = RESULT_CHECK_LIMITS.quoteBytes;
+export const LOCAL_FINDINGS_TEXT_LIMIT = RESULT_CHECK_LIMITS.textBytes;
 function shortFindingFields(value) {
     if (typeof value === "string")
         return Buffer.byteLength(value, "utf8") <= LOCAL_FINDINGS_TEXT_LIMIT;
     return value === null || typeof value !== "object" || Object.values(value).every(shortFindingFields);
 }
-function validIntakeText(value) {
-    if (typeof value === "string")
-        return !value.includes(String.fromCharCode(0)) && !/[\uD800-\uDFFF]/u.test(value);
-    return value === null || typeof value !== "object" || Object.values(value).every(validIntakeText);
-}
 const quote = z.string().refine(value => Buffer.byteLength(value, "utf8") <= LOCAL_FINDINGS_QUOTE_LIMIT);
 const text = z.string().min(1).refine(value => value.trim().length > 0);
 const delta = fixDeltaSchema.extend({
@@ -80,7 +104,8 @@ const notes = sourceNotesSchema.extend({
     sites: z.array(sourceNotesSchema.shape.sites.element.extend({ keyPhrase: quote }).strict()),
     counterEvidence: z.array(sourceNotesSchema.shape.counterEvidence.element.extend({ excerpt: quote }).strict()),
 }).strict();
-const finding = rawFindingSchema.extend({
+export const localFindingSchema = rawFindingSchema.extend({
+    audience: findingAudienceSchema.optional(),
     summary: z.string().nullable(),
     category: rawFindingSchema.shape.category.removeCatch(),
     question: rawFindingSchema.shape.question.removeCatch().nullable(),
@@ -94,10 +119,10 @@ const finding = rawFindingSchema.extend({
 const payload = z.strictObject({
     checkId: z.uuid(), projectId: z.uuid(), reservationId: uuid.optional(),
     agent: z.strictObject({
-        repository: text.max(4096), commit: z.string().regex(/^(?:[a-f\d]{40}|[a-f\d]{64})$/i),
+        repository: text.max(4096), commit: z.string().regex(/^(?:[a-f\d]{40}|[a-f\d]{64})$/i).nullable(),
         files: z.array(z.strictObject({ path: text.max(4096), hash: z.string().regex(/^[a-f\d]{64}$/i) })).min(1),
     }),
-    findings: z.array(finding), bundleVersion: text.max(128), relayVersion: text.max(128), counterfactLocalVersion: text.max(128),
+    findings: z.array(localFindingSchema), bundleVersion: text.max(128), relayVersion: text.max(128), counterfactLocalVersion: text.max(128),
 }).refine(validIntakeText);
 // Original JSON size is checked before a shared schema can trim text or apply defaults.
 export const localFindingsPayloadSchema = z.unknown().refine(value => {