@counterfact-labs/cli 0.2.4 → 0.2.5

package/README.md

@@ -16,6 +16,7 @@ Use Node.js 22 or later and install the pinned dependencies:
 
 ```bash
 npm ci
+npm run build:core
 ```
 
 Set `ANTHROPIC_API_KEY` in your shell to your Anthropic development key, then run these commands from this checkout:
@@ -141,8 +142,9 @@ or add both to the sandbox's allowed domains.
 The command uses the existing saved sign-in and sends `X-Counterfact-CLI-Version: 0.2.0`. It asks
 `/api/cli/checks/mode` before reading source or starting paid work. Upload, paused, update-required and unavailable
 responses stop the analysis; the command never falls back to uploading files. Settings are captured at command start.
-The analysis uses a committed Git folder. Admitted files must match that commit; unrelated local output files are ignored.
+An analysis reads the agent's files as they are on disk, including uncommitted changes, and also works in folders without Git.
 The console owns prices, expressed in millionths of a dollar.
+By default, the CLI adds .counterfact/ to the folder's .gitignore when Git doesn't already ignore it. Set CF_LOCAL_GITIGNORE_OUTPUT=0 to turn this off.
 
 The installed command uses the relay address in `bundle/client-release.json` and saved sign-in. The relay runner sends
 repository facts and the admitted file list (paths and sizes, without contents or absolute checkout paths) to
@@ -154,6 +156,10 @@ Release stays blocked while `relayUrl` and `projectContext` are unconfigured in
 `projectContext` to `checks` only after local start support is reviewed. The release validator requires both settings
 along with the signed bundle and trust pins; an environment override cannot bypass the project-context pin.
 
+## Relay privacy
+
+The sealed relay's source is public at [github.com/counterfact-labs/sealed-relay](https://github.com/counterfact-labs/sealed-relay), with a reproducible build of its JavaScript, and the CLI checks the relay's attestation against a pinned image digest before sending it any analysis input.
+
 ## Build and release the customer CLI archive
 
 Generate `bundle/sealed.json` with the existing release tooling and externally supplied release keys. Install the

package/bundle/client-release.json

@@ -1,7 +1,7 @@
 {
   "verificationKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAbBab1PYdmBKXxCvoJ47toJhQvxPevo9nlZnb0zbDWoc=\n-----END PUBLIC KEY-----\n",
   "relayVersion": "relay-1.0.1",
-  "localVersion": "0.2.4",
+  "localVersion": "0.2.5",
   "relayUrl": "https://relay.counterfactlabs.com:8443",
   "projectContext": "checks"
 }

package/dist/adapters/anthropic.js

@@ -5,6 +5,7 @@ import { estimateTokensFromBytes } from "../analysis-core/llm/cost.js";
 import { anthropicStructuredLimit, supportsReasoningControls } from "../analysis-core/llm/output-limit.js";
 import { requestCachesInput, structuredPromptOf } from "./prompt-cache.js";
 import { StructuredOutputError } from "../analysis-core/llm/structured-output-error.js";
+import { THINKING_MODES } from "../analysis-core/llm/types.js";
 export function anthropicLlm(settings, opts = {}) {
     const client = opts.client ?? new Anthropic({ ...(opts.apiKey === undefined ? {} : { apiKey: opts.apiKey }) });
     return { structured: call => structuredCall(settings, client, call, opts.onUsage, opts.sourceRetries) };
@@ -19,6 +20,10 @@ export function anthropicCaptureBackend(client = new Anthropic({ maxRetries: 0 }
 function canceled() {
     return new JobError("canceled", "The model call was canceled.");
 }
+export class ProviderRequestRefused extends Error {
+    name = "ProviderRequestRefused";
+    constructor() { super("Invalid model request"); }
+}
 export class ProviderCallError extends JobError {
     payment;
     constructor(code, message, retryable, payment) {
@@ -34,6 +39,10 @@ function providerFailure(error, signal) {
         return new ProviderCallError("rate_limited", "The model provider is busy. Wait a minute and try again.", true, "unpaid");
     }
     if (error instanceof Anthropic.APIConnectionError) {
+        // The guard rejects before network access, so no provider work can have been paid.
+        if (error.cause instanceof ProviderRequestRefused) {
+            return new ProviderCallError("llm", "Invalid model request", false, "unpaid");
+        }
         return new ProviderCallError("llm", "The model could not be reached. Try again.", true, "unknown");
     }
     const directive = error instanceof Anthropic.APIError ? error.headers?.get("x-should-retry") : undefined;
@@ -66,13 +75,13 @@ function providerRequest(settings, call) {
     const streamed = supportsReasoningControls(call.model);
     const params = {
         model: call.model, max_tokens: anthropicStructuredLimit(call),
-        ...(streamed ? { thinking: { type: call.thinking ?? "adaptive" } } : {}),
+        ...(streamed ? { thinking: { type: call.thinking ?? THINKING_MODES.adaptive } } : {}),
         ...(call.system ? { system: call.system } : {}),
         messages: [{ role: "user", content: structuredPromptOf(settings, call) }],
         output_config: {
             // SDK stream parsing can throw before returning usage for incomplete JSON.
             format: { type: format.type, schema: format.schema },
-            ...(call.effort && streamed && call.thinking !== "disabled" ? { effort: call.effort } : {}),
+            ...(call.effort && streamed && call.thinking !== THINKING_MODES.disabled ? { effort: call.effort } : {}),
         },
     };
     return { params, format, streamed };

package/dist/adapters/completion.js

@@ -104,6 +104,9 @@ export async function loadCompletion(folder) {
             return null;
         throw new Error(INVALID_COMPLETION_MESSAGE);
     }
+    // Released folder-local records always had a Git commit; hashes alone cannot establish their provenance.
+    if (legacy.payload.agent.commit === null)
+        return null;
     if (!await matchesSnapshotProvenance(folder, legacy.payload.agent))
         throw new Error(INVALID_COMPLETION_MESSAGE);
     // Attempt imported recovery once automatically; uncertain legacy data must not block later analyses.

package/dist/adapters/durable-write.js

@@ -1,14 +1,20 @@
 import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
-import { open, rename, rm } from "node:fs/promises";
+import { chmod, mkdir, open, rename, rm } from "node:fs/promises";
 import { dirname } from "node:path";
+export async function preparePrivateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    await chmod(path, 0o700);
+}
 export async function durableWrite(path, bytes) {
     const temporary = `${path}.${randomUUID()}.tmp`;
+    let created = false;
     const permission = process.permission !== undefined;
     // The permission model disables fsync, so sync data on each write and skip the unavailable directory sync.
     const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | (permission ? constants.O_DSYNC : 0);
     try {
         const file = await open(temporary, flags, 0o600);
+        created = true;
         try {
             await file.writeFile(bytes);
             if (!permission)
@@ -29,6 +35,7 @@ export async function durableWrite(path, bytes) {
         }
     }
     finally {
-        await rm(temporary, { force: true });
+        if (created)
+            await rm(temporary, { force: true });
     }
 }

package/dist/adapters/files.js

@@ -1,6 +1,6 @@
 import { opendir, realpath, stat, readFile } from "node:fs/promises";
 import { dirname, join, posix } from "node:path";
-import { admitFile, fileRefusalWarning, localSymlinkGuardEnabled, respectGitignore, readRepoFile, resolveLocalExclusions } from "../analysis-core/conventions/file-admission.js";
+import { admitFile, FileReadRefusal, fileRefusalWarning, localSymlinkGuardEnabled, respectGitignore, readRepoFile, resolveLocalExclusions } from "../analysis-core/conventions/file-admission.js";
 import { assessAnalysisSize, measureAnalysisSize } from "../analysis-core/conventions/analysis-fit.js";
 import { localRepoKeyFor } from "../analysis-core/github/repo-key.js";
 import { fetchLocalSources } from "../analysis-core/index.js";
@@ -34,12 +34,15 @@ export async function readLocalFolder(settings, folder, admission = {}, options
         }
     });
     const targets = new Map();
-    const snapshot = {};
+    const snapshot = Object.create(null);
+    const snapshotTargets = new Map();
     let visited = 0;
     const targetOf = async (path, purpose, directory = false) => {
         const target = await realpath(join(root, path));
         const result = admitFile(settings, { path, directory }, { purpose, route: "local-folder", ...admission, localTarget: { root, path: target, excludedTargets } });
         if (!result.admitted) {
+            if (purpose === "proposal")
+                throw new FileReadRefusal(result.reason, path);
             refused.push({ path, reason: result.reason });
             if (result.reason === "secret" || result.reason === "out-of-scope")
                 warnings.push({ path, reason: result.reason });
@@ -50,6 +53,8 @@ export async function readLocalFolder(settings, folder, admission = {}, options
         const allowed = admitFile(settings, { path, directory }, { purpose, route: "local-folder", ...admission,
             gitIgnored, localTarget: { root, path: target, parent, excludedTargets } });
         if (!allowed.admitted) {
+            if (purpose === "proposal")
+                throw new FileReadRefusal(allowed.reason, path);
             if (directory)
                 gitSkipped.push(...await ignoredFiles(join(root, path), path));
             else
@@ -124,20 +129,27 @@ export async function readLocalFolder(settings, folder, admission = {}, options
     const listing = new Set(entries.map(entry => entry.path));
     const repoKey = localRepoKeyFor(root);
     const repository = createRepositoryFiles(settings, root, admission, options);
-    const discovered = await fetchLocalSources(settings, { repoKey, entries, admission, repository, read: async (entry) => {
-            const target = guarded ? await targetOf(entry.path, "override") : targets.get(entry.path);
-            return target ? readRepoFile(settings, entry, async () => {
-                if (!options.captureSnapshot)
-                    return readFile(target, "utf8");
-                const bytes = snapshot[entry.path] ?? await readFile(target);
-                snapshot[entry.path] = bytes;
-                return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-            }, { ...admission, listing, route: "local-folder", localTarget: { root, path: target, excludedTargets } }) : null;
-        } });
+    const read = async (entry, purpose) => {
+        const target = guarded || purpose === "proposal" ? await targetOf(entry.path, purpose) : targets.get(entry.path);
+        return target ? readRepoFile(settings, entry, async () => {
+            if (!options.captureSnapshot)
+                return readFile(target, "utf8");
+            const cached = purpose !== "proposal" || snapshotTargets.get(entry.path) === target ? snapshot[entry.path] : undefined;
+            const bytes = cached ?? await readFile(target);
+            snapshot[entry.path] = bytes;
+            snapshotTargets.set(entry.path, target);
+            return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        }, { ...admission, listing, route: "local-folder", localTarget: { root, path: target, excludedTargets } }) : null;
+    };
+    const discovered = await fetchLocalSources(settings, { repoKey, entries, admission, repository,
+        proposal: options.proposal, proposalRefusals: [...gitSkipped, ...refused],
+        read: entry => read(entry, "override"), proposalRead: entry => read(entry, "proposal"),
+    });
     const expanded = discovered.root !== undefined;
     const ignored = mergeSkippedFiles(expanded ? gitSkipped.map(file => ({ ...file, path: repoPathFrom(file.path, discovered.root) })) : gitSkipped, repository.skippedFiles.map(file => ({ ...file, path: expanded ? file.path : posix.relative(repository.selectedRoot ?? "", file.path) })));
     const captured = { ...Object.fromEntries(Object.entries(snapshot).map(([path, bytes]) => [repoPathFrom(path, discovered.root), bytes])), ...repository.snapshot };
-    return { repoKey, files: discovered.files, analysisSize, ...(analysisFit ? { analysisFit } : {}), ...(expanded ? { root: discovered.root, sourceBase: repository.sourceBase } : {}),
+    return { repoKey, ...(discovered.agentChoice ? { agentChoice: discovered.agentChoice } : {}), files: discovered.files, analysisSize, ...(analysisFit ? { analysisFit } : {}), ...(expanded ? { root: discovered.root, sourceBase: repository.sourceBase } : {}),
+        ...(discovered.proposalCounts ? { proposalCounts: discovered.proposalCounts } : {}),
         ...(options.captureSnapshot ? { snapshot: Object.fromEntries(Object.keys(discovered.files).map(path => [path, captured[path]])) } : {}), fragment: discovered.fragment, selection: discovered.selection,
         skippedFiles: mergeSkippedFiles(discovered.skippedFiles, ignored, expanded ? refused.map(file => ({ ...file, path: repoPathFrom(file.path, discovered.root) })) : refused),
         warnings: [...new Set(mergeUnlistedFileWarnings([...warnings.map(file => fileRefusalWarning(repoPathFrom(file.path, discovered.root), file.reason)), ...discovered.warnings], ignored.length))] };

package/dist/adapters/git-ignore.js

@@ -2,21 +2,28 @@ import { isAbsolute, relative, resolve, sep } from "node:path";
 import { mapLimit } from "../analysis-core/map-limit.js";
 import { respectGitignore } from "../analysis-core/conventions/file-admission.js";
 import { runGit } from "./git.js";
-import { gitRepositoryRoot, searchBaseMatches, searchBoundary } from "./repository-root.js";
+import { gitRepositoryRoot } from "./repository-root.js";
 /** Query path facts only; admission owns whether an ignored path can be read. */
 export function createGitIgnore(settings, folder) {
+    const query = createGitIgnoreQuery(folder);
+    return (paths) => respectGitignore(settings) ? query(paths) : Promise.resolve(undefined);
+}
+export function createGitIgnoreQuery(folder) {
+    const query = createGitIgnoreFactsQuery(folder);
+    return async (paths) => {
+        const facts = await query(paths);
+        return facts && new Set([...facts].filter(([, fact]) => fact === "ignored").map(([path]) => path));
+    };
+}
+/** Git supplies the last matching rule, including a deliberate negation. */
+export function createGitIgnoreFactsQuery(folder) {
     const cache = new Map();
     let root;
     return async (paths) => {
-        if (!respectGitignore(settings))
-            return undefined;
         if (!paths.length)
-            return new Set();
-        const base = await (root ??= (async () => {
-            const [boundary, reported] = await Promise.all([searchBoundary(folder),
-                gitRepositoryRoot(async (args) => (await runGit(folder, args)).toString("utf8"))]);
-            return boundary && await searchBaseMatches(boundary.base, reported) ? boundary.base : null;
-        })());
+            return new Map();
+        // Git's root owns ignore rules even when discovery stops at a different marker.
+        const base = await (root ??= gitRepositoryRoot(async (args) => (await runGit(folder, args)).toString("utf8"), folder));
         if (!base)
             return undefined;
         const candidates = paths.filter(path => {
@@ -30,20 +37,27 @@ export function createGitIgnore(settings, folder) {
             const input = Buffer.from(batch.map(path => resolve(folder, path)).join("\0") + "\0");
             let output;
             try {
-                output = await runGit(folder, ["check-ignore", "-z", "--stdin"], { userConfig: true, input, maxBuffer: input.length + 1024 });
+                output = await runGit(folder, ["check-ignore", "--verbose", "-z", "--stdin"], { userConfig: true, input, maxBuffer: input.length + 1024 * 1024 });
             }
             catch (error) {
                 if (error.code === 1) {
                     for (const path of batch)
-                        cache.set(path, false);
+                        cache.set(path, null);
                     return;
                 }
                 throw error;
             }
-            const matches = new Set(output.toString("utf8").split("\0"));
+            const fields = output.toString("utf8").split("\0");
+            const matches = new Map();
+            for (let index = 0; index + 3 < fields.length; index += 4) {
+                matches.set(fields[index + 3], fields[index + 2].startsWith("!") ? "included" : "ignored");
+            }
             for (const path of batch)
-                cache.set(path, matches.has(path));
+                cache.set(path, matches.get(path) ?? null);
         });
-        return new Set(candidates.filter(path => cache.get(resolve(folder, path))));
+        return new Map(candidates.flatMap(path => {
+            const fact = cache.get(resolve(folder, path));
+            return fact ? [[path, fact]] : [];
+        }));
     };
 }

package/dist/adapters/git.js

@@ -8,7 +8,7 @@ export async function runGit(folder, args, options = {}) {
             "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", "-c", "core.sshCommand=",
             "-c", "protocol.ext.allow=never", "-c", "diff.external=", "-c", "core.attributesFile=/dev/null",
             ...overrides, "-C", folder, ...command], {
-            encoding: "buffer", timeout: options.timeout ?? 3000, maxBuffer,
+            encoding: "buffer", timeout: options.timeout ?? 3000, maxBuffer, signal: options.signal,
             env: { ...env, GIT_ATTR_NOSYSTEM: "1", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0", GIT_CONFIG_NOSYSTEM: "1",
                 GIT_CONFIG_GLOBAL: options.userConfig ? process.env.GIT_CONFIG_GLOBAL : "/dev/null", GIT_PAGER: "cat" },
         });

package/dist/adapters/gitignore-output.js

@@ -0,0 +1,41 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { createGitIgnoreFactsQuery } from "./git-ignore.js";
+import { runGit } from "./git.js";
+import { analysisReadRoots, gitRepositoryRoot } from "./repository-root.js";
+import { DEFAULT_OUTPUT_DIR, outputPaths } from "./output-paths.js";
+const ignoreRule = `${DEFAULT_OUTPUT_DIR}/`;
+export const GITIGNORE_OUTPUT_NOTICE = `Added ${ignoreRule} to .gitignore, so the local report stays out of Git.\n`;
+export const gitignoreOutputEnabled = (settings = process.env) => settings.CF_LOCAL_GITIGNORE_OUTPUT !== "0";
+/** Keep local excerpts out of Git after a successful default report write. */
+export async function ignoreDefaultOutput(folder, outputDir, options = {}) {
+    if (outputDir !== undefined || !gitignoreOutputEnabled(options.settings))
+        return false;
+    try {
+        // Automatic edits need confirmed checkout boundaries even when ignore reads can trust Git alone.
+        const reported = await gitRepositoryRoot(async (args) => (await runGit(folder, args)).toString("utf8"), folder);
+        if (!(await analysisReadRoots(folder, reported)).repository)
+            return false;
+        const facts = await createGitIgnoreFactsQuery(folder)([ignoreRule]);
+        if (!facts || facts.has(ignoreRule))
+            return false;
+        // Appending preserves existing rules, and refusing links keeps this write in the selected folder.
+        const [path] = await outputPaths(folder, [".gitignore"], folder);
+        const file = await open(path, constants.O_RDWR | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o644);
+        try {
+            const info = await file.stat();
+            if (!info.isFile())
+                return false;
+            const last = Buffer.alloc(1);
+            if (info.size)
+                await file.read(last, 0, 1, info.size - 1);
+            await file.writeFile(`${info.size && last[0] !== 10 ? "\n" : ""}${ignoreRule}\n`);
+        }
+        finally {
+            await file.close();
+        }
+        return true;
+    }
+    catch { /* Report delivery must survive an unavailable Git command or ignore file. */ }
+    return false;
+}

package/dist/adapters/models.js

@@ -1,6 +1,4 @@
 import { executeStructuredRequest } from "../analysis-core/llm/execution.js";
-import { findingHeadlinesEnabled } from "../analysis-core/settings.js";
-import { headlineRequest } from "../analysis-core/analysis/headlines/input.js";
 import { retryCalls } from "../analysis-core/llm/slots.js";
 import { relayModel, ModelConfigurationError } from "../gatekeeper/model.js";
 import { readableRequestTools, readableInstructions } from "./instructions.js";
@@ -42,10 +40,7 @@ export async function selectAnalysisExecution(transport, source, relay) {
     return { model: relayModel({ ...relay, bundleVersion: requestTools.bundleVersion }), requestTools,
         instructions: async () => { throw new Error("Readable instructions are unavailable in relay mode"); } };
 }
-export async function analysisExecution(model, options = {}, settings = {}) {
+export async function analysisExecution(model, options = {}) {
     const execution = options.execution ?? await selectAnalysisExecution(options.transport ?? {}, () => "execute" in model ? model : localModel(model), options.relay);
-    // Validate enabled result support before earlier stages can spend, even for supplied executions.
-    if (findingHeadlinesEnabled(settings))
-        execution.requestTools.headlinePlan(headlineRequest([]));
     return execution;
 }

package/dist/adapters/output-paths.js

@@ -1,8 +1,9 @@
-import { lstat, mkdir, realpath } from "node:fs/promises";
+import { chmod, lstat, mkdir, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { FINISH_FAILURE_MESSAGE } from "../contract/cli-refusals.js";
 import { resolveFolderPath } from "./folder-path.js";
 import { durableWrite } from "./durable-write.js";
+export const DEFAULT_OUTPUT_DIR = ".counterfact";
 export class OutputPathError extends Error {
     constructor() {
         super(FINISH_FAILURE_MESSAGE);
@@ -16,7 +17,7 @@ const within = (base, path) => {
 /** Validate the selected anchor and every output component before creating or replacing files. */
 export async function outputPaths(folder, names, outputDir, create = false) {
     const selected = resolve(folder), root = await resolveFolderPath(folder);
-    const requested = resolve(outputDir ?? join(selected, ".counterfact"));
+    const requested = resolve(outputDir ?? join(selected, DEFAULT_OUTPUT_DIR));
     let directory = within(selected, requested) ? resolve(root, relative(selected, requested)) : requested;
     const external = !within(root, directory);
     const userUid = process.getuid?.();
@@ -84,6 +85,8 @@ export async function outputPaths(folder, names, outputDir, create = false) {
 export async function writeOutputFiles(folder, files, outputDir) {
     const names = Object.keys(files);
     const paths = await outputPaths(folder, names, outputDir, true);
+    if (paths.length)
+        await chmod(dirname(paths[0]), 0o700);
     for (let index = 0; index < paths.length; index++) {
         await outputPaths(folder, names, outputDir);
         await durableWrite(paths[index], files[names[index]]);

package/dist/adapters/public-instructions.js

@@ -13,7 +13,7 @@ export function loadPublicRequestTools(value, verificationKey, settings = {}) {
     const renderingUnavailable = () => { throw new Error("Instruction rendering requires the sealed relay"); };
     if (findingHeadlinesEnabled(settings) && bundle.metadata.headlinePlan?.resultVersion !== HEADLINE_RESULT_VERSION)
         renderingUnavailable();
-    return { ...versions, bundleVersion: bundle.version, modelReaderPrompt: renderingUnavailable, callInputBytes, checkDiagnosticsText,
+    return { ...versions, bundleVersion: bundle.version, answerFormats: bundle.answerFormats, modelReaderPrompt: renderingUnavailable, callInputBytes, checkDiagnosticsText,
         buildAnalysisCall: renderingUnavailable,
         headlinePlan(request) {
             const plan = bundle.metadata.headlinePlan;

package/dist/adapters/relay-plan.js

@@ -1,13 +1,10 @@
 import { bundleContentHash } from "../bundle/seal/signature.js";
 import { checkPlannedCallsAgainstBundle } from "../bundle/seal/planned-calls.js";
-import { localCallPlan } from "../analysis-core/requests/local-plan.js";
+import { localSourcePlan } from "../analysis-core/requests/local-plan.js";
 import { relayPlanSchema } from "../contract/console.js";
 /** Callers authenticate the release before reading files; only this owner turns source facts into a paid plan. */
 export function prepareRelayPlan({ bundle, tools, relayVersion, settings, source }) {
-    const files = Object.entries(source.files).map(([path, text]) => ({ path, size: Buffer.byteLength(text) }));
-    const calls = localCallPlan(settings, files, {
-        structureState: { repos: [{ key: source.repoKey, kind: "fs", files: source.files, ...(source.root !== undefined ? { root: source.root } : {}) }], mapped: [source.fragment] },
-    });
+    const { files, calls } = localSourcePlan(settings, source);
     checkPlannedCallsAgainstBundle(bundle, calls);
     return { files, plan: relayPlanSchema.parse({ bundleVersion: tools.bundleVersion,
             bundleHash: bundleContentHash(bundle.sealed), relayVersion,

package/dist/adapters/release.js

@@ -7,6 +7,7 @@ import { relayOrigin } from "../gatekeeper/connection.js";
 import { z } from "zod";
 import { cliRefusals } from "../contract/cli-refusals.js";
 import { RELEASE_KEY_SPKI_SHA256 } from "../contract/release-key.js";
+import { findingAudienceSettings } from "../analysis-core/analysis/finding-audience-switch.js";
 const releasePins = z.object({ verificationKey: z.string().min(1), relayVersion: z.string().min(1), localVersion: z.string().min(1),
     relayUrl: z.string().min(1), projectContext: z.literal("checks") });
 export function readClientReleasePins(value) {
@@ -20,7 +21,7 @@ export function validateClientRelease(release, settings = {}) {
     const tools = loadPublicRequestTools(bundle, release.verificationKey, settings);
     if (!bundle.relayVersions.includes(release.relayVersion))
         throw new Error();
-    return { bundle, tools };
+    return { bundle, tools, settings: findingAudienceSettings(settings, bundle) };
 }
 export function readClientReleaseKey(pem) {
     const key = createPublicKey(pem);

package/dist/adapters/repository-files.js

@@ -1,11 +1,172 @@
 import { constants } from "node:fs";
+import { createHash } from "node:crypto";
 import { lstat, open, opendir, realpath, stat } from "node:fs/promises";
-import { dirname, join, relative, sep } from "node:path";
+import { join, relative, sep } from "node:path";
 import { READ_LIMITS } from "../analysis-core/import/outside-loader-sources.js";
 import { admitFile, FileReadRefusal, readRepoFile, resolveLocalExclusions } from "../analysis-core/conventions/file-admission.js";
 import { createGitIgnore } from "./git-ignore.js";
 import { createIgnoredFileCollector } from "./ignored-files.js";
-import { searchBaseMatches, searchBoundary } from "./repository-root.js";
+import { readTargetMatches, searchBaseMatches, searchBoundary } from "./repository-root.js";
+import { resolveLocalExclusions as safetyExclusions } from "../analysis-core/contracts/file-safety.js";
+/** The transport lists permitted bytes without deciding their role in an agent. */
+export async function createAnalysisFileSource(settings, root, admission, signal, options = {}) {
+    const guarded = { ...settings, CF_LOCAL_SYMLINK_GUARD: "1" };
+    const expectedBoundary = (await searchBoundary(root))?.base ?? null;
+    const excludedTargets = await safetyExclusions(admission, async (path) => realpath(join(root, path)).catch(() => null));
+    const committed = options.committed && new Set([...options.committed].flatMap(path => {
+        const parts = path.split("/");
+        return parts.map((_, index) => parts.slice(0, index + 1).join("/"));
+    }));
+    const permission = async (path) => {
+        signal?.throwIfAborted();
+        if (committed && !committed.has(path))
+            return { admitted: false, reason: "out-of-scope" };
+        const lexical = admitFile(guarded, { path }, { ...admission, purpose: "listing", route: "local-folder" });
+        if (!lexical.admitted)
+            return lexical;
+        const target = await realpath(join(root, path));
+        if (relative(root, target).split(sep).includes(".git"))
+            return { admitted: false, reason: "out-of-scope" };
+        const currentExclusions = await safetyExclusions(admission, async (path) => realpath(join(root, path)).catch(() => null));
+        const canonical = relative(root, target).split(sep).join("/");
+        if (committed && !committed.has(canonical))
+            return { admitted: false, reason: "out-of-scope" };
+        const ask = { ...admission, purpose: "listing", route: "local-folder", localTarget: { root, path: target, excludedTargets: [...excludedTargets, ...currentExclusions] } };
+        const lexicalTarget = admitFile(guarded, { path }, ask);
+        const allowed = lexicalTarget.admitted ? admitFile(guarded, { path: canonical }, ask) : lexicalTarget;
+        return allowed.admitted ? { admitted: true, target } : allowed;
+    };
+    const admittedCapture = async (file) => {
+        try {
+            const current = await permission(file.path);
+            if (!current.admitted)
+                return current;
+            if (current.target !== file.target || !await readTargetMatches(file.target, expectedBoundary))
+                return { admitted: false, reason: "out-of-scope" };
+            const info = await stat(current.target, { bigint: true });
+            return info.isFile() && info.dev === file.device && info.ino === file.inode
+                ? { admitted: true } : { admitted: false, reason: "out-of-scope" };
+        }
+        catch {
+            signal?.throwIfAborted();
+            return { admitted: false, reason: "unreadable" };
+        }
+    };
+    return {
+        allowed: admittedCapture,
+        async capture(accept, existing = new Map()) {
+            let entriesVisited = 0, truncated = false;
+            const maxBytes = options.maxBytes ?? READ_LIMITS.archive.bytes;
+            const directories = new Set();
+            const targets = new Set();
+            async function walk(dir, prefix) {
+                signal?.throwIfAborted();
+                if (directories.has(dir))
+                    return;
+                directories.add(dir);
+                const handle = await opendir(dir);
+                try {
+                    while (true) {
+                        signal?.throwIfAborted();
+                        if (entriesVisited >= READ_LIMITS.archive.files) {
+                            truncated = true;
+                            return;
+                        }
+                        const item = await handle.read();
+                        if (!item)
+                            return;
+                        entriesVisited++;
+                        // Administrative markers are local boundary evidence, never analysis inputs.
+                        if (item.name === ".git")
+                            continue;
+                        const path = prefix ? `${prefix}/${item.name}` : item.name;
+                        let allowed;
+                        try {
+                            allowed = await permission(path);
+                        }
+                        catch {
+                            signal?.throwIfAborted();
+                            continue;
+                        }
+                        if (!allowed.admitted)
+                            continue;
+                        const target = allowed.target;
+                        const info = await stat(target, { bigint: true }).catch(() => null);
+                        if (!info)
+                            continue;
+                        if (info.isDirectory()) {
+                            if (await lstat(join(target, ".git")).then(() => true, error => error.code !== "ENOENT"))
+                                continue;
+                            await walk(target, relative(root, target).split(sep).join("/"));
+                            if (entriesVisited >= READ_LIMITS.archive.files)
+                                return;
+                        }
+                        else if (info.isFile() && !targets.has(target)) {
+                            const canonical = relative(root, target).split(sep).join("/");
+                            const prior = existing.get(target);
+                            if (prior) {
+                                const current = { ...prior, path: canonical };
+                                if (prior.device === info.dev && prior.inode === info.ino && (await admittedCapture(current)).admitted)
+                                    accept(current);
+                                targets.add(target);
+                                continue;
+                            }
+                            if (info.size > BigInt(maxBytes)) {
+                                truncated = true;
+                                continue;
+                            }
+                            let input, bytes;
+                            try {
+                                input = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+                                const before = await input.stat({ bigint: true });
+                                if (!before.isFile() || before.dev !== info.dev || before.ino !== info.ino || before.size !== info.size)
+                                    continue;
+                                bytes = Buffer.alloc(65_536);
+                                const hash = createHash("sha256");
+                                const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+                                let offset = 0;
+                                while (offset < Number(before.size)) {
+                                    signal?.throwIfAborted();
+                                    const { bytesRead } = await input.read(bytes, 0, Math.min(bytes.length, Number(before.size) - offset), offset);
+                                    if (!bytesRead)
+                                        break;
+                                    const part = bytes.subarray(0, bytesRead);
+                                    hash.update(part);
+                                    decoder.decode(part, { stream: true });
+                                    offset += bytesRead;
+                                }
+                                decoder.decode();
+                                const after = await input.stat({ bigint: true });
+                                if (offset !== Number(before.size) || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+                                    continue;
+                                const file = { path: canonical, target, size: offset, hash: hash.digest("hex"), device: before.dev, inode: before.ino };
+                                await options.verify?.(file);
+                                // Git verification can yield while local permissions or checkout boundaries change.
+                                if (!(await admittedCapture(file)).admitted)
+                                    continue;
+                                targets.add(target);
+                                accept(file);
+                            }
+                            catch {
+                                signal?.throwIfAborted();
+                            }
+                            finally {
+                                // Clear source bytes before the buffer's memory is reused; decoded strings are left to garbage collection.
+                                bytes?.fill(0);
+                                await input?.close();
+                            }
+                        }
+                    }
+                }
+                finally {
+                    await handle.close().catch(() => { });
+                }
+            }
+            await walk(root, "");
+            return { entriesVisited, truncated };
+        },
+    };
+}
 /** Construction does no I/O. Discovery is initialized only by the owner's request. */
 export function createRepositoryFiles(settings, folder, admission = {}, options = {}) {
     const guarded = { ...settings, CF_LOCAL_SYMLINK_GUARD: "1" };
@@ -162,8 +323,7 @@ export function createRepositoryFiles(settings, folder, admission = {}, options
                 const allowed = await admit(ctx, entry.path, target, entry.size);
                 if (!allowed.admitted)
                     return { text: null, bytesRead, refusal: allowed.reason };
-                const boundary = await searchBoundary(dirname(target));
-                if (!boundary || !await searchBaseMatches(boundary.base, ctx.base))
+                if (!await readTargetMatches(target, ctx.base))
                     return { text: null, bytesRead, refusal: "out-of-scope" };
                 const capacity = Math.min(maxBytes, READ_LIMITS.codeScan.fileBytes + 1);
                 if (!Number.isSafeInteger(capacity) || capacity <= 0)