@counterfact-labs/cli 0.2.4 → 0.2.5

package/dist/cli/commands/finding.js

@@ -1,6 +1,12 @@
-export async function finding(id, ctx) {
-    const value = await ctx.api.request(`findings/${encodeURIComponent(id)}`);
-    ctx.write(`${value.title}\n${value.explanation}\n`);
+import { loadFinding } from "../finding-lookup.js";
+import { formatFindingNumber } from "../finding-display.js";
+import { findingSequenceSchema } from "../../contract/findings.js";
+export async function finding(id, ctx, options = {}) {
+    const value = await loadFinding(id, ctx.api, options.projectId, options.numbers ?? false);
+    const showNumber = ctx.findingNumbers !== false && findingSequenceSchema.safeParse(value.seq).success;
+    options.onLoaded?.(value);
+    const number = showNumber ? `${formatFindingNumber(value.seq)} ` : "";
+    ctx.write(`${number}${value.title}\n${value.explanation}\n`);
     for (const quote of value.quotes) {
         ctx.write(`\n${quote.path}${quote.line === null ? "" : `:${quote.line}`}\n`);
         if (quote.text !== null)

package/dist/cli/context.js

@@ -6,15 +6,18 @@ import { openBrowser } from "./browser.js";
 import { readCredentials } from "./credentials.js";
 import { userEmail } from "./git.js";
 import { terminalSignInInput } from "./sign-in-input.js";
+import { readFindingSettings } from "./finding-settings.js";
 export function commandContext(options = {}) {
     const startup = readCliSettings(options.env, options.emailSignIn);
     const homeDir = options.homeDir ?? homedir();
     const baseUrl = (options.baseUrl ?? startup.baseUrl ?? DEFAULT_URL).replace(/\/+$/, "");
     const api = new ApiClient(baseUrl, () => readCredentials(homeDir, api.baseUrl), undefined, options.signal);
     const write = options.write ?? (text => { process.stdout.write(text); });
+    const findingSettings = options.findingSettings ?? readFindingSettings(options.env);
     return {
+        findingNumbers: findingSettings.numbersEnabled,
         startup, signal: options.signal, relayRuntime: options.relayRuntime, cwd: options.cwd ?? process.cwd(),
-        token: () => readCredentials(homeDir, api.baseUrl), onCheckComplete: options.onCheckComplete, onCheckStart: options.onCheckStart,
+        token: () => readCredentials(homeDir, api.baseUrl), onCheckComplete: options.onCheckComplete, onCheckStart: options.onCheckStart, onAgentChoice: options.onAgentChoice,
         api, homeDir, write, openBrowser: options.openBrowser ?? openBrowser,
         signInInput: options.signInInput ?? terminalSignInInput(), readEmail: options.readEmail ?? userEmail,
         sleep: options.sleep ?? (async (ms) => { await delay(ms, undefined, { signal: options.signal }); }), now: options.now ?? Date.now,

package/dist/cli/finding-display.js

@@ -0,0 +1,39 @@
+import { groupByAudience } from "../analysis-core/analysis/schemas.js";
+export const TEAM_WORKFLOW_HEADING = "Team workflow";
+export const formatFindingNumber = (seq) => `F-${seq}`;
+/** Intake returns one id per payload finding in order; the optional number mapping is joined by id. */
+export function savedFindings(result, report) {
+    const numbers = new Map(result.findings?.map(value => [value.id, value]));
+    return result.findingIds.map((id, index) => {
+        const numbered = numbers.get(id), local = report[index];
+        return { id, ...(numbered ? { seq: numbered.seq, number: formatFindingNumber(numbered.seq) } : {}),
+            title: local?.title ?? "", ...(local?.audience === undefined ? {} : { audience: local.audience }) };
+    });
+}
+function findingLine(value, enabled, index, labels, audienceEnabled) {
+    // The off switch preserves the original Markdown summary, including whitespace.
+    if (labels === "position" && !audienceEnabled)
+        return `${index + 1}. ${value.title}`;
+    const title = value.title.replace(/[\r\n\u2028\u2029]+/g, " ");
+    const label = labels === "position" ? `${index + 1}.` : enabled && value.seq !== undefined ? formatFindingNumber(value.seq) : value.id ?? `${index + 1}.`;
+    return `${label}${title ? ` ${title}` : ""}`;
+}
+export function findingDisplayRows(findings, { numbersEnabled = true, audienceEnabled, labels }) {
+    const groups = audienceEnabled ? groupByAudience(findings) : { users: findings, team: [] };
+    return [...groups.users, ...groups.team].map((finding, index) => ({ finding,
+        label: findingLine(finding, numbersEnabled, index, labels, audienceEnabled), startsTeamGroup: groups.team.length > 0 && index === groups.users.length }));
+}
+export function formatSavedFindings(result, options) {
+    if (options.numbersEnabled !== false && result.findings?.some(value => value.seq !== undefined)) {
+        return "Findings:\n" + findingDisplayRows(result.findings, { ...options, labels: "reference" }).map(row => `${row.startsTeamGroup ? `${TEAM_WORKFLOW_HEADING}:\n` : ""}${row.label}\n`).join("");
+    }
+    return result.findingIds?.length ? `Finding ids: ${result.findingIds.join(", ")}\n` : "";
+}
+export function formatWaitingFixes(items, enabled, needsProject) {
+    if (!items.length)
+        return "No waiting fixes.";
+    return "Waiting fixes:\n" + findingDisplayRows(items.map(item => ({ ...item, id: item.findingId })), { numbersEnabled: enabled, audienceEnabled: false, labels: "reference" }).map(({ finding: item, label }) => {
+        const scope = [item.repoKey, ...(enabled && needsProject(item) ? [`project ${item.projectId}`] : [])].filter(Boolean);
+        return `${label}${scope.length ? ` (${scope.join("; ")})` : ""}\n`;
+    }).join("");
+}

package/dist/cli/finding-lookup.js

@@ -0,0 +1,92 @@
+import { canonicalUuidSchema, findingNumberParamsSchema, findingNumberResponseSchema, findingSequenceSchema } from "../contract/findings.js";
+import { cliApiMessages } from "../contract/cli-api-messages.js";
+export const FINDING_PROJECT_MESSAGE = "Give the project for this finding number, which analysis results and the waiting_fixes tool list.";
+export const numberedFindingInputSchema = { type: "object", properties: {
+        id: { type: "string", description: "A finding id, or a number such as F-10." },
+        projectId: { type: "string", description: "The project the finding number belongs to, needed unless this session knows only one project." },
+    }, required: ["id"], additionalProperties: false };
+export function findingNumber(value) {
+    const match = /^F-?([1-9][0-9]*)$/i.exec(value.trim());
+    const seq = match ? Number(match[1]) : undefined;
+    return seq !== undefined && Number.isSafeInteger(seq) ? seq : undefined;
+}
+export class FindingReferences {
+    projects = new Set();
+    analysedProjects = new Set();
+    remember(projectId, source = "analysis") {
+        const canonical = projectId.toLowerCase();
+        this.projects.add(canonical);
+        if (source === "analysis")
+            this.analysedProjects.add(canonical);
+    }
+    // Observed findings cannot prove another project lacks the same historical number.
+    project() { return this.projects.size === 1 ? [...this.projects][0] : undefined; }
+    async resolve(reference, projectId, readWaiting) {
+        const seq = findingNumber(reference);
+        if (projectId || seq === undefined)
+            return projectId;
+        let waiting = [];
+        try {
+            waiting = await readWaiting?.() ?? [];
+        }
+        catch { /* A known project can still resolve a finding when the queue is unavailable. */ }
+        return this.resolveNumber(this.waitingByNumber(waiting).get(seq) ?? []);
+    }
+    projectsNeeded(waiting) {
+        const needed = new Set();
+        for (const matches of this.waitingByNumber(waiting).values()) {
+            const project = this.resolveNumber(matches);
+            for (const item of matches)
+                if (project !== item.projectId.toLowerCase())
+                    needed.add(item.findingId);
+        }
+        return needed;
+    }
+    waitingByNumber(waiting) {
+        const numbers = new Map();
+        for (const item of waiting) {
+            this.remember(item.projectId, "waiting");
+            const matches = numbers.get(item.seq);
+            if (matches)
+                matches.push(item);
+            else
+                numbers.set(item.seq, [item]);
+        }
+        return numbers;
+    }
+    resolveNumber(matches) {
+        if (!matches.length && this.analysedProjects.size === 1)
+            return [...this.analysedProjects][0];
+        if (matches.length !== 1)
+            return this.project();
+        const candidate = matches[0].projectId.toLowerCase();
+        // A queued fix may be older than the project the user just analysed.
+        if (this.analysedProjects.size > 0 && (this.analysedProjects.size !== 1 || !this.analysedProjects.has(candidate)))
+            return undefined;
+        return candidate;
+    }
+}
+export async function loadFinding(reference, api, projectId, numbered = true) {
+    const seq = numbered ? findingNumber(reference) : undefined;
+    let id = reference;
+    if (seq !== undefined) {
+        if (!projectId)
+            throw new Error(FINDING_PROJECT_MESSAGE);
+        const params = findingNumberParamsSchema.safeParse({ projectId, seq: String(seq) });
+        if (!params.success)
+            throw new Error(FINDING_PROJECT_MESSAGE);
+        const result = findingNumberResponseSchema.safeParse(await api.request(`projects/${params.data.projectId}/findings/${params.data.seq}`));
+        if (!result.success || result.data.seq !== seq)
+            throw new Error(cliApiMessages.invalid_response);
+        id = result.data.id;
+    }
+    const value = await api.request(`findings/${encodeURIComponent(id)}`);
+    const canonicalId = canonicalUuidSchema.safeParse(value.id);
+    if (seq !== undefined && (!canonicalId.success || canonicalId.data !== id || value.seq !== undefined && value.seq !== seq)) {
+        throw new Error(cliApiMessages.invalid_response);
+    }
+    if (seq !== undefined)
+        return { ...value, id, seq };
+    const { seq: detailSeq, ...detail } = value;
+    return numbered && detailSeq !== undefined && !findingSequenceSchema.safeParse(detailSeq).success ? detail : value;
+}

package/dist/cli/finding-settings.js

@@ -0,0 +1,5 @@
+import { findingAudienceEnabled } from "../analysis-core/analysis/finding-audience-switch.js";
+export function readFindingSettings(env = process.env, bundle) {
+    return { numbersEnabled: env.CF_FINDING_NUMBERS !== "0", fixesEnabled: env.CF_WAITING_FIXES !== "0",
+        audienceEnabled: findingAudienceEnabled(env, bundle) };
+}

package/dist/cli/fix-requests.js

@@ -0,0 +1,42 @@
+import { waitingFixesResponseSchema, claimFixRequestParamsSchema, claimFixRequestResponseSchema } from "../contract/fix-requests.js";
+import { cliApiMessages } from "../contract/cli-api-messages.js";
+import { ApiError } from "./api.js";
+export const FIX_DISCOVERY_TIMEOUT_MS = 2_000;
+export const fixRequestTools = [
+    { name: "waiting_fixes", description: "Lists the fixes you asked for in the console that are still waiting. It is read-only and free.",
+        annotations: { readOnlyHint: true },
+        inputSchema: { type: "object", properties: {}, additionalProperties: false } },
+    { name: "claim_fix", description: "Marks a waiting fix as taken when you start it, without editing files or running an analysis.",
+        inputSchema: { type: "object", properties: { id: { type: "string", description: "The findingId returned by waiting_fixes." } }, required: ["id"], additionalProperties: false } },
+];
+export async function waitingFixes(api, options = {}) {
+    try {
+        const result = waitingFixesResponseSchema.safeParse(await api.request("fix-requests", undefined, true, options));
+        if (!result.success)
+            throw new Error(cliApiMessages.invalid_response);
+        return result.data;
+    }
+    catch (error) {
+        // An older console has no queue; read-only discovery still works during rollout.
+        if (error instanceof ApiError && error.status === 404)
+            return [];
+        throw error;
+    }
+}
+export async function waitingFixCount(api) {
+    try {
+        return (await waitingFixes(api, { timeoutMs: FIX_DISCOVERY_TIMEOUT_MS })).length;
+    }
+    catch {
+        return 0;
+    }
+}
+export async function claimFix(api, id) {
+    const params = claimFixRequestParamsSchema.safeParse({ id });
+    if (!params.success)
+        throw new Error("Provide a finding id.");
+    const result = claimFixRequestResponseSchema.safeParse(await api.request(`fix-requests/${params.data.id}/claim`, {}));
+    if (!result.success || result.data.findingId !== params.data.id)
+        throw new Error(cliApiMessages.invalid_response);
+    return result.data;
+}

package/dist/cli/intake-payload.js

@@ -1,18 +1,26 @@
+import { resultSafetyCheckEnabled } from "../analysis-core/settings.js";
 import { localFindingsPayloadSchema } from "../contract/console.js";
+import { projectPublicFinding } from "../contract/public-report.js";
+import { checkIntakeFindings } from "./result-check.js";
 import { RESULTS_TOO_LARGE_MESSAGE } from "../contract/cli-refusals.js";
-export function buildIntakePayload(identity, agent, report) {
+export function buildIntakePayload(identity, agent, report, options = {}) {
     const repo = (key) => key === null || key === report.repoKey ? agent.repository : key;
-    const findings = report.findings.map(finding => {
-        // The local report may add presentation fields; the intake accepts cleaned evidence only.
-        const { kind, severity, title, cause, summary, category, question, site, excerpt, otherSites, fixes, sourceNotes } = finding;
-        return { kind, severity, title, cause, summary, category, question, site, excerpt,
-            fixes: fixes.map(({ title, approach, kind, targetFiles, expectedOutcome, summary, impact, confidence, objective, status, blockedBy, alsoFixes, delta }) => ({ title, approach, kind, targetFiles, expectedOutcome, summary, impact, confidence, objective, status, blockedBy, alsoFixes, delta })),
-            siteRepo: repo(finding.siteRepo), otherSites: otherSites.map(site => ({ ...site, repo: repo(site.repo) })),
-            ...(sourceNotes === undefined ? {} : { sourceNotes: sourceNotes && { ...sourceNotes,
-                    counterEvidence: sourceNotes.counterEvidence.map(site => ({ ...site, repo: repo(site.repo) })) } }) };
-    });
+    let findings = report.findings.map(finding => projectPublicFinding(finding, repo));
+    let resultCheck = null;
+    let findingIndexes = report.findings.map((_, index) => index);
+    if (resultSafetyCheckEnabled(options.settings ?? {})) {
+        const captured = options.files;
+        if (!captured)
+            throw new Error("Result check requires a captured file snapshot");
+        const admitted = Object.fromEntries(agent.files.filter(file => Object.hasOwn(captured, file.path))
+            .map(file => [file.path, captured[file.path]]));
+        const { findings: accepted, acceptedIndexes, ...counts } = checkIntakeFindings(findings, { repoKey: agent.repository, files: admitted });
+        findings = accepted;
+        resultCheck = counts;
+        findingIndexes = acceptedIndexes;
+    }
     const result = localFindingsPayloadSchema.safeParse({ ...identity, agent, findings });
     if (!result.success)
         throw new Error(RESULTS_TOO_LARGE_MESSAGE);
-    return result.data;
+    return { payload: result.data, resultCheck, findingIndexes };
 }

package/dist/cli/main.js

@@ -4,13 +4,13 @@ import { realpath } from "node:fs/promises";
 import { errorCode, errorText } from "./api.js";
 import { readEmailSignIn } from "../adapters/settings.js";
 import { commandContext } from "./context.js";
-import { analyze } from "./commands/analyze.js";
+import { analyze, parseAnalyzeOptions } from "./commands/analyze.js";
 import { finding } from "./commands/finding.js";
 import { balance } from "./commands/balance.js";
 import { login, parseLoginOptions } from "./commands/login.js";
 import { logout } from "./commands/logout.js";
 import { serveMcp } from "./mcp.js";
-const usage = "Usage: counterfact-labs analyze [path]\n       counterfact-labs finding <id>\n       counterfact-labs balance | login | logout | mcp\n";
+const usage = "Usage: counterfact-labs analyze [path] [--proposal <json-file>]\n       counterfact-labs finding <id>\n       counterfact-labs balance | login | logout | mcp\n";
 export async function run(args, options = {}) {
     const write = options.write ?? (text => { process.stdout.write(text); });
     const emailSignIn = options.emailSignIn ?? readEmailSignIn(options.env);
@@ -22,9 +22,14 @@ export async function run(args, options = {}) {
             return 0;
         }
         if (command === "analyze") {
-            if (rest.length > 1 || rest.some(arg => arg.startsWith("-")))
+            let parsed;
+            try {
+                parsed = parseAnalyzeOptions(rest);
+            }
+            catch {
                 throw new Error(usage.trimEnd());
-            return await analyze(rest[0] ?? ".", {}, commandContext(commandOptions));
+            }
+            return await analyze(parsed.path, parsed.options, commandContext(commandOptions));
         }
         if (command === "finding" && rest.length === 1 && !rest[0].startsWith("-"))
             return await finding(rest[0], commandContext(commandOptions));

package/dist/cli/mcp.js

@@ -15,11 +15,16 @@ import { emailSignInMessages } from "../contract/email-sign-in-messages.js";
 import { EMAIL_SIGN_IN_TERMS, normalizeSignInEmail, validSignInCode, startEmailSignIn, signInWithCode } from "./email-sign-in.js";
 import { resolveAgentFolder, resolveMcpAgentFolder } from "./agent-folder.js";
 import { suggestedEmail } from "./suggested-email.js";
+import { agentProposalInputSchema } from "../contract/agent-proposal.js";
+import { fixRequestTools, waitingFixes, waitingFixCount, claimFix, FIX_DISCOVERY_TIMEOUT_MS } from "./fix-requests.js";
+import { FINDING_PROJECT_MESSAGE, FindingReferences, numberedFindingInputSchema } from "./finding-lookup.js";
+import { findingDisplayRows, formatFindingNumber, formatWaitingFixes } from "./finding-display.js";
+import { readFindingSettings } from "./finding-settings.js";
 const legacyTools = [
     {
         name: ANALYZE_TOOL_NAME,
         description: "Analyze the agent in a folder on this computer. Each call runs one analysis and charges the user's balance, so call it only when the user asks for an analysis. After edits, suggest an analysis and wait for the user to ask. Prices are listed on the top-up page and website. If the balance doesn't cover the analysis, show the returned message and top-up link.",
-        inputSchema: { type: "object", properties: { path: { type: "string", description: "The agent folder on this computer." } }, required: ["path"], additionalProperties: false },
+        inputSchema: { type: "object", properties: { path: { type: "string", description: "The agent folder on this computer." }, proposal: { ...agentProposalInputSchema, description: "Optional: the files you believe make up the agent, with each file's role. Paths are relative to the agent folder." } }, required: ["path"], additionalProperties: false },
     },
     { name: "get_finding", description: "Get a finding's explanation, quoted lines, and suggested fixes.", inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"], additionalProperties: false } },
     { name: "get_balance", description: "Get the balance and top-up link.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
@@ -35,12 +40,16 @@ class ProtocolError extends Error {
 }
 function object(value) { return value !== null && typeof value === "object" && !Array.isArray(value); }
 export async function serveMcp(input, output, options = {}) {
+    const audienceChoice = (options.env ?? process.env).CF_FINDING_AUDIENCE;
     const cwd = options.cwd ?? process.cwd();
     const guarded = (options.env ?? process.env).CF_MCP_PATH_GUARD !== "0";
     const launch = guarded ? resolveFolderPath(cwd).catch(() => null) : Promise.resolve(cwd);
     const lastAnalysis = new Map();
+    const findingSettings = readFindingSettings(options.env);
+    const { numbersEnabled, fixesEnabled } = findingSettings;
+    const references = new FindingReferences();
     const emailSignIn = options.emailSignIn ?? readEmailSignIn(options.env);
-    const tools = emailSignIn ? [...legacyTools.slice(0, 3),
+    const signInTools = emailSignIn ? [...legacyTools.slice(0, 3),
         {
             name: "sign_in_status",
             description: "Check whether this computer is signed in to Counterfact and whether the user has allowed the analysis tool in Claude Code. Use path only to choose the agent folder for the local git email suggestion; otherwise use the launch folder. Analysis permission is always checked in the launch folder. A valid local git email is returned as suggestedEmail. Prefer the signed-in user's email already in your context; otherwise offer suggestedEmail. Ask the user to confirm an address before sending a code. With wait: true, wait only for browser sign-in to finish.",
@@ -65,6 +74,9 @@ export async function serveMcp(input, output, options = {}) {
                 }, required: ["email", "code"], additionalProperties: false },
         },
     ] : legacyTools;
+    const tools = signInTools.map(tool => tool.name === "get_finding" && numbersEnabled ? {
+        ...tool, inputSchema: numberedFindingInputSchema,
+    } : tool).concat(fixesEnabled ? fixRequestTools : []);
     let pendingSignIn;
     const requests = new Map();
     let queue = Promise.resolve();
@@ -76,15 +88,18 @@ export async function serveMcp(input, output, options = {}) {
         if (!object(args))
             throw new ProtocolError(-32602, "Tool arguments must be an object.");
         const name = params.name;
-        const allowed = name === ANALYZE_TOOL_NAME ? ["path"] : name === "get_finding" ? ["id"]
-            : name === "sign_in_status" ? (emailSignIn ? ["wait", "path"] : ["wait"])
-                : emailSignIn && name === "sign_in" ? ["email"] : emailSignIn && name === "sign_in_with_code" ? ["email", "code"] : [];
+        const allowed = name === ANALYZE_TOOL_NAME ? ["path", "proposal"] : name === "get_finding" ? (numbersEnabled ? Object.keys(numberedFindingInputSchema.properties) : ["id"])
+            : name === "claim_fix" ? ["id"]
+                : name === "sign_in_status" ? (emailSignIn ? ["wait", "path"] : ["wait"])
+                    : emailSignIn && name === "sign_in" ? ["email"] : emailSignIn && name === "sign_in_with_code" ? ["email", "code"] : [];
         if (!tools.some(tool => tool.name === name) || Object.keys(args).some(key => !allowed.includes(key)))
             throw new ProtocolError(-32602, "Unknown tool or argument.");
         if (name === ANALYZE_TOOL_NAME && (typeof args.path !== "string" || !args.path.trim()))
             throw new ProtocolError(-32602, "Provide a path.");
         if (name === "get_finding" && (typeof args.id !== "string" || !args.id.trim()))
             throw new ProtocolError(-32602, "Provide a finding id.");
+        if (name === "get_finding" && args.projectId !== undefined && (typeof args.projectId !== "string" || !args.projectId.trim()))
+            throw new ProtocolError(-32602, FINDING_PROJECT_MESSAGE);
         if (name === "sign_in_status" && args.wait !== undefined && typeof args.wait !== "boolean")
             throw new ProtocolError(-32602, "Provide an optional boolean wait.");
         if (name === "sign_in_status" && "path" in args && (typeof args.path !== "string" || !args.path.trim()))
@@ -96,12 +111,30 @@ export async function serveMcp(input, output, options = {}) {
         if (name === "sign_in_with_code" && !validSignInCode(args.code))
             throw new ProtocolError(-32602, emailSignInMessages.invalid_code);
         let text = "", exitCode = 0;
+        let agentChoice;
         let findingIds;
-        let url;
+        let findings, projectId;
+        let loadedFinding;
+        let fixRequests, claimed;
+        let waitingCount;
+        let url, analysisFolder;
+        let started = false;
         let signIn;
         try {
-            const ctx = commandContext({ ...options, emailSignIn, signal, onCheckComplete: result => {
+            const ctx = commandContext({ ...options, env: { ...(options.env ?? process.env), CF_FINDING_AUDIENCE: audienceChoice },
+                emailSignIn, findingSettings, signal, onCheckStart: () => {
+                    started = true;
+                    if (guarded && analysisFolder)
+                        lastAnalysis.set(analysisFolder, ctx.now());
+                    options.onCheckStart?.();
+                }, onAgentChoice: choice => { agentChoice = choice; options.onAgentChoice?.(choice); }, onCheckComplete: result => {
                     findingIds = result.findingIds ?? [];
+                    if (numbersEnabled) {
+                        findings = findingDisplayRows(result.findings ?? [], { numbersEnabled,
+                            audienceEnabled: result.audienceEnabled, labels: "reference" }).map(row => row.finding);
+                        projectId = result.projectId;
+                        references.remember(result.projectId);
+                    }
                     url = result.url;
                     options.onCheckComplete?.(result);
                 }, write: chunk => {
@@ -109,8 +142,23 @@ export async function serveMcp(input, output, options = {}) {
                     if (!chunk.startsWith("\r"))
                         text += chunk;
                 } });
-            if (name === "get_finding")
-                await finding(args.id, ctx);
+            if (name === "waiting_fixes") {
+                const waiting = await waitingFixes(ctx.api);
+                fixRequests = waiting;
+                const projectsNeeded = references.projectsNeeded(waiting);
+                text = formatWaitingFixes(waiting, numbersEnabled, item => projectsNeeded.has(item.findingId));
+            }
+            else if (name === "claim_fix") {
+                claimed = await claimFix(ctx.api, args.id);
+                text = "The fix request is marked as taken.";
+            }
+            else if (name === "get_finding") {
+                const project = numbersEnabled ? await references.resolve(args.id, args.projectId, fixesEnabled ? () => waitingFixes(ctx.api, { timeoutMs: FIX_DISCOVERY_TIMEOUT_MS }) : undefined) : undefined;
+                await finding(args.id, ctx, { projectId: project, numbers: numbersEnabled, onLoaded: value => {
+                        if (numbersEnabled)
+                            loadedFinding = { ...value, ...(value.seq !== undefined ? { number: formatFindingNumber(value.seq) } : {}) };
+                    } });
+            }
             else if (name === "get_balance")
                 await balance(ctx);
             else if (name === "sign_in_status") {
@@ -129,6 +177,8 @@ export async function serveMcp(input, output, options = {}) {
                     }
                 }
                 signIn = { ...await signInStatus(ctx), analyzeToolAllowed: allowed };
+                if (fixesEnabled)
+                    waitingCount = signIn.signedIn ? await waitingFixCount(ctx.api) : 0;
                 text = signIn.signedIn ? "Signed in." : "Not signed in.";
                 if (emailSignIn) {
                     const suggestion = await suggestedEmail(resolveAgentFolder(args.path ?? ".", cwd), ctx.readEmail);
@@ -162,7 +212,7 @@ export async function serveMcp(input, output, options = {}) {
                         signal.addEventListener("abort", cancel, { once: true });
                         try {
                             signal.throwIfAborted();
-                            const flow = await startSignIn(commandContext({ ...options, emailSignIn, homeDir: ctx.homeDir, baseUrl: ctx.api.baseUrl, signal: controller.signal }));
+                            const flow = await startSignIn(commandContext({ ...options, emailSignIn, findingSettings, homeDir: ctx.homeDir, baseUrl: ctx.api.baseUrl, signal: controller.signal }));
                             pending = { flow, controller, opened: false };
                             pendingSignIn = pending;
                             const current = pending;
@@ -190,14 +240,9 @@ export async function serveMcp(input, output, options = {}) {
                 if (guarded && last !== undefined && ctx.now() - last < 10 * 60 * 1000) {
                     throw new Error(FINISH_FAILURE_MESSAGE);
                 }
-                let started = false;
+                analysisFolder = folder;
                 try {
-                    exitCode = await analyze(folder, {}, { ...ctx, onCheckStart: () => {
-                            started = true;
-                            if (guarded)
-                                lastAnalysis.set(folder, ctx.now());
-                            ctx.onCheckStart?.();
-                        } });
+                    exitCode = await analyze(folder, { proposal: args.proposal }, ctx);
                 }
                 finally {
                     if (guarded && started)
@@ -212,7 +257,9 @@ export async function serveMcp(input, output, options = {}) {
         // Some clients (Claude Code among them) give the model only the structured result when one is present, so it
         // repeats the text: without it the model cannot read the result.
         return { content: [{ type: "text", text }], isError: exitCode !== 0,
-            structuredContent: { text, exitCode, ...(findingIds ? { findingIds } : {}), ...(url ? { url } : {}), ...signIn } };
+            structuredContent: { text, exitCode, ...agentChoice, ...(findingIds ? { findingIds } : {}), ...(url ? { url } : {}), ...signIn,
+                ...(findings ? { findings, projectId } : {}), ...(loadedFinding ? { finding: loadedFinding } : {}),
+                ...(fixRequests ? { fixRequests } : {}), ...claimed, ...(waitingCount !== undefined ? { waitingFixes: waitingCount } : {}) } };
     }
     async function respond(message, id, signal) {
         if (signal.aborted)

package/dist/cli/relay-check.js

@@ -1,12 +1,14 @@
-import { resolveFolderPath } from "../adapters/folder-path.js";
-import { savedAnalysisUrl } from "../contract/console-url.js";
 import { randomUUID } from "node:crypto";
 import { disabledSetupPings } from "../setup-pings/client.js";
 import { saveCompletion, loadCompletion } from "../adapters/completion.js";
 import { saveLocalResults } from "../adapters/results.js";
+import { GITIGNORE_OUTPUT_NOTICE } from "../adapters/gitignore-output.js";
 import { OutputPathError, outputPaths } from "../adapters/output-paths.js";
 import { validateClientRelease } from "../adapters/release.js";
 import { selectAnalysisExecution } from "../adapters/models.js";
+import { resolveFolderPath } from "../adapters/folder-path.js";
+import { AgentChoiceError } from "../contract/agent-choice.js";
+import { savedAnalysisUrl } from "../contract/console-url.js";
 import { prepareRelayCheck } from "./relay-preparation.js";
 import { cliRefusals, COMMITTED_FILES_MESSAGE, FINISH_FAILURE_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, refusalExitCode } from "../contract/cli-refusals.js";
 import { ConsoleClient, ConsoleError } from "../gatekeeper/console.js";
@@ -14,9 +16,13 @@ import { GatekeeperClient } from "../gatekeeper/client.js";
 import { connectRelay, relayOrigin } from "../gatekeeper/connection.js";
 import productionTrust from "../gatekeeper/trust/production.json" with { type: "json" };
 import { runAnalysisToEnd } from "../core/analysis/run-to-end.js";
+import { findingPresentation } from "../analysis-core/findings/presentation.js";
 import { formatSummary } from "./summary.js";
 import { buildIntakePayload } from "./intake-payload.js";
 import { completionRecoveryDecision, COMPLETION_SETTINGS_MISMATCH_MESSAGE, matchesCheck } from "./completion-recovery.js";
+import { savedFindings } from "./finding-display.js";
+import { INVALID_PROPOSAL_MESSAGE } from "../contract/agent-proposal.js";
+import { readFindingSettings } from "./finding-settings.js";
 const stateLine = (status) => `Reservation ${status.state}; settlement ${status.settlement}; lease ${new Date(status.expiresAt).toLocaleString("en-US", { timeZone: "America/Los_Angeles", timeZoneName: "short" })}.\n`;
 function requireIntakeReservation(status) {
     if (status.state === "reserved")
@@ -31,7 +37,8 @@ function requireIntakeReservation(status) {
 async function submit(client, payload, signal) {
     signal.throwIfAborted();
     const status = await client.status(payload.reservationId);
-    const committed = (value) => ({ checkId: value.checkId, projectId: value.projectId, analysisId: value.analysisId, findingIds: value.findingIds, settlement: value.settlement });
+    const committed = (value) => ({ checkId: value.checkId, projectId: value.projectId, analysisId: value.analysisId, findingIds: value.findingIds,
+        ...(value.findings ? { findings: value.findings } : {}), settlement: value.settlement });
     if (!matchesCheck(status, payload))
         throw new ConsoleError("check_conflict");
     if (status.uploadState === "saved")
@@ -65,11 +72,14 @@ export function runReservedRelayCheck(folder, options) {
     return runRelayLifecycle(folder, options, options);
 }
 async function runRelayLifecycle(folder, options, existing) {
-    const { config, settings, stdout, stderr } = options;
+    const { config, stdout, stderr } = options;
+    let settings = options.settings;
+    const summaryOptions = { audienceEnabled: false };
     let client, reservationId, projectId;
     let connection = existing?.connection;
     let identity;
     let completedPayload;
+    let displayFindings;
     let completionOrigin;
     let completed = false, uploaded = false, heartbeat;
     let renewal;
@@ -77,7 +87,8 @@ async function runRelayLifecycle(folder, options, existing) {
     const signal = options.signal ? AbortSignal.any([controller.signal, options.signal]) : controller.signal;
     const showSaved = (result) => {
         const url = savedAnalysisUrl(result.projectId, config.CF_CONSOLE_URL);
-        options.onSaved?.({ ...result, url });
+        const findings = savedFindings({ findingIds: result.findingIds ?? [], findings: result.findings }, displayFindings ?? completedPayload?.findings ?? []);
+        options.onSaved?.({ ...result, findings, url, audienceEnabled: summaryOptions.audienceEnabled });
         stdout(`Saved analysis ${result.analysisId}: ${url}\n`);
     };
     try {
@@ -100,6 +111,8 @@ async function runRelayLifecycle(folder, options, existing) {
         // Signature verification precedes all folder reads, status calls and spending.
         const validated = validateClientRelease(options.release, settings);
         const { bundle } = validated;
+        settings = validated.settings;
+        summaryOptions.audienceEnabled = readFindingSettings(settings).audienceEnabled;
         folder = await resolveFolderPath(folder);
         signal.throwIfAborted();
         const prior = await loadCompletion(folder);
@@ -134,7 +147,7 @@ async function runRelayLifecycle(folder, options, existing) {
             if (error.code !== "ENOENT")
                 throw error;
         }
-        const { source, provenance, plan, start, startMetadata } = await prepareRelayCheck(folder, { ...options, signal, expectedCommit: existing?.expectedCommit }, validated);
+        const { source, provenance, plan, start, startMetadata } = await prepareRelayCheck(folder, { ...options, signal, expectedCommit: existing?.expectedCommit, expectedFiles: existing?.expectedFiles }, validated);
         let reservation = existing?.reservation;
         if (!reservation) {
             const started = await client.start(start, startMetadata);
@@ -171,9 +184,28 @@ async function runRelayLifecycle(folder, options, existing) {
         (options.setupPings ?? disabledSetupPings).ping("first_analysis_started");
         const report = await runAnalysisToEnd(source, execution.model, settings, { execution });
         signal.throwIfAborted();
-        const paths = await saveLocalResults(folder, report, source.skippedFiles, options.outputDir);
-        const payload = buildIntakePayload({ checkId: reservation.checkId, projectId: projectId, reservationId,
-            bundleVersion: bundle.version, relayVersion: options.release.relayVersion, counterfactLocalVersion: options.release.localVersion }, provenance, report);
+        const paths = await saveLocalResults(folder, report, source.skippedFiles, options.outputDir, { ...summaryOptions, settings });
+        try {
+            options.onLocalSaved?.(paths);
+            if (paths.ignoreAdded)
+                stderr(GITIGNORE_OUTPUT_NOTICE);
+        }
+        catch { /* Output failure must not change a server outcome. */ }
+        const { payload, resultCheck, findingIndexes } = buildIntakePayload({ checkId: reservation.checkId, projectId: projectId, reservationId,
+            bundleVersion: bundle.version, relayVersion: options.release.relayVersion, counterfactLocalVersion: options.release.localVersion }, provenance, report, { settings, files: source.snapshot });
+        displayFindings = findingIndexes.map(index => {
+            const finding = report.findings[index];
+            return { title: findingPresentation(finding).displayTitle, audience: finding.audience };
+        });
+        if (resultCheck?.droppedFindings) {
+            const count = resultCheck.droppedFindings;
+            const reason = resultCheck.schemaDroppedFindings || resultCheck.capDroppedFindings
+                ? `${count === 1 ? "it was" : "they were"} too long or not in the expected format` : `${count === 1 ? "its" : "their"} quotes did not match your files`;
+            try {
+                stderr(`${count} ${count === 1 ? "finding was" : "findings were"} not uploaded because ${reason}.\n`);
+            }
+            catch { /* Output failure must not change a server outcome. */ }
+        }
         completionOrigin = new URL(config.CF_CONSOLE_URL).origin;
         await saveCompletion(folder, payload, completionOrigin);
         completedPayload = payload;
@@ -181,7 +213,7 @@ async function runRelayLifecycle(folder, options, existing) {
         const saved = await submit(client, payload, signal);
         uploaded = true;
         await saveCompletion(folder, payload, completionOrigin, true);
-        stdout(formatSummary(report));
+        stdout(formatSummary(report, summaryOptions));
         stdout(`\nSaved ${paths.findingsPath}\nSaved ${paths.summaryPath}\n`);
         showSaved(saved);
         return 0;
@@ -204,7 +236,7 @@ async function runRelayLifecycle(folder, options, existing) {
                 catch { /* Committed server state still survives a local write failure. */ }
             }
             try {
-                showSaved({ projectId: status.projectId, analysisId: status.analysisId, findingIds: status.findingIds });
+                showSaved({ projectId: status.projectId, analysisId: status.analysisId, findingIds: status.findingIds, findings: status.findings });
             }
             catch { /* Output failure must not change a server outcome. */ }
             return 0;
@@ -216,11 +248,12 @@ async function runRelayLifecycle(folder, options, existing) {
             }
             catch { /* Keep the pending record if the durable write cannot be confirmed. */ }
         }
-        const known = error instanceof ConsoleError || error instanceof OutputPathError || error instanceof Error && ([cliRefusals.release_unavailable, COMMITTED_FILES_MESSAGE, RESULTS_TOO_LARGE_MESSAGE].includes(error.message)
+        const known = error instanceof AgentChoiceError || error instanceof ConsoleError || error instanceof OutputPathError || error instanceof Error && ([cliRefusals.release_unavailable, COMMITTED_FILES_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, INVALID_PROPOSAL_MESSAGE].includes(error.message)
             || error.message.startsWith("The saved completion") || error.message === COMPLETION_SETTINGS_MISMATCH_MESSAGE);
         const message = known ? error.message : FINISH_FAILURE_MESSAGE;
         try {
-            options.onError?.({ code: error instanceof ConsoleError ? error.code : undefined, message });
+            options.onError?.({ code: error instanceof ConsoleError ? error.code : undefined, message,
+                ...(error instanceof AgentChoiceError ? { agentChoice: error.agentChoice } : {}) });
             stderr(`${message}\n`);
             if (status && !(error instanceof ConsoleError && error.code === "low_balance"))
                 stderr(stateLine(status));