@counterfact-labs/cli 0.2.4 → 0.2.6

package/dist/cli/commands/analyze.js

@@ -6,6 +6,11 @@ import { cliApiMessages } from "../../contract/cli-api-messages.js";
 import { ApiError } from "../api.js";
 import { resolveAgentFolder } from "../agent-folder.js";
 import { runRelayCheck } from "../relay-check.js";
+import { GITIGNORE_OUTPUT_NOTICE } from "../../adapters/gitignore-output.js";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { loadAgentProposal } from "../../contract/agent-proposal.js";
+import { formatSavedFindings } from "../finding-display.js";
 // Only a real pause says "paused"; an unreviewed release or an upload-only server cannot start.
 const unavailable = START_FAILURE_MESSAGE;
 function requireLocal(value) {
@@ -26,16 +31,35 @@ function requireLocal(value) {
     if (value.mode !== "local")
         throw new ApiError(503, "unavailable", unavailable);
 }
-export async function analyze(path, _options, ctx) {
+export function parseAnalyzeOptions(args) {
+    let path, proposalFile;
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === "--proposal" && proposalFile === undefined) {
+            const value = args[++index];
+            if (!value || value.startsWith("-"))
+                throw new Error();
+            proposalFile = value;
+        }
+        else if (!arg.startsWith("-") && path === undefined)
+            path = arg;
+        else
+            throw new Error();
+    }
+    return { path: path ?? ".", options: proposalFile === undefined ? {} : { proposalFile } };
+}
+export async function analyze(path, options, ctx) {
     const startup = ctx.startup;
+    const proposal = await loadAgentProposal(async () => options.proposalFile === undefined ? options.proposal
+        : JSON.parse(await readFile(resolve(ctx.cwd ?? process.cwd(), options.proposalFile), "utf8")), startup.settings);
     requireLocal(await ctx.api.request("checks/mode"));
     const development = startup.transport.CF_RELAY_DEV === "1" ? await loadDevelopmentRelay(startup.transport) : undefined;
     const release = development?.release ?? ctx.relayRuntime?.release ?? await loadInstalledRelease();
     if (release.projectContext !== "checks")
-        throw new Error(unavailable);
+        throw new ApiError(503, "unavailable", unavailable);
     const token = await ctx.token?.();
     if (!token)
-        throw new Error("Not signed in. Run counterfact-labs login.");
+        throw new ApiError(401, "unauthorized", cliApiMessages.unauthorized);
     const folder = resolveAgentFolder(path, ctx.cwd);
     const config = Object.freeze({ ...startup.transport, CF_RELAY_URL: startup.transport.CF_RELAY_URL ?? release.relayUrl,
         CF_LOCAL_RELAY: "1", CF_CONSOLE_URL: ctx.api.baseUrl, CF_CONSOLE_TOKEN: token });
@@ -50,19 +74,28 @@ export async function analyze(path, _options, ctx) {
     } };
     try {
         return await (ctx.relayRuntime?.run ?? runRelayCheck)(folder, {
-            settings: startup.settings, config, release, connect: development?.connect ?? ctx.relayRuntime?.connect,
+            settings: startup.settings, config, release, cwd: ctx.cwd, connect: development?.connect ?? ctx.relayRuntime?.connect,
+            ...(proposal ? { proposal } : {}),
             signal: ctx.signal ? AbortSignal.any([controller.signal, ctx.signal]) : controller.signal,
             stdout() { }, stderr() { },
             onStart: () => { ctx.onCheckStart?.(); ctx.write("\r\u001b[2KAnalyzing the agent…"); progressShown = true; },
+            onLocalSaved: result => {
+                if (result.ignoreAdded) {
+                    clearProgress();
+                    ctx.write(GITIGNORE_OUTPUT_NOTICE);
+                }
+            },
             onError: failure => {
+                ctx.onCheckFailure?.(failure);
+                if (failure.agentChoice)
+                    ctx.onAgentChoice?.(failure.agentChoice);
                 clearProgress();
                 ctx.write(`${failure.message}\n`);
             },
             onSaved: result => {
                 clearProgress();
                 ctx.onCheckComplete?.(result);
-                if (result.findingIds?.length)
-                    ctx.write(`Finding ids: ${result.findingIds.join(", ")}\n`);
+                ctx.write(formatSavedFindings(result, { numbersEnabled: ctx.findingNumbers, audienceEnabled: result.audienceEnabled }));
                 ctx.write(`Full results: ${result.url}\n`);
             },
         });

package/dist/cli/commands/balance.js

@@ -1,6 +1,9 @@
 import { money } from "../output.js";
-export async function balance(ctx) {
-    const value = await ctx.api.request("balance");
-    ctx.write(`Balance: ${money(value.balanceMicro)}\nTop up: ${value.topUpUrl}\n`);
+export async function balance(ctx, options = {}) {
+    const response = await ctx.api.request("balance");
+    const value = { ...response, freeAnalysisAvailable: response.freeAnalysisAvailable ?? false };
+    options.onLoaded?.(value);
+    const freeAnalysis = value.freeAnalysisAvailable ? "Your first analysis is free.\n" : "";
+    ctx.write(`Balance: ${money(value.balanceMicro)}\n${freeAnalysis}Top up: ${value.topUpUrl}\n`);
     return 0;
 }

package/dist/cli/commands/finding.js

@@ -1,6 +1,12 @@
-export async function finding(id, ctx) {
-    const value = await ctx.api.request(`findings/${encodeURIComponent(id)}`);
-    ctx.write(`${value.title}\n${value.explanation}\n`);
+import { loadFinding } from "../finding-lookup.js";
+import { formatFindingNumber } from "../finding-display.js";
+import { findingSequenceSchema } from "../../contract/findings.js";
+export async function finding(id, ctx, options = {}) {
+    const value = await loadFinding(id, ctx.api, options.projectId, options.numbers ?? false);
+    const showNumber = ctx.findingNumbers !== false && findingSequenceSchema.safeParse(value.seq).success;
+    options.onLoaded?.(value);
+    const number = showNumber ? `${formatFindingNumber(value.seq)} ` : "";
+    ctx.write(`${number}${value.title}\n${value.explanation}\n`);
     for (const quote of value.quotes) {
         ctx.write(`\n${quote.path}${quote.line === null ? "" : `:${quote.line}`}\n`);
         if (quote.text !== null)

package/dist/cli/context.js

@@ -6,15 +6,20 @@ import { openBrowser } from "./browser.js";
 import { readCredentials } from "./credentials.js";
 import { userEmail } from "./git.js";
 import { terminalSignInInput } from "./sign-in-input.js";
+import { readFindingSettings } from "./finding-settings.js";
 export function commandContext(options = {}) {
     const startup = readCliSettings(options.env, options.emailSignIn);
     const homeDir = options.homeDir ?? homedir();
     const baseUrl = (options.baseUrl ?? startup.baseUrl ?? DEFAULT_URL).replace(/\/+$/, "");
     const api = new ApiClient(baseUrl, () => readCredentials(homeDir, api.baseUrl), undefined, options.signal);
     const write = options.write ?? (text => { process.stdout.write(text); });
+    const findingSettings = options.findingSettings ?? readFindingSettings(options.env);
     return {
+        findingNumbers: findingSettings.numbersEnabled,
+        signInRetry: (options.env ?? process.env).CF_SIGN_IN_RETRY !== "0",
         startup, signal: options.signal, relayRuntime: options.relayRuntime, cwd: options.cwd ?? process.cwd(),
-        token: () => readCredentials(homeDir, api.baseUrl), onCheckComplete: options.onCheckComplete, onCheckStart: options.onCheckStart,
+        token: () => readCredentials(homeDir, api.baseUrl), onCheckComplete: options.onCheckComplete, onCheckStart: options.onCheckStart, onAgentChoice: options.onAgentChoice,
+        onCheckFailure: options.onCheckFailure,
         api, homeDir, write, openBrowser: options.openBrowser ?? openBrowser,
         signInInput: options.signInInput ?? terminalSignInInput(), readEmail: options.readEmail ?? userEmail,
         sleep: options.sleep ?? (async (ms) => { await delay(ms, undefined, { signal: options.signal }); }), now: options.now ?? Date.now,

package/dist/cli/finding-display.js

@@ -0,0 +1,39 @@
+import { groupByAudience } from "../analysis-core/analysis/schemas.js";
+export const TEAM_WORKFLOW_HEADING = "Team workflow";
+export const formatFindingNumber = (seq) => `F-${seq}`;
+/** Intake returns one id per payload finding in order; the optional number mapping is joined by id. */
+export function savedFindings(result, report) {
+    const numbers = new Map(result.findings?.map(value => [value.id, value]));
+    return result.findingIds.map((id, index) => {
+        const numbered = numbers.get(id), local = report[index];
+        return { id, ...(numbered ? { seq: numbered.seq, number: formatFindingNumber(numbered.seq) } : {}),
+            title: local?.title ?? "", ...(local?.audience === undefined ? {} : { audience: local.audience }) };
+    });
+}
+function findingLine(value, enabled, index, labels, audienceEnabled) {
+    // The off switch preserves the original Markdown summary, including whitespace.
+    if (labels === "position" && !audienceEnabled)
+        return `${index + 1}. ${value.title}`;
+    const title = value.title.replace(/[\r\n\u2028\u2029]+/g, " ");
+    const label = labels === "position" ? `${index + 1}.` : enabled && value.seq !== undefined ? formatFindingNumber(value.seq) : value.id ?? `${index + 1}.`;
+    return `${label}${title ? ` ${title}` : ""}`;
+}
+export function findingDisplayRows(findings, { numbersEnabled = true, audienceEnabled, labels }) {
+    const groups = audienceEnabled ? groupByAudience(findings) : { users: findings, team: [] };
+    return [...groups.users, ...groups.team].map((finding, index) => ({ finding,
+        label: findingLine(finding, numbersEnabled, index, labels, audienceEnabled), startsTeamGroup: groups.team.length > 0 && index === groups.users.length }));
+}
+export function formatSavedFindings(result, options) {
+    if (options.numbersEnabled !== false && result.findings?.some(value => value.seq !== undefined)) {
+        return "Findings:\n" + findingDisplayRows(result.findings, { ...options, labels: "reference" }).map(row => `${row.startsTeamGroup ? `${TEAM_WORKFLOW_HEADING}:\n` : ""}${row.label}\n`).join("");
+    }
+    return result.findingIds?.length ? `Finding ids: ${result.findingIds.join(", ")}\n` : "";
+}
+export function formatWaitingFixes(items, enabled, needsProject) {
+    if (!items.length)
+        return "No waiting fixes.";
+    return "Waiting fixes:\n" + findingDisplayRows(items.map(item => ({ ...item, id: item.findingId })), { numbersEnabled: enabled, audienceEnabled: false, labels: "reference" }).map(({ finding: item, label }) => {
+        const scope = [item.repoKey, ...(enabled && needsProject(item) ? [`project ${item.projectId}`] : [])].filter(Boolean);
+        return `${label}${scope.length ? ` (${scope.join("; ")})` : ""}\n`;
+    }).join("");
+}

package/dist/cli/finding-lookup.js

@@ -0,0 +1,92 @@
+import { canonicalUuidSchema, findingNumberParamsSchema, findingNumberResponseSchema, findingSequenceSchema } from "../contract/findings.js";
+import { cliApiMessages } from "../contract/cli-api-messages.js";
+export const FINDING_PROJECT_MESSAGE = "Give the project for this finding number, which analysis results and the waiting_fixes tool list.";
+export const numberedFindingInputSchema = { type: "object", properties: {
+        id: { type: "string", description: "A finding id, or a number such as F-10." },
+        projectId: { type: "string", description: "The project the finding number belongs to, needed unless this session knows only one project." },
+    }, required: ["id"], additionalProperties: false };
+export function findingNumber(value) {
+    const match = /^F-?([1-9][0-9]*)$/i.exec(value.trim());
+    const seq = match ? Number(match[1]) : undefined;
+    return seq !== undefined && Number.isSafeInteger(seq) ? seq : undefined;
+}
+export class FindingReferences {
+    projects = new Set();
+    analysedProjects = new Set();
+    remember(projectId, source = "analysis") {
+        const canonical = projectId.toLowerCase();
+        this.projects.add(canonical);
+        if (source === "analysis")
+            this.analysedProjects.add(canonical);
+    }
+    // Observed findings cannot prove another project lacks the same historical number.
+    project() { return this.projects.size === 1 ? [...this.projects][0] : undefined; }
+    async resolve(reference, projectId, readWaiting) {
+        const seq = findingNumber(reference);
+        if (projectId || seq === undefined)
+            return projectId;
+        let waiting = [];
+        try {
+            waiting = await readWaiting?.() ?? [];
+        }
+        catch { /* A known project can still resolve a finding when the queue is unavailable. */ }
+        return this.resolveNumber(this.waitingByNumber(waiting).get(seq) ?? []);
+    }
+    projectsNeeded(waiting) {
+        const needed = new Set();
+        for (const matches of this.waitingByNumber(waiting).values()) {
+            const project = this.resolveNumber(matches);
+            for (const item of matches)
+                if (project !== item.projectId.toLowerCase())
+                    needed.add(item.findingId);
+        }
+        return needed;
+    }
+    waitingByNumber(waiting) {
+        const numbers = new Map();
+        for (const item of waiting) {
+            this.remember(item.projectId, "waiting");
+            const matches = numbers.get(item.seq);
+            if (matches)
+                matches.push(item);
+            else
+                numbers.set(item.seq, [item]);
+        }
+        return numbers;
+    }
+    resolveNumber(matches) {
+        if (!matches.length && this.analysedProjects.size === 1)
+            return [...this.analysedProjects][0];
+        if (matches.length !== 1)
+            return this.project();
+        const candidate = matches[0].projectId.toLowerCase();
+        // A queued fix may be older than the project the user just analysed.
+        if (this.analysedProjects.size > 0 && (this.analysedProjects.size !== 1 || !this.analysedProjects.has(candidate)))
+            return undefined;
+        return candidate;
+    }
+}
+export async function loadFinding(reference, api, projectId, numbered = true) {
+    const seq = numbered ? findingNumber(reference) : undefined;
+    let id = reference;
+    if (seq !== undefined) {
+        if (!projectId)
+            throw new Error(FINDING_PROJECT_MESSAGE);
+        const params = findingNumberParamsSchema.safeParse({ projectId, seq: String(seq) });
+        if (!params.success)
+            throw new Error(FINDING_PROJECT_MESSAGE);
+        const result = findingNumberResponseSchema.safeParse(await api.request(`projects/${params.data.projectId}/findings/${params.data.seq}`));
+        if (!result.success || result.data.seq !== seq)
+            throw new Error(cliApiMessages.invalid_response);
+        id = result.data.id;
+    }
+    const value = await api.request(`findings/${encodeURIComponent(id)}`);
+    const canonicalId = canonicalUuidSchema.safeParse(value.id);
+    if (seq !== undefined && (!canonicalId.success || canonicalId.data !== id || value.seq !== undefined && value.seq !== seq)) {
+        throw new Error(cliApiMessages.invalid_response);
+    }
+    if (seq !== undefined)
+        return { ...value, id, seq };
+    const { seq: detailSeq, ...detail } = value;
+    return numbered && detailSeq !== undefined && !findingSequenceSchema.safeParse(detailSeq).success ? detail : value;
+}

package/dist/cli/finding-settings.js

@@ -0,0 +1,5 @@
+import { findingAudienceEnabled } from "../analysis-core/analysis/finding-audience-switch.js";
+export function readFindingSettings(env = process.env, bundle) {
+    return { numbersEnabled: env.CF_FINDING_NUMBERS !== "0", fixesEnabled: env.CF_WAITING_FIXES !== "0",
+        audienceEnabled: findingAudienceEnabled(env, bundle) };
+}

package/dist/cli/fix-requests.js

@@ -0,0 +1,42 @@
+import { waitingFixesResponseSchema, claimFixRequestParamsSchema, claimFixRequestResponseSchema } from "../contract/fix-requests.js";
+import { cliApiMessages } from "../contract/cli-api-messages.js";
+import { ApiError } from "./api.js";
+export const FIX_DISCOVERY_TIMEOUT_MS = 2_000;
+export const fixRequestTools = [
+    { name: "waiting_fixes", description: "Lists the fixes you asked for in the console that are still waiting. It is read-only and free.",
+        annotations: { readOnlyHint: true },
+        inputSchema: { type: "object", properties: {}, additionalProperties: false } },
+    { name: "claim_fix", description: "Marks a waiting fix as taken when you start it, without editing files or running an analysis.",
+        inputSchema: { type: "object", properties: { id: { type: "string", description: "The findingId returned by waiting_fixes." } }, required: ["id"], additionalProperties: false } },
+];
+export async function waitingFixes(api, options = {}) {
+    try {
+        const result = waitingFixesResponseSchema.safeParse(await api.request("fix-requests", undefined, true, options));
+        if (!result.success)
+            throw new Error(cliApiMessages.invalid_response);
+        return result.data;
+    }
+    catch (error) {
+        // An older console has no queue; read-only discovery still works during rollout.
+        if (error instanceof ApiError && error.status === 404)
+            return [];
+        throw error;
+    }
+}
+export async function waitingFixCount(api) {
+    try {
+        return (await waitingFixes(api, { timeoutMs: FIX_DISCOVERY_TIMEOUT_MS })).length;
+    }
+    catch {
+        return 0;
+    }
+}
+export async function claimFix(api, id) {
+    const params = claimFixRequestParamsSchema.safeParse({ id });
+    if (!params.success)
+        throw new Error("Provide a finding id.");
+    const result = claimFixRequestResponseSchema.safeParse(await api.request(`fix-requests/${params.data.id}/claim`, {}));
+    if (!result.success || result.data.findingId !== params.data.id)
+        throw new Error(cliApiMessages.invalid_response);
+    return result.data;
+}

package/dist/cli/intake-payload.js

@@ -1,18 +1,26 @@
+import { resultSafetyCheckEnabled } from "../analysis-core/settings.js";
 import { localFindingsPayloadSchema } from "../contract/console.js";
+import { projectPublicFinding } from "../contract/public-report.js";
+import { checkIntakeFindings } from "./result-check.js";
 import { RESULTS_TOO_LARGE_MESSAGE } from "../contract/cli-refusals.js";
-export function buildIntakePayload(identity, agent, report) {
+export function buildIntakePayload(identity, agent, report, options = {}) {
     const repo = (key) => key === null || key === report.repoKey ? agent.repository : key;
-    const findings = report.findings.map(finding => {
-        // The local report may add presentation fields; the intake accepts cleaned evidence only.
-        const { kind, severity, title, cause, summary, category, question, site, excerpt, otherSites, fixes, sourceNotes } = finding;
-        return { kind, severity, title, cause, summary, category, question, site, excerpt,
-            fixes: fixes.map(({ title, approach, kind, targetFiles, expectedOutcome, summary, impact, confidence, objective, status, blockedBy, alsoFixes, delta }) => ({ title, approach, kind, targetFiles, expectedOutcome, summary, impact, confidence, objective, status, blockedBy, alsoFixes, delta })),
-            siteRepo: repo(finding.siteRepo), otherSites: otherSites.map(site => ({ ...site, repo: repo(site.repo) })),
-            ...(sourceNotes === undefined ? {} : { sourceNotes: sourceNotes && { ...sourceNotes,
-                    counterEvidence: sourceNotes.counterEvidence.map(site => ({ ...site, repo: repo(site.repo) })) } }) };
-    });
+    let findings = report.findings.map(finding => projectPublicFinding(finding, repo));
+    let resultCheck = null;
+    let findingIndexes = report.findings.map((_, index) => index);
+    if (resultSafetyCheckEnabled(options.settings ?? {})) {
+        const captured = options.files;
+        if (!captured)
+            throw new Error("Result check requires a captured file snapshot");
+        const admitted = Object.fromEntries(agent.files.filter(file => Object.hasOwn(captured, file.path))
+            .map(file => [file.path, captured[file.path]]));
+        const { findings: accepted, acceptedIndexes, ...counts } = checkIntakeFindings(findings, { repoKey: agent.repository, files: admitted });
+        findings = accepted;
+        resultCheck = counts;
+        findingIndexes = acceptedIndexes;
+    }
     const result = localFindingsPayloadSchema.safeParse({ ...identity, agent, findings });
     if (!result.success)
         throw new Error(RESULTS_TOO_LARGE_MESSAGE);
-    return result.data;
+    return { payload: result.data, resultCheck, findingIndexes };
 }

package/dist/cli/main.js

@@ -4,13 +4,13 @@ import { realpath } from "node:fs/promises";
 import { errorCode, errorText } from "./api.js";
 import { readEmailSignIn } from "../adapters/settings.js";
 import { commandContext } from "./context.js";
-import { analyze } from "./commands/analyze.js";
+import { analyze, parseAnalyzeOptions } from "./commands/analyze.js";
 import { finding } from "./commands/finding.js";
 import { balance } from "./commands/balance.js";
 import { login, parseLoginOptions } from "./commands/login.js";
 import { logout } from "./commands/logout.js";
 import { serveMcp } from "./mcp.js";
-const usage = "Usage: counterfact-labs analyze [path]\n       counterfact-labs finding <id>\n       counterfact-labs balance | login | logout | mcp\n";
+const usage = "Usage: counterfact-labs analyze [path] [--proposal <json-file>]\n       counterfact-labs finding <id>\n       counterfact-labs balance | login | logout | mcp\n";
 export async function run(args, options = {}) {
     const write = options.write ?? (text => { process.stdout.write(text); });
     const emailSignIn = options.emailSignIn ?? readEmailSignIn(options.env);
@@ -22,9 +22,14 @@ export async function run(args, options = {}) {
             return 0;
         }
         if (command === "analyze") {
-            if (rest.length > 1 || rest.some(arg => arg.startsWith("-")))
+            let parsed;
+            try {
+                parsed = parseAnalyzeOptions(rest);
+            }
+            catch {
                 throw new Error(usage.trimEnd());
-            return await analyze(rest[0] ?? ".", {}, commandContext(commandOptions));
+            }
+            return await analyze(parsed.path, parsed.options, commandContext(commandOptions));
         }
         if (command === "finding" && rest.length === 1 && !rest[0].startsWith("-"))
             return await finding(rest[0], commandContext(commandOptions));

package/dist/cli/mcp-failure.js

@@ -0,0 +1,8 @@
+import { CliRefusalError, failureReason, START_FAILURE_MESSAGE } from "../contract/cli-refusals.js";
+import { errorText } from "./api.js";
+export function mcpFailure(error, enabled) {
+    // Only outside_project changed its sentence; the other local refusals already use the old sentences.
+    const message = !enabled && error instanceof CliRefusalError && error.code === "outside_project" ? START_FAILURE_MESSAGE
+        : errorText(error);
+    return { message, ...(enabled ? { reason: failureReason(error) } : {}) };
+}