@counterfact-labs/cli 0.2.4 → 0.2.6

package/dist/cli/mcp.js

@@ -1,28 +1,34 @@
 import { createInterface } from "node:readline";
 import { once } from "node:events";
 import { resolveFolderPath } from "../adapters/folder-path.js";
-import { FINISH_FAILURE_MESSAGE, START_FAILURE_MESSAGE } from "../contract/cli-refusals.js";
-import { errorCode, errorText } from "./api.js";
+import { CliRefusalError, failureReason } from "../contract/cli-refusals.js";
+import { mcpFailure } from "./mcp-failure.js";
+import { errorCode } from "./api.js";
 import { commandContext } from "./context.js";
 import { analyze } from "./commands/analyze.js";
 import { CLI_VERSION } from "../contract/cli-version.js";
 import { finding } from "./commands/finding.js";
 import { balance } from "./commands/balance.js";
 import { ANALYZE_TOOL_NAME, analyzeToolAllowed } from "./claude-code-permission.js";
-import { signInStatus, startSignIn } from "./sign-in.js";
+import { signInStatus, startSignIn, waitForSignIn, SignInExpiredError, SignInDeniedError } from "./sign-in.js";
 import { readEmailSignIn } from "../adapters/settings.js";
 import { emailSignInMessages } from "../contract/email-sign-in-messages.js";
 import { EMAIL_SIGN_IN_TERMS, normalizeSignInEmail, validSignInCode, startEmailSignIn, signInWithCode } from "./email-sign-in.js";
 import { resolveAgentFolder, resolveMcpAgentFolder } from "./agent-folder.js";
 import { suggestedEmail } from "./suggested-email.js";
+import { agentProposalInputSchema } from "../contract/agent-proposal.js";
+import { fixRequestTools, waitingFixes, waitingFixCount, claimFix, FIX_DISCOVERY_TIMEOUT_MS } from "./fix-requests.js";
+import { FINDING_PROJECT_MESSAGE, FindingReferences, numberedFindingInputSchema } from "./finding-lookup.js";
+import { findingDisplayRows, formatFindingNumber, formatWaitingFixes } from "./finding-display.js";
+import { readFindingSettings } from "./finding-settings.js";
 const legacyTools = [
     {
         name: ANALYZE_TOOL_NAME,
-        description: "Analyze the agent in a folder on this computer. Each call runs one analysis and charges the user's balance, so call it only when the user asks for an analysis. After edits, suggest an analysis and wait for the user to ask. Prices are listed on the top-up page and website. If the balance doesn't cover the analysis, show the returned message and top-up link.",
-        inputSchema: { type: "object", properties: { path: { type: "string", description: "The agent folder on this computer." } }, required: ["path"], additionalProperties: false },
+        description: "Analyze the agent in a folder on this computer. Each call runs one analysis and charges the user's balance unless a free analysis is available, so call it only when the user asks for an analysis. A free first analysis needs no top-up. After edits, suggest an analysis and wait for the user to ask. Prices are listed on the top-up page and website. If the balance doesn't cover the analysis, show the returned message and top-up link.",
+        inputSchema: { type: "object", properties: { path: { type: "string", description: "The agent folder on this computer." }, proposal: { ...agentProposalInputSchema, description: "Optional: the files you believe make up the agent, with each file's role. Paths are relative to the agent folder." } }, required: ["path"], additionalProperties: false },
     },
     { name: "get_finding", description: "Get a finding's explanation, quoted lines, and suggested fixes.", inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"], additionalProperties: false } },
-    { name: "get_balance", description: "Get the balance and top-up link.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
+    { name: "get_balance", description: "Get the balance and top-up link, and whether a free first analysis is available. A free first analysis needs no top-up.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
     { name: "sign_in_status", description: "Check whether this computer is signed in to Counterfact, and whether the user has allowed the analysis tool in Claude Code. With wait: true, first wait for a sign-in started by sign_in to finish.", inputSchema: { type: "object", properties: { wait: { type: "boolean" } }, additionalProperties: false } },
     { name: "sign_in", description: "Open the Counterfact sign-in page in the user's browser. Then call sign_in_status with wait: true.", inputSchema: { type: "object", properties: {}, additionalProperties: false } },
 ];
@@ -35,12 +41,17 @@ class ProtocolError extends Error {
 }
 function object(value) { return value !== null && typeof value === "object" && !Array.isArray(value); }
 export async function serveMcp(input, output, options = {}) {
+    const audienceChoice = (options.env ?? process.env).CF_FINDING_AUDIENCE;
     const cwd = options.cwd ?? process.cwd();
     const guarded = (options.env ?? process.env).CF_MCP_PATH_GUARD !== "0";
+    const failureReasons = (options.env ?? process.env).CF_MCP_FAILURE_REASONS !== "0";
     const launch = guarded ? resolveFolderPath(cwd).catch(() => null) : Promise.resolve(cwd);
     const lastAnalysis = new Map();
+    const findingSettings = readFindingSettings(options.env);
+    const { numbersEnabled, fixesEnabled } = findingSettings;
+    const references = new FindingReferences();
     const emailSignIn = options.emailSignIn ?? readEmailSignIn(options.env);
-    const tools = emailSignIn ? [...legacyTools.slice(0, 3),
+    const signInTools = emailSignIn ? [...legacyTools.slice(0, 3),
         {
             name: "sign_in_status",
             description: "Check whether this computer is signed in to Counterfact and whether the user has allowed the analysis tool in Claude Code. Use path only to choose the agent folder for the local git email suggestion; otherwise use the launch folder. Analysis permission is always checked in the launch folder. A valid local git email is returned as suggestedEmail. Prefer the signed-in user's email already in your context; otherwise offer suggestedEmail. Ask the user to confirm an address before sending a code. With wait: true, wait only for browser sign-in to finish.",
@@ -65,7 +76,11 @@ export async function serveMcp(input, output, options = {}) {
                 }, required: ["email", "code"], additionalProperties: false },
         },
     ] : legacyTools;
+    const tools = signInTools.map(tool => tool.name === "get_finding" && numbersEnabled ? {
+        ...tool, inputSchema: numberedFindingInputSchema,
+    } : tool).concat(fixesEnabled ? fixRequestTools : []);
     let pendingSignIn;
+    let signInFailure;
     const requests = new Map();
     let queue = Promise.resolve();
     const lines = createInterface({ input, crlfDelay: Infinity });
@@ -76,15 +91,18 @@ export async function serveMcp(input, output, options = {}) {
         if (!object(args))
             throw new ProtocolError(-32602, "Tool arguments must be an object.");
         const name = params.name;
-        const allowed = name === ANALYZE_TOOL_NAME ? ["path"] : name === "get_finding" ? ["id"]
-            : name === "sign_in_status" ? (emailSignIn ? ["wait", "path"] : ["wait"])
-                : emailSignIn && name === "sign_in" ? ["email"] : emailSignIn && name === "sign_in_with_code" ? ["email", "code"] : [];
+        const allowed = name === ANALYZE_TOOL_NAME ? ["path", "proposal"] : name === "get_finding" ? (numbersEnabled ? Object.keys(numberedFindingInputSchema.properties) : ["id"])
+            : name === "claim_fix" ? ["id"]
+                : name === "sign_in_status" ? (emailSignIn ? ["wait", "path"] : ["wait"])
+                    : emailSignIn && name === "sign_in" ? ["email"] : emailSignIn && name === "sign_in_with_code" ? ["email", "code"] : [];
         if (!tools.some(tool => tool.name === name) || Object.keys(args).some(key => !allowed.includes(key)))
             throw new ProtocolError(-32602, "Unknown tool or argument.");
         if (name === ANALYZE_TOOL_NAME && (typeof args.path !== "string" || !args.path.trim()))
             throw new ProtocolError(-32602, "Provide a path.");
         if (name === "get_finding" && (typeof args.id !== "string" || !args.id.trim()))
             throw new ProtocolError(-32602, "Provide a finding id.");
+        if (name === "get_finding" && args.projectId !== undefined && (typeof args.projectId !== "string" || !args.projectId.trim()))
+            throw new ProtocolError(-32602, FINDING_PROJECT_MESSAGE);
         if (name === "sign_in_status" && args.wait !== undefined && typeof args.wait !== "boolean")
             throw new ProtocolError(-32602, "Provide an optional boolean wait.");
         if (name === "sign_in_status" && "path" in args && (typeof args.path !== "string" || !args.path.trim()))
@@ -96,12 +114,33 @@ export async function serveMcp(input, output, options = {}) {
         if (name === "sign_in_with_code" && !validSignInCode(args.code))
             throw new ProtocolError(-32602, emailSignInMessages.invalid_code);
         let text = "", exitCode = 0;
+        let reason;
+        let freeAnalysisAvailable = false;
+        let agentChoice;
         let findingIds;
-        let url;
+        let findings, projectId;
+        let loadedFinding;
+        let fixRequests, claimed;
+        let waitingCount;
+        let url, analysisFolder;
+        let started = false;
         let signIn;
         try {
-            const ctx = commandContext({ ...options, emailSignIn, signal, onCheckComplete: result => {
+            const ctx = commandContext({ ...options, env: { ...(options.env ?? process.env), CF_FINDING_AUDIENCE: audienceChoice },
+                onCheckFailure: failure => { reason = failure.reason; options.onCheckFailure?.(failure); },
+                emailSignIn, findingSettings, signal, onCheckStart: () => {
+                    started = true;
+                    if (guarded && analysisFolder)
+                        lastAnalysis.set(analysisFolder, ctx.now());
+                    options.onCheckStart?.();
+                }, onAgentChoice: choice => { agentChoice = choice; options.onAgentChoice?.(choice); }, onCheckComplete: result => {
                     findingIds = result.findingIds ?? [];
+                    if (numbersEnabled) {
+                        findings = findingDisplayRows(result.findings ?? [], { numbersEnabled,
+                            audienceEnabled: result.audienceEnabled, labels: "reference" }).map(row => row.finding);
+                        projectId = result.projectId;
+                        references.remember(result.projectId);
+                    }
                     url = result.url;
                     options.onCheckComplete?.(result);
                 }, write: chunk => {
@@ -109,43 +148,86 @@ export async function serveMcp(input, output, options = {}) {
                     if (!chunk.startsWith("\r"))
                         text += chunk;
                 } });
-            if (name === "get_finding")
-                await finding(args.id, ctx);
+            if (name === "waiting_fixes") {
+                const waiting = await waitingFixes(ctx.api);
+                fixRequests = waiting;
+                const projectsNeeded = references.projectsNeeded(waiting);
+                text = formatWaitingFixes(waiting, numbersEnabled, item => projectsNeeded.has(item.findingId));
+            }
+            else if (name === "claim_fix") {
+                claimed = await claimFix(ctx.api, args.id);
+                text = "The fix request is marked as taken.";
+            }
+            else if (name === "get_finding") {
+                const project = numbersEnabled ? await references.resolve(args.id, args.projectId, fixesEnabled ? () => waitingFixes(ctx.api, { timeoutMs: FIX_DISCOVERY_TIMEOUT_MS }) : undefined) : undefined;
+                await finding(args.id, ctx, { projectId: project, numbers: numbersEnabled, onLoaded: value => {
+                        if (numbersEnabled)
+                            loadedFinding = { ...value, ...(value.seq !== undefined ? { number: formatFindingNumber(value.seq) } : {}) };
+                    } });
+            }
             else if (name === "get_balance")
-                await balance(ctx);
+                await balance(ctx, { onLoaded: value => { freeAnalysisAvailable = value.freeAnalysisAvailable; } });
             else if (name === "sign_in_status") {
                 const pending = pendingSignIn;
                 const allowed = await analyzeToolAllowed(ctx.homeDir, cwd);
                 if (args.wait === true && pending) {
-                    const cancel = () => pending.controller.abort();
-                    signal.addEventListener("abort", cancel, { once: true });
-                    try {
-                        if (signal.aborted)
-                            cancel();
-                        await pending.flow.done;
+                    if (pending.flow.retryEnabled) {
+                        try {
+                            await waitForSignIn(pending.flow, signal);
+                        }
+                        catch (error) {
+                            if (signal.aborted)
+                                throw error;
+                            // The flow stores its failure; collect the usual status fields before reporting it.
+                        }
                     }
-                    finally {
-                        signal.removeEventListener("abort", cancel);
+                    else {
+                        const cancel = () => pending.controller.abort();
+                        signal.addEventListener("abort", cancel, { once: true });
+                        try {
+                            if (signal.aborted)
+                                cancel();
+                            await pending.flow.done;
+                        }
+                        finally {
+                            signal.removeEventListener("abort", cancel);
+                        }
                     }
                 }
                 signIn = { ...await signInStatus(ctx), analyzeToolAllowed: allowed };
+                if (fixesEnabled)
+                    waitingCount = signIn.signedIn ? await waitingFixCount(ctx.api) : 0;
                 text = signIn.signedIn ? "Signed in." : "Not signed in.";
                 if (emailSignIn) {
                     const suggestion = await suggestedEmail(resolveAgentFolder(args.path ?? ".", cwd), ctx.readEmail);
                     if (suggestion)
                         signIn.suggestedEmail = suggestion;
                 }
+                if (signInFailure)
+                    signal.throwIfAborted();
+                const failure = signInFailure;
+                signInFailure = undefined;
+                if (failure && !signIn.signedIn) {
+                    const shown = mcpFailure(failure.error, failureReasons);
+                    text = (failure.error instanceof SignInExpiredError
+                        ? emailSignInMessages.mcp_expired : failure.error instanceof SignInDeniedError
+                        ? emailSignInMessages.mcp_cancelled : shown.message) + "\n";
+                    exitCode = errorCode(failure.error);
+                    reason = shown.reason;
+                }
             }
             else if (emailFlow) {
                 if (pendingSignIn)
                     throw new Error(emailSignInMessages.browser_sign_in_pending);
                 if (name === "sign_in") {
                     const start = await startEmailSignIn(ctx, email);
+                    signInFailure = undefined;
                     signIn = { email: email, expiresIn: start.expiresIn };
                     text = `We sent a sign-in code to ${email}. Ask the user for the code from their email, then call sign_in_with_code with the same email and their code. Do not repeat the code.`;
                 }
                 else {
                     await signInWithCode(ctx, email, args.code);
+                    signInFailure = undefined;
                     signIn = { signedIn: true };
                     text = "Signed in.";
                 }
@@ -156,20 +238,25 @@ export async function serveMcp(input, output, options = {}) {
                 else {
                     let pending = pendingSignIn;
                     if (!pending) {
-                        // The flow outlives this call; a later wait call can cancel its polling.
+                        // With retry on, the browser flow belongs to the session, so a cancelled status wait leaves it running.
                         const controller = new AbortController();
                         const cancel = () => controller.abort();
                         signal.addEventListener("abort", cancel, { once: true });
                         try {
                             signal.throwIfAborted();
-                            const flow = await startSignIn(commandContext({ ...options, emailSignIn, homeDir: ctx.homeDir, baseUrl: ctx.api.baseUrl, signal: controller.signal }));
+                            const flow = await startSignIn(commandContext({ ...options, emailSignIn, findingSettings, homeDir: ctx.homeDir, baseUrl: ctx.api.baseUrl, signal: controller.signal }));
                             pending = { flow, controller, opened: false };
                             pendingSignIn = pending;
+                            signInFailure = undefined;
                             const current = pending;
                             const clear = () => { if (pendingSignIn === current)
                                 pendingSignIn = undefined; };
                             // Handle background failures even when the client never calls wait.
-                            void flow.done.then(clear, clear);
+                            void flow.done.then(clear, error => {
+                                if (flow.retryEnabled && pendingSignIn === current && !current.controller.signal.aborted)
+                                    signInFailure = { error };
+                                clear();
+                            });
                             pending.opened = await ctx.openBrowser(flow.pageUrl);
                         }
                         finally {
@@ -184,20 +271,15 @@ export async function serveMcp(input, output, options = {}) {
             else {
                 const launchFolder = await launch;
                 if (guarded && !launchFolder)
-                    throw new Error(START_FAILURE_MESSAGE);
+                    throw new CliRefusalError("launch_folder_unavailable");
                 const folder = guarded ? await resolveMcpAgentFolder(args.path, launchFolder, ctx.homeDir) : resolveAgentFolder(args.path, cwd);
                 const last = lastAnalysis.get(folder);
                 if (guarded && last !== undefined && ctx.now() - last < 10 * 60 * 1000) {
-                    throw new Error(FINISH_FAILURE_MESSAGE);
+                    throw new CliRefusalError("repeat_too_soon");
                 }
-                let started = false;
+                analysisFolder = folder;
                 try {
-                    exitCode = await analyze(folder, {}, { ...ctx, onCheckStart: () => {
-                            started = true;
-                            if (guarded)
-                                lastAnalysis.set(folder, ctx.now());
-                            ctx.onCheckStart?.();
-                        } });
+                    exitCode = await analyze(folder, { proposal: args.proposal }, ctx);
                 }
                 finally {
                     if (guarded && started)
@@ -206,13 +288,19 @@ export async function serveMcp(input, output, options = {}) {
             }
         }
         catch (error) {
-            text += errorText(error) + "\n";
+            const failure = mcpFailure(error, failureReasons);
+            text += failure.message + "\n";
+            reason = failure.reason;
             exitCode = errorCode(error);
         }
         // Some clients (Claude Code among them) give the model only the structured result when one is present, so it
         // repeats the text: without it the model cannot read the result.
         return { content: [{ type: "text", text }], isError: exitCode !== 0,
-            structuredContent: { text, exitCode, ...(findingIds ? { findingIds } : {}), ...(url ? { url } : {}), ...signIn } };
+            structuredContent: { text, exitCode, ...agentChoice, ...(findingIds ? { findingIds } : {}), ...(url ? { url } : {}), ...signIn,
+                ...(exitCode !== 0 && failureReasons ? { reason: reason ?? failureReason(undefined) } : {}),
+                ...(freeAnalysisAvailable ? { freeAnalysisAvailable } : {}),
+                ...(findings ? { findings, projectId } : {}), ...(loadedFinding ? { finding: loadedFinding } : {}),
+                ...(fixRequests ? { fixRequests } : {}), ...claimed, ...(waitingCount !== undefined ? { waitingFixes: waitingCount } : {}) } };
     }
     async function respond(message, id, signal) {
         if (signal.aborted)

package/dist/cli/relay-check.js

@@ -1,22 +1,28 @@
-import { resolveFolderPath } from "../adapters/folder-path.js";
-import { savedAnalysisUrl } from "../contract/console-url.js";
 import { randomUUID } from "node:crypto";
 import { disabledSetupPings } from "../setup-pings/client.js";
 import { saveCompletion, loadCompletion } from "../adapters/completion.js";
 import { saveLocalResults } from "../adapters/results.js";
+import { GITIGNORE_OUTPUT_NOTICE } from "../adapters/gitignore-output.js";
 import { OutputPathError, outputPaths } from "../adapters/output-paths.js";
 import { validateClientRelease } from "../adapters/release.js";
 import { selectAnalysisExecution } from "../adapters/models.js";
+import { resolveFolderPath } from "../adapters/folder-path.js";
+import { AgentChoiceError } from "../contract/agent-choice.js";
+import { savedAnalysisUrl } from "../contract/console-url.js";
 import { prepareRelayCheck } from "./relay-preparation.js";
-import { cliRefusals, COMMITTED_FILES_MESSAGE, FINISH_FAILURE_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, refusalExitCode } from "../contract/cli-refusals.js";
+import { cliRefusals, COMMITTED_FILES_MESSAGE, failureReason, FINISH_FAILURE_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, refusalExitCode } from "../contract/cli-refusals.js";
 import { ConsoleClient, ConsoleError } from "../gatekeeper/console.js";
 import { GatekeeperClient } from "../gatekeeper/client.js";
 import { connectRelay, relayOrigin } from "../gatekeeper/connection.js";
 import productionTrust from "../gatekeeper/trust/production.json" with { type: "json" };
 import { runAnalysisToEnd } from "../core/analysis/run-to-end.js";
+import { findingPresentation } from "../analysis-core/findings/presentation.js";
 import { formatSummary } from "./summary.js";
 import { buildIntakePayload } from "./intake-payload.js";
 import { completionRecoveryDecision, COMPLETION_SETTINGS_MISMATCH_MESSAGE, matchesCheck } from "./completion-recovery.js";
+import { savedFindings } from "./finding-display.js";
+import { INVALID_PROPOSAL_MESSAGE } from "../contract/agent-proposal.js";
+import { readFindingSettings } from "./finding-settings.js";
 const stateLine = (status) => `Reservation ${status.state}; settlement ${status.settlement}; lease ${new Date(status.expiresAt).toLocaleString("en-US", { timeZone: "America/Los_Angeles", timeZoneName: "short" })}.\n`;
 function requireIntakeReservation(status) {
     if (status.state === "reserved")
@@ -31,7 +37,8 @@ function requireIntakeReservation(status) {
 async function submit(client, payload, signal) {
     signal.throwIfAborted();
     const status = await client.status(payload.reservationId);
-    const committed = (value) => ({ checkId: value.checkId, projectId: value.projectId, analysisId: value.analysisId, findingIds: value.findingIds, settlement: value.settlement });
+    const committed = (value) => ({ checkId: value.checkId, projectId: value.projectId, analysisId: value.analysisId, findingIds: value.findingIds,
+        ...(value.findings ? { findings: value.findings } : {}), settlement: value.settlement });
     if (!matchesCheck(status, payload))
         throw new ConsoleError("check_conflict");
     if (status.uploadState === "saved")
@@ -65,11 +72,14 @@ export function runReservedRelayCheck(folder, options) {
     return runRelayLifecycle(folder, options, options);
 }
 async function runRelayLifecycle(folder, options, existing) {
-    const { config, settings, stdout, stderr } = options;
+    const { config, stdout, stderr } = options;
+    let settings = options.settings;
+    const summaryOptions = { audienceEnabled: false };
     let client, reservationId, projectId;
     let connection = existing?.connection;
     let identity;
     let completedPayload;
+    let displayFindings;
     let completionOrigin;
     let completed = false, uploaded = false, heartbeat;
     let renewal;
@@ -77,7 +87,8 @@ async function runRelayLifecycle(folder, options, existing) {
     const signal = options.signal ? AbortSignal.any([controller.signal, options.signal]) : controller.signal;
     const showSaved = (result) => {
         const url = savedAnalysisUrl(result.projectId, config.CF_CONSOLE_URL);
-        options.onSaved?.({ ...result, url });
+        const findings = savedFindings({ findingIds: result.findingIds ?? [], findings: result.findings }, displayFindings ?? completedPayload?.findings ?? []);
+        options.onSaved?.({ ...result, findings, url, audienceEnabled: summaryOptions.audienceEnabled });
         stdout(`Saved analysis ${result.analysisId}: ${url}\n`);
     };
     try {
@@ -100,6 +111,8 @@ async function runRelayLifecycle(folder, options, existing) {
         // Signature verification precedes all folder reads, status calls and spending.
         const validated = validateClientRelease(options.release, settings);
         const { bundle } = validated;
+        settings = validated.settings;
+        summaryOptions.audienceEnabled = readFindingSettings(settings).audienceEnabled;
         folder = await resolveFolderPath(folder);
         signal.throwIfAborted();
         const prior = await loadCompletion(folder);
@@ -134,7 +147,7 @@ async function runRelayLifecycle(folder, options, existing) {
             if (error.code !== "ENOENT")
                 throw error;
         }
-        const { source, provenance, plan, start, startMetadata } = await prepareRelayCheck(folder, { ...options, signal, expectedCommit: existing?.expectedCommit }, validated);
+        const { source, provenance, plan, start, startMetadata } = await prepareRelayCheck(folder, { ...options, signal, expectedCommit: existing?.expectedCommit, expectedFiles: existing?.expectedFiles }, validated);
         let reservation = existing?.reservation;
         if (!reservation) {
             const started = await client.start(start, startMetadata);
@@ -171,9 +184,28 @@ async function runRelayLifecycle(folder, options, existing) {
         (options.setupPings ?? disabledSetupPings).ping("first_analysis_started");
         const report = await runAnalysisToEnd(source, execution.model, settings, { execution });
         signal.throwIfAborted();
-        const paths = await saveLocalResults(folder, report, source.skippedFiles, options.outputDir);
-        const payload = buildIntakePayload({ checkId: reservation.checkId, projectId: projectId, reservationId,
-            bundleVersion: bundle.version, relayVersion: options.release.relayVersion, counterfactLocalVersion: options.release.localVersion }, provenance, report);
+        const paths = await saveLocalResults(folder, report, source.skippedFiles, options.outputDir, { ...summaryOptions, settings });
+        try {
+            options.onLocalSaved?.(paths);
+            if (paths.ignoreAdded)
+                stderr(GITIGNORE_OUTPUT_NOTICE);
+        }
+        catch { /* Output failure must not change a server outcome. */ }
+        const { payload, resultCheck, findingIndexes } = buildIntakePayload({ checkId: reservation.checkId, projectId: projectId, reservationId,
+            bundleVersion: bundle.version, relayVersion: options.release.relayVersion, counterfactLocalVersion: options.release.localVersion }, provenance, report, { settings, files: source.snapshot });
+        displayFindings = findingIndexes.map(index => {
+            const finding = report.findings[index];
+            return { title: findingPresentation(finding).displayTitle, audience: finding.audience };
+        });
+        if (resultCheck?.droppedFindings) {
+            const count = resultCheck.droppedFindings;
+            const reason = resultCheck.schemaDroppedFindings || resultCheck.capDroppedFindings
+                ? `${count === 1 ? "it was" : "they were"} too long or not in the expected format` : `${count === 1 ? "its" : "their"} quotes did not match your files`;
+            try {
+                stderr(`${count} ${count === 1 ? "finding was" : "findings were"} not uploaded because ${reason}.\n`);
+            }
+            catch { /* Output failure must not change a server outcome. */ }
+        }
         completionOrigin = new URL(config.CF_CONSOLE_URL).origin;
         await saveCompletion(folder, payload, completionOrigin);
         completedPayload = payload;
@@ -181,7 +213,7 @@ async function runRelayLifecycle(folder, options, existing) {
         const saved = await submit(client, payload, signal);
         uploaded = true;
         await saveCompletion(folder, payload, completionOrigin, true);
-        stdout(formatSummary(report));
+        stdout(formatSummary(report, summaryOptions));
         stdout(`\nSaved ${paths.findingsPath}\nSaved ${paths.summaryPath}\n`);
         showSaved(saved);
         return 0;
@@ -204,7 +236,7 @@ async function runRelayLifecycle(folder, options, existing) {
                 catch { /* Committed server state still survives a local write failure. */ }
             }
             try {
-                showSaved({ projectId: status.projectId, analysisId: status.analysisId, findingIds: status.findingIds });
+                showSaved({ projectId: status.projectId, analysisId: status.analysisId, findingIds: status.findingIds, findings: status.findings });
             }
             catch { /* Output failure must not change a server outcome. */ }
             return 0;
@@ -216,11 +248,12 @@ async function runRelayLifecycle(folder, options, existing) {
             }
             catch { /* Keep the pending record if the durable write cannot be confirmed. */ }
         }
-        const known = error instanceof ConsoleError || error instanceof OutputPathError || error instanceof Error && ([cliRefusals.release_unavailable, COMMITTED_FILES_MESSAGE, RESULTS_TOO_LARGE_MESSAGE].includes(error.message)
+        const known = error instanceof AgentChoiceError || error instanceof ConsoleError || error instanceof OutputPathError || error instanceof Error && ([cliRefusals.release_unavailable, COMMITTED_FILES_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, INVALID_PROPOSAL_MESSAGE].includes(error.message)
             || error.message.startsWith("The saved completion") || error.message === COMPLETION_SETTINGS_MISMATCH_MESSAGE);
         const message = known ? error.message : FINISH_FAILURE_MESSAGE;
         try {
-            options.onError?.({ code: error instanceof ConsoleError ? error.code : undefined, message });
+            options.onError?.({ code: error instanceof ConsoleError ? error.code : undefined, reason: failureReason(error), message,
+                ...(error instanceof AgentChoiceError ? { agentChoice: error.agentChoice } : {}) });
             stderr(`${message}\n`);
             if (status && !(error instanceof ConsoleError && error.code === "low_balance"))
                 stderr(stateLine(status));

package/dist/cli/relay-preparation.js

@@ -1,30 +1,53 @@
 import { randomUUID } from "node:crypto";
+import { join, relative, sep } from "node:path";
 import { outsideLoadersEnabled } from "../analysis-core/settings.js";
+import { resolveFolderPath } from "../adapters/folder-path.js";
 import { readLocalFolder } from "../adapters/files.js";
-import { snapshotProvenance } from "../adapters/snapshot.js";
+import { snapshotProvenance, sameFileHashes } from "../adapters/snapshot.js";
 import { validateClientRelease } from "../adapters/release.js";
 import { prepareRelayPlan } from "../adapters/relay-plan.js";
+import { AgentChoiceError } from "../contract/agent-choice.js";
 import { COMMITTED_FILES_MESSAGE } from "../contract/cli-refusals.js";
+import { INVALID_PROPOSAL_MESSAGE } from "../contract/agent-proposal.js";
 import { repositoryFacts } from "./git.js";
 /** Absolute checkout paths stay local; repository facts own the start's commit. */
 export function buildRelayStartPayload(facts, files) {
     const { remoteUrl, relPath, folderName, branch, commit, dirty } = facts;
     return { execution: "local", remoteUrl, relPath, folderName, branch, commit, dirty, files };
 }
+export function committedFilesOnly(settings) {
+    return settings.CF_LOCAL_COMMITTED_ONLY === "1";
+}
 /** Recovery can reuse signature validation without reading the folder again. */
 export async function prepareRelayCheck(folder, options, validated = validateClientRelease(options.release, options.settings)) {
-    const { bundle, tools } = validated;
+    const { bundle, tools, settings } = validated;
     options.signal?.throwIfAborted();
     // Discovery must agree with Git before publishing repository-relative captures.
     const earlyFacts = outsideLoadersEnabled(options.settings) ? await (options.facts ?? repositoryFacts)(folder) : undefined;
     options.signal?.throwIfAborted();
     const read = await readLocalFolder(options.settings, folder, options.trialAdmission, { captureSnapshot: true,
+        proposal: options.proposal,
         ...(earlyFacts ? { expectedRepositoryRoot: earlyFacts.repoRoot ?? null } : {}) });
+    if (read.proposalCounts?.fromProposal === 0 && read.proposalCounts.rejected > 0)
+        throw new Error(INVALID_PROPOSAL_MESSAGE);
+    if (read.agentChoice) {
+        const cwd = await resolveFolderPath(options.cwd ?? process.cwd());
+        const launchPath = (path) => relative(cwd, join(read.sourceBase ?? folder, path)).split(sep).join("/") || ".";
+        throw new AgentChoiceError({ ...read.agentChoice,
+            candidates: read.agentChoice.candidates.map(candidate => ({
+                folder: launchPath(candidate.folder), reason: launchPath(candidate.reason),
+            })),
+        });
+    }
     const source = { ...read, files: Object.freeze({ ...read.files }) };
-    const provenance = await snapshotProvenance(source.sourceBase ?? folder, source.snapshot, source.sourceBase ? { selectionFolder: folder } : undefined);
-    if (options.expectedCommit !== undefined && provenance.commit !== options.expectedCommit)
+    const provenance = await snapshotProvenance(source.sourceBase ?? folder, source.snapshot, { selectionFolder: folder, committedOnly: committedFilesOnly(options.settings) });
+    if (options.expectedCommit === null) {
+        if (!sameFileHashes(options.expectedFiles ?? [], source.snapshot))
+            throw new Error(COMMITTED_FILES_MESSAGE);
+    }
+    else if (options.expectedCommit !== undefined && provenance.commit !== options.expectedCommit)
         throw new Error(COMMITTED_FILES_MESSAGE);
-    const { plan, files } = prepareRelayPlan({ bundle, tools, settings: options.settings, relayVersion: options.release.relayVersion, source });
+    const { plan, files } = prepareRelayPlan({ bundle, tools, settings, relayVersion: options.release.relayVersion, source });
     options.signal?.throwIfAborted();
     const facts = earlyFacts ?? await (options.facts ?? repositoryFacts)(folder);
     options.signal?.throwIfAborted();

package/dist/cli/result-check.js

@@ -0,0 +1,68 @@
+import { publicFinding, resultCheckFinding, RESULT_CHECK_LIMITS } from "../analysis-core/contracts/relay-analysis.js";
+import { findingSitesInOrder } from "../analysis-core/findings/sites.js";
+import { localFindingSchema } from "../contract/console.js";
+function evidenceQuotes(finding, repoKey) {
+    const primary = finding.site ? { repo: finding.siteRepo ?? repoKey, ...finding.site, excerpt: finding.excerpt } : null;
+    const sites = findingSitesInOrder(primary, finding.otherSites);
+    const quotes = [];
+    function add(site, text) {
+        if (typeof text === "string")
+            quotes.push({ repo: site.repo, path: site.path, text });
+    }
+    add(primary ?? {}, finding.excerpt);
+    finding.otherSites.forEach(site => add(site, site.excerpt));
+    for (const note of finding.sourceNotes?.sites ?? []) {
+        if (note.keyPhrase !== "")
+            add(sites[note.index] ?? {}, note.keyPhrase);
+    }
+    for (const site of finding.sourceNotes?.counterEvidence ?? [])
+        add(site, site.excerpt);
+    return quotes;
+}
+/** The intake boundary and offline measurement use exactly the same evidence decision. */
+export function checkIntakeFindings(findings, context, onInvalidQuote) {
+    const accepted = [], acceptedIndexes = [];
+    const originals = new Map();
+    function original(path) {
+        if (!originals.has(path)) {
+            const captured = context.files[path];
+            try {
+                originals.set(path, typeof captured === "string" ? captured : new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(captured));
+            }
+            catch {
+                originals.set(path, null);
+            }
+        }
+        return originals.get(path);
+    }
+    let quotes = 0, droppedQuotes = 0, invalidQuotes = 0, schemaDroppedFindings = 0, capDroppedFindings = 0;
+    findings.forEach((finding, index) => {
+        const parsed = publicFinding.safeParse(finding);
+        const evidence = parsed.success ? evidenceQuotes(parsed.data, context.repoKey) : [];
+        quotes += evidence.length;
+        const invalid = evidence.filter(quote => {
+            const source = quote.repo === context.repoKey && typeof quote.path === "string" && Object.hasOwn(context.files, quote.path)
+                ? original(quote.path) : null;
+            const invalid = !quote.text.length || source === null || !source.includes(quote.text);
+            if (invalid)
+                onInvalidQuote?.({ text: quote.text, source });
+            return invalid;
+        }).length;
+        invalidQuotes += invalid;
+        const schemaValid = parsed.success && resultCheckFinding.safeParse(parsed.data).success && localFindingSchema.safeParse(parsed.data).success;
+        if (!schemaValid)
+            schemaDroppedFindings++;
+        if (index >= RESULT_CHECK_LIMITS.findings)
+            capDroppedFindings++;
+        if (!schemaValid || !parsed.success || invalid || index >= RESULT_CHECK_LIMITS.findings) {
+            // Removing one supporting quote could change the claim or invalidate source-note indices.
+            droppedQuotes += evidence.length;
+        }
+        else {
+            accepted.push(parsed.data);
+            acceptedIndexes.push(index);
+        }
+    });
+    return { findings: accepted, acceptedIndexes, droppedFindings: findings.length - accepted.length, quotes, droppedQuotes, invalidQuotes,
+        schemaDroppedFindings, capDroppedFindings };
+}