@counterfact-labs/cli 0.2.6 → 0.2.7

package/README.md

@@ -95,6 +95,26 @@ With `CF_EMAIL_SIGN_IN=0`, login help, arguments and the full MCP tool/status co
 `confirm` argument are removed. Each requested analysis runs once without a price prompt. Prices belong on the website
 and top-up page; an uncovered balance refuses with a top-up link.
 
+CLI 0.2.7 enables file selection and smaller-scope choices by default for the
+terminal and MCP server. `CF_FILE_SCOPE=0` restores the earlier folder-only
+behavior; `CF_SCOPE_CHOICES=0` disables smaller-scope offers and scope retry
+arguments. Shared core and sealed relay defaults are unchanged. Use
+`counterfact-labs analyze ./agents/room.ts` to select a file within the launch
+folder. The same file path works with `analyze_agent`. File paths must stay inside
+the launch folder before and after resolving symlinks. Terminal folder analysis
+still accepts folders outside the launch folder. MCP folder analysis keeps its
+project path guard; `CF_MCP_PATH_GUARD=0` disables that guard.
+`CF_LOCAL_IMPORT_RESOLUTION=0` also keeps folder analysis available by default;
+explicitly combining it with `CF_FILE_SCOPE=1` retains the file-mode refusal.
+Missing or unreadable paths follow the earlier folder route, including names that look like files and symlink loops.
+MCP reports `folder_unavailable`, or passes the path to the runner when its guard is off.
+An over-limit selection returns included and omitted files for the user to
+choose. The coding agent must ask before narrowing coverage. Terminal offers
+exit with status 3 and save a private scope JSON file for `--scope <json-file>`;
+MCP returns a successful `choose_scope` response. Each retry uses the saved
+snapshot and the ordinary admission checks. File reports live under the file's
+parent at `.counterfact/files/<entry-path-hash>/` and include selection metadata.
+
 The archive also ships `bundle/client-release.json` with its public Ed25519 verification key and local/relay versions,
 and the gatekeeper's public production trust policy. Production trust has no environment override. With exactly
 `CF_RELAY_DEV=1`, development startup accepts separate issuer trust, a bundle and public release pins through

package/bundle/client-release.json

@@ -1,7 +1,7 @@
 {
   "verificationKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAbBab1PYdmBKXxCvoJ47toJhQvxPevo9nlZnb0zbDWoc=\n-----END PUBLIC KEY-----\n",
   "relayVersion": "relay-1.0.1",
-  "localVersion": "0.2.6",
+  "localVersion": "0.2.7",
   "relayUrl": "https://relay.counterfactlabs.com:8443",
   "projectContext": "checks"
 }

package/dist/adapters/completion-lock.js

@@ -0,0 +1,95 @@
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, readdir, rename, rmdir, unlink, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { FOLDER_BUSY_MESSAGE } from "../contract/cli-refusals.js";
+export class CompletionBusyError extends Error {
+    reason = "folder_busy";
+    constructor() { super(FOLDER_BUSY_MESSAGE); }
+}
+const staleMs = 60_000;
+const missing = (error) => error.code === "ENOENT";
+async function retireStaleLock(lock) {
+    try {
+        const info = await lstat(lock);
+        if (!info.isDirectory() || Date.now() - info.mtimeMs < staleMs)
+            return;
+        const owners = await readdir(lock);
+        const current = await lstat(lock);
+        if (current.ino !== info.ino || current.dev !== info.dev || current.mtimeMs !== info.mtimeMs)
+            return;
+        // Unique owner names prevent a stale observer from removing a newly acquired lease.
+        for (const owner of owners)
+            await unlink(join(lock, owner)).catch(error => { if (!missing(error))
+                throw error; });
+        await rmdir(lock).catch(error => { if (!missing(error) && error.code !== "ENOTEMPTY")
+            throw error; });
+    }
+    catch (error) {
+        if (!missing(error))
+            throw error;
+    }
+}
+async function retireStaleTemporaryLocks(lock) {
+    const prefix = `${basename(lock)}.`;
+    for (const name of await readdir(dirname(lock))) {
+        if (!name.startsWith(prefix) || !/^[0-9a-f-]{36}\.tmp$/.test(name.slice(prefix.length)))
+            continue;
+        await retireStaleLock(join(dirname(lock), name));
+    }
+}
+/** Acquire before paid work. Renewal keeps long analyses live; crashed owners expire after a minute. */
+export async function acquireCompletionLock(path, onLost = () => { }) {
+    const lock = `${path}.lock`, temporary = `${lock}.${randomUUID()}.tmp`;
+    await retireStaleTemporaryLocks(lock);
+    let owner = randomUUID();
+    await mkdir(temporary, { mode: 0o700 });
+    let acquired = false;
+    try {
+        await writeFile(join(temporary, owner), "", { flag: "wx", mode: 0o600 });
+        const deadline = Date.now() + 500;
+        for (;;) {
+            try {
+                await rename(temporary, lock);
+                acquired = true;
+                break;
+            }
+            catch (error) {
+                if (!["EEXIST", "ENOTEMPTY"].includes(error.code ?? ""))
+                    throw error;
+                await retireStaleLock(lock);
+                if (Date.now() >= deadline)
+                    throw new CompletionBusyError();
+                await sleep(25);
+            }
+        }
+        let renewal;
+        const heartbeat = setInterval(() => {
+            if (renewal)
+                return;
+            const next = randomUUID();
+            // A stale observer can remove only the name it saw, so renewal survives its cleanup.
+            renewal = rename(join(lock, owner), join(lock, next)).then(() => { owner = next; })
+                .catch(() => { clearInterval(heartbeat); onLost(); }).finally(() => { renewal = undefined; });
+        }, 20_000);
+        heartbeat.unref();
+        let released = false;
+        return async () => {
+            if (released)
+                return;
+            released = true;
+            clearInterval(heartbeat);
+            await renewal;
+            await unlink(join(lock, owner)).catch(error => { if (!missing(error))
+                throw error; });
+            await rmdir(lock).catch(error => { if (!missing(error) && error.code !== "ENOTEMPTY")
+                throw error; });
+        };
+    }
+    catch (error) {
+        const directory = acquired ? lock : temporary;
+        await unlink(join(directory, owner)).catch(() => { });
+        await rmdir(directory).catch(() => { });
+        throw error;
+    }
+}

package/dist/adapters/completion.js

@@ -1,6 +1,6 @@
 import { constants } from "node:fs";
 import { createHash } from "node:crypto";
-import { lstat, open, realpath } from "node:fs/promises";
+import { lstat, open, readdir, realpath } from "node:fs/promises";
 import os from "node:os";
 import { basename, dirname, join } from "node:path";
 import { z } from "zod";
@@ -10,11 +10,19 @@ import { standaloneGitFailure } from "./repository-root.js";
 import { runGit } from "./git.js";
 import { resolveFolderPath } from "./folder-path.js";
 import { matchesSnapshotProvenance } from "./snapshot.js";
+import { acquireCompletionLock } from "./completion-lock.js";
 const record = z.strictObject({ version: z.literal(1), consoleOrigin: z.url().optional(), uploaded: z.boolean().optional(),
-    finished: z.boolean().optional(), payload: localFindingsPayloadSchema });
+    finished: z.boolean().optional(), completedAt: z.number().finite().nonnegative().optional(),
+    absoluteExpiresAt: z.number().finite().nonnegative().optional(), payload: localFindingsPayloadSchema });
+const selectionIdentity = z.strictObject({ consoleOrigin: z.url(), selectionKey: z.string().min(1).max(16384) });
+const selectedRecord = record.extend({ version: z.literal(2), consoleOrigin: z.url(), selectionKey: selectionIdentity.shape.selectionKey });
+const records = z.discriminatedUnion("version", [record, selectedRecord]);
+const retiredRecord = z.strictObject({ version: z.literal(1), finished: z.literal(true) });
+const selectedRetiredRecord = retiredRecord.extend({ version: z.literal(2), ...selectionIdentity.shape });
+const storedRecord = z.union([records, retiredRecord, selectedRetiredRecord]);
 const maxBytes = LOCAL_FINDINGS_BODY_LIMIT + 1024;
 /** Recovery belongs to this checkout and origin, and survives edits and new commits. */
-export async function completionPath(folder) {
+export async function completionPath(folder, identity) {
     const root = await resolveFolderPath(folder);
     let repository = null;
     let common;
@@ -37,21 +45,60 @@ export async function completionPath(folder) {
         }
         repository = [await realpath(common), origin];
     }
-    const key = createHash("sha256").update(JSON.stringify([root, repository])).digest("hex");
+    const coordinates = identity ? [root, repository, selectionIdentity.parse(identity)] : [root, repository];
+    const key = createHash("sha256").update(JSON.stringify(coordinates)).digest("hex");
     const home = await realpath(os.homedir());
     return { home, path: join(home, ".config/counterfact-labs/completions", `${key}.json`) };
 }
-export async function saveCompletion(folder, payload, consoleOrigin, uploaded = false, finished = false) {
-    const value = record.parse({ version: 1, payload, consoleOrigin, uploaded, finished });
+export function matchesCompletionSetup(saved, setup) {
+    return saved.consoleOrigin === setup.consoleOrigin && (setup.projectId === undefined || saved.payload.projectId === setup.projectId);
+}
+function setupSlot(path, consoleOrigin, projectId) {
+    const key = createHash("sha256").update(JSON.stringify([consoleOrigin, projectId])).digest("hex");
+    return path.replace(/\.json$/, `.${key}.json`);
+}
+export async function saveCompletion(folder, payload, consoleOrigin, options = {}) {
+    const { uploaded = false, finished = false, retainUnsaved, identity, ...timing } = options;
+    if (identity && consoleOrigin !== identity.consoleOrigin)
+        throw new Error(INVALID_COMPLETION_MESSAGE);
+    const value = identity ? selectedRecord.parse({ version: 2, payload, ...selectionIdentity.parse(identity), ...timing, uploaded, finished })
+        : record.parse({ version: 1, payload, consoleOrigin, ...timing, uploaded, finished });
     const bytes = JSON.stringify(value);
     if (Buffer.byteLength(bytes) > maxBytes)
         throw new Error("Invalid completion record");
-    const { home, path } = await completionPath(folder);
-    await writeOutputFiles(home, { [basename(path)]: bytes }, dirname(path));
-    return path;
+    const { home, path } = await completionPath(folder, identity);
+    let destination = path;
+    if (retainUnsaved) {
+        const separate = setupSlot(path, consoleOrigin, payload.projectId);
+        // A setup keeps its own slot once created, so later saves cannot split its pending work.
+        try {
+            await outputPaths(home, [basename(separate)], dirname(path));
+            await lstat(separate);
+            destination = separate;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        if (destination === path) {
+            try {
+                await outputPaths(home, [basename(path)], dirname(path));
+                const { value: prior } = await readCompletion(path, identity);
+                if ("payload" in prior && !prior.uploaded && !prior.finished
+                    && !matchesCompletionSetup(prior, { consoleOrigin, projectId: payload.projectId }))
+                    destination = separate;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+    }
+    await writeOutputFiles(home, { [basename(destination)]: bytes }, dirname(path));
+    return destination;
 }
 const INVALID_COMPLETION_MESSAGE = "The saved completion record is invalid. Keep the local report and choose a new output directory.";
-async function readCompletion(path) {
+async function readCompletion(path, identity) {
     let file;
     try {
         file = await open(path, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
@@ -62,17 +109,24 @@ async function readCompletion(path) {
         const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
         if (bytesRead > maxBytes)
             throw new Error();
-        return record.parse(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, bytesRead))));
+        const value = storedRecord.parse(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, bytesRead))));
+        if (identity ? value.version !== 2 || value.consoleOrigin !== identity.consoleOrigin || value.selectionKey !== identity.selectionKey
+            : value.version !== 1)
+            throw new Error(INVALID_COMPLETION_MESSAGE);
+        // File times can carry a sub-millisecond fraction; completion times are whole milliseconds everywhere else.
+        return { value, modifiedAt: Math.round(info.mtimeMs) };
     }
     finally {
         await file?.close();
     }
 }
-export async function loadCompletion(folder) {
+export async function loadCompletion(folder, options = {}) {
+    const { identity } = options;
     try {
-        const { home, path } = await completionPath(folder);
+        const { home, path } = await completionPath(folder, identity);
         await outputPaths(home, [basename(path)], dirname(path));
-        return await readCompletion(path);
+        const { value, modifiedAt } = await readCompletion(path, identity);
+        return "payload" in value ? options.retainUnsaved ? { ...value, completedAt: value.completedAt ?? modifiedAt } : value : null;
     }
     catch (error) {
         if (error instanceof OutputPathError)
@@ -81,6 +135,8 @@ export async function loadCompletion(folder) {
             throw new Error(INVALID_COMPLETION_MESSAGE);
         }
     }
+    if (identity)
+        return null;
     // Repository-owned records cannot supply recovery data, even with matching provenance.
     let legacy;
     try {
@@ -97,7 +153,10 @@ export async function loadCompletion(folder) {
                 throw error;
         }
         const [path] = await outputPaths(folder, ["completion.json"]);
-        legacy = await readCompletion(path);
+        const { value, modifiedAt } = await readCompletion(path);
+        if (!("payload" in value))
+            return null;
+        legacy = options.retainUnsaved ? { ...value, completedAt: value.completedAt ?? modifiedAt } : value;
     }
     catch (error) {
         if (error.code === "ENOENT")
@@ -109,7 +168,63 @@ export async function loadCompletion(folder) {
         return null;
     if (!await matchesSnapshotProvenance(folder, legacy.payload.agent))
         throw new Error(INVALID_COMPLETION_MESSAGE);
-    // Attempt imported recovery once automatically; uncertain legacy data must not block later analyses.
-    await saveCompletion(folder, legacy.payload, legacy.consoleOrigin, legacy.uploaded, true);
+    // Imported results follow the same retention policy as newly completed work.
+    await saveCompletion(folder, legacy.payload, legacy.consoleOrigin, { uploaded: legacy.uploaded, finished: !options.retainUnsaved || legacy.finished === true,
+        completedAt: legacy.completedAt, absoluteExpiresAt: legacy.absoluteExpiresAt });
     return legacy;
 }
+/** Setup slots share the folder lock, but each pending payload keeps its original file. */
+export async function loadCompletions(folder, options = {}) {
+    const primary = await loadCompletion(folder, options);
+    const { home, path } = await completionPath(folder, options.identity);
+    const records = primary ? [{ path, record: primary }] : [];
+    if (!options.retainUnsaved)
+        return records;
+    let names;
+    try {
+        names = await readdir(dirname(path));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return records;
+        throw error;
+    }
+    const prefix = basename(path, ".json") + ".";
+    const ownSlot = options.projectId === undefined ? undefined : setupSlot(path, options.consoleOrigin, options.projectId);
+    for (const name of names.sort()) {
+        if (!name.startsWith(prefix) || !/^[a-f0-9]{64}\.json$/.test(name.slice(prefix.length)))
+            continue;
+        const slot = join(dirname(path), name);
+        try {
+            await outputPaths(home, [name], dirname(path));
+            const { value, modifiedAt } = await readCompletion(slot, options.identity);
+            if ("payload" in value)
+                records.push({ path: slot, record: { ...value, completedAt: value.completedAt ?? modifiedAt } });
+        }
+        catch (error) {
+            // An unreadable sibling must not prevent another setup from saving its results.
+            if (slot === ownSlot)
+                throw error;
+        }
+    }
+    return records;
+}
+/** A retired copy is named <record>.<64 hex digest>.json; checked without building a pattern from the path. */
+function isRetiredCopyName(record, name) {
+    const digest = name.startsWith(`${record}.`) && name.endsWith(".json") ? name.slice(record.length + 1, -".json".length) : "";
+    return /^[a-f0-9]{64}$/.test(digest);
+}
+/** The empty marker also prevents a retired legacy copy from being imported again. */
+export async function discardCompletion(folder, recordPath, identity) {
+    const { home, path } = await completionPath(folder, identity);
+    const destination = recordPath ?? path;
+    if (dirname(destination) !== dirname(path) || destination !== path && !isRetiredCopyName(basename(path, ".json"), basename(destination)))
+        throw new OutputPathError();
+    const value = identity ? selectedRetiredRecord.parse({ version: 2, finished: true, ...identity }) : { version: 1, finished: true };
+    await writeOutputFiles(home, { [basename(destination)]: JSON.stringify(value) }, dirname(path));
+}
+export async function lockCompletion(folder, onLost, identity) {
+    const { home, path } = await completionPath(folder, identity);
+    await outputPaths(home, [basename(path)], dirname(path), true);
+    return acquireCompletionLock(path, onLost);
+}

package/dist/adapters/entry-files.js

@@ -0,0 +1,126 @@
+import { constants } from "node:fs";
+import { ENTRY_LIMITS } from "../analysis-core/index.js";
+import { lstat, open, opendir, realpath, stat } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { admitFile, resolveLocalExclusions } from "../analysis-core/conventions/file-admission.js";
+import { moduleResolutionLimits } from "../analysis-core/import/calls/modules.js";
+import { createGitIgnore } from "./git-ignore.js";
+import { readTargetMatches, searchBoundary } from "./repository-root.js";
+/** Inventory and bounded reads supply filesystem facts; core decides which files belong. */
+export async function createEntryFiles(settings, root, admission = {}, signal, entryPath) {
+    signal?.throwIfAborted();
+    const safety = { ...settings, CF_LOCAL_SYMLINK_GUARD: "1", CF_RESPECT_GITIGNORE: "1", CF_SECRET_SCAN: "1" };
+    const ignored = createGitIgnore(safety, root), gitIgnored = new Set();
+    const boundary = (await searchBoundary(root))?.base ?? null;
+    const snapshot = Object.create(null);
+    const entries = [], directories = new Set();
+    let visited = 0, inventoryIncomplete = 0;
+    const localTarget = async (path) => {
+        signal?.throwIfAborted();
+        const lexical = join(root, path), target = await realpath(lexical);
+        const facts = await ignored([lexical, target]);
+        if (facts?.has(lexical))
+            gitIgnored.add(path);
+        for (const ignoredPath of facts ?? [])
+            gitIgnored.add(ignoredPath);
+        const excludedTargets = await resolveLocalExclusions(admission, async (excluded) => realpath(join(root, excluded)).catch(() => null));
+        return { root, path: target, ...(facts === undefined ? {} : { parent: await realpath(dirname(lexical)) }), excludedTargets };
+    };
+    const allowed = async (path, directory = false) => {
+        const target = await localTarget(path);
+        return admitFile(safety, { path: directory ? `${path}/` : path, directory }, { ...admission, purpose: "entry", route: "local-folder", localTarget: target, gitIgnored }).admitted
+            && await readTargetMatches(target.path, boundary) ? target : null;
+    };
+    async function walk(folder, prefix) {
+        if (directories.has(folder))
+            return;
+        directories.add(folder);
+        for await (const item of await opendir(folder)) {
+            signal?.throwIfAborted();
+            if (++visited > moduleResolutionLimits.inventoryEntries) {
+                inventoryIncomplete = 1;
+                return;
+            }
+            const path = prefix ? `${prefix}/${item.name}` : item.name;
+            try {
+                if (item.isDirectory() || item.isSymbolicLink()) {
+                    const target = await allowed(path, true);
+                    if (target && (await stat(target.path)).isDirectory()) {
+                        // A Git marker starts another checkout, which is outside this inventory's search boundary.
+                        if (await lstat(join(target.path, ".git")).then(() => true, error => error.code !== "ENOENT"))
+                            continue;
+                        await walk(target.path, path);
+                        if (inventoryIncomplete)
+                            return;
+                        continue;
+                    }
+                }
+                const info = await stat(join(root, path));
+                if (!info.isFile())
+                    continue;
+                // Denied metadata stays visible so an unreadable config cannot look absent.
+                await localTarget(path);
+                entries.push({ path, size: info.size, ref: path });
+            }
+            catch {
+                signal?.throwIfAborted();
+            }
+        }
+    }
+    await walk(root, "");
+    if (entryPath && !entries.some(entry => entry.path === entryPath)) {
+        const info = await stat(join(root, entryPath)).catch(() => null);
+        if (info?.isFile())
+            entries.push({ path: entryPath, size: info.size, ref: entryPath });
+    }
+    entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    return { entries, gitIgnored, inventoryIncomplete, snapshot, localTarget,
+        async read(entry) {
+            signal?.throwIfAborted();
+            let handle;
+            try {
+                const target = await allowed(entry.path);
+                if (!target)
+                    return null;
+                if (snapshot[entry.path])
+                    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(snapshot[entry.path]);
+                const capacity = entry.readBytes ?? entry.size + 1;
+                if (!Number.isSafeInteger(capacity) || capacity < 1 || capacity > Math.max(ENTRY_LIMITS.bytes, moduleResolutionLimits.settingsBytes) + 1)
+                    return null;
+                handle = await open(target.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+                const before = await handle.stat({ bigint: true });
+                if (!before.isFile() || before.size !== BigInt(entry.size))
+                    return null;
+                const bytes = Buffer.alloc(capacity);
+                let size = 0;
+                while (size < capacity) {
+                    signal?.throwIfAborted();
+                    const { bytesRead } = await handle.read(bytes, size, Math.min(65_536, capacity - size), null);
+                    if (!bytesRead)
+                        break;
+                    size += bytesRead;
+                }
+                const after = await handle.stat({ bigint: true });
+                if (size !== entry.size || size === capacity || before.ino !== after.ino || before.dev !== after.dev
+                    || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+                    return null;
+                const current = await allowed(entry.path);
+                if (!current || current.path !== target.path)
+                    return null;
+                const captured = bytes.subarray(0, size);
+                const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(captured);
+                if (!admitFile(safety, { path: entry.path, text }, { ...admission, purpose: "entry", route: "local-folder", localTarget: current, gitIgnored }).admitted)
+                    return null;
+                snapshot[entry.path] = captured;
+                return text;
+            }
+            catch {
+                signal?.throwIfAborted();
+                return null;
+            }
+            finally {
+                await handle?.close();
+            }
+        },
+    };
+}

package/dist/adapters/entry-selection.js

@@ -0,0 +1,45 @@
+import { discoverLocalSources, fileScopeEnabled, readEntrySelection } from "../analysis-core/index.js";
+import { measureAnalysisSize, assessAnalysisSize } from "../analysis-core/conventions/analysis-fit.js";
+import { FileReadRefusal } from "../analysis-core/conventions/file-admission.js";
+import { localRepoKeyFor } from "../analysis-core/github/repo-key.js";
+import { cliRefusals } from "../contract/cli-refusals.js";
+import { INVALID_SELECTION_MESSAGE, INVALID_SCOPE_MESSAGE, SINGLE_FILE_TOO_LARGE_MESSAGE, SCOPE_PROPOSAL_CONFLICT_MESSAGE, STALE_SCOPE_MESSAGE } from "../contract/scope-choice.js";
+import { createEntryFiles } from "./entry-files.js";
+/** The CLI consumes the core membership answer and captures only its retained files. */
+export const entrySelectionProvider = async (settings, request, options) => {
+    if (!fileScopeEnabled(settings) || request.kind !== "file")
+        throw new Error(cliRefusals.release_unavailable);
+    const port = await createEntryFiles(settings, request.launchRoot, options.admission, options.signal, request.entry).catch(() => {
+        options.signal?.throwIfAborted();
+        throw new Error(INVALID_SELECTION_MESSAGE);
+    });
+    const input = { ...port, request: { ...request, scope: undefined }, admission: options.admission };
+    const full = await readEntrySelection(settings, input);
+    const refusal = (reason) => {
+        if (reason === "over-limit")
+            throw new Error(SINGLE_FILE_TOO_LARGE_MESSAGE);
+        if (reason === "stale-snapshot")
+            throw new Error(STALE_SCOPE_MESSAGE);
+        if (reason === "invalid-scope")
+            throw new Error(options.proposal ? SCOPE_PROPOSAL_CONFLICT_MESSAGE : INVALID_SCOPE_MESSAGE);
+        if (reason === "excluded" || reason === "hidden" || reason === "secret" || reason === "secret-content")
+            throw new FileReadRefusal(reason, request.entry);
+        throw new Error(INVALID_SELECTION_MESSAGE);
+    };
+    if (full.kind !== "ready")
+        return refusal(full.reason);
+    // Replay the same admitted captures through the owner to validate a narrower scope.
+    const selected = request.scope || options.proposal ? await readEntrySelection(settings, { ...input, request, proposal: options.proposal }) : full;
+    if (selected.kind !== "ready")
+        return refusal(selected.reason);
+    const { files } = selected;
+    const entries = selected.selection.files.map(({ path, size }) => ({ path, size, ref: path }));
+    const selection = { selected: entries, refused: [], totalBytes: entries.reduce((sum, file) => sum + file.size, 0) };
+    const repoKey = localRepoKeyFor(request.launchRoot);
+    const discovered = await discoverLocalSources(settings, { repoKey, entries, selection, membership: selected.selection, admission: options.admission,
+        read: async (entry) => files[entry.path] });
+    const analysisSize = measureAnalysisSize(settings, entries, options.admission);
+    return { membership: full.selection, source: { ...discovered, repoKey, root: ".", sourceBase: request.launchRoot, files, selection,
+            snapshot: Object.fromEntries(entries.map(({ path }) => [path, port.snapshot[path]])), analysisSize,
+            ...(settings.CF_REFUSE_TOO_LARGE === "0" ? {} : { analysisFit: assessAnalysisSize(analysisSize) }) } };
+};

package/dist/adapters/files.js

@@ -1,3 +1,4 @@
+import { moduleResolutionLimits } from "../analysis-core/import/calls/modules.js";
 import { opendir, realpath, stat, readFile } from "node:fs/promises";
 import { dirname, join, posix } from "node:path";
 import { admitFile, FileReadRefusal, fileRefusalWarning, localSymlinkGuardEnabled, respectGitignore, readRepoFile, resolveLocalExclusions } from "../analysis-core/conventions/file-admission.js";
@@ -10,7 +11,7 @@ import { createGitIgnore } from "./git-ignore.js";
 import { createIgnoredFileCollector } from "./ignored-files.js";
 import { resolveFolderPath } from "./folder-path.js";
 import { createRepositoryFiles } from "./repository-files.js";
-export const FOLDER_ENTRY_LIMIT = 10_000;
+export const FOLDER_ENTRY_LIMIT = moduleResolutionLimits.inventoryEntries;
 export const FOLDER_ENTRY_LIMIT_MESSAGE = "The folder has too many entries to analyze. Choose a smaller folder.";
 export async function readLocalFolder(settings, folder, admission = {}, options = {}) {
     const root = await resolveFolderPath(folder);

package/dist/adapters/results.js

@@ -2,12 +2,20 @@ import { formatSummary } from "../cli/summary.js";
 import { ignoreDefaultOutput } from "./gitignore-output.js";
 import { writeOutputFiles } from "./output-paths.js";
 import { projectPublicReport } from "../contract/public-report.js";
+import { INCLUDED_FILES_CAPTION, INCOMPLETE_IMPORTS_MESSAGE, SELECTION_COVERAGE_DESCRIPTION } from "../contract/scope-choice.js";
 export async function saveLocalResults(folder, report, refusedFiles, outputDir, options) {
     const publicReport = projectPublicReport(report, refusedFiles);
+    const scope = options.scope;
+    const incomplete = options.selection && !options.selection.completeness.complete
+        ? [INCOMPLETE_IMPORTS_MESSAGE, "", INCLUDED_FILES_CAPTION, ...options.includedPaths.map(path => `  ${path}`), "", ""].join("\n") : "";
+    const coverage = scope && scope.imports !== "all" ? SELECTION_COVERAGE_DESCRIPTION
+        .replace("{entry}", () => scope.entry).replace("{count}", String(Array.isArray(scope.imports) ? scope.imports.length : 0)) + "\n\n" : "";
     const [findingsPath, summaryPath] = await writeOutputFiles(folder, {
         "findings.json": `${JSON.stringify(publicReport, null, 2)}\n`,
-        "summary.md": formatSummary(publicReport, options),
+        "summary.md": incomplete + coverage + formatSummary(publicReport, options),
+        ...(options.selection ? { "selection.json": JSON.stringify({ schemaVersion: 1, selection: options.selection,
+                ...(scope ? { scope } : {}) }, null, 2) + "\n" } : {}),
     }, outputDir);
-    const ignoreAdded = await ignoreDefaultOutput(folder, outputDir, options);
+    const ignoreAdded = await ignoreDefaultOutput(folder, options.defaultFileOutput ? undefined : outputDir, options);
     return { findingsPath, summaryPath, ignoreAdded };
 }