@counterfact-labs/cli 0.2.6 → 0.2.9

package/dist/cli/commands/analyze.js

@@ -1,3 +1,5 @@
+import { formatSavedResults } from "../saved-results.js";
+import { skipped } from "./skipped.js";
 import { loadDevelopmentRelay } from "../development-relay.js";
 import { loadInstalledRelease } from "../../adapters/release.js";
 import { cliRefusals, START_FAILURE_MESSAGE } from "../../contract/cli-refusals.js";
@@ -10,7 +12,13 @@ import { GITIGNORE_OUTPUT_NOTICE } from "../../adapters/gitignore-output.js";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { loadAgentProposal } from "../../contract/agent-proposal.js";
-import { formatSavedFindings } from "../finding-display.js";
+import { fileScopeOf } from "../../analysis-core/analysis/file-analysis-plan.js";
+import { folderPartsEnabled } from "../../analysis-core/settings.js";
+import { captureArchitectureSettings, scopeChoicesEnabled } from "../../adapters/settings.js";
+import { resolveRunSelection } from "../analysis-selection.js";
+import { renderScopeChoices } from "../scope-choices.js";
+import { progressLine } from "../../contract/scope-choice.js";
+import { consoleCapabilities } from "../../gatekeeper/console.js";
 // Only a real pause says "paused"; an unreviewed release or an upload-only server cannot start.
 const unavailable = START_FAILURE_MESSAGE;
 function requireLocal(value) {
@@ -30,29 +38,70 @@ function requireLocal(value) {
     // A local-capable client never falls back to sending source files to the hosted upload API.
     if (value.mode !== "local")
         throw new ApiError(503, "unavailable", unavailable);
+    return consoleCapabilities(value);
 }
-export function parseAnalyzeOptions(args) {
-    let path, proposalFile;
+export function parseAnalyzeOptions(args, choices = false, multiple = false) {
+    let path, proposalFile, scopeFile;
+    let skipped;
+    let scope;
+    const paths = [];
     for (let index = 0; index < args.length; index++) {
         const arg = args[index];
-        if (arg === "--proposal" && proposalFile === undefined) {
+        if (["--skipped", "--skipped-plan", "--show-skipped"].includes(arg) && skipped === undefined) {
+            skipped = arg === "--skipped" ? "analyze" : arg === "--skipped-plan" ? "plan" : "files";
+        }
+        else if (arg === "--proposal" && proposalFile === undefined) {
             const value = args[++index];
             if (!value || value.startsWith("-"))
                 throw new Error();
             proposalFile = value;
         }
-        else if (!arg.startsWith("-") && path === undefined)
-            path = arg;
+        else if ((choices || args[index + 1]?.startsWith("[")) && arg === "--scope" && scope === undefined && scopeFile === undefined) {
+            const value = args[++index];
+            if (!value || value.startsWith("-"))
+                throw new Error();
+            if (value.startsWith("["))
+                scope = JSON.parse(value);
+            else
+                scopeFile = value;
+        }
+        else if (!arg.startsWith("-") && (path === undefined || multiple)) {
+            path ??= arg;
+            paths.push(arg);
+        }
         else
             throw new Error();
     }
-    return { path: path ?? ".", options: proposalFile === undefined ? {} : { proposalFile } };
+    if (skipped && (paths.length > 1 || proposalFile || scope !== undefined || scopeFile !== undefined))
+        throw new Error();
+    return { path: path ?? ".", options: { ...(paths.length > 1 ? { paths } : {}), ...(scope === undefined ? {} : { scope }), ...(proposalFile === undefined ? {} : { proposalFile }), ...(scopeFile === undefined ? {} : { scopeFile }), ...(skipped ? { skipped } : {}) } };
 }
 export async function analyze(path, options, ctx) {
+    if (Array.isArray(options.scope) && (options.proposal !== undefined || options.proposalFile !== undefined)) {
+        throw new ApiError(400, "invalid_body", cliRefusals.invalid_body);
+    }
+    if (options.skipped)
+        return skipped(path, options.skipped, ctx, analyze, options.surface);
     const startup = ctx.startup;
+    let settings = startup.settings;
+    if (Array.isArray(options.scope)) {
+        try {
+            if (!folderPartsEnabled(settings))
+                throw new Error();
+            const scope = fileScopeOf({ ...settings, CF_PART_FILES: JSON.stringify(options.scope) });
+            if (!scope?.length)
+                throw new Error();
+            settings = Object.freeze({ ...settings, CF_PART_FILES: JSON.stringify(scope) });
+        }
+        catch {
+            throw new ApiError(400, "invalid_body", cliRefusals.invalid_body);
+        }
+    }
+    const scope = Array.isArray(options.scope) ? undefined : options.scope;
     const proposal = await loadAgentProposal(async () => options.proposalFile === undefined ? options.proposal
         : JSON.parse(await readFile(resolve(ctx.cwd ?? process.cwd(), options.proposalFile), "utf8")), startup.settings);
-    requireLocal(await ctx.api.request("checks/mode"));
+    const mode = await (ctx.consoleMode?.() ?? ctx.api.request("checks/mode"));
+    const capabilities = requireLocal(mode);
     const development = startup.transport.CF_RELAY_DEV === "1" ? await loadDevelopmentRelay(startup.transport) : undefined;
     const release = development?.release ?? ctx.relayRuntime?.release ?? await loadInstalledRelease();
     if (release.projectContext !== "checks")
@@ -60,7 +109,8 @@ export async function analyze(path, options, ctx) {
     const token = await ctx.token?.();
     if (!token)
         throw new ApiError(401, "unauthorized", cliApiMessages.unauthorized);
-    const folder = resolveAgentFolder(path, ctx.cwd);
+    const selection = await resolveRunSelection(path, ctx.cwd ?? process.cwd(), settings, { ...options, scope });
+    const folder = selection?.path ?? resolveAgentFolder(path, ctx.cwd);
     const config = Object.freeze({ ...startup.transport, CF_RELAY_URL: startup.transport.CF_RELAY_URL ?? release.relayUrl,
         CF_LOCAL_RELAY: "1", CF_CONSOLE_URL: ctx.api.baseUrl, CF_CONSOLE_TOKEN: token });
     const controller = new AbortController();
@@ -72,13 +122,28 @@ export async function analyze(path, options, ctx) {
         ctx.write("\r\u001b[2K");
         progressShown = false;
     } };
+    let choice;
     try {
-        return await (ctx.relayRuntime?.run ?? runRelayCheck)(folder, {
-            settings: startup.settings, config, release, cwd: ctx.cwd, connect: development?.connect ?? ctx.relayRuntime?.connect,
+        const code = await (ctx.relayRuntime?.run ?? runRelayCheck)(folder, {
+            analyzedFolder: options.analyzedFolder ?? path,
+            settings: captureArchitectureSettings(settings, config), config, release, skippedFilesSupported: capabilities.skippedFiles,
+            consoleSupportsActivity: capabilities.findingActivity, consoleSupportsArchitecture: capabilities.architecture,
+            cwd: ctx.cwd, connect: development?.connect ?? ctx.relayRuntime?.connect,
+            ...(ctx.relayRuntime?.selectionProvider ? { selectionProvider: ctx.relayRuntime.selectionProvider } : {}),
             ...(proposal ? { proposal } : {}),
+            ...(selection ? { selection } : {}), ...(scope ? { scope } : {}),
+            ...(options.addToAnalysisId ? { addToAnalysisId: options.addToAnalysisId, expectedProjectId: options.expectedProjectId } : {}),
+            ...(options.retryUpload ? { retryUpload: true } : {}),
             signal: ctx.signal ? AbortSignal.any([controller.signal, ctx.signal]) : controller.signal,
             stdout() { }, stderr() { },
-            onStart: () => { ctx.onCheckStart?.(); ctx.write("\r\u001b[2KAnalyzing the agent…"); progressShown = true; },
+            onStart: () => { ctx.onCheckStart?.(); ctx.write(`\r\u001b[2K${progressLine(selection, "terminal")}`); progressShown = true; },
+            ...(scopeChoicesEnabled(startup.settings) ? { onScopeChoice: (value) => {
+                    choice = value;
+                    clearProgress();
+                    ctx.onScopeChoice?.(value);
+                } } : {}),
+            onNotice: message => { clearProgress(); ctx.write(`${message}\n`); },
+            onSaving: () => { clearProgress(); ctx.write("\r\u001b[2KSaving the results…"); progressShown = true; },
             onLocalSaved: result => {
                 if (result.ignoreAdded) {
                     clearProgress();
@@ -95,10 +160,13 @@ export async function analyze(path, options, ctx) {
             onSaved: result => {
                 clearProgress();
                 ctx.onCheckComplete?.(result);
-                ctx.write(formatSavedFindings(result, { numbersEnabled: ctx.findingNumbers, audienceEnabled: result.audienceEnabled }));
-                ctx.write(`Full results: ${result.url}\n`);
+                if (!options.deferResults)
+                    ctx.write(formatSavedResults(result, settings, ctx.findingNumbers, !options.addToAnalysisId, { agentReadableResults: ctx.findingSettings.agentReadableResults, surface: options.surface, analyzedFolder: options.analyzedFolder ?? path }));
             },
         });
+        if (choice && !ctx.onScopeChoice && selection)
+            ctx.write(await renderScopeChoices(choice, selection));
+        return code;
     }
     finally {
         clearProgress();

package/dist/cli/commands/skipped.js

@@ -0,0 +1,65 @@
+import { followupSettings, skippedFilesEnabled } from "../../analysis-core/settings.js";
+import { loadAnalysisResults } from "../../adapters/analysis-results.js";
+import { readLocalFolder } from "../../adapters/files.js";
+import { loadCompletion } from "../../adapters/completion.js";
+import { sizeSkippedFiles } from "../../analysis-core/analysis/code-agents/skipped-files.js";
+import { followupPlanText } from "../skipped-files.js";
+import { resolveAgentFolder } from "../agent-folder.js";
+import { formatSavedResults } from "../saved-results.js";
+export async function skipped(path, action, ctx, run, surface) {
+    if (!skippedFilesEnabled(ctx.startup.settings))
+        throw new Error("Skipped-file analyses are not enabled.");
+    const folder = resolveAgentFolder(path, ctx.cwd);
+    let latest;
+    let mode;
+    const deferred = { ...ctx, consoleMode: ctx.consoleMode ?? (() => mode ??= ctx.api.request("checks/mode")),
+        onCheckComplete: (result) => { latest = result; } };
+    const publish = () => {
+        if (!latest)
+            return;
+        ctx.onCheckComplete?.(latest);
+        ctx.write(formatSavedResults(latest, ctx.startup.settings, ctx.findingNumbers, false, { agentReadableResults: ctx.findingSettings.agentReadableResults, surface }));
+    };
+    // Finish an already completed upload before planning; its reading must not be purchased again.
+    const pending = await loadCompletion(folder);
+    const unsettled = pending?.uploaded ? await loadAnalysisResults(folder).then(saved => saved.context.pending?.checkId === pending.payload.checkId).catch(() => false) : false;
+    if (pending && !pending.finished && (!pending.uploaded || unsettled)) {
+        const recovered = await run(folder, { retryUpload: true, deferResults: true, surface }, deferred);
+        if (recovered !== 0) {
+            if (action === "analyze")
+                publish();
+            return recovered;
+        }
+    }
+    let saved;
+    try {
+        saved = await loadAnalysisResults(folder);
+    }
+    catch {
+        throw new Error("The saved analysis is missing or unreadable. Run an analysis of this folder first.");
+    }
+    const paths = sizeSkippedFiles(saved.report.refusedFiles).map(file => file.path);
+    if (action === "files") {
+        ctx.write(paths.length ? `${paths.join("\n")}\n` : "No skipped files remain to analyze.\n");
+        return 0;
+    }
+    const settings = followupSettings(ctx.startup.settings, saved.context.settings);
+    const source = await readLocalFolder(settings, folder, undefined, { planSkipped: paths });
+    const plan = source.filePlan;
+    ctx.write(followupPlanText(plan));
+    if (action === "plan")
+        return 0;
+    // Groups share the same local result files; save one completely before starting the next.
+    for (const group of plan.groups) {
+        ctx.signal?.throwIfAborted();
+        const scoped = { ...deferred,
+            startup: { ...ctx.startup, settings: Object.freeze({ ...settings, CF_PART_FILES: JSON.stringify(group.files) }) } };
+        const code = await run(folder, { deferResults: true, surface, addToAnalysisId: saved.context.analysisId, expectedProjectId: saved.context.projectId }, scoped);
+        if (code !== 0) {
+            publish();
+            return code;
+        }
+    }
+    publish();
+    return 0;
+}

package/dist/cli/completion-delivery.js

@@ -0,0 +1,63 @@
+import { OutputPathError } from "../adapters/output-paths.js";
+import { FINISH_FAILURE_MESSAGE } from "../contract/cli-refusals.js";
+import { completionRecoveryDecision, observedCompletionTiming } from "./completion-recovery.js";
+import { ResultsUploadError } from "./results-upload.js";
+/** Keep delivery ahead of report writes, including when private storage is unavailable. */
+export async function deliverCompletedResults(operations) {
+    const result = { uploaded: false };
+    let storageError, uploadError;
+    try {
+        await operations.persist(false);
+    }
+    catch (error) {
+        storageError = error;
+    }
+    try {
+        result.saved = await operations.submit();
+        result.uploaded = true;
+        try {
+            await operations.persist(true);
+        }
+        catch (error) {
+            storageError ??= error;
+        }
+    }
+    catch (error) {
+        uploadError = error;
+        if (error instanceof ResultsUploadError) {
+            result.outcome = error.outcome;
+            result.timing = error.timing;
+        }
+    }
+    try {
+        result.paths = await operations.saveReports();
+    }
+    catch {
+        result.localErrorMessage = "The local report couldn't be written.";
+    }
+    if (storageError) {
+        const message = storageError instanceof OutputPathError ? storageError.message : FINISH_FAILURE_MESSAGE;
+        result.localErrorMessage = result.localErrorMessage ? `${message}\n${result.localErrorMessage}` : message;
+    }
+    result.error = storageError ?? uploadError ?? (result.localErrorMessage ? new Error(result.localErrorMessage) : undefined);
+    return result;
+}
+/** Cleanup consumes the same decision as upload and writes only while the runner owns the folder. */
+export async function recoverCompletedResults(input, operations) {
+    const timing = observedCompletionTiming(input.timing ?? {}, input.statusLookup, input.payload);
+    const decision = completionRecoveryDecision({ ...input, timing });
+    if (input.canWrite) {
+        try {
+            if (decision.action === "saved")
+                await operations.markUploaded();
+            else if (decision.action === "give-up")
+                await operations.retire();
+            else if (decision.action === "retry" && input.retryEnabled && input.completionStored)
+                await operations.keepPending?.(timing);
+        }
+        catch { /* A local write cannot change a confirmed server outcome. */ }
+    }
+    const recoveryMessage = "message" in decision && (input.completionStored || decision.action === "give-up") ? decision.message : undefined;
+    const message = input.localErrorMessage && recoveryMessage ? `${input.localErrorMessage}\n${recoveryMessage}` : recoveryMessage ?? input.localErrorMessage;
+    return { decision, message };
+}

package/dist/cli/completion-recovery.js

@@ -1,18 +1,72 @@
-export const COMPLETION_SETTINGS_MISMATCH_MESSAGE = "This folder has a saved result for a different Counterfact project or address. Run the analysis again with the original settings to save it, or delete .counterfact/completion.json to start a new analysis.";
+import { cliRefusals, NOT_ALLOWED_MESSAGE, SIGN_IN_EXPIRED_MESSAGE, CHECK_CONFLICT_MESSAGE, PENDING_RESULTS_MESSAGE, UNSAVED_RESULTS_MESSAGE } from "../contract/cli-refusals.js";
+export const OTHER_SETUP_RESULTS_MESSAGE = "A saved result from another Counterfact setup was left untouched.";
+export const COMPLETION_SETTINGS_MISMATCH_MESSAGE = "This folder has a saved result for a different Counterfact project or address. Run the analysis again with the original settings to save it.";
 export const matchesCheck = (status, identity) => status.checkId === identity.checkId && status.projectId === identity.projectId;
+export function observedCompletionTiming(timing, lookup, payload) {
+    const status = lookup?.kind === "found" ? lookup.status : undefined;
+    if (!status || !payload || !matchesCheck(status, payload) || !status.absoluteExpiresAt)
+        return timing;
+    return { ...timing, absoluteExpiresAt: Math.min(timing.absoluteExpiresAt ?? Infinity, Date.parse(status.absoluteExpiresAt)) };
+}
+export function completionDeadline(timing, lookup, payload, outcome) {
+    const observed = observedCompletionTiming(timing, lookup, payload);
+    const reachable = lookup?.kind === "found" || lookup?.kind === "failed" && lookup.httpStatus !== undefined
+        || outcome && "httpStatus" in outcome && outcome.httpStatus !== undefined;
+    return Math.min(observed.completedAt === undefined ? Infinity : observed.completedAt + 2 * 60 * 60_000, reachable ? Infinity : observed.absoluteExpiresAt ?? Infinity);
+}
+export function completionRetryDeadline(timing, lookup, payload, outcome) {
+    return Math.min(completionDeadline(timing, lookup, payload, outcome), timing.retryStartedAt === undefined ? Infinity : timing.retryStartedAt + 10 * 60_000);
+}
+/** HTTP status owns certainty; proxy text and unfamiliar server codes cannot discard paid work. */
 export function completionRecoveryDecision(input) {
+    const { statusLookup, uploadOutcome, payload, retryEnabled, timing = {}, now = Date.now() } = input;
+    const uploadSaved = uploadOutcome.kind === "saved" || uploadOutcome.kind === "decided" && uploadOutcome.decision.action === "saved";
     if (input.localMismatch)
-        return { finished: false, message: COMPLETION_SETTINGS_MISMATCH_MESSAGE };
-    if (!input.statusSucceeded)
-        return { finished: false };
-    const { status, completedPayload } = input;
-    // A different analysis cannot settle this saved payload, even when submission reports a conflict.
-    if (status && completedPayload && !matchesCheck(status, completedPayload))
-        return { finished: false };
-    // Only trusted terminal status retires unsaved work; outages and closing work remain retryable.
-    if (status?.uploadState === "missing" && (status.state === "closed" || status.state === "expired")
-        && completedPayload && matchesCheck(status, completedPayload))
-        return { finished: true };
-    // A refusal never retires paid work by itself; only the console's own terminal status above can.
-    return { finished: false };
+        return !retryEnabled ? { action: "retry", automatic: false, message: COMPLETION_SETTINGS_MISMATCH_MESSAGE }
+            : !uploadSaved && now >= completionDeadline(timing) ? { action: "give-up" }
+                : { action: "leave", message: OTHER_SETUP_RESULTS_MESSAGE };
+    const status = statusLookup.kind === "found" ? statusLookup.status : undefined;
+    const matching = status && matchesCheck(status, payload);
+    if (uploadSaved
+        || retryEnabled && uploadOutcome.kind === "refused" && uploadOutcome.httpStatus !== undefined && uploadOutcome.httpStatus >= 200 && uploadOutcome.httpStatus < 300
+        || matching && status.uploadState === "saved")
+        return { action: "saved" };
+    // With retry off, trusted terminal status retires unsaved work using the original refusal.
+    if (!retryEnabled)
+        return matching && status.uploadState === "missing" && ["closed", "expired"].includes(status.state)
+            ? { action: "give-up" } : { action: "retry", automatic: false };
+    if (uploadOutcome.kind === "decided" && uploadOutcome.decision.action === "give-up")
+        return uploadOutcome.decision;
+    if (status && !matching)
+        return { action: "give-up", code: "check_conflict", message: CHECK_CONFLICT_MESSAGE };
+    if (now >= completionDeadline(timing, statusLookup, payload, uploadOutcome)) {
+        return { action: "give-up", message: UNSAVED_RESULTS_MESSAGE };
+    }
+    const refusals = [uploadOutcome.kind === "refused" ? uploadOutcome : undefined]
+        .filter(value => value !== undefined);
+    const uncertain = ({ code, httpStatus, transportFailure }) => transportFailure || (httpStatus === undefined
+        ? code === "unavailable"
+        : httpStatus === 408 || httpStatus === 429 || httpStatus >= 500 && httpStatus <= 599 || httpStatus === 409 && code === "reservation_closing"
+            || httpStatus < 400 || httpStatus >= 600);
+    const refusal = refusals.find(value => !uncertain(value));
+    if (refusal) {
+        // Guidance is explicit per code; copy edits never decide whether results survive.
+        const messages = {
+            check_conflict: CHECK_CONFLICT_MESSAGE,
+            not_allowed: NOT_ALLOWED_MESSAGE,
+            unauthorized: SIGN_IN_EXPIRED_MESSAGE,
+            invalid_body: cliRefusals.invalid_body,
+            cli_update_required: cliRefusals.cli_update_required,
+            local_checks_paused: cliRefusals.local_checks_paused,
+        };
+        return { action: "give-up", code: refusal.code, message: Object.hasOwn(messages, refusal.code)
+                ? refusal.code === "check_conflict" ? messages[refusal.code] : `${messages[refusal.code]}\n${UNSAVED_RESULTS_MESSAGE}`
+                : UNSAVED_RESULTS_MESSAGE };
+    }
+    if (matching && status.uploadState === "missing" && status.settlement === "released")
+        return { action: "give-up",
+            code: status.state === "expired" ? "reservation_expired" : "reservation_closed", message: UNSAVED_RESULTS_MESSAGE };
+    if (uploadOutcome.kind === "decided")
+        return uploadOutcome.decision;
+    return { action: "retry", automatic: now < completionRetryDeadline(timing, statusLookup, payload, uploadOutcome) && refusals.some(value => uncertain(value)), message: PENDING_RESULTS_MESSAGE };
 }

package/dist/cli/context.js

@@ -8,18 +8,20 @@ import { userEmail } from "./git.js";
 import { terminalSignInInput } from "./sign-in-input.js";
 import { readFindingSettings } from "./finding-settings.js";
 export function commandContext(options = {}) {
-    const startup = readCliSettings(options.env, options.emailSignIn);
+    const startup = options.startup ?? readCliSettings(options.env, options.emailSignIn);
     const homeDir = options.homeDir ?? homedir();
     const baseUrl = (options.baseUrl ?? startup.baseUrl ?? DEFAULT_URL).replace(/\/+$/, "");
-    const api = new ApiClient(baseUrl, () => readCredentials(homeDir, api.baseUrl), undefined, options.signal);
+    const api = new ApiClient(baseUrl, () => readCredentials(homeDir, api.baseUrl), undefined, options.signal, startup.transport.CF_CLI_TRANSPORT_ERRORS !== "0");
     const write = options.write ?? (text => { process.stdout.write(text); });
     const findingSettings = options.findingSettings ?? readFindingSettings(options.env);
     return {
         findingNumbers: findingSettings.numbersEnabled,
+        findingSettings,
         signInRetry: (options.env ?? process.env).CF_SIGN_IN_RETRY !== "0",
         startup, signal: options.signal, relayRuntime: options.relayRuntime, cwd: options.cwd ?? process.cwd(),
         token: () => readCredentials(homeDir, api.baseUrl), onCheckComplete: options.onCheckComplete, onCheckStart: options.onCheckStart, onAgentChoice: options.onAgentChoice,
         onCheckFailure: options.onCheckFailure,
+        onScopeChoice: options.onScopeChoice,
         api, homeDir, write, openBrowser: options.openBrowser ?? openBrowser,
         signInInput: options.signInInput ?? terminalSignInInput(), readEmail: options.readEmail ?? userEmail,
         sleep: options.sleep ?? (async (ms) => { await delay(ms, undefined, { signal: options.signal }); }), now: options.now ?? Date.now,

package/dist/cli/finding-display.js

@@ -1,5 +1,9 @@
-import { groupByAudience } from "../analysis-core/analysis/schemas.js";
+import { stripVTControlCharacters } from "node:util";
+import { groupByActivity, groupByAudience } from "../analysis-core/analysis/schemas.js";
 export const TEAM_WORKFLOW_HEADING = "Team workflow";
+export const notActiveCountLine = (count) => `${count} more ${count === 1 ? "finding is" : "findings are"} about code that doesn't run today (not active)`;
+export const activityAdvice = (activity) => activity.state === "dead" ? "Remove it (cleanup)."
+    : `Fix this before turning on ${activity.gate}, or remove it if you don't plan to use it.`;
 export const formatFindingNumber = (seq) => `F-${seq}`;
 /** Intake returns one id per payload finding in order; the optional number mapping is joined by id. */
 export function savedFindings(result, report) {
@@ -7,28 +11,119 @@ export function savedFindings(result, report) {
     return result.findingIds.map((id, index) => {
         const numbered = numbers.get(id), local = report[index];
         return { id, ...(numbered ? { seq: numbered.seq, number: formatFindingNumber(numbered.seq) } : {}),
-            title: local?.title ?? "", ...(local?.audience === undefined ? {} : { audience: local.audience }) };
+            title: local?.title ?? "", ...(local?.audience === undefined ? {} : { audience: local.audience }),
+            ...(local?.activity === undefined ? {} : { activity: local.activity }),
+            ...(local?.activity === undefined || local.fixes === undefined ? {} : { fixes: local.fixes.map(({ title, approach }) => ({ title: title ?? "", approach: approach ?? "" })) }),
+            ...(local?.severity === undefined ? {} : { severity: local.severity }),
+            ...(local?.site === undefined ? {} : { site: local.site }),
+            ...(local?.fixes === undefined ? {} : { shortFix: shortFix(local.fixes[0]) }) };
     });
 }
+function findingLabel(value, enabled, index, labels) {
+    return labels === "position" ? `${index + 1}.` : enabled && value.seq !== undefined ? formatFindingNumber(value.seq) : value.id ?? `${index + 1}.`;
+}
 function findingLine(value, enabled, index, labels, audienceEnabled) {
     // The off switch preserves the original Markdown summary, including whitespace.
     if (labels === "position" && !audienceEnabled)
         return `${index + 1}. ${value.title}`;
     const title = value.title.replace(/[\r\n\u2028\u2029]+/g, " ");
-    const label = labels === "position" ? `${index + 1}.` : enabled && value.seq !== undefined ? formatFindingNumber(value.seq) : value.id ?? `${index + 1}.`;
+    const label = findingLabel(value, enabled, index, labels);
     return `${label}${title ? ` ${title}` : ""}`;
 }
-export function findingDisplayRows(findings, { numbersEnabled = true, audienceEnabled, labels }) {
-    const groups = audienceEnabled ? groupByAudience(findings) : { users: findings, team: [] };
+export function findingDisplayRows(findings, { numbersEnabled = true, audienceEnabled, notActiveEnabled = false, labels }) {
+    const { active } = groupByActivity(findings, notActiveEnabled);
+    const groups = audienceEnabled ? groupByAudience(active) : { users: active, team: [] };
     return [...groups.users, ...groups.team].map((finding, index) => ({ finding,
         label: findingLine(finding, numbersEnabled, index, labels, audienceEnabled), startsTeamGroup: groups.team.length > 0 && index === groups.users.length }));
 }
-export function formatSavedFindings(result, options) {
+function legacyFindingList(result, options) {
+    const groups = groupByActivity(result.findings ?? [], options.notActiveEnabled === true);
+    const collapsed = groups.notActive.length ? notActiveCountLine(groups.notActive.length) + "\n" : "";
     if (options.numbersEnabled !== false && result.findings?.some(value => value.seq !== undefined)) {
-        return "Findings:\n" + findingDisplayRows(result.findings, { ...options, labels: "reference" }).map(row => `${row.startsTeamGroup ? `${TEAM_WORKFLOW_HEADING}:\n` : ""}${row.label}\n`).join("");
+        return "Findings:\n" + findingDisplayRows(result.findings, { ...options, labels: "reference" }).map(row => `${row.startsTeamGroup ? `${TEAM_WORKFLOW_HEADING}:\n` : ""}${row.label}\n`).join("") + collapsed;
     }
+    if (collapsed)
+        return (groups.active.length ? `Finding ids: ${groups.active.map(f => f.id).join(", ")}\n` : "") + collapsed;
     return result.findingIds?.length ? `Finding ids: ${result.findingIds.join(", ")}\n` : "";
 }
+export function formatFindingActivity(activity) {
+    return `${activity.state === "dead" ? "Dead" : "Switched off"}: ${activity.reason}\n${activityAdvice(activity)}\n`;
+}
+// This is a presentation budget, separate from the size of the saved report.
+export const AGENT_FINDING_LIST_BUDGET = 12_000;
+function shortFix(fix) {
+    return [fix?.summary, fix?.title, fix?.approach].find(text => text?.trim()) ?? "";
+}
+function compactText(value, limit) {
+    const text = stripVTControlCharacters(value).replace(/[\p{Cc}\s]+/gu, " ").replace(/\s*\u2014\s*/g, ", ").trim();
+    if (text.length <= limit)
+        return text;
+    // Avoid ending on half of a supplementary Unicode character.
+    return Array.from(text.slice(0, limit - 3)).filter(char => !/^[\ud800-\udbff]$/.test(char)).join("") + "...";
+}
+function sentence(text) { return /[.!?]$/.test(text) ? text : `${text}.`; }
+function compactFinding(value) {
+    const compact = legacyFinding(value);
+    // Full fixes remain in saved detail; compact lists use only the existing short fix.
+    delete compact.fixes;
+    return { ...compact, title: compactText(value.title, 160) || "Untitled finding",
+        severity: compactText(value.severity ?? "", 24) || "severity unavailable",
+        ...(value.site ? { site: { path: compactText(value.site.path, 240), line: value.site.line } } : {}),
+        shortFix: compactText(value.shortFix ?? "", 240) || "No suggested fix available." };
+}
+function legacyFinding(value) {
+    const original = { ...value };
+    delete original.severity;
+    delete original.site;
+    delete original.shortFix;
+    return original;
+}
+export function findingDetailReference(value, projectId) {
+    return { id: value.seq !== undefined ? formatFindingNumber(value.seq) : value.id, ...(projectId ? { projectId } : {}) };
+}
+export function formatFindingContinuation(next) {
+    return `Next finding: get_finding(${JSON.stringify(next)})\n`;
+}
+export function presentSavedFindings(result, options) {
+    const rows = findingDisplayRows(result.findings ?? [], { ...options, labels: "reference" });
+    const orderedReferences = rows.flatMap(({ finding }) => finding.id ? [{ id: finding.id, seq: finding.seq }] : []);
+    if (options.agentReadableResults === false || options.numbersEnabled === false || !rows.length) {
+        return { text: legacyFindingList(result, options), findings: rows.map(row => legacyFinding(row.finding)),
+            findingIds: result.findingIds ?? [], nextFinding: undefined, orderedReferences };
+    }
+    const { notActive } = groupByActivity(result.findings ?? [], options.notActiveEnabled === true);
+    const collapsed = notActive.length ? notActiveCountLine(notActive.length) + "\n" : "";
+    let text = "Findings:\n";
+    const findings = [];
+    let nextFinding;
+    for (const [index, row] of rows.entries()) {
+        const value = compactFinding(row.finding);
+        const label = findingLabel(value, true, index, "reference");
+        const site = value.site ? `${value.site.path}:${value.site.line ?? "?"}` : "File unavailable";
+        const line = `${row.startsTeamGroup ? `${TEAM_WORKFLOW_HEADING}:\n` : ""}${label} (${value.severity}) ${sentence(value.title)} ${site}. Fix: ${value.shortFix}\n`;
+        const next = rows[index + 1]?.finding;
+        const footer = next ? overflowLine(rows.length - index - 1, next, options) : "";
+        const candidate = { text: text + line + footer + collapsed, findings: [...findings, value],
+            findingIds: [...findings, value].flatMap(finding => finding.id ? [finding.id] : []),
+            ...(next ? { nextFinding: findingDetailReference(next, options.projectId) } : {}) };
+        if (JSON.stringify(candidate).length > AGENT_FINDING_LIST_BUDGET) {
+            nextFinding = findingDetailReference(row.finding, options.projectId);
+            text += overflowLine(rows.length - index, row.finding, options);
+            break;
+        }
+        text += line;
+        findings.push(value);
+    }
+    return { text: text + collapsed, findings, findingIds: findings.flatMap(value => value.id ? [value.id] : []), nextFinding, orderedReferences };
+}
+function overflowLine(count, next, options) {
+    const guidance = options.surface === "mcp" ? `Next: get_finding(${JSON.stringify(findingDetailReference(next, options.projectId))}); follow nextFinding for the rest.`
+        : `Run counterfact-labs finding ${next.id} for the next one, or open Full results below.`;
+    return `${count} more ${count === 1 ? "finding" : "findings"}. ${guidance}\n`;
+}
+export function formatSavedFindings(result, options) {
+    return presentSavedFindings(result, options).text;
+}
 export function formatWaitingFixes(items, enabled, needsProject) {
     if (!items.length)
         return "No waiting fixes.";

package/dist/cli/finding-settings.js

@@ -1,5 +1,7 @@
 import { findingAudienceEnabled } from "../analysis-core/analysis/finding-audience-switch.js";
+import { notActiveEnabled } from "../analysis-core/analysis/finding-activity-switch.js";
 export function readFindingSettings(env = process.env, bundle) {
     return { numbersEnabled: env.CF_FINDING_NUMBERS !== "0", fixesEnabled: env.CF_WAITING_FIXES !== "0",
-        audienceEnabled: findingAudienceEnabled(env, bundle) };
+        audienceEnabled: findingAudienceEnabled(env, bundle), notActiveEnabled: notActiveEnabled(env),
+        agentReadableResults: env.CF_AGENT_READABLE_RESULTS !== "0" };
 }

package/dist/cli/intake-payload.js

@@ -1,8 +1,11 @@
+import { skippedFilesEnabled } from "../analysis-core/settings.js";
+import { fingerprintOf } from "../analysis-core/analysis/finding-identity.js";
 import { resultSafetyCheckEnabled } from "../analysis-core/settings.js";
 import { localFindingsPayloadSchema } from "../contract/console.js";
 import { projectPublicFinding } from "../contract/public-report.js";
 import { checkIntakeFindings } from "./result-check.js";
 import { RESULTS_TOO_LARGE_MESSAGE } from "../contract/cli-refusals.js";
+import { projectArchitecture } from "../contract/project-architecture.js";
 export function buildIntakePayload(identity, agent, report, options = {}) {
     const repo = (key) => key === null || key === report.repoKey ? agent.repository : key;
     let findings = report.findings.map(finding => projectPublicFinding(finding, repo));
@@ -19,8 +22,29 @@ export function buildIntakePayload(identity, agent, report, options = {}) {
         resultCheck = counts;
         findingIndexes = acceptedIndexes;
     }
-    const result = localFindingsPayloadSchema.safeParse({ ...identity, agent, findings });
+    const metadata = !skippedFilesEnabled(options.settings ?? {}) ? {} : {
+        ...(options.coverage ? { coverage: options.coverage } : {}),
+        ...(options.addToAnalysisId ? { addToAnalysisId: options.addToAnalysisId } : {}),
+        ...(options.findingAssessments ? { findingAssessments: findingIndexes.flatMap((index, at) => {
+                const assessment = options.findingAssessments.find(row => row.fingerprint === fingerprintOf(report.findings[index]));
+                return assessment ? [{ ...assessment, fingerprint: fingerprintOf(findings[at]) }] : [];
+            }) } : {}),
+    };
+    const findingActivities = findings.map(finding => finding.activity);
+    // Older consoles use a strict schema. Local grouping survives without sending an unsupported field.
+    if (options.consoleSupportsActivity !== true)
+        findings = findings.map(finding => {
+            const legacy = { ...finding };
+            delete legacy.activity;
+            return legacy;
+        });
+    const architecture = options.consoleSupportsArchitecture === true && options.settings?.CF_LOCAL_ARCHITECTURE === "1"
+        ? projectArchitecture(report.graph) : undefined;
+    let result = localFindingsPayloadSchema.safeParse({ ...identity, agent, findings, ...metadata, ...(architecture ? { architecture } : {}) });
+    // Optional map metadata must not crowd otherwise valid findings out of the total upload allowance.
+    if (!result.success && architecture)
+        result = localFindingsPayloadSchema.safeParse({ ...identity, agent, findings, ...metadata });
     if (!result.success)
         throw new Error(RESULTS_TOO_LARGE_MESSAGE);
-    return { payload: result.data, resultCheck, findingIndexes };
+    return { payload: result.data, resultCheck, findingIndexes, findingActivities };
 }