@counterfact-labs/cli 0.2.7 → 0.2.9

package/bundle/client-release.json

@@ -1,7 +1,7 @@
 {
   "verificationKey": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAbBab1PYdmBKXxCvoJ47toJhQvxPevo9nlZnb0zbDWoc=\n-----END PUBLIC KEY-----\n",
   "relayVersion": "relay-1.0.1",
-  "localVersion": "0.2.7",
+  "localVersion": "0.2.9",
   "relayUrl": "https://relay.counterfactlabs.com:8443",
   "projectContext": "checks"
 }

package/dist/adapters/analysis-results.js

@@ -0,0 +1,87 @@
+import { constants } from "node:fs";
+import { open, unlink } from "node:fs/promises";
+import { z } from "zod";
+import { findingActivitySchema } from "../analysis-core/analysis/schemas.js";
+import { snapshotSettings } from "../analysis-core/settings.js";
+import { publicReportSchema } from "../contract/public-report.js";
+import { outputPaths, writeOutputFiles } from "./output-paths.js";
+import { savedFindings } from "../cli/finding-display.js";
+import { rankFindings } from "../analysis-core/analysis/finding-quality/policy.js";
+import { fingerprintOf } from "../analysis-core/analysis/finding-identity.js";
+import { combineAssessments } from "./combined-results.js";
+import { createHash } from "node:crypto";
+const displayFields = { title: z.string(), audience: z.string().optional(), activity: findingActivitySchema.optional(),
+    severity: z.string().optional(), site: z.object({ path: z.string(), line: z.number().nullable() }).nullable().optional() };
+const referenceSchema = z.object({ fingerprint: z.string(), id: z.string(), seq: z.number().optional(), number: z.string().optional(),
+    ...displayFields, shortFix: z.string().optional(), fixes: z.array(z.object({ title: z.string(), approach: z.string() })).optional() });
+const pendingFindingSchema = z.object({ ...displayFields, fixes: z.array(z.object({ summary: z.string().nullable().optional(),
+        title: z.string().nullable().optional(), approach: z.string().nullable().optional() })).optional() });
+const contextSchema = z.strictObject({ projectId: z.uuid(), analysisId: z.uuid(), settings: z.record(z.string(), z.string()),
+    reportHash: z.string(),
+    findings: z.array(referenceSchema).optional(),
+    topFindingIds: z.array(z.string()).optional(),
+    pending: z.strictObject({ checkId: z.uuid(), fingerprints: z.array(z.string()), titles: z.array(pendingFindingSchema) }).optional(),
+    assessments: z.array(z.strictObject({ fingerprint: z.string(), support: z.enum(["complete", "incomplete"]),
+        confidence: z.enum(["sure", "not sure"]), weak: z.boolean(), reason: z.string() })) });
+async function readJson(path) {
+    const input = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const info = await input.stat();
+        if (!info.isFile() || info.size > 64 * 1024 * 1024)
+            throw new Error("Invalid saved analysis");
+        return JSON.parse(await input.readFile("utf8"));
+    }
+    finally {
+        await input.close();
+    }
+}
+/** Saved results are the authority for which omissions still need an analysis. */
+export async function loadAnalysisResults(folder, outputDir) {
+    const [reportPath, contextPath] = await outputPaths(folder, ["findings.json", "analysis-context.json"], outputDir);
+    const report = publicReportSchema.parse(await readJson(reportPath));
+    const { reportHash, ...context } = contextSchema.parse(await readJson(contextPath));
+    if (reportHash !== hashReport(report))
+        throw new Error("Invalid saved analysis");
+    return { report, context };
+}
+export async function loadPublicReport(folder, outputDir) {
+    const [path] = await outputPaths(folder, ["findings.json"], outputDir);
+    return publicReportSchema.parse(await readJson(path));
+}
+/** Only non-secret analysis choices may survive into a later scoped run. */
+export async function saveAnalysisContext(folder, context, outputDir) {
+    const report = await loadPublicReport(folder, outputDir);
+    const value = contextSchema.parse({ ...context, reportHash: hashReport(report), settings: snapshotSettings(context.settings) });
+    await writeOutputFiles(folder, { "analysis-context.json": `${JSON.stringify(value)}\n` }, outputDir);
+}
+function hashReport(report) { return createHash("sha256").update(JSON.stringify(report)).digest("hex"); }
+export async function invalidateAnalysisContext(folder, outputDir) {
+    try {
+        const [path] = await outputPaths(folder, ["analysis-context.json"], outputDir);
+        await unlink(path);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+/** Intake assigns ids once; retries join them to the same saved claims without replacing original references. */
+export async function settleAnalysisContext(folder, result, checkId, addToAnalysisId, outputDir) {
+    const { context, report } = await loadAnalysisResults(folder, outputDir);
+    if (context.projectId !== result.projectId)
+        throw new Error("Invalid saved analysis");
+    const { pending, ...before } = context;
+    if (!pending || pending.checkId !== checkId)
+        return context;
+    const known = new Map(context.findings?.map(finding => [finding.fingerprint, finding]));
+    savedFindings(result, pending.titles).forEach((finding, index) => {
+        const fingerprint = pending.fingerprints[index];
+        if (fingerprint && !known.has(fingerprint))
+            known.set(fingerprint, { ...finding, fingerprint });
+    });
+    const ranking = rankFindings(report.findings, combineAssessments([], context.assessments), fingerprintOf);
+    const next = { ...before, analysisId: addToAnalysisId ?? result.analysisId, findings: [...known.values()],
+        topFindingIds: ranking.defaultIds.flatMap(key => known.has(key) ? [known.get(key).id] : []) };
+    await saveAnalysisContext(folder, next, outputDir);
+    return next;
+}

package/dist/adapters/combined-results.js

@@ -0,0 +1,27 @@
+import { fingerprintOf } from "../analysis-core/analysis/finding-identity.js";
+import { rankFindings } from "../analysis-core/analysis/finding-quality/policy.js";
+import { mergeSkippedFiles } from "../analysis-core/analysis/code-agents/skipped-files.js";
+/** Existing support belongs to the original claim; another reading cannot weaken it or make its identity ambiguous. */
+export function combineAssessments(before, after) {
+    const known = new Map();
+    for (const assessment of [...before, ...after])
+        if (!known.has(assessment.fingerprint))
+            known.set(assessment.fingerprint, assessment);
+    return [...known.values()];
+}
+/** Additional reading cannot replace claims that it did not re-analyze. */
+export function combineLocalReports(before, after, assessments, readPaths) {
+    const existing = new Set(before.findings.map(fingerprintOf));
+    const additions = after.findings.filter(finding => {
+        const key = fingerprintOf(finding);
+        if (existing.has(key))
+            return false;
+        existing.add(key);
+        return true;
+    });
+    const ranking = rankFindings([...before.findings, ...additions], combineAssessments([], assessments), fingerprintOf);
+    const read = new Set(readPaths);
+    return { report: { ...before, findings: ranking.ordered,
+            structures: [...before.structures, ...after.structures], warnings: [...new Set([...before.warnings, ...after.warnings])],
+            refusedFiles: mergeSkippedFiles(before.refusedFiles.filter(file => !read.has(file.path)), after.refusedFiles) }, ranking };
+}

package/dist/adapters/entry-files.js

@@ -7,7 +7,7 @@ import { moduleResolutionLimits } from "../analysis-core/import/calls/modules.js
 import { createGitIgnore } from "./git-ignore.js";
 import { readTargetMatches, searchBoundary } from "./repository-root.js";
 /** Inventory and bounded reads supply filesystem facts; core decides which files belong. */
-export async function createEntryFiles(settings, root, admission = {}, signal, entryPath) {
+export async function createEntryFiles(settings, root, admission = {}, signal, entryPaths) {
     signal?.throwIfAborted();
     const safety = { ...settings, CF_LOCAL_SYMLINK_GUARD: "1", CF_RESPECT_GITIGNORE: "1", CF_SECRET_SCAN: "1" };
     const ignored = createGitIgnore(safety, root), gitIgnored = new Set();
@@ -68,7 +68,10 @@ export async function createEntryFiles(settings, root, admission = {}, signal, e
         }
     }
     await walk(root, "");
-    if (entryPath && !entries.some(entry => entry.path === entryPath)) {
+    for (const entryPath of typeof entryPaths === "string" ? [entryPaths] : entryPaths ?? []) {
+        signal?.throwIfAborted();
+        if (entries.some(entry => entry.path === entryPath))
+            continue;
         const info = await stat(join(root, entryPath)).catch(() => null);
         if (info?.isFile())
             entries.push({ path: entryPath, size: info.size, ref: entryPath });

package/dist/adapters/entry-packing.js

@@ -0,0 +1,161 @@
+import { MAX_ANALYSIS_ENTRIES } from "../analysis-core/contracts/analysis-selection.js";
+import { entryGroupChoice } from "../analysis-core/import/entry-selection.js";
+import { analysisSizeLimits, assessAnalysisSize, measureAnalysisSize, measureAnalysisSizeLowerBound } from "../analysis-core/conventions/analysis-fit.js";
+const defaultBudget = { measurements: 4_096, candidates: 16_384, searchSteps: 100_000 };
+/** Size stays at this boundary; core supplies and validates the complete entry import sets. */
+export function fittingEntryGroups(settings, membership, currentPaths, budget = defaultBudget) {
+    if (membership.kind !== "file" || !membership.entrySets)
+        return [];
+    let optimizing = false, exhausted = false, measurements = 0, candidates = 0, searchSteps = 0;
+    const current = new Set(currentPaths);
+    const byteFloors = new Map(membership.files.map(file => [file.path, measureAnalysisSizeLowerBound(settings, [file])]));
+    const pools = [["totalBytes", analysisSizeLimits.totalLimitBytes], ["instructionBytes", analysisSizeLimits.instructionLimitBytes]];
+    const cache = new Map();
+    const candidate = (entries) => {
+        const key = JSON.stringify([...entries].sort());
+        if (cache.has(key))
+            return cache.get(key);
+        const choice = entryGroupChoice(membership, entries);
+        let result;
+        if (choice && choice.includes.every(path => current.has(path))) {
+            const floors = pools.map(([pool, limit]) => choice.includes.reduce((sum, path) => sum + byteFloors.get(path)[pool], 0) / limit);
+            const floorWeight = Math.max(...floors), floorFits = floorWeight <= 1;
+            const paths = new Set(choice.includes);
+            if (floorFits && optimizing && measurements++ >= budget.measurements) {
+                exhausted = true;
+                return undefined;
+            }
+            const size = !floorFits ? undefined
+                : measureAnalysisSize(settings, membership.files.filter(file => paths.has(file.path)));
+            result = { choice, fits: size ? assessAnalysisSize(size).fits : false, floorFits,
+                weight: size ? Math.max(size.totalBytes / analysisSizeLimits.totalLimitBytes, size.instructionBytes / analysisSizeLimits.instructionLimitBytes)
+                    : floorWeight };
+        }
+        cache.set(key, result);
+        return result;
+    };
+    const sets = new Map(membership.entrySets.map(set => [set.entry, set.includes]));
+    const inputOrder = membership.entrySets.map(set => set.entry).filter(entry => candidate([entry]));
+    const entries = [...inputOrder].sort((left, right) => candidate([right]).weight - candidate([left]).weight);
+    if (!entries.length)
+        return [];
+    const minimumParts = (roots) => {
+        const owners = new Map();
+        for (const entry of roots)
+            for (const path of sets.get(entry))
+                owners.set(path, (owners.get(path) ?? 0) + 1);
+        let minimum = Math.ceil(roots.length / MAX_ANALYSIS_ENTRIES);
+        for (const [pool, limit] of pools) {
+            const exclusiveBytes = roots.map(entry => sets.get(entry).reduce((sum, path) => sum + (owners.get(path) === 1 ? byteFloors.get(path)[pool] : 0), 0));
+            minimum = Math.max(minimum, Math.ceil([...owners.keys()].reduce((sum, path) => sum + byteFloors.get(path)[pool], 0) / limit));
+            for (let count = 1; count < MAX_ANALYSIS_ENTRIES; count++)
+                minimum = Math.max(minimum, Math.ceil(exclusiveBytes.filter(bytes => bytes > limit / (count + 1)).length / count));
+        }
+        return minimum;
+    };
+    const pack = (order) => {
+        const groups = [];
+        let complete = true;
+        for (const entry of order) {
+            if (groups.some(group => sets.get(entry).every(path => candidate(group).choice.includes.includes(path))))
+                continue;
+            const group = groups.find(group => candidate([...group, entry])?.fits);
+            if (exhausted)
+                return undefined;
+            if (group)
+                group.push(entry);
+            else if (candidate([entry]).fits)
+                groups.push([entry]);
+            else
+                complete = false;
+        }
+        return complete ? groups : undefined;
+    };
+    let best = pack(entries);
+    const ordered = (groups) => groups.map(group => [...group].sort((a, b) => membership.entries.indexOf(a) - membership.entries.indexOf(b)))
+        .sort((a, b) => membership.entries.indexOf(a[0]) - membership.entries.indexOf(b[0]))
+        .map(group => candidate(group).choice);
+    const minimum = minimumParts(entries);
+    if (best && best.length === minimum)
+        return ordered(best);
+    // Keep the measured baseline before spending bounded extra work on fewer parts.
+    optimizing = true;
+    // Size sorting can miss a fitting arrangement that the user's entry order finds immediately.
+    // Proving either pass optimal avoids enumerating the full combination frontier.
+    const alternate = pack(inputOrder);
+    if (alternate && (!best || alternate.length < best.length))
+        best = alternate;
+    if (exhausted || best?.length === minimum)
+        return ordered(best ?? []);
+    const choices = new Map();
+    const extend = (group, start) => {
+        if (exhausted || candidates++ >= budget.candidates) {
+            exhausted = true;
+            return;
+        }
+        const value = candidate(group);
+        // Only an inventory-independent floor can rule out every larger combination.
+        if (!value || !value.floorFits)
+            return;
+        if (value.fits) {
+            const included = new Set(value.choice.includes);
+            const covered = new Set(entries.filter(entry => sets.get(entry).every(path => included.has(path))));
+            const key = JSON.stringify([...covered].sort());
+            if (!choices.has(key))
+                choices.set(key, { entries: group, covered, weight: value.weight });
+        }
+        if (group.length === MAX_ANALYSIS_ENTRIES)
+            return;
+        for (let index = start; index < entries.length && !exhausted; index++)
+            extend([...group, entries[index]], index + 1);
+    };
+    for (let index = 0; index < entries.length && !exhausted; index++)
+        extend([entries[index]], index + 1);
+    if (exhausted)
+        return ordered(best ?? []);
+    const groups = [...choices.values()].sort((left, right) => right.weight - left.weight || right.covered.size - left.covered.size);
+    const byEntry = new Map(entries.map(entry => [entry, groups.filter(group => group.covered.has(entry))]));
+    const eligible = entries.filter(entry => byEntry.get(entry).length);
+    if (!eligible.length)
+        return [];
+    const eligibleMinimum = minimumParts(eligible);
+    const visited = new Map();
+    const search = (remaining, selected) => {
+        if (exhausted || searchSteps++ >= budget.searchSteps) {
+            exhausted = true;
+            return;
+        }
+        if (best?.length === eligibleMinimum)
+            return;
+        if (!remaining.length) {
+            best = selected.map(group => [...group]);
+            return;
+        }
+        const key = JSON.stringify(remaining);
+        if ((visited.get(key) ?? Infinity) <= selected.length)
+            return;
+        visited.set(key, selected.length);
+        if (selected.length + minimumParts(remaining) >= (best?.length ?? Infinity))
+            return;
+        const entry = remaining.reduce((fewest, entry) => byEntry.get(entry).length < byEntry.get(fewest).length ? entry : fewest);
+        const seen = new Set();
+        for (const group of byEntry.get(entry)) {
+            if (exhausted || searchSteps++ >= budget.searchSteps) {
+                exhausted = true;
+                return;
+            }
+            const next = remaining.filter(entry => !group.covered.has(entry));
+            const nextKey = JSON.stringify(next);
+            if (seen.has(nextKey))
+                continue;
+            seen.add(nextKey);
+            selected.push(group.entries);
+            search(next, selected);
+            selected.pop();
+            if (best?.length === eligibleMinimum)
+                return;
+        }
+    };
+    search(eligible, []);
+    return ordered(best ?? []);
+}

package/dist/adapters/entry-selection.js

@@ -5,16 +5,20 @@ import { localRepoKeyFor } from "../analysis-core/github/repo-key.js";
 import { cliRefusals } from "../contract/cli-refusals.js";
 import { INVALID_SELECTION_MESSAGE, INVALID_SCOPE_MESSAGE, SINGLE_FILE_TOO_LARGE_MESSAGE, SCOPE_PROPOSAL_CONFLICT_MESSAGE, STALE_SCOPE_MESSAGE } from "../contract/scope-choice.js";
 import { createEntryFiles } from "./entry-files.js";
+import { selectionSizeOffer } from "./selection.js";
+import { MAX_ANALYSIS_ENTRIES } from "../analysis-core/contracts/analysis-selection.js";
+import { ScopeChoiceError } from "../contract/selection-offer.js";
 /** The CLI consumes the core membership answer and captures only its retained files. */
 export const entrySelectionProvider = async (settings, request, options) => {
     if (!fileScopeEnabled(settings) || request.kind !== "file")
         throw new Error(cliRefusals.release_unavailable);
-    const port = await createEntryFiles(settings, request.launchRoot, options.admission, options.signal, request.entry).catch(() => {
+    const port = await createEntryFiles(settings, request.launchRoot, options.admission, options.signal, request.entries ?? request.entry).catch(() => {
         options.signal?.throwIfAborted();
         throw new Error(INVALID_SELECTION_MESSAGE);
     });
     const input = { ...port, request: { ...request, scope: undefined }, admission: options.admission };
     const full = await readEntrySelection(settings, input);
+    options.signal?.throwIfAborted();
     const refusal = (reason) => {
         if (reason === "over-limit")
             throw new Error(SINGLE_FILE_TOO_LARGE_MESSAGE);
@@ -30,8 +34,16 @@ export const entrySelectionProvider = async (settings, request, options) => {
         return refusal(full.reason);
     // Replay the same admitted captures through the owner to validate a narrower scope.
     const selected = request.scope || options.proposal ? await readEntrySelection(settings, { ...input, request, proposal: options.proposal }) : full;
+    options.signal?.throwIfAborted();
     if (selected.kind !== "ready")
         return refusal(selected.reason);
+    if (request.entries && (selected.selection.files.filter(file => file.role === "entry").length > MAX_ANALYSIS_ENTRIES
+        || !request.scope && request.entries.some(entry => !selected.selection.files.some(file => file.path === entry)))) {
+        const choices = selectionSizeOffer(settings, full.selection, { files: selected.files }, { force: true });
+        if (choices)
+            throw new ScopeChoiceError(choices);
+        throw new Error(INVALID_SCOPE_MESSAGE);
+    }
     const { files } = selected;
     const entries = selected.selection.files.map(({ path, size }) => ({ path, size, ref: path }));
     const selection = { selected: entries, refused: [], totalBytes: entries.reduce((sum, file) => sum + file.size, 0) };

package/dist/adapters/files.js

@@ -1,11 +1,18 @@
-import { moduleResolutionLimits } from "../analysis-core/import/calls/modules.js";
+import { folderPartsEnabled, skippedFilesEnabled } from "../analysis-core/settings.js";
+import { ModuleResolver, moduleResolutionLimits } from "../analysis-core/import/calls/modules.js";
 import { opendir, realpath, stat, readFile } from "node:fs/promises";
 import { dirname, join, posix } from "node:path";
 import { admitFile, FileReadRefusal, fileRefusalWarning, localSymlinkGuardEnabled, respectGitignore, readRepoFile, resolveLocalExclusions } from "../analysis-core/conventions/file-admission.js";
 import { assessAnalysisSize, measureAnalysisSize } from "../analysis-core/conventions/analysis-fit.js";
 import { localRepoKeyFor } from "../analysis-core/github/repo-key.js";
+import { fileScopeOf, planFileAnalyses } from "../analysis-core/analysis/file-analysis-plan.js";
+import { planFolderAnalyses } from "../analysis-core/analysis/folder-analysis-plan.js";
+import { fileDependencies } from "../analysis-core/analysis/file-dependencies.js";
+import { mapLimit } from "../analysis-core/map-limit.js";
+import { fileEvidenceBytes } from "../analysis-core/analysis/passes/full-file-passes.js";
 import { fetchLocalSources } from "../analysis-core/index.js";
 import { repoPathFrom } from "../analysis-core/import/outside-loader-sources.js";
+import { READ_LIMITS } from "../analysis-core/conventions/read-limits.js";
 import { mergeSkippedFiles, mergeUnlistedFileWarnings } from "../analysis-core/analysis/code-agents/skipped-files.js";
 import { createGitIgnore } from "./git-ignore.js";
 import { createIgnoredFileCollector } from "./ignored-files.js";
@@ -13,11 +20,23 @@ import { resolveFolderPath } from "./folder-path.js";
 import { createRepositoryFiles } from "./repository-files.js";
 export const FOLDER_ENTRY_LIMIT = moduleResolutionLimits.inventoryEntries;
 export const FOLDER_ENTRY_LIMIT_MESSAGE = "The folder has too many entries to analyze. Choose a smaller folder.";
-export async function readLocalFolder(settings, folder, admission = {}, options = {}) {
+export async function readLocalFolder(...args) {
+    try {
+        return await readFolder(...args);
+    }
+    catch (error) {
+        // An open failure is a read failure here; outside this owner it may belong to a write.
+        if (error instanceof Error)
+            Object.assign(error, { localOperation: "read" });
+        throw error;
+    }
+}
+async function readFolder(settings, folder, admission = {}, options = {}) {
     const root = await resolveFolderPath(folder);
     if (!(await stat(root)).isDirectory())
         throw new Error("Select a folder to analyze.");
     const entries = [];
+    const knownPaths = new Set(), opaquePaths = new Set();
     const warnings = [];
     const refused = [];
     const gitSkipped = [];
@@ -76,12 +95,17 @@ export async function readLocalFolder(settings, folder, admission = {}, options
                 throw new Error(FOLDER_ENTRY_LIMIT_MESSAGE);
             items.push(entry);
         }
+        opaquePaths.delete(prefix);
         const names = items.map(item => item.name);
         const facts = await ignoredPaths(names.map(name => join(target, name)));
         const gitIgnored = facts && new Set(names.filter(name => facts.has(join(target, name))).map(name => prefix ? `${prefix}/${name}` : name));
         for (const item of items.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
             const name = item.name;
             const path = prefix ? `${prefix}/${name}` : name;
+            if (item.isDirectory() || item.isSymbolicLink())
+                opaquePaths.add(path);
+            if (item.isFile() || item.isSymbolicLink())
+                knownPaths.add(path);
             // A link's filename-only refusal waits until its target type is known.
             const listed = { path, directory: item.isDirectory() || item.isSymbolicLink() };
             if (!admitFile(settings, listed, { purpose: "listing", route: "local-folder", ...admission }).admitted)
@@ -113,6 +137,7 @@ export async function readLocalFolder(settings, folder, admission = {}, options
             if (info.isDirectory())
                 await walk(file, path, parents);
             else if (info.isFile()) {
+                opaquePaths.delete(path);
                 entries.push({ path, size: info.size, ref: path });
                 targets.set(path, file);
             }
@@ -122,9 +147,11 @@ export async function readLocalFolder(settings, folder, admission = {}, options
         gitIgnored: await ignoredPaths(["."]), localTarget: { root, path: root } });
     if (selectedRoot.admitted)
         await walk(root, "", new Set());
-    else
+    else {
+        opaquePaths.add("");
         gitSkipped.push(...await ignoredFiles(root, ""));
-    const analysisSize = measureAnalysisSize(settings, entries, admission);
+    }
+    const analysisSize = measureAnalysisSize(settings, entries, { ...admission, paths: fileScopeOf(settings) });
     // The service makes the final decision; local prediction never changes retained files.
     const analysisFit = settings.CF_REFUSE_TOO_LARGE === "0" ? undefined : assessAnalysisSize(analysisSize);
     const listing = new Set(entries.map(entry => entry.path));
@@ -142,6 +169,77 @@ export async function readLocalFolder(settings, folder, admission = {}, options
             return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
         }, { ...admission, listing, route: "local-folder", localTarget: { root, path: target, excludedTargets } }) : null;
     };
+    let filePlan;
+    const planParts = options.planParts && folderPartsEnabled(settings);
+    if (options.planSkipped && skippedFilesEnabled(settings) || planParts) {
+        // The ordinary inventory owns exclusions and targets; planning never opens a second file walker.
+        const byPath = new Map(entries.map(entry => [entry.path, entry]));
+        const files = Object.create(null), visited = new Set(), unavailable = new Set();
+        const paths = planParts ? entries.map(entry => entry.path) : [...options.planSkipped];
+        const metadataPaths = new Set();
+        let metadataBytes = 0;
+        let pending = paths, dependencies = {}, retainedBytes = 0;
+        while (pending.length) {
+            const next = [...new Set(pending)].filter(path => !visited.has(path));
+            next.forEach(path => visited.add(path));
+            await mapLimit(next, 4, async (path) => {
+                const entry = byPath.get(path);
+                if (!entry || !admitFile(settings, entry, { ...admission, purpose: "proposal", route: "local-folder" }).admitted)
+                    return;
+                if (planParts && entry.size > READ_LIMITS.archive.bytes - retainedBytes) {
+                    unavailable.add(path);
+                    return;
+                }
+                try {
+                    const text = await read(entry, "proposal");
+                    const size = text === null ? 0 : Buffer.byteLength(text);
+                    if (text === null || planParts && size > READ_LIMITS.archive.bytes - retainedBytes)
+                        unavailable.add(path);
+                    else {
+                        files[path] = text;
+                        retainedBytes += size;
+                    }
+                }
+                catch {
+                    unavailable.add(path);
+                }
+                finally {
+                    // The archive allowance counts kept text; mapLimit bounds the additional reads in flight.
+                    if (planParts) {
+                        delete snapshot[path];
+                        snapshotTargets.delete(path);
+                    }
+                }
+            });
+            dependencies = fileDependencies({ entries, files, settings });
+            const metadata = settings.CF_LOCAL_IMPORT_RESOLUTION === "0" ? [] : ModuleResolver.settingsFiles(listing, new Map(Object.entries(files)), Object.keys(files));
+            const settingsPaths = metadata.filter(path => {
+                if (visited.has(path) || metadataPaths.has(path))
+                    return false;
+                const size = byPath.get(path)?.size;
+                if (size === undefined || metadataPaths.size >= moduleResolutionLimits.settingsFiles || size > moduleResolutionLimits.settingsBytes - metadataBytes)
+                    return false;
+                metadataPaths.add(path);
+                metadataBytes += size;
+                return true;
+            });
+            pending = [...settingsPaths, ...Object.values(dependencies).flat()].filter(path => !visited.has(path));
+        }
+        const plannedEntries = entries.filter(entry => planParts ? Object.hasOwn(files, entry.path) : !unavailable.has(entry.path)).map(entry => Object.hasOwn(files, entry.path)
+            ? { ...entry, size: Buffer.byteLength(files[entry.path]) } : entry);
+        const input = { entries: plannedEntries, paths: planParts ? plannedEntries.map(entry => entry.path) : paths,
+            inputBytes: Object.fromEntries(Object.entries(files).map(([path, text]) => [path, fileEvidenceBytes(path, text)])),
+            dependencies };
+        const discovered = planParts ? await fetchLocalSources(settings, { repoKey, entries: plannedEntries, admission, includeAgentPromptPaths: true,
+            read: async (entry) => files[entry.path] ?? null }) : undefined;
+        const analysisParts = discovered ? planFolderAnalyses(settings, { ...input, fragment: discovered.fragment,
+            agentPromptPaths: discovered.agentPromptPaths ?? [], codeAgents: discovered.codeAgents }) : undefined;
+        if (!planParts)
+            filePlan = planFileAnalyses(settings, input);
+        return { repoKey, ...(filePlan ? { filePlan } : {}), ...(analysisParts ? { analysisParts } : {}), files: {}, fragment: { nodes: [], edges: [], warnings: [] }, skippedFiles: [], warnings: [],
+            selection: { selected: [], refused: [], totalBytes: 0 }, analysisSize, ...(analysisFit ? { analysisFit } : {}),
+            ...(options.captureSnapshot ? { snapshot: {} } : {}) };
+    }
     const discovered = await fetchLocalSources(settings, { repoKey, entries, admission, repository,
         proposal: options.proposal, proposalRefusals: [...gitSkipped, ...refused],
         read: entry => read(entry, "override"), proposalRead: entry => read(entry, "proposal"),
@@ -149,8 +247,15 @@ export async function readLocalFolder(settings, folder, admission = {}, options
     const expanded = discovered.root !== undefined;
     const ignored = mergeSkippedFiles(expanded ? gitSkipped.map(file => ({ ...file, path: repoPathFrom(file.path, discovered.root) })) : gitSkipped, repository.skippedFiles.map(file => ({ ...file, path: expanded ? file.path : posix.relative(repository.selectedRoot ?? "", file.path) })));
     const captured = { ...Object.fromEntries(Object.entries(snapshot).map(([path, bytes]) => [repoPathFrom(path, discovered.root), bytes])), ...repository.snapshot };
-    return { repoKey, ...(discovered.agentChoice ? { agentChoice: discovered.agentChoice } : {}), files: discovered.files, analysisSize, ...(analysisFit ? { analysisFit } : {}), ...(expanded ? { root: discovered.root, sourceBase: repository.sourceBase } : {}),
+    return { repoKey, ...(filePlan ? { filePlan } : {}), ...(discovered.agentChoice ? { agentChoice: discovered.agentChoice } : {}), files: discovered.files, analysisSize, ...(analysisFit ? { analysisFit } : {}), ...(expanded ? { root: discovered.root, sourceBase: repository.sourceBase } : {}),
         ...(discovered.proposalCounts ? { proposalCounts: discovered.proposalCounts } : {}),
+        ...(settings.CF_MECHANICAL_CHECKS === "0" ? {} : { mechanicalInventory: {
+                paths: [...knownPaths].map(path => repoPathFrom(path, discovered.root)), complete: !expanded,
+                admittedPaths: entries.map(entry => repoPathFrom(entry.path, discovered.root)),
+                opaquePaths: [...opaquePaths].map(path => repoPathFrom(path, discovered.root)),
+                asOf: new Intl.DateTimeFormat("en-CA", { timeZone: "America/Los_Angeles", year: "numeric", month: "2-digit", day: "2-digit" }).format(new Date()),
+                incompletePaths: discovered.selection.selected.filter(entry => entry.readBytes !== undefined).map(entry => repoPathFrom(entry.path, discovered.root)),
+            } }),
         ...(options.captureSnapshot ? { snapshot: Object.fromEntries(Object.keys(discovered.files).map(path => [path, captured[path]])) } : {}), fragment: discovered.fragment, selection: discovered.selection,
         skippedFiles: mergeSkippedFiles(discovered.skippedFiles, ignored, expanded ? refused.map(file => ({ ...file, path: repoPathFrom(file.path, discovered.root) })) : refused),
         warnings: [...new Set(mergeUnlistedFileWarnings([...warnings.map(file => fileRefusalWarning(repoPathFrom(file.path, discovered.root), file.reason)), ...discovered.warnings], ignored.length))] };

package/dist/adapters/git.js

@@ -14,7 +14,16 @@ export async function runGit(folder, args, options = {}) {
         });
         if (input)
             running.child.stdin?.end(input);
-        return (await running).stdout;
+        try {
+            return (await running).stdout;
+        }
+        catch (error) {
+            options.signal?.throwIfAborted();
+            // Callers still need exit codes for ordinary Git misses, but public errors must not expose stderr.
+            if (error instanceof Error)
+                Object.assign(error, { reason: "local_git_failed" });
+            throw error;
+        }
     };
     // Reading configuration runs no filters. Disable every filter and diff driver before any command touches working files.
     let configured;

package/dist/adapters/relay-plan.js

@@ -1,12 +1,10 @@
 import { bundleContentHash } from "../bundle/seal/signature.js";
 import { checkPlannedCallsAgainstBundle } from "../bundle/seal/planned-calls.js";
-import { localSourcePlan } from "../analysis-core/requests/local-plan.js";
 import { relayPlanSchema } from "../contract/console.js";
-/** Callers authenticate the release before reading files; only this owner turns source facts into a paid plan. */
-export function prepareRelayPlan({ bundle, tools, relayVersion, settings, source }) {
-    const { files, calls } = localSourcePlan(settings, source);
+/** Callers authenticate the bundle; validate its richer descriptions before exposing aggregate fields. */
+export function prepareRelayPlanFromCalls({ bundle, relayVersion, calls }) {
     checkPlannedCallsAgainstBundle(bundle, calls);
-    return { files, plan: relayPlanSchema.parse({ bundleVersion: tools.bundleVersion,
-            bundleHash: bundleContentHash(bundle.sealed), relayVersion,
-            calls: calls.map(({ routeId, model, calls, maxInputBytes, maxInputTokens, maxOutputTokens }) => ({ routeId, model, calls, maxInputBytes, maxInputTokens, maxOutputTokens })) }) };
+    return relayPlanSchema.parse({ bundleVersion: bundle.version,
+        bundleHash: bundleContentHash(bundle.sealed), relayVersion,
+        calls: calls.map(({ routeId, model, calls, maxInputBytes, maxInputTokens, maxOutputTokens }) => ({ routeId, model, calls, maxInputBytes, maxInputTokens, maxOutputTokens })) });
 }

package/dist/adapters/release.js

@@ -8,6 +8,7 @@ import { z } from "zod";
 import { cliRefusals } from "../contract/cli-refusals.js";
 import { RELEASE_KEY_SPKI_SHA256 } from "../contract/release-key.js";
 import { findingAudienceSettings } from "../analysis-core/analysis/finding-audience-switch.js";
+import { findingActivitySettings } from "../analysis-core/analysis/finding-activity-switch.js";
 const releasePins = z.object({ verificationKey: z.string().min(1), relayVersion: z.string().min(1), localVersion: z.string().min(1),
     relayUrl: z.string().min(1), projectContext: z.literal("checks") });
 export function readClientReleasePins(value) {
@@ -21,7 +22,9 @@ export function validateClientRelease(release, settings = {}) {
     const tools = loadPublicRequestTools(bundle, release.verificationKey, settings);
     if (!bundle.relayVersions.includes(release.relayVersion))
         throw new Error();
-    return { bundle, tools, settings: findingAudienceSettings(settings, bundle) };
+    // Request-only relays keep the earlier CLI output; static findings ship with whole-analysis engines.
+    const compatible = bundle.metadata.analysis ? settings : { ...settings, CF_COST_FINDINGS: "0" };
+    return { bundle, tools, settings: findingActivitySettings(findingAudienceSettings(compatible, bundle), bundle) };
 }
 export function readClientReleaseKey(pem) {
     const key = createPublicKey(pem);

package/dist/adapters/results.js

@@ -1,10 +1,17 @@
+import { skippedFilesEnabled } from "../analysis-core/settings.js";
+import { combineLocalReports } from "./combined-results.js";
+import { invalidateAnalysisContext, loadPublicReport } from "./analysis-results.js";
 import { formatSummary } from "../cli/summary.js";
 import { ignoreDefaultOutput } from "./gitignore-output.js";
 import { writeOutputFiles } from "./output-paths.js";
 import { projectPublicReport } from "../contract/public-report.js";
 import { INCLUDED_FILES_CAPTION, INCOMPLETE_IMPORTS_MESSAGE, SELECTION_COVERAGE_DESCRIPTION } from "../contract/scope-choice.js";
 export async function saveLocalResults(folder, report, refusedFiles, outputDir, options) {
-    const publicReport = projectPublicReport(report, refusedFiles);
+    const next = projectPublicReport(report, refusedFiles);
+    const publicReport = options.append && skippedFilesEnabled(options.settings ?? {})
+        ? combineLocalReports(await loadPublicReport(folder, outputDir), next, options.append.assessments, options.append.readPaths).report : next;
+    if (!options.append)
+        await invalidateAnalysisContext(folder, outputDir);
     const scope = options.scope;
     const incomplete = options.selection && !options.selection.completeness.complete
         ? [INCOMPLETE_IMPORTS_MESSAGE, "", INCLUDED_FILES_CAPTION, ...options.includedPaths.map(path => `  ${path}`), "", ""].join("\n") : "";
@@ -12,7 +19,7 @@ export async function saveLocalResults(folder, report, refusedFiles, outputDir,
         .replace("{entry}", () => scope.entry).replace("{count}", String(Array.isArray(scope.imports) ? scope.imports.length : 0)) + "\n\n" : "";
     const [findingsPath, summaryPath] = await writeOutputFiles(folder, {
         "findings.json": `${JSON.stringify(publicReport, null, 2)}\n`,
-        "summary.md": incomplete + coverage + formatSummary(publicReport, options),
+        "summary.md": incomplete + coverage + formatSummary(publicReport, { ...options, analyzedFolder: options.analyzedFolder ?? folder, skippedOffer: !options.append, skippedFilesEnabled: skippedFilesEnabled(options.settings ?? {}) }),
         ...(options.selection ? { "selection.json": JSON.stringify({ schemaVersion: 1, selection: options.selection,
                 ...(scope ? { scope } : {}) }, null, 2) + "\n" } : {}),
     }, outputDir);