@counterfact-labs/cli 0.2.9 → 0.2.11

package/dist/cli/skipped-files.js

@@ -1,3 +1,4 @@
+import { countForm } from "../analysis-core/wording.js";
 import { skippedFilesEnabled } from "../analysis-core/settings.js";
 import { skippedFilesNotice, ANALYZE_SKIPPED_FILES_OFFER } from "../analysis-core/analysis/code-agents/skipped-files.js";
 import { analyzeCommand } from "../contract/agent-choice.js";
@@ -15,7 +16,7 @@ export function skippedResultText(files, settings = {}, options = {}) {
 }
 export function followupPlanText(plan) {
     const count = plan.groups.length;
-    return [count ? `This will run ${count} ${count === 1 ? "analysis" : "analyses"}.` : "No skipped files remain to analyze.",
+    return [count ? `This will run ${count} ${countForm(count, "analysis", "analyses")}.` : "No skipped files remain to analyze.",
         ...plan.tooLarge.map(path => `${path}: too large to analyze.`),
         ...plan.unavailable.map(path => `${path}: could not be read.`),
         ...(plan.missingContext ?? []).map(file => `${file.path}: some imported files could not be included: ${file.imports.join(", ")}.`), ""].join("\n");

package/dist/cli/suggested-email.js

@@ -1,8 +1,13 @@
 import { normalizeSignInEmail } from "./email-sign-in.js";
 import { userEmail } from "./git.js";
+function isNoreplyEmail(email) {
+    // These addresses cannot receive the sign-in code.
+    return /(?:^|[.@+_-])(?:no[._-]?reply|do[._-]?not[._-]?reply)(?:$|[.@+_-])/.test(email);
+}
 export async function suggestedEmail(folder, readEmail = userEmail) {
     try {
-        return normalizeSignInEmail(await readEmail(folder));
+        const email = normalizeSignInEmail(await readEmail(folder));
+        return email && !isNoreplyEmail(email) ? email : undefined;
     }
     catch {
         return undefined;

package/dist/cli/summary.js

@@ -2,9 +2,10 @@ import { skippedResultText } from "./skipped-files.js";
 import { findingPresentation } from "../analysis-core/findings/presentation.js";
 import { activityAdvice, findingDisplayRows, notActiveCountLine, TEAM_WORKFLOW_HEADING } from "./finding-display.js";
 import { groupByActivity } from "../analysis-core/analysis/schemas.js";
+import { countForm } from "../analysis-core/wording.js";
 export function formatSummary(report, options) {
     const lines = ["# Counterfact analysis", "",
-        `${report.findings.length} findings; ${report.structures.length} structural proposals.`, ""];
+        `${report.findings.length} ${countForm(report.findings.length, "finding")}; ${report.structures.length} ${countForm(report.structures.length, "structural proposal")}.`, ""];
     const skipped = skippedResultText(report.refusedFiles ?? [], { CF_SKIPPED_FILES: options.skippedFilesEnabled === false ? "0" : "1" }, { offer: options.skippedOffer, folder: options.analyzedFolder });
     if (skipped)
         lines.push(skipped.trimEnd(), "");

package/dist/contract/agent-choice.js

@@ -8,9 +8,11 @@ export function analyzeCommand(folder) {
 /** The local importer supplies the choice; transport keeps its data and wording together. */
 export class AgentChoiceError extends Error {
     agentChoice;
+    reason;
     constructor(agentChoice) {
         super(agentChoiceMessage(agentChoice));
         this.agentChoice = agentChoice;
+        this.reason = agentChoice.kind;
     }
 }
 export function agentChoiceMessage(agentChoice, surface = "terminal") {

package/dist/contract/cli-refusals.js

@@ -5,15 +5,80 @@ import { ANALYSIS_TOO_LARGE_MESSAGE, INVALID_SELECTION_MESSAGE } from "./scope-c
 export const START_FAILURE_MESSAGE = "This couldn't start. Try again.";
 export const RESERVATION_EXPIRED_MESSAGE = "This reservation expired. Start a new analysis.";
 export const FINISH_FAILURE_MESSAGE = "The analysis couldn't finish. Try again.";
+export const REPORT_HOME_IN_REPOSITORY_MESSAGE = "Counterfact can't store reports outside this repository because it contains your home folder. Run the analysis from a copy of the repository outside your home folder.";
+export const REPORT_OUTPUT_IN_REPOSITORY_MESSAGE = "Counterfact can't save reports inside the analyzed repository. Use --output with a directory outside the repository.";
+export const OUTPUT_PATH_MESSAGE = "Counterfact couldn't safely write results in the output folder. Check its permissions and remove any links in that folder, then try again.";
+export const LOCAL_REPORT_WRITE_MESSAGE = "The local report couldn't be written.";
+export const COMPLETION_STORAGE_MESSAGE = "Counterfact couldn't save the recovery record on this computer. Check the output folder's permissions and available disk space.";
+export const INVALID_CONSOLE_REQUEST_MESSAGE = "Counterfact couldn't read this request. Update Counterfact, then try again.";
+export function repeatAnalysisMessage(retryAt, url, charged = false) {
+    const time = new Date(Math.ceil(retryAt / 60_000) * 60_000).toLocaleTimeString("en-US", { timeZone: "America/Los_Angeles", hour: "numeric", minute: "2-digit", timeZoneName: "short" });
+    if (charged && !url)
+        return `This folder's last analysis ended without saved results. You can run it again after ${time}. ${retryChargeWarning}`;
+    return `This folder was analyzed a few minutes ago. You can run it again after ${time}.${url ? ` Earlier results: ${url}` : ""}`;
+}
+const retryChargeWarning = "Running the analysis again may charge you.";
+const safeRetryMessage = "It is safe to run the analysis again.";
+const relayChargeMessages = {
+    charged: "This analysis was charged.", free_used: "This run used a free analysis.", not_charged: "Nothing was charged.",
+    unknown: "Counterfact couldn't confirm whether anything was charged.",
+};
+/** Settlement owns retry certainty; a zero-price charge still consumed a free analysis. */
+export function relayChargeStatus(status, noReservation) {
+    return status?.settlement === "charged" ? status.priceMicro === 0 ? "free_used" : "charged"
+        : status?.settlement === "released" || status?.settlement === "unheld" || noReservation ? "not_charged" : "unknown";
+}
+export function relayClosedMessage(charge) {
+    return `The connection to Counterfact closed before the analysis finished. ${relayChargeMessages[charge]} ${charge === "not_charged" ? safeRetryMessage : retryChargeWarning}`;
+}
+function chargeWarning(message, charge) {
+    return charge === "not_charged" ? message : `${message} ${relayChargeMessages[charge]} ${retryChargeWarning}`;
+}
+export const relayFailureMessages = {
+    relay_frame_too_large: "Part of this agent was too large to send in one request, so the analysis stopped. Nothing was charged. Try again, or choose a smaller folder.",
+    model_answer_invalid: "The model's answer couldn't be read, so the analysis stopped. Nothing was charged. Try again.",
+    relay_protocol_invalid: "Counterfact's server sent an answer this version can't read. Update Counterfact, then try again.",
+};
+export const analysisFailureMessages = {
+    ...relayFailureMessages,
+    relay_unreachable: "Counterfact couldn't establish or keep a valid relay connection. Try the analysis again.",
+    relay_local_closed: "Counterfact closed this analysis connection on this computer before the analysis finished. Try the analysis again.",
+    console_unavailable: "Counterfact's analysis service is unavailable. Try again later.",
+    reservation: "Counterfact couldn't authorize this analysis. Start a new analysis.",
+    leak_refused: "Counterfact stopped this analysis because its response failed a safety check.",
+    cancelled: "The analysis was cancelled.",
+};
+/** Analysis failures use the same cause and settlement wording in terminal runs and MCP. */
+export function relayFailureMessage(reason, charge, noReservation = false) {
+    if (reason === "relay_closed")
+        return relayClosedMessage(charge);
+    if (typeof reason !== "string" || !Object.hasOwn(analysisFailureMessages, reason))
+        return undefined;
+    const message = analysisFailureMessages[reason];
+    if (message === undefined)
+        return undefined;
+    if (reason === "relay_frame_too_large" || reason === "model_answer_invalid")
+        return noReservation || charge === "not_charged" ? message : FINISH_FAILURE_MESSAGE;
+    // Protocol guidance makes no charge claim and applies to every settlement.
+    if (reason === "relay_protocol_invalid")
+        return message;
+    if (charge !== "not_charged")
+        return chargeWarning(message, charge);
+    return reason === "leak_refused" || reason === "cancelled" ? `${message} ${safeRetryMessage}` : message;
+}
 export const NOT_ALLOWED_MESSAGE = "Your account can't run analyses. Ask Counterfact for access.";
 export const SIGN_IN_EXPIRED_MESSAGE = "Your sign-in has expired. Run counterfact-labs login, then try again.";
 export const FOLDER_BUSY_MESSAGE = "Another analysis is running on this folder. Try again when it finishes.";
 export const CHECK_CONFLICT_MESSAGE = "Saved results from an earlier run don't match this analysis. Start a new analysis.";
 export const UNSAVED_RESULTS_MESSAGE = "The analysis ended before its results were saved. Start a new analysis.";
-export const PENDING_RESULTS_MESSAGE = "Your results are kept on this computer. Run the same command on the same folder again to save them at no extra charge.";
+export const RETAINED_RESULTS_MESSAGE = "Your results are kept on this computer.";
+export const PENDING_RESULTS_MESSAGE = `${RETAINED_RESULTS_MESSAGE} Run the same command on the same folder again to save them at no extra charge.`;
 export const RESULTS_TOO_LARGE_MESSAGE = "The results were too large to save. Try again.";
 export const COMMITTED_FILES_MESSAGE = "Counterfact analyzes the committed version of the agent's files. Commit your changes, then try again.";
 const unsupportedVersion = "This version of Counterfact can't run analyses. Update it: npm install -g @counterfact-labs/cli@latest.";
+const updateCli = "Update Counterfact: run npm install -g @counterfact-labs/cli@latest.\n\n"
+    + "Claude Code plugin users: run claude plugin update counterfact@counterfact-labs, then restart Claude Code. "
+    + "/reload-plugins does not restart the running Counterfact server.";
 // The console separates over-limit costs from version or route mismatches, so each code gets its own recovery guidance.
 const localReadFailure = "Counterfact couldn't read the selected file or folder. Check that it exists and is readable, then try again.";
 export const localRefusals = {
@@ -22,18 +87,19 @@ export const localRefusals = {
     folder_unavailable: localReadFailure,
     local_read_failed: localReadFailure,
     local_git_failed: "Counterfact couldn't read this folder's Git information. Check that Git works in this folder, then try again.",
-    repeat_too_soon: FINISH_FAILURE_MESSAGE,
+    repeat_too_soon: "This folder was analyzed a few minutes ago. Wait 10 minutes after it finished, then try again.",
 };
 /** Both console clients use the same public messages for server refusals. */
 export const cliRefusals = {
     folder_too_large: FOLDER_TOO_LARGE_MESSAGE,
     low_balance: "Your balance doesn't cover this analysis. Add credit at https://app.counterfactlabs.com/account?status=low_balance#balance",
     local_checks_paused: "Analyses are paused right now. Try again later.",
-    cli_update_required: "Update Counterfact: run npm install -g @counterfact-labs/cli@latest.",
+    cli_update_required: updateCli,
+    cli_version_too_old: updateCli,
     release_unavailable: unsupportedVersion,
     plan_over_limit: ANALYSIS_TOO_LARGE_MESSAGE,
     invalid_plan: unsupportedVersion,
-    invalid_body: "Counterfact couldn't read this request. Update Counterfact, then try again.",
+    invalid_body: INVALID_CONSOLE_REQUEST_MESSAGE,
     body_too_large: "This request is too large. The limit is 2 MB.",
     free_cap_reached: "Free analyses are paused for today. Try again tomorrow, or top up to run a paid analysis.",
     org_spend_limit: "The workspace spending limit was reached. Ask Counterfact to raise it.",
@@ -44,8 +110,8 @@ export const cliRefusals = {
 export function refusalExitCode(code) { return code === "low_balance" ? 2 : 1; }
 export class CliRefusalError extends Error {
     code;
-    constructor(code) {
-        super(Object.hasOwn(localRefusals, code) ? localRefusals[code] : cliRefusals[code]);
+    constructor(code, repeat) {
+        super(code === "repeat_too_soon" && repeat ? repeatAnalysisMessage(repeat.retryAt, repeat.url, repeat.charged) : Object.hasOwn(localRefusals, code) ? localRefusals[code] : cliRefusals[code]);
         this.code = code;
     }
 }
@@ -67,6 +133,10 @@ const otherReasons = {
     too_many_attempts: "too_many_attempts",
     email_unavailable: "email_unavailable",
     request_failed: "request_failed",
+    bad_request: "relay_protocol_invalid",
+    reservation: "reservation",
+    leak_refused: "leak_refused",
+    cancelled: "cancelled",
 };
 const messageReasons = {
     [cliRefusals.release_unavailable]: "release_unavailable",
@@ -78,10 +148,13 @@ const reasonValues = [
     ...Object.keys(cliRefusals),
     ...Object.keys(localRefusals),
     ...Object.values(otherReasons), ...Object.values(messageReasons),
-    "console_unreachable", "invalid_console_url", "relay_unreachable", "results_not_saved",
-    "results_saved_report_failed", "results_pending", "results_discarded",
+    "console_unreachable", "invalid_console_url", "relay_unreachable", "relay_closed", "relay_local_closed", "results_not_saved",
+    "results_saved_report_failed", "results_pending", "results_discarded", "results_kept",
     "folder_busy", "completion_settings_mismatch",
+    "no_agent", "choose_agent", "choose_scope",
+    "relay_frame_too_large", "model_answer_invalid", "relay_protocol_invalid",
 ];
+export const FAILURE_REASONS = [...new Set(reasonValues)];
 const ownedReasons = new Set(reasonValues);
 const readErrorCodes = new Set(["ENOENT", "EACCES", "EPERM", "ENOTDIR", "EISDIR", "ELOOP", "EMFILE", "ENFILE", "EIO", "ESTALE", "EBADF", "EINVAL", "ENOMEM", "EAGAIN", "EBUSY"]);
 /** Classify local failures without copying paths, command output or file contents into public errors. */
@@ -90,9 +163,11 @@ export function localFailure(error) {
         return undefined;
     if ("reason" in error && error.reason === "local_git_failed")
         return { message: localRefusals.local_git_failed, reason: "local_git_failed" };
-    // Only the selection reader knows whether a filesystem operation belongs to the agent.
+    // The reader boundary can also identify operations that failed after initial selection.
     if (!("localOperation" in error) || error.localOperation !== "read")
         return undefined;
+    if ("reason" in error && error.reason === "local_read_failed")
+        return { message: localRefusals.local_read_failed, reason: "local_read_failed" };
     const syscall = "syscall" in error ? error.syscall : undefined;
     const code = "code" in error ? error.code : undefined;
     if (typeof code === "string" && readErrorCodes.has(code) && typeof syscall === "string"
@@ -103,6 +178,27 @@ export function localFailure(error) {
     }
     return undefined;
 }
+/** Analysis failures expose fixed causes without private reader diagnostics. */
+export function analysisFailureDetails(error, charge, context = {}) {
+    if (!(error instanceof Error) || error instanceof CliRefusalError)
+        return undefined;
+    const reason = failureReason(error);
+    const interrupted = context.cancelled && (reason === "relay_unreachable" || reason === "relay_closed" || reason === "relay_local_closed"
+        || "localOperation" in error && error.localOperation === "read");
+    if (interrupted || error.name === "AbortError")
+        return { message: relayFailureMessage("cancelled", charge), reason: "cancelled" };
+    const local = localFailure(error);
+    if (local)
+        return { ...local, message: chargeWarning(local.message, charge) };
+    if ("localOperation" in error && error.localOperation === "read") {
+        return { message: chargeWarning(FINISH_FAILURE_MESSAGE, charge), reason: "request_failed" };
+    }
+    if (reason === "folder_busy" || reason === "reservation_expired") {
+        return { message: chargeWarning(reason === "folder_busy" ? FOLDER_BUSY_MESSAGE : RESERVATION_EXPIRED_MESSAGE, charge), reason };
+    }
+    const message = relayFailureMessage(reason, charge, context.noReservation);
+    return message ? { message, reason } : undefined;
+}
 /** Only fixed reasons may cross the MCP boundary; diagnostics can contain customer data. */
 export function failureReason(error) {
     if (!(error instanceof Error))

package/dist/contract/cli-version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.2.9";
+export const CLI_VERSION = "0.2.11";

package/dist/contract/console.js

@@ -7,6 +7,7 @@ import { projectArchitectureSchema } from "./project-architecture.js";
 import { intakeFinding as localFindingSchema, nonblankText as text, RESULT_CHECK_LIMITS, validIntakeText } from "../analysis-core/contracts/intake-finding.js";
 export { localFindingSchema };
 import { selectionStartIdentitySchema } from "./selection-metadata.js";
+import { FAILURE_REASONS } from "./cli-refusals.js";
 export const id = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
 const money = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
 const count = (max) => z.number().int().positive().max(max);
@@ -60,7 +61,7 @@ export const cliRelayReservationRequestSchema = z.discriminatedUnion("action", [
     z.strictObject({ action: z.literal("reserve"), reservationId: uuid }),
     z.strictObject({ action: z.literal("status"), reservationId: uuid }),
     z.strictObject({ action: z.literal("heartbeat"), reservationId: uuid }),
-    z.strictObject({ action: z.literal("fail"), reservationId: uuid }),
+    z.strictObject({ action: z.literal("fail"), reservationId: uuid, reason: z.enum(FAILURE_REASONS).optional() }),
 ]);
 export const consoleCreatedSchema = z.strictObject({ reservationId: uuid, jobId: uuid, projectId: uuid, checkId: uuid, state: z.literal("quoted") });
 export const consoleStatusSchema = z.strictObject({

package/dist/contract/email-sign-in-messages.js

@@ -1,4 +1,5 @@
 import { cliApiMessages } from "./cli-api-messages.js";
+import { countForm } from "../analysis-core/wording.js";
 const rateLimited = "Too many sign-in requests. Try again later.";
 // Holds the sentences both sign-in flows share, so browser expiry lives here too.
 export const emailSignInMessages = Object.freeze({
@@ -9,7 +10,7 @@ export const emailSignInMessages = Object.freeze({
     too_many_attempts: "Too many incorrect codes. Request a new sign-in code.",
     rate_limited: rateLimited,
     rate_limited_with_cooldown: (seconds) => seconds === 0 ? rateLimited
-        : `Too many sign-in requests. Try again in ${seconds} ${seconds === 1 ? "second" : "seconds"}.`,
+        : `Too many sign-in requests. Try again in ${seconds} ${countForm(seconds, "second")}.`,
     email_unavailable: "Email sign-in isn't available. Use browser sign-in instead.",
     browser_sign_in_pending: "A browser sign-in is still in progress. Finish it before starting email sign-in.",
     browser_expired: "The sign-in code expired. Run counterfact-labs login to try again.",

package/dist/contract/scope-choice.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { countForm } from "../analysis-core/wording.js";
 import { ANALYSIS_SELECTION_LIMITS, provenScopeChoiceSchema } from "../analysis-core/contracts/analysis-selection.js";
 import { refusedImportSchema } from "../analysis-core/contracts/module-resolution.js";
 import { selectionPathSchema, snapshotIdSchema } from "../analysis-core/contracts/selection-paths.js";
@@ -52,7 +53,9 @@ export function progressLine(selection, surface = "source") {
 export function failureLine(selection) {
     return selection?.kind === "file" ? SELECTED_PATH_FAILURE : "Analysis could not finish. Check the folder, provider key and connection.";
 }
-export const SELECTION_COVERAGE_DESCRIPTION = "This analysis covers {entry} and {count} selected imports. Other imports were left out.";
+export function selectionCoverageDescription(entry, count) {
+    return `This analysis covers ${entry} and ${count} selected ${countForm(count, "import")}. Other imports were left out.`;
+}
 export const SCOPE_RETRY_TEMPLATE = "Run again: counterfact-labs analyze {quoted-entry} --scope {quoted-scope-file}";
 export const FILE_SCOPE_PUBLIC_USAGE = "Usage: counterfact-labs analyze [path] [--proposal <json-file>] [--scope <json-file>]\n       counterfact-labs finding <id>\n       counterfact-labs balance | login | logout | mcp\n";
 export const FILE_SCOPE_SOURCE_USAGE = "Usage: npx tsx cli/check.ts <path> [--output <directory>] [--scope <json-file>]\n";

package/dist/gatekeeper/client.js

@@ -1,3 +1,6 @@
+import { publicRelayConnectionError } from "./connection-exchange.js";
+import { assertFrameBytes } from "../analysis-core/requests/frame-budget.js";
+import { isPublicModelError, RelayProtocolError } from "../analysis-core/contracts/model-errors.js";
 import { randomBytes } from "node:crypto";
 import { relayAnswer, relayRequest } from "../contract/messages.js";
 import { verifyAttestation } from "./attestation.js";
@@ -21,6 +24,7 @@ export class GatekeeperClient {
         const outgoing = relayRequest.safeParse({ ...request, nonce: randomBytes(32).toString("hex") });
         if (!outgoing.success)
             throw new GatekeeperClientError("Invalid relay request");
+        assertFrameBytes(Buffer.byteLength(JSON.stringify(outgoing.data)));
         const options = this.options;
         if (options.mode === "development") {
             let token;
@@ -39,13 +43,18 @@ export class GatekeeperClient {
                 beforeSend();
                 incoming = await options.connection.send(outgoing.data, { ...sendOptions, beforeSend });
             }
-            catch {
+            catch (error) {
                 // Transport errors can include request bodies, so do not retain their text or cause.
+                if (isPublicModelError(error))
+                    throw error;
+                const connectionError = publicRelayConnectionError(error);
+                if (connectionError)
+                    throw connectionError;
                 throw new GatekeeperClientError("Unable to send relay request");
             }
             const answer = relayAnswer.safeParse(incoming);
             if (!answer.success)
-                throw new GatekeeperClientError("Invalid relay answer");
+                throw new RelayProtocolError();
             if (answer.data.nonce !== outgoing.data.nonce)
                 throw new GatekeeperClientError("Relay answer nonce mismatch");
             if (answer.data.ok || answer.data.code !== "busy" || !options.deadlineMs)

package/dist/gatekeeper/connection-exchange.js

@@ -1,9 +1,19 @@
+import { isPublicModelError, RelayProtocolError } from "../analysis-core/contracts/model-errors.js";
 import { RELAY_MAX_FRAME_BYTES, deliveryReceipt, relayAnswer, relayAnswerFrame, relayRequest } from "../contract/messages.js";
 import { unredactedAnswer } from "../contract/public-report.js";
 export class RelayConnectionError extends Error {
+    reason;
     name = "RelayConnectionError";
-    reason = "relay_unreachable";
-    constructor() { super("Relay connection failed"); }
+    constructor(reason = "relay_unreachable") {
+        super("Relay connection failed");
+        this.reason = reason;
+    }
+}
+/** Keep only transport-owned categories when crossing a boundary that discards diagnostics. */
+export function publicRelayConnectionError(error) {
+    if (!(error instanceof RelayConnectionError) || !["relay_unreachable", "relay_closed", "relay_local_closed"].includes(error.reason))
+        return undefined;
+    return new RelayConnectionError(error.reason);
 }
 /** Both carriers retry the same confirmation, never another paid request. */
 export async function acknowledgeDelivery(options, confirmation) {
@@ -29,7 +39,10 @@ export function createRelayExchange(options) {
             // Provider work can exceed a network-body timeout; evidence expiry still closes this exact socket.
             const response = await options.exchange("/relay", request, RELAY_MAX_FRAME_BYTES, options.remainingEvidenceMs());
             const legacy = options.development ? relayAnswer.safeParse(response.body) : undefined;
-            const frame = legacy?.success ? { answer: legacy.data, delivery: undefined } : relayAnswerFrame.parse(response.body);
+            const parsed = legacy?.success ? { success: true, data: { answer: legacy.data, delivery: undefined } } : relayAnswerFrame.safeParse(response.body);
+            if (!parsed.success)
+                throw new RelayProtocolError();
+            const frame = parsed.data;
             if (frame.answer.nonce !== request.nonce)
                 throw new Error();
             if (frame.answer.ok)
@@ -43,8 +56,10 @@ export function createRelayExchange(options) {
             }
             return frame.answer;
         }
-        catch {
+        catch (error) {
             options.close();
+            if (isPublicModelError(error))
+                throw error;
             throw new RelayConnectionError();
         }
     }

package/dist/gatekeeper/connection.js

@@ -1,8 +1,10 @@
+import { assertFrameBytes } from "../analysis-core/requests/frame-budget.js";
+import { isPublicModelError, RelayProtocolError } from "../analysis-core/contracts/model-errors.js";
 import { isLoopbackHost } from "./loopback.js";
 import { randomBytes, X509Certificate } from "node:crypto";
 import { Agent, request as httpsRequest } from "node:https";
 import { connect } from "node:tls";
-import { PRODUCTION_EVIDENCE_VERSION, RELAY_MAX_FRAME_BYTES, RELAY_URL } from "../contract/messages.js";
+import { PRODUCTION_EVIDENCE_VERSION, RELAY_URL } from "../contract/messages.js";
 import { requestBoundedResponse } from "../transport/http-response.js";
 import { relayExportedKeyMaterial } from "../transport/tls-exporter.js";
 import { createRelayExchange, RelayConnectionError } from "./connection-exchange.js";
@@ -84,8 +86,7 @@ export async function connectRelay(url = RELAY_URL, policy) {
             if (closed || actualSocket.destroyed)
                 throw new RelayConnectionError();
             const body = JSON.stringify(input);
-            if (Buffer.byteLength(body) > RELAY_MAX_FRAME_BYTES)
-                throw new RelayConnectionError();
+            assertFrameBytes(Buffer.byteLength(body));
             const developmentAttestation = !!policy.development && path === "/attestation";
             try {
                 const result = await requestBoundedResponse(receive => {
@@ -103,12 +104,20 @@ export async function connectRelay(url = RELAY_URL, policy) {
                     } });
                 if (authenticated)
                     valid();
-                const text = new TextDecoder("utf-8", { fatal: true }).decode(result.body);
-                const answer = developmentAttestation ? text : JSON.parse(text);
+                let answer;
+                try {
+                    const text = new TextDecoder("utf-8", { fatal: true }).decode(result.body);
+                    answer = developmentAttestation ? text : JSON.parse(text);
+                }
+                catch {
+                    throw new RelayProtocolError();
+                }
                 return { status: result.response.statusCode ?? 0, body: answer };
             }
-            catch {
+            catch (error) {
                 close();
+                if (isPublicModelError(error))
+                    throw error;
                 throw new RelayConnectionError();
             }
         }

package/dist/gatekeeper/console.js

@@ -3,14 +3,14 @@ import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { z } from "zod";
 import { CLI_VERSION } from "../contract/cli-version.js";
-import { cliRefusals, NOT_ALLOWED_MESSAGE, SIGN_IN_EXPIRED_MESSAGE, CHECK_CONFLICT_MESSAGE, UNSAVED_RESULTS_MESSAGE, FINISH_FAILURE_MESSAGE, RESERVATION_EXPIRED_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, START_FAILURE_MESSAGE } from "../contract/cli-refusals.js";
+import { cliRefusals, NOT_ALLOWED_MESSAGE, SIGN_IN_EXPIRED_MESSAGE, CHECK_CONFLICT_MESSAGE, UNSAVED_RESULTS_MESSAGE, INVALID_CONSOLE_REQUEST_MESSAGE, RESERVATION_EXPIRED_MESSAGE, RESULTS_TOO_LARGE_MESSAGE, START_FAILURE_MESSAGE } from "../contract/cli-refusals.js";
 import { cliRelayReservationRequestSchema, consoleCreatedSchema, consoleIntakeResultSchema, consoleReservationSchema, consoleStatusSchema, LOCAL_FINDINGS_BODY_LIMIT, localFindingsPayloadSchema, LOCAL_START_BODY_LIMIT, LOCAL_START_EXECUTION_HEADER, localStartRequestSchema, localStartResponseSchema, serializeLocalStartMetadata } from "../contract/console.js";
 const RESPONSE_LIMIT = 64 * 1024;
 const RESERVATION_BODY_LIMIT = 64 * 1024;
 export const consoleErrorMessages = {
     ...cliRefusals,
     invalid_configuration: START_FAILURE_MESSAGE,
-    invalid_request: FINISH_FAILURE_MESSAGE,
+    invalid_request: INVALID_CONSOLE_REQUEST_MESSAGE,
     unavailable: "The results couldn't be saved yet. Run the analysis on the same folder again to save them; you won't be charged again.",
     unauthorized: SIGN_IN_EXPIRED_MESSAGE,
     not_allowed: NOT_ALLOWED_MESSAGE,
@@ -50,14 +50,6 @@ export class ConsoleError extends Error {
     }
 }
 export const isConsoleToken = (token) => /^[\x21-\x7e]{1,4096}$/.test(token);
-/** Strict older consoles accept optional metadata only after explicitly advertising it. */
-export function consoleCapabilities(mode) {
-    return {
-        skippedFiles: "skippedFiles" in mode && mode.skippedFiles === true,
-        findingActivity: "findingActivity" in mode && mode.findingActivity === true,
-        architecture: "architecture" in mode && mode.architecture === true,
-    };
-}
 /** Only this client may send repository metadata, content-free lifecycle or findings-only intake payloads to the console. */
 export class ConsoleClient {
     #url;
@@ -93,12 +85,13 @@ export class ConsoleClient {
         }
         return this.#send("/api/cli/checks", input, localStartRequestSchema, localStartResponseSchema, LOCAL_START_BODY_LIMIT, { statuses: [201], headers: { ...headers, [LOCAL_START_EXECUTION_HEADER.name]: LOCAL_START_EXECUTION_HEADER.value }, context: "start" });
     }
-    async capabilities() {
-        const mode = await this.#send("/api/cli/checks/mode", {}, z.object({}), z.object({ skippedFiles: z.boolean().optional() }).passthrough(), 1024, { method: "GET", context: "start" });
-        return consoleCapabilities(mode);
-    }
     async supportsSkippedFiles() {
-        return (await this.capabilities()).skippedFiles;
+        const mode = await this.#send("/api/cli/checks/mode", {}, z.object({}), z.object({ skippedFiles: z.boolean().optional() }), 1024, { method: "GET", context: "start" });
+        return mode.skippedFiles === true;
+    }
+    async supportsFailureReason() {
+        const mode = await this.#send("/api/cli/checks/mode", {}, z.object({}), z.object({ failureReason: z.boolean().optional() }), 1024, { method: "GET", context: "start" });
+        return mode.failureReason === true;
     }
     create(input) {
         return this.#lifecycle({ ...input, action: "create" }, consoleCreatedSchema);
@@ -112,8 +105,8 @@ export class ConsoleClient {
     heartbeat(reservationId) {
         return this.#lifecycle({ action: "heartbeat", reservationId }, consoleStatusSchema);
     }
-    fail(reservationId) {
-        return this.#lifecycle({ action: "fail", reservationId }, consoleStatusSchema);
+    fail(reservationId, reason) {
+        return this.#lifecycle({ action: "fail", reservationId, ...(reason === undefined ? {} : { reason }) }, consoleStatusSchema);
     }
     intake(input, options = {}) {
         return this.#send("/api/cli/checks/local", input, localFindingsPayloadSchema, consoleIntakeResultSchema, LOCAL_FINDINGS_BODY_LIMIT, { statuses: [200, 201], context: "intake", ...options });

package/dist/gatekeeper/model.js

@@ -1,3 +1,5 @@
+import { publicRelayConnectionError } from "./connection-exchange.js";
+import { isPublicModelError } from "../analysis-core/contracts/model-errors.js";
 import { randomUUID } from "node:crypto";
 import { unredactedAnswer } from "../contract/public-report.js";
 import { executionRequest } from "../analysis-core/contracts/execution-request.js";
@@ -34,11 +36,19 @@ export function relayModel(options) {
                     const signals = [options.signal, execution.signal].filter((signal) => !!signal);
                     reply = await client.call({ ...snapshot, bundleVersion, reservationId, reservationToken, callId: identity }, { signal: signals.length ? AbortSignal.any(signals) : undefined });
                 }
-                catch {
+                catch (error) {
+                    if (isPublicModelError(error))
+                        throw error;
+                    const connectionError = publicRelayConnectionError(error);
+                    if (connectionError)
+                        throw connectionError;
                     throw new Error("Relay request could not finish");
                 }
-                if (!reply.ok)
-                    throw new Error(`Relay refused the request: ${reply.code}`);
+                if (!reply.ok) {
+                    const refused = new Error(`Relay refused the request: ${reply.code}`);
+                    refused.reason = reply.code === "bad_request" ? "relay_protocol_invalid" : reply.code === "reservation" || reply.code === "leak_refused" ? reply.code : undefined;
+                    throw refused;
+                }
                 try {
                     onUsage?.({ ...reply.usage, template: snapshot.template, model: snapshot.model });
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@counterfact-labs/cli",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "homepage": "https://counterfactlabs.com",
   "relaySource": "https://github.com/counterfact-labs/sealed-relay",
   "type": "module",

package/dist/adapters/gitignore-output.js

@@ -1,41 +0,0 @@
-import { constants } from "node:fs";
-import { open } from "node:fs/promises";
-import { createGitIgnoreFactsQuery } from "./git-ignore.js";
-import { runGit } from "./git.js";
-import { analysisReadRoots, gitRepositoryRoot } from "./repository-root.js";
-import { DEFAULT_OUTPUT_DIR, outputPaths } from "./output-paths.js";
-const ignoreRule = `${DEFAULT_OUTPUT_DIR}/`;
-export const GITIGNORE_OUTPUT_NOTICE = `Added ${ignoreRule} to .gitignore, so the local report stays out of Git.\n`;
-export const gitignoreOutputEnabled = (settings = process.env) => settings.CF_LOCAL_GITIGNORE_OUTPUT !== "0";
-/** Keep local excerpts out of Git after a successful default report write. */
-export async function ignoreDefaultOutput(folder, outputDir, options = {}) {
-    if (outputDir !== undefined || !gitignoreOutputEnabled(options.settings))
-        return false;
-    try {
-        // Automatic edits need confirmed checkout boundaries even when ignore reads can trust Git alone.
-        const reported = await gitRepositoryRoot(async (args) => (await runGit(folder, args)).toString("utf8"), folder);
-        if (!(await analysisReadRoots(folder, reported)).repository)
-            return false;
-        const facts = await createGitIgnoreFactsQuery(folder)([ignoreRule]);
-        if (!facts || facts.has(ignoreRule))
-            return false;
-        // Appending preserves existing rules, and refusing links keeps this write in the selected folder.
-        const [path] = await outputPaths(folder, [".gitignore"], folder);
-        const file = await open(path, constants.O_RDWR | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o644);
-        try {
-            const info = await file.stat();
-            if (!info.isFile())
-                return false;
-            const last = Buffer.alloc(1);
-            if (info.size)
-                await file.read(last, 0, 1, info.size - 1);
-            await file.writeFile(`${info.size && last[0] !== 10 ? "\n" : ""}${ignoreRule}\n`);
-        }
-        finally {
-            await file.close();
-        }
-        return true;
-    }
-    catch { /* Report delivery must survive an unavailable Git command or ignore file. */ }
-    return false;
-}

package/dist/adapters/source-relay-plan.js

@@ -1,7 +0,0 @@
-import { localSourcePlan } from "../analysis-core/requests/local-plan.js";
-import { prepareRelayPlanFromCalls } from "./relay-plan.js";
-/** Source preparation plans the captured view once and shares the public paid-plan owner. */
-export function prepareRelayPlan({ bundle, relayVersion, settings, source }) {
-    const { files, calls } = localSourcePlan(settings, source);
-    return { files, plan: prepareRelayPlanFromCalls({ bundle, relayVersion, calls }) };
-}