@haystackeditor/cli 0.12.3 → 0.13.1

package/README.md

@@ -241,7 +241,7 @@ The `setup` wizard writes `.haystack.json` to your repos with discovered rules,
 ## How It Works
 
 1. Run `haystack setup` to configure your repos (or `haystack init` for local-only config)
-2. Install the [Haystack GitHub App](https://haystackeditor.com/github-app)
+2. Install the [Haystack GitHub App](https://github.com/apps/haystack-code-reviewer-pr-hook/installations/new)
 3. When PRs are opened, Haystack automatically:
    - Analyzes the code for bugs, instruction drift, and rule violations
    - Reports results on the PR

package/dist/commands/config.js

@@ -8,7 +8,7 @@ import chalk from 'chalk';
 import { readFileSync, writeFileSync } from 'fs';
 import { resolve } from 'path';
 import { execSync } from 'child_process';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { AI_REVIEWER_SOURCES, AI_REVIEWER_DISPLAY_NAMES, AI_REVIEWER_BOT_USERNAMES } from '../types.js';
 const API_BASE = 'https://haystackeditor.com/api/preferences';
 const AGENTIC_TOOL_LABELS = {
@@ -64,12 +64,14 @@ function setPreference(key, value) {
 // API helpers (user-level preferences)
 // ============================================================================
 async function requireAuth() {
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    try {
+        const authContext = await resolveAuthContext();
+        return authContext.token;
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    return token;
 }
 async function apiRequest(method, token, body) {
     return fetch(API_BASE, {

package/dist/commands/dismiss.js

@@ -13,7 +13,7 @@
  *   https://github.com/owner/repo/pull/123 # GitHub URL
  */
 import chalk from 'chalk';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { parseRemoteUrl } from '../utils/git.js';
 // ============================================================================
 // PR identifier parsing (shared with triage — duplicated to avoid circular deps)
@@ -125,9 +125,12 @@ async function runOverride(identifier, type, commandName) {
         process.exit(1);
     }
     // Require auth
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext({ owner: pr.owner, repo: pr.repo });
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
     const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
@@ -139,7 +142,7 @@ async function runOverride(identifier, type, commandName) {
     // Get PR HEAD SHA
     let headSha;
     try {
-        headSha = await getPRHeadSha(pr.owner, pr.repo, pr.prNumber, token);
+        headSha = await getPRHeadSha(pr.owner, pr.repo, pr.prNumber, authContext.token);
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));
@@ -147,7 +150,7 @@ async function runOverride(identifier, type, commandName) {
     }
     // Post the override
     try {
-        await postUserOverride(repoFullName, pr.prNumber, headSha, type, token);
+        await postUserOverride(repoFullName, pr.prNumber, headSha, type, authContext.token);
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));
@@ -182,16 +185,19 @@ export async function undismissCommand(identifier) {
         console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext({ owner: pr.owner, repo: pr.repo });
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
     const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
     const repoFullName = `${pr.owner}/${pr.repo}`;
     console.log(chalk.dim(`\nClearing overrides for ${prLabel}...`));
     try {
-        await deleteUserOverrides(repoFullName, pr.prNumber, token);
+        await deleteUserOverrides(repoFullName, pr.prNumber, authContext.token);
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));

package/dist/commands/login.d.ts

@@ -1,9 +1,8 @@
 /**
  * Login command - GitHub OAuth device flow
  */
-/**
- * Load token from disk
- */
-export declare function loadToken(): Promise<string | null>;
 export declare function loginCommand(): Promise<void>;
-export declare function logoutCommand(): Promise<void>;
+export declare function logoutCommand(login?: string): Promise<void>;
+export declare function whoamiCommand(): Promise<void>;
+export declare function authListCommand(): Promise<void>;
+export declare function authUseCommand(login: string): Promise<void>;

package/dist/commands/login.js

@@ -2,12 +2,12 @@
  * Login command - GitHub OAuth device flow
  */
 import chalk from 'chalk';
-import * as fs from 'fs/promises';
 import * as path from 'path';
 import * as os from 'os';
+import { getActiveLogin, getRepoDefaultAccount, listStoredAccounts, removeAccount, saveAuthenticatedToken, setActiveAccount, } from '../utils/auth.js';
+import { parseRemoteUrl } from '../utils/git.js';
 const GITHUB_CLIENT_ID = 'Ov23liW3JE38D3gZWa85'; // Haystack GitHub OAuth App
 const CONFIG_DIR = path.join(os.homedir(), '.haystack');
-const TOKEN_FILE = path.join(CONFIG_DIR, 'credentials.json');
 /**
  * Start device flow and get user code
  */
@@ -68,66 +68,15 @@ async function pollForToken(deviceCode, interval) {
         throw new Error(`OAuth error: ${data.error}`);
     }
 }
-/**
- * Save token to disk
- */
-async function saveToken(token) {
-    await fs.mkdir(CONFIG_DIR, { recursive: true });
-    const credentials = {
-        github_token: token,
-        created_at: new Date().toISOString(),
-    };
-    await fs.writeFile(TOKEN_FILE, JSON.stringify(credentials, null, 2), {
-        mode: 0o600, // Owner read/write only
-    });
-}
-/**
- * Load token from disk
- */
-export async function loadToken() {
-    try {
-        const content = await fs.readFile(TOKEN_FILE, 'utf-8');
-        const credentials = JSON.parse(content);
-        return credentials.github_token;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Verify token is valid by calling GitHub API
- */
-async function verifyToken(token) {
-    try {
-        const response = await fetch('https://api.github.com/user', {
-            headers: {
-                'Authorization': `Bearer ${token}`,
-                'User-Agent': 'Haystack-CLI',
-            },
-        });
-        if (!response.ok) {
-            return null;
-        }
-        return response.json();
-    }
-    catch {
-        return null;
-    }
-}
 export async function loginCommand() {
-    console.log(chalk.bold('\nHaystack Login\n'));
-    // Check if already logged in
-    const existingToken = await loadToken();
-    if (existingToken) {
-        const user = await verifyToken(existingToken);
-        if (user) {
-            console.log(chalk.green(`Already logged in as ${chalk.bold(user.login)}`));
-            console.log(chalk.dim('Run `haystack logout` to sign out.\n'));
-            return;
-        }
-    }
-    console.log('Authenticating with GitHub...\n');
     try {
+        console.log(chalk.bold('\nHaystack Login\n'));
+        const activeLogin = await getActiveLogin();
+        if (activeLogin) {
+            console.log(chalk.dim(`Current active account: ${chalk.bold(activeLogin)}`));
+            console.log(chalk.dim('This login will add or refresh a saved account and make it active.\n'));
+        }
+        console.log('Authenticating with GitHub...\n');
         // Start device flow
         const deviceFlow = await startDeviceFlow();
         console.log(chalk.yellow('Open this URL in your browser:\n'));
@@ -138,25 +87,100 @@ export async function loginCommand() {
         // Poll for token
         const token = await pollForToken(deviceFlow.device_code, deviceFlow.interval);
         // Verify and save
-        const user = await verifyToken(token);
-        if (!user) {
-            throw new Error('Failed to verify token');
-        }
-        await saveToken(token);
+        const user = await saveAuthenticatedToken(token);
         console.log(chalk.green(`\nLogged in as ${chalk.bold(user.login)}`));
-        console.log(chalk.dim('Credentials saved to ~/.haystack/credentials.json\n'));
+        console.log(chalk.dim(`Credentials saved to ${path.join(CONFIG_DIR, 'credentials.json')}\n`));
     }
     catch (error) {
         console.error(chalk.red(`\nLogin failed: ${error.message}\n`));
         process.exit(1);
     }
 }
-export async function logoutCommand() {
+export async function logoutCommand(login) {
     try {
-        await fs.unlink(TOKEN_FILE);
-        console.log(chalk.green('\nLogged out successfully.\n'));
+        const removedLogin = await removeAccount(login);
+        if (!removedLogin) {
+            console.log(chalk.yellow('\nNot logged in.\n'));
+            return;
+        }
+        console.log(chalk.green(`\nRemoved saved account ${chalk.bold(removedLogin)}.`));
+        const nextActive = await getActiveLogin();
+        if (nextActive) {
+            console.log(chalk.dim(`Active account is now ${chalk.bold(nextActive)}.\n`));
+        }
+        else {
+            console.log(chalk.dim('No saved Haystack accounts remain.\n'));
+        }
     }
-    catch {
-        console.log(chalk.yellow('\nNot logged in.\n'));
+    catch (error) {
+        console.error(chalk.red(`\n${error.message}\n`));
+        process.exit(1);
+    }
+}
+export async function whoamiCommand() {
+    try {
+        const accounts = await listStoredAccounts();
+        if (accounts.length === 0) {
+            console.log(chalk.yellow('\nNot logged in.\n'));
+            return;
+        }
+        const active = accounts.find((account) => account.isActive);
+        if (!active) {
+            console.log(chalk.yellow('\nNo active Haystack account is configured.\n'));
+            return;
+        }
+        console.log(chalk.bold('\nHaystack Account\n'));
+        console.log(`  ${chalk.dim('Active:')} ${chalk.bold(active.login)}`);
+        console.log(`  ${chalk.dim('Saved:')}  ${accounts.length} account(s)`);
+        let remote = null;
+        try {
+            remote = parseRemoteUrl('origin');
+        }
+        catch {
+            remote = null;
+        }
+        if (remote) {
+            const repoDefault = await getRepoDefaultAccount(remote.owner, remote.repo);
+            if (repoDefault) {
+                console.log(`  ${chalk.dim('Repo:')}   ${remote.owner}/${remote.repo} -> ${repoDefault}`);
+            }
+        }
+        console.log('');
+    }
+    catch (error) {
+        console.error(chalk.red(`\n${error.message}\n`));
+        process.exit(1);
+    }
+}
+export async function authListCommand() {
+    try {
+        const accounts = await listStoredAccounts();
+        if (accounts.length === 0) {
+            console.log(chalk.yellow('\nNo saved Haystack accounts.\n'));
+            return;
+        }
+        console.log(chalk.bold('\nSaved Haystack Accounts\n'));
+        for (const account of accounts) {
+            const marker = account.isActive ? chalk.green('✓') : ' ';
+            const repoDefaultNote = account.repoDefaultCount > 0
+                ? chalk.dim(` (${account.repoDefaultCount} repo default${account.repoDefaultCount === 1 ? '' : 's'})`)
+                : '';
+            console.log(`  ${marker} ${chalk.bold(account.login)}${repoDefaultNote}`);
+        }
+        console.log('');
+    }
+    catch (error) {
+        console.error(chalk.red(`\n${error.message}\n`));
+        process.exit(1);
+    }
+}
+export async function authUseCommand(login) {
+    try {
+        await setActiveAccount(login);
+        console.log(chalk.green(`\nActive Haystack account set to ${chalk.bold(login)}.\n`));
+    }
+    catch (error) {
+        console.error(chalk.red(`\n${error.message}\n`));
+        process.exit(1);
     }
 }

package/dist/commands/pr-status.js

@@ -11,7 +11,7 @@
  *   https://github.com/owner/repo/pull/123 # GitHub URL
  */
 import chalk from 'chalk';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { parseRemoteUrl } from '../utils/git.js';
 // ============================================================================
 // PR identifier parsing
@@ -120,11 +120,15 @@ export async function prStatusCommand(identifier, options) {
         console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext({ owner: pr.owner, repo: pr.repo });
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
+    const token = authContext.token;
     const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
     if (!options.json) {
         console.log(chalk.dim(`\nFetching status for ${prLabel}...\n`));

package/dist/commands/request-review.js

@@ -13,7 +13,7 @@
  *   https://github.com/owner/repo/pull/123 # GitHub URL
  */
 import chalk from 'chalk';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { parseRemoteUrl } from '../utils/git.js';
 import { ensureHaystackLabels, addLabelsToIssue, requestReviewers, } from '../utils/github-api.js';
 // ============================================================================
@@ -59,18 +59,20 @@ export async function requestReviewCommand(identifier, reviewer) {
         console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    // Require auth
-    const token = await loadToken();
-    if (!token) {
-        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext({ owner: pr.owner, repo: pr.repo });
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
     const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
     console.log(chalk.dim(`\nRequesting review for ${prLabel}...`));
     // Ensure the label exists in the repo, then add it to the PR
     try {
-        await ensureHaystackLabels(pr.owner, pr.repo, ['haystack:needs-review']);
-        await addLabelsToIssue(pr.owner, pr.repo, pr.prNumber, ['haystack:needs-review']);
+        await ensureHaystackLabels(pr.owner, pr.repo, ['haystack:needs-review'], authContext.token);
+        await addLabelsToIssue(pr.owner, pr.repo, pr.prNumber, ['haystack:needs-review'], authContext.token);
     }
     catch (err) {
         console.error(chalk.red(`\nFailed to add label: ${err.message}\n`));
@@ -79,7 +81,7 @@ export async function requestReviewCommand(identifier, reviewer) {
     // Request specific reviewer if provided
     if (reviewer) {
         try {
-            await requestReviewers(pr.owner, pr.repo, pr.prNumber, [reviewer]);
+            await requestReviewers(pr.owner, pr.repo, pr.prNumber, [reviewer], authContext.token);
             console.log(chalk.green(`\n  Review requested from ${reviewer} on ${prLabel}`));
         }
         catch (err) {

package/dist/commands/setup.js

@@ -16,7 +16,7 @@ import inquirer from 'inquirer';
 import { execFileSync, execSync } from 'child_process';
 import { mkdirSync } from 'fs';
 import { basename, join } from 'path';
-import { loadToken } from './login.js';
+import { resolveAuthContext } from '../utils/auth.js';
 import { hooksInstall } from './hooks.js';
 import { findGitRoot } from '../utils/hooks.js';
 import { trackError, trackSetupEvent } from '../utils/telemetry.js';
@@ -473,11 +473,15 @@ async function stepConfirm(selectedRepos, rules, signals, policies, token) {
 export async function setupCommand() {
     console.log(chalk.cyan('\n  Haystack Setup Wizard\n'));
     // Step 0: Check login
-    const token = await loadToken();
-    if (!token) {
-        console.log(chalk.yellow('  Not logged in. Run `haystack login` first.\n'));
+    let authContext;
+    try {
+        authContext = await resolveAuthContext();
+    }
+    catch (err) {
+        console.log(chalk.yellow(`  ${err.message}\n`));
         process.exit(1);
     }
+    const token = authContext.token;
     // Verify token
     const userResponse = await fetch(`${GITHUB_API}/user`, {
         headers: {

package/dist/commands/submit.d.ts

@@ -10,6 +10,7 @@
  *   - --force: skip triage checks
  */
 export interface SubmitOptions {
+    account?: string;
     title?: string;
     body?: string;
     bodyFile?: string;
@@ -20,5 +21,7 @@ export interface SubmitOptions {
     wait?: boolean;
     autoFix?: boolean;
     autoMerge?: boolean;
+    maxTurns?: number;
+    triageTimeout?: number;
 }
 export declare function submitCommand(options: SubmitOptions): Promise<void>;