@haystackeditor/cli 0.12.3 → 0.13.1

package/dist/commands/submit.js

@@ -12,11 +12,13 @@
 import chalk from 'chalk';
 import fs from 'fs';
 import { findGitRoot, getCurrentBranch, getDefaultBranch, hasUncommittedChanges, parseRemoteUrl, pushBranch, getLastCommitMessage, getCommitMessagesSinceBase, } from '../utils/git.js';
-import { createPullRequest, findExistingPR, requireGitHubAuth, requestReviewers, } from '../utils/github-api.js';
+import { createPullRequest, findExistingPR, getRepositoryAccess, requestReviewers, } from '../utils/github-api.js';
 import { runTriage } from '../triage/runner.js';
+import { loadConfig } from '../utils/config.js';
 import { checkAnalysisReady, fetchAnalysisResults } from '../utils/analysis-api.js';
 import { savePendingSubmit, updatePendingSubmit } from '../utils/pending-state.js';
 import { ensureHaystackLabels, addLabelsToIssue, } from '../utils/github-api.js';
+import { listStoredAccounts, resolveAuthContext, setRepoDefaultAccount, } from '../utils/auth.js';
 // ============================================================================
 // Helpers
 // ============================================================================
@@ -27,6 +29,87 @@ function buildPRBody(commitMessages) {
 ---
 *Created via [Haystack CLI](https://haystackeditor.com)*`;
 }
+function canCreateSameRepoPullRequest(permissions) {
+    return permissions?.admin === true
+        || permissions?.maintain === true
+        || permissions?.push === true;
+}
+function buildSubmitPermissionMessage(activeLogin, owner, repo, detail) {
+    const repoName = `${owner}/${repo}`;
+    const lines = [
+        `Haystack is authenticated as ${activeLogin}, but that account cannot create a same-repo pull request in ${repoName}.`,
+        'Use `haystack submit --account <login>` or `haystack auth use <login>` to select a different saved account.',
+    ];
+    if (detail) {
+        lines.push(detail);
+    }
+    lines.push(`If the correct account is not saved yet, run \`haystack login\` with a GitHub account that has collaborator access to ${repoName}, then retry \`haystack submit\`.`);
+    return lines.join('\n');
+}
+function formatSubmitPermissionError(error, activeLogin, owner, repo) {
+    const message = error instanceof Error ? error.message : String(error);
+    const lowerMessage = message.toLowerCase();
+    const shouldWrap = lowerMessage.includes('must be a collaborator')
+        || lowerMessage.includes('permission denied')
+        || message.startsWith('Not found: getting repository access');
+    if (!shouldWrap) {
+        return message;
+    }
+    return buildSubmitPermissionMessage(activeLogin, owner, repo, `GitHub said: ${message}`);
+}
+async function checkSubmitAccess(owner, repo, authContext) {
+    try {
+        const repoAccess = await getRepositoryAccess(owner, repo, authContext.token);
+        return { repoAccess };
+    }
+    catch (error) {
+        return { error };
+    }
+}
+function ambiguousAccountMessage(owner, repo, logins) {
+    return [
+        `Multiple saved Haystack accounts can create a same-repo pull request in ${owner}/${repo}: ${logins.join(', ')}.`,
+        'Re-run `haystack submit --account <login>` or `haystack auth use <login>` to choose one.',
+    ].join('\n');
+}
+async function resolveSubmitAuthContext(owner, repo, preferredLogin) {
+    const primaryContext = await resolveAuthContext({ preferredLogin, owner, repo });
+    const primaryResult = await checkSubmitAccess(owner, repo, primaryContext);
+    if (primaryResult.repoAccess && canCreateSameRepoPullRequest(primaryResult.repoAccess.permissions)) {
+        return {
+            authContext: primaryContext,
+            repoAccess: primaryResult.repoAccess,
+            autoSelected: false,
+        };
+    }
+    if (!preferredLogin) {
+        const alternatives = [];
+        const accounts = await listStoredAccounts();
+        for (const account of accounts) {
+            if (account.login === primaryContext.login)
+                continue;
+            const candidateContext = await resolveAuthContext({ preferredLogin: account.login });
+            const candidateResult = await checkSubmitAccess(owner, repo, candidateContext);
+            if (candidateResult.repoAccess && canCreateSameRepoPullRequest(candidateResult.repoAccess.permissions)) {
+                alternatives.push({
+                    authContext: candidateContext,
+                    repoAccess: candidateResult.repoAccess,
+                    autoSelected: true,
+                });
+            }
+        }
+        if (alternatives.length === 1) {
+            return alternatives[0];
+        }
+        if (alternatives.length > 1) {
+            throw new Error(ambiguousAccountMessage(owner, repo, alternatives.map((candidate) => candidate.authContext.login)));
+        }
+    }
+    if (primaryResult.error) {
+        throw new Error(formatSubmitPermissionError(primaryResult.error, primaryContext.login, owner, repo));
+    }
+    throw new Error(buildSubmitPermissionMessage(primaryContext.login, owner, repo, 'The selected Haystack account does not have the collaborator access required for same-repo PR creation.'));
+}
 // ============================================================================
 // Triage output
 // ============================================================================
@@ -54,6 +137,47 @@ function checkerDisplayName(checker) {
         default: return checker;
     }
 }
+/**
+ * Merge triage-tuning knobs from two sources, in ascending precedence:
+ *   defaults (in runner.ts) < .haystack.json triage.* < CLI flags
+ *
+ * --max-turns <N> applies the same number to every checker. Per-checker
+ * granularity stays in .haystack.json (less common, more verbose).
+ */
+async function resolveTriageOptions(options) {
+    let config = null;
+    try {
+        config = await loadConfig();
+    }
+    catch (err) {
+        // loadConfig returns null when the file doesn't exist — it only throws on
+        // read/parse failures, which we must surface so a malformed config doesn't
+        // silently lose the user's project-level triage overrides.
+        console.warn(chalk.yellow(`⚠ Could not load .haystack.json: ${err.message}`));
+        console.warn(chalk.dim('  Triage will use CLI flags / defaults — fix the config to apply project overrides.'));
+    }
+    const triageConfig = config?.triage ?? {};
+    const maxTurns = { ...(triageConfig.maxTurns ?? {}) };
+    if (typeof options.maxTurns === 'number' && options.maxTurns > 0) {
+        for (const name of ['code-review', 'rules-validator', 'intent-drift']) {
+            maxTurns[name] = options.maxTurns;
+        }
+    }
+    // loadConfig does a raw `as HaystackConfig` cast (no Zod runtime parse), so
+    // malformed .haystack.json values can reach us as strings/negatives/NaN.
+    // Mirror the positive-number guard we already apply to maxTurns before
+    // letting this flow into setTimeout.
+    const configTimeoutMs = typeof triageConfig.timeoutMs === 'number' && triageConfig.timeoutMs > 0
+        ? triageConfig.timeoutMs
+        : undefined;
+    const timeoutMs = typeof options.triageTimeout === 'number' && options.triageTimeout > 0
+        ? options.triageTimeout * 1000
+        : configTimeoutMs;
+    return {
+        maxTurns: Object.keys(maxTurns).length > 0 ? maxTurns : undefined,
+        timeoutMs,
+    };
+}
 function isCodexNetworkDisabledTriageError(err) {
     const message = err instanceof Error ? err.message : String(err);
     return message.includes('CODEX_SANDBOX_NETWORK_DISABLED=1');
@@ -80,11 +204,19 @@ function printTriageSummary(result) {
             console.log('');
         }
     }
-    // Errors from sub-agent failures
+    // Hard errors from sub-agent failures (auth, crashes) — these block submit.
     if (result.errors.length > 0) {
-        console.log(chalk.yellow('  Checker errors:'));
+        console.log(chalk.red('  Checker errors:'));
         for (const err of result.errors) {
-            console.log(chalk.yellow(`    ! ${err}`));
+            console.log(chalk.red(`    ✗ ${err}`));
+        }
+        console.log('');
+    }
+    // Soft failures (max turns, timeout) — non-blocking, purely informational.
+    if (result.warnings.length > 0) {
+        console.log(chalk.yellow('  Checker warnings (non-blocking):'));
+        for (const warn of result.warnings) {
+            console.log(chalk.yellow(`    ! ${warn}`));
         }
         console.log('');
     }
@@ -93,9 +225,14 @@ function printTriageSummary(result) {
     const errorCount = result.results.reduce((sum, r) => sum + r.issues.filter((i) => i.severity === 'error').length, 0);
     const warningCount = result.results.reduce((sum, r) => sum + r.issues.filter((i) => i.severity === 'warning').length, 0);
     const duration = (result.duration / 1000).toFixed(1);
-    if (result.passed) {
+    if (result.passed && result.results.length > 0) {
         console.log(chalk.green(`  All checks passed (${duration}s)\n`));
     }
+    else if (result.passed) {
+        // No blocking issues, but nothing actually completed either — the
+        // triage-unavailable warning will print separately.
+        console.log(chalk.yellow(`  No checkers produced results (${duration}s)\n`));
+    }
     else {
         const parts = [];
         if (errorCount > 0)
@@ -127,21 +264,34 @@ export async function submitCommand(options) {
         console.error(chalk.red('\nNot a git repository.\n'));
         process.exit(1);
     }
-    // Check authentication
-    let githubToken;
+    // Get remote info
+    let remoteInfo;
     try {
-        githubToken = await requireGitHubAuth();
-        console.log(chalk.green('✓ Authenticated'));
+        remoteInfo = parseRemoteUrl('origin');
+        console.log(chalk.green(`✓ Repository: ${remoteInfo.owner}/${remoteInfo.repo}`));
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));
         process.exit(1);
     }
-    // Get remote info
-    let remoteInfo;
+    let githubToken;
+    let activeGitHubLogin;
+    let autoSelectedAccount = false;
     try {
-        remoteInfo = parseRemoteUrl('origin');
-        console.log(chalk.green(`✓ Repository: ${remoteInfo.owner}/${remoteInfo.repo}`));
+        const authResolution = await resolveSubmitAuthContext(remoteInfo.owner, remoteInfo.repo, options.account);
+        githubToken = authResolution.authContext.token;
+        activeGitHubLogin = authResolution.authContext.login;
+        autoSelectedAccount = authResolution.autoSelected;
+        try {
+            await setRepoDefaultAccount(remoteInfo.owner, remoteInfo.repo, activeGitHubLogin);
+        }
+        catch (err) {
+            console.log(chalk.yellow(`⚠ Could not save ${activeGitHubLogin} as the default Haystack account for ${remoteInfo.owner}/${remoteInfo.repo}: ${err.message}`));
+        }
+        console.log(chalk.green(`✓ Authenticated as ${activeGitHubLogin}`));
+        if (autoSelectedAccount) {
+            console.log(chalk.dim(`  Auto-selected saved account ${activeGitHubLogin} for ${remoteInfo.owner}/${remoteInfo.repo}`));
+        }
     }
     catch (err) {
         console.error(chalk.red(`\n${err.message}\n`));
@@ -162,11 +312,17 @@ export async function submitCommand(options) {
     if (!options.force) {
         console.log(chalk.dim('\nRunning pre-PR triage checks...'));
         try {
-            const triageResult = await runTriage(gitRoot, baseBranch);
+            const triageOptions = await resolveTriageOptions(options);
+            const triageResult = await runTriage(gitRoot, baseBranch, triageOptions);
             printTriageSummary(triageResult);
-            const triageInfraFailure = triageResult.results.length === 0 && triageResult.errors.length > 0;
+            // No valid results means we got zero signal from triage. That's
+            // "unavailable" whether the cause was a hard error (auth crash) or a
+            // soft cap (every checker hit max turns). Either way don't pretend it
+            // passed — print the warning and continue.
+            const triageInfraFailure = triageResult.results.length === 0 &&
+                (triageResult.errors.length > 0 || triageResult.warnings.length > 0);
             if (triageInfraFailure) {
-                console.log(chalk.yellow('\n⚠ Triage unavailable (sub-agents failed to run). Continuing with submit.\n'));
+                console.log(chalk.yellow('\n⚠ Triage unavailable (no checkers produced results). Continuing with submit.\n'));
             }
             if (!triageResult.passed) {
                 if (triageInfraFailure) {
@@ -219,7 +375,7 @@ export async function submitCommand(options) {
     // -------------------------------------------------------------------------
     console.log(chalk.dim('\nCreating pull request...'));
     // Check if PR already exists
-    const existingPR = await findExistingPR(remoteInfo.owner, remoteInfo.repo, currentBranch);
+    const existingPR = await findExistingPR(remoteInfo.owner, remoteInfo.repo, currentBranch, githubToken);
     let prNumber;
     let prUrl;
     if (existingPR) {
@@ -255,13 +411,14 @@ export async function submitCommand(options) {
                 base: baseBranch,
                 body: prBody,
                 draft: options.draft,
+                token: githubToken,
             });
             prNumber = pr.number;
             prUrl = pr.html_url;
             console.log(chalk.green(`✓ Pull request created: #${prNumber}`));
         }
         catch (err) {
-            console.error(chalk.red(`\n${err.message}\n`));
+            console.error(chalk.red(`\n${formatSubmitPermissionError(err, activeGitHubLogin, remoteInfo.owner, remoteInfo.repo)}\n`));
             process.exit(1);
         }
     }
@@ -270,8 +427,8 @@ export async function submitCommand(options) {
     // -------------------------------------------------------------------------
     if (options.autoMerge) {
         try {
-            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-merge']);
-            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-merge']);
+            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-merge'], githubToken);
+            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-merge'], githubToken);
             console.log(chalk.green('✓ Auto-merge enabled for this PR'));
         }
         catch (err) {
@@ -283,8 +440,8 @@ export async function submitCommand(options) {
     // -------------------------------------------------------------------------
     if (options.autoFix) {
         try {
-            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-fix']);
-            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-fix']);
+            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-fix'], githubToken);
+            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-fix'], githubToken);
             console.log(chalk.green('✓ Auto-fix (alpha) enabled for this PR'));
         }
         catch (err) {
@@ -296,11 +453,11 @@ export async function submitCommand(options) {
     // -------------------------------------------------------------------------
     if (options.review) {
         try {
-            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:needs-review']);
-            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:needs-review']);
+            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:needs-review'], githubToken);
+            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:needs-review'], githubToken);
             if (typeof options.review === 'string') {
                 // Specific reviewer requested
-                await requestReviewers(remoteInfo.owner, remoteInfo.repo, prNumber, [options.review]);
+                await requestReviewers(remoteInfo.owner, remoteInfo.repo, prNumber, [options.review], githubToken);
                 console.log(chalk.green(`✓ Review requested from ${options.review}`));
             }
             else {

package/dist/commands/triage.js

@@ -22,7 +22,7 @@
 import chalk from 'chalk';
 import { checkAnalysisReady, fetchRatingSynthesis, fetchAutoFixManifest } from '../utils/analysis-api.js';
 import { parseRemoteUrl } from '../utils/git.js';
-import { loadToken } from './login.js';
+import { loadToken } from '../utils/auth.js';
 import { loadPendingSubmit, updatePendingSubmit, clearPendingSubmit } from '../utils/pending-state.js';
 // ============================================================================
 // PR identifier parsing
@@ -248,9 +248,18 @@ export async function triageCommand(identifier, options) {
     const pr = resolvePR(identifier, options);
     if (!pr)
         return;
-    // Load GitHub token for private repo auth
-    const token = await loadToken() || undefined;
     const isQuiet = options.hook || options.json;
+    // Load GitHub token for private repo auth
+    let token;
+    try {
+        token = await loadToken({ owner: pr.owner, repo: pr.repo }) || undefined;
+    }
+    catch (err) {
+        if (!isQuiet) {
+            console.log(chalk.yellow(`\n⚠ Could not load Haystack credentials: ${err.message}`));
+            console.log(chalk.dim('  Continuing without GitHub auth. Private repos may require `haystack login`.\n'));
+        }
+    }
     if (!isQuiet) {
         console.log(chalk.dim(`\nFetching analysis for ${pr.owner}/${pr.repo}#${pr.prNumber}...`));
     }

package/dist/index.js

@@ -22,7 +22,7 @@
 import { Command } from 'commander';
 import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
-import { loginCommand, logoutCommand } from './commands/login.js';
+import { authListCommand, authUseCommand, loginCommand, logoutCommand, whoamiCommand, } from './commands/login.js';
 import { handleAgenticTool, handleAutoMerge, handleWaitForReviewers, isAutoMergeEnabled } from './commands/config.js';
 import { installSkills, listSkills } from './commands/skills.js';
 import { hooksInstall, hooksStatus, hooksUpdate } from './commands/hooks.js';
@@ -38,7 +38,7 @@ const program = new Command();
 program
     .name('haystack')
     .description('Haystack CLI — automated PR review, triage, and merge queue')
-    .version('0.12.3');
+    .version('0.13.1');
 program
     .command('init')
     .description('Create .haystack.json configuration')
@@ -78,15 +78,31 @@ program
     .action(statusCommand);
 program
     .command('login')
-    .description('Authenticate with GitHub')
+    .description('Add or refresh a saved GitHub account')
     .action(loginCommand);
 program
-    .command('logout')
-    .description('Remove stored credentials')
+    .command('logout [login]')
+    .description('Remove a saved GitHub account (defaults to the active account)')
     .action(logoutCommand);
+program
+    .command('whoami')
+    .description('Show the active Haystack GitHub account')
+    .action(whoamiCommand);
+const authProgram = program
+    .command('auth')
+    .description('Manage saved Haystack GitHub accounts');
+authProgram
+    .command('list')
+    .description('List saved Haystack GitHub accounts')
+    .action(authListCommand);
+authProgram
+    .command('use <login>')
+    .description('Set the active Haystack GitHub account')
+    .action(authUseCommand);
 program
     .command('submit')
     .description('Create a PR from current changes')
+    .option('--account <login>', 'Saved Haystack account login to use for GitHub API calls')
     .option('--title <title>', 'PR title (default: last commit message)')
     .option('--body <body>', 'PR body (default: commit messages since base)')
     .option('--body-file <path>', 'Read PR body from file (use "-" for stdin)')
@@ -97,6 +113,8 @@ program
     .option('--auto-fix', 'Alpha auto-fix for straightforward mechanical issues (discouraged)')
     .option('--auto-merge', 'Apply auto-merge label (default: from .haystack.json, --no-auto-merge to disable)')
     .option('--no-wait', 'Skip waiting for analysis results')
+    .option('--max-turns <n>', 'Max agentic turns per triage checker (overrides .haystack.json triage.maxTurns)', (v) => parseInt(v, 10))
+    .option('--triage-timeout <seconds>', 'Wall-clock timeout per triage checker in seconds (overrides .haystack.json triage.timeoutMs)', (v) => parseInt(v, 10))
     .addHelpText('after', `
 This command is designed for AI coding agents to submit PRs.
 
@@ -116,6 +134,22 @@ Pre-PR Triage:
   Use --auto-fix only when explicitly opting into the alpha fixer for
   straightforward mechanical issues.
 
+  Triage budgets:
+  • --max-turns <n>         Raise/lower the per-checker tool-use turn cap.
+                            Defaults: code-review 8, rules-validator 10,
+                            intent-drift 10. Applies the same N to all three.
+  • --triage-timeout <sec>  Raise/lower the per-checker wall-clock timeout
+                            (default: 180s).
+
+  Persist these in .haystack.json to apply per project:
+
+    {
+      "triage": {
+        "maxTurns": { "code-review": 12 },
+        "timeoutMs": 240000
+      }
+    }
+
 Review Routing:
   If repo auto-merge is enabled in .haystack.json, plain \`haystack submit\`
   enters the auto-merge queue after submission. Otherwise it still runs the
@@ -146,6 +180,9 @@ Examples:
   haystack submit --draft              # Create as draft PR
   haystack submit --review             # ⚠ Blocks auto-merge, needs human approval
   haystack submit --review octocat     # ⚠ Blocks auto-merge, requests review from octocat
+  haystack submit --account octocat    # Use a specific saved Haystack account for this submit
+  haystack submit --max-turns 12       # Raise triage turn cap to 12 per checker
+  haystack submit --triage-timeout 300 # Raise triage wall-clock to 5 minutes
 `)
     .action(async (options) => {
     // Resolve --auto-merge default from .haystack.json when not explicitly set

package/dist/triage/prompts.d.ts

@@ -11,14 +11,14 @@
  * Build the code review prompt.
  * Always runs — looks for objective bugs in the diff.
  */
-export declare function buildCodeReviewPrompt(baseBranch: string, outputPath: string, precomputedDiff?: string | null): string;
+export declare function buildCodeReviewPrompt(baseBranch: string, outputPath: string, maxTurns: number, timeoutMs: number, precomputedDiff?: string | null): string;
 /**
  * Build the rules validator prompt.
  * Runs if .haystack/pr-rules.yml exists OR agent instruction files are found.
  *
  * @returns The prompt string, or null if no rules content or agent policies provided.
  */
-export declare function buildRulesValidatorPrompt(baseBranch: string, rulesYaml: string, outputPath: string, agentPolicies?: {
+export declare function buildRulesValidatorPrompt(baseBranch: string, rulesYaml: string, outputPath: string, maxTurns: number, timeoutMs: number, agentPolicies?: {
     filename: string;
     content: string;
 }[], precomputedDiff?: string | null): string | null;
@@ -28,4 +28,4 @@ export declare function buildRulesValidatorPrompt(baseBranch: string, rulesYaml:
  *
  * @returns The prompt string, or null if no trace files provided.
  */
-export declare function buildIntentDriftPrompt(baseBranch: string, traceFiles: string[], outputPath: string, precomputedDiff?: string | null): string | null;
+export declare function buildIntentDriftPrompt(baseBranch: string, traceFiles: string[], outputPath: string, maxTurns: number, timeoutMs: number, precomputedDiff?: string | null): string | null;

package/dist/triage/prompts.js

@@ -55,11 +55,29 @@ const INTENT_DRIFT_SCHEMA = `{
 // ============================================================================
 // Prompt builders
 // ============================================================================
+/**
+ * Build the time-budget preamble shared by every checker prompt. Agents don't
+ * otherwise know about the externally-enforced turn cap and wall-clock
+ * deadline, so they'd happily burn budget on deep dives and get SIGTERM'd.
+ * Telling them up front makes them triage instead of exhaustively explore.
+ */
+function buildTimeBudgetHeader(maxTurns, timeoutMs) {
+    const minutes = Math.round(timeoutMs / 60_000);
+    return `## Time budget (hard limits)
+
+- You have **${maxTurns} tool-use turns max** and **~${minutes} minutes wall-clock** before this process is killed.
+- Be decisive. Skip speculative exploration. If a file looks incidental, don't open it.
+- Prefer the provided diff over running fresh searches unless the diff alone is ambiguous.
+- Report only findings you can confirm quickly. A timeout produces ZERO findings, so ship a partial high-confidence result rather than chase a perfect one that never lands.
+- Write the output JSON file EARLY (even if partial) and update it if you find more. Never exit without writing.
+
+`;
+}
 /**
  * Build the code review prompt.
  * Always runs — looks for objective bugs in the diff.
  */
-export function buildCodeReviewPrompt(baseBranch, outputPath, precomputedDiff) {
+export function buildCodeReviewPrompt(baseBranch, outputPath, maxTurns, timeoutMs, precomputedDiff) {
     const diffSection = precomputedDiff
         ? `## Diff (precomputed)
 
@@ -79,7 +97,7 @@ ${precomputedDiff}
 3. Identify only REAL BUGS — things that will definitely crash, produce wrong results, or corrupt data.`;
     return `You are a pre-PR code reviewer. Your job is to find OBJECTIVE BUGS in the code changes that will cause incorrect runtime behavior.
 
-${diffSection}
+${buildTimeBudgetHeader(maxTurns, timeoutMs)}${diffSection}
 
 ## What to flag
 
@@ -122,7 +140,7 @@ Be extremely conservative. False positives waste the developer's time. Only flag
  *
  * @returns The prompt string, or null if no rules content or agent policies provided.
  */
-export function buildRulesValidatorPrompt(baseBranch, rulesYaml, outputPath, agentPolicies, precomputedDiff) {
+export function buildRulesValidatorPrompt(baseBranch, rulesYaml, outputPath, maxTurns, timeoutMs, agentPolicies, precomputedDiff) {
     const hasRules = rulesYaml.trim().length > 0;
     const hasPolicies = agentPolicies && agentPolicies.length > 0;
     if (!hasRules && !hasPolicies)
@@ -196,7 +214,7 @@ ${precomputedDiff}
 3. If you need more context, read just the relevant section of the file — do NOT read entire large files.`;
     return `You are a PR rules validator. Your job is to check the code changes against project rules and policies, then flag violations.
 
-${rulesSection}${policiesSection}${diffInstructions}
+${buildTimeBudgetHeader(maxTurns, timeoutMs)}${rulesSection}${policiesSection}${diffInstructions}
 
 ## Important
 
@@ -223,13 +241,13 @@ ${RULES_VALIDATOR_SCHEMA}
  *
  * @returns The prompt string, or null if no trace files provided.
  */
-export function buildIntentDriftPrompt(baseBranch, traceFiles, outputPath, precomputedDiff) {
+export function buildIntentDriftPrompt(baseBranch, traceFiles, outputPath, maxTurns, timeoutMs, precomputedDiff) {
     if (traceFiles.length === 0)
         return null;
     const traceFileList = traceFiles.map(f => `- \`${f}\``).join('\n');
     return `You are an intent drift detector. Your job is to check whether an AI coding agent faithfully implemented what the user asked for.
 
-## Context
+${buildTimeBudgetHeader(maxTurns, timeoutMs)}## Context
 
 This PR was created by an AI coding agent. The agent's session transcripts (traces) are stored locally. You will compare what the user asked the agent to do against what was actually implemented in the diff.
 

package/dist/triage/runner.d.ts

@@ -5,6 +5,12 @@
  * parallel sub-processes for each checker, and collects structured JSON results.
  */
 import type { AgenticCLI, TriageResult } from './types.js';
+export interface RunTriageOptions {
+    /** Per-checker max-turn overrides (CLI flag > .haystack.json > defaults). */
+    maxTurns?: Partial<Record<string, number>>;
+    /** Per-checker wall-clock timeout override, in ms. */
+    timeoutMs?: number;
+}
 /**
  * Detect which agentic CLI is installed.
  * Returns the first one found, or null if none available.
@@ -18,4 +24,4 @@ export declare function detectAgenticCLI(): AgenticCLI | null;
  * @returns Aggregated triage results
  * @throws If no agentic CLI is detected
  */
-export declare function runTriage(gitRoot: string, baseBranch: string): Promise<TriageResult>;
+export declare function runTriage(gitRoot: string, baseBranch: string, options?: RunTriageOptions): Promise<TriageResult>;