@haystackeditor/cli 0.12.3 → 0.13.1

package/dist/triage/runner.js

@@ -10,14 +10,20 @@ import { join } from 'path';
 import chalk from 'chalk';
 import { buildCodeReviewPrompt, buildRulesValidatorPrompt, buildIntentDriftPrompt } from './prompts.js';
 import { findRelevantTraces } from './traces.js';
+import { trackError } from '../utils/telemetry.js';
 // ============================================================================
 // Constants
 // ============================================================================
 const TRIAGE_DIR = '.haystack/triage';
-const TIMEOUT_MS = 300_000; // 5 minutes per checker
-/** Max agentic turns per checker — kept tight since these are read-only tasks */
-const MAX_TURNS = {
-    'code-review': 5,
+/** Wall-clock timeout per checker. Overridable via .haystack.json triage.timeoutMs or --triage-timeout. */
+const DEFAULT_TIMEOUT_MS = 180_000; // 3 minutes
+/**
+ * Default max agentic turns per checker. Overridable via .haystack.json
+ * triage.maxTurns or --max-turns. code-review tends to saturate first because
+ * it reads the diff line-by-line; 8 is the breakeven we landed on empirically.
+ */
+const DEFAULT_MAX_TURNS = {
+    'code-review': 8,
     'rules-validator': 10,
     'intent-drift': 10,
 };
@@ -107,7 +113,7 @@ function buildCommand(cli, prompt, maxTurns) {
  * Spawn a sub-agent process and wait for it to complete.
  * Returns the exit code.
  */
-function spawnChecker(cli, config, cwd) {
+function spawnChecker(cli, config, cwd, timeoutMs) {
     return new Promise((resolve) => {
         const { command, args } = buildCommand(cli, config.prompt, config.maxTurns);
         let stdout = '';
@@ -134,8 +140,8 @@ function spawnChecker(cli, config, cwd) {
         // Timeout
         const timer = setTimeout(() => {
             proc.kill('SIGTERM');
-            stderr += `\nProcess killed after ${TIMEOUT_MS / 1000}s timeout`;
-        }, TIMEOUT_MS);
+            stderr += `\nProcess killed after ${Math.round(timeoutMs / 1000)}s timeout`;
+        }, timeoutMs);
         proc.on('close', (code) => {
             clearTimeout(timer);
             resolve({ exitCode: code ?? 1, output: `${stdout}\n${stderr}`.trim() });
@@ -146,6 +152,30 @@ function spawnChecker(cli, config, cwd) {
         });
     });
 }
+/**
+ * Classify why a checker failed to produce a valid JSON result.
+ *
+ * - `max_turns`: the sub-agent exhausted its --max-turns budget. Expected when
+ *   the diff is too large for the budget; should not block submit.
+ * - `timeout`: we killed the process at the configured wall-clock cap. Also non-blocking.
+ * - `error`: anything else (auth failure, crash, malformed output). Blocks.
+ *
+ * The max-turns markers come from the CLIs themselves (Claude CLI prints
+ * "Reached max turns", Codex prints "turn limit"). If a new CLI is added, add
+ * its marker here — unknown failures fall through to `error` (safe default).
+ */
+function classifyCheckerFailure(output) {
+    const summary = summarizeCheckerFailureOutput(output) ?? '(no output)';
+    // Claude: "Reached max turns (N)". Codex/Gemini variants: "turn limit", "max iterations".
+    if (/reached max turns|max turns reached|turn limit|max iterations/i.test(output)) {
+        return { kind: 'max_turns', summary };
+    }
+    // Our own SIGTERM message from spawnChecker.
+    if (/process killed after \d+s timeout/i.test(output)) {
+        return { kind: 'timeout', summary };
+    }
+    return { kind: 'error', summary };
+}
 function summarizeCheckerFailureOutput(output) {
     const lines = output
         .split('\n')
@@ -212,8 +242,18 @@ function readCheckerResult(outputPath, checkerName) {
  * @returns Aggregated triage results
  * @throws If no agentic CLI is detected
  */
-export async function runTriage(gitRoot, baseBranch) {
+export async function runTriage(gitRoot, baseBranch, options = {}) {
     const startTime = Date.now();
+    // Merge defaults with caller-provided overrides. The caller (submit.ts) is
+    // responsible for layering CLI flags on top of .haystack.json values before
+    // calling us — we just see a flat override map.
+    const maxTurns = { ...DEFAULT_MAX_TURNS };
+    for (const [name, value] of Object.entries(options.maxTurns ?? {})) {
+        if (typeof value === 'number' && value > 0) {
+            maxTurns[name] = value;
+        }
+    }
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     // Detect CLI
     const cli = detectAgenticCLI();
     if (!cli) {
@@ -252,9 +292,9 @@ export async function runTriage(gitRoot, baseBranch) {
     const codeReviewOutput = join(triageDir, 'code-review.json');
     checkers.push({
         name: 'code-review',
-        prompt: buildCodeReviewPrompt(baseBranch, codeReviewOutput, precomputedDiff),
+        prompt: buildCodeReviewPrompt(baseBranch, codeReviewOutput, maxTurns['code-review'], timeoutMs, precomputedDiff),
         outputFile: codeReviewOutput,
-        maxTurns: MAX_TURNS['code-review'],
+        maxTurns: maxTurns['code-review'],
     });
     // 2. Rules validator (if pr-rules.yml or agent instruction files exist)
     const rulesPath = join(gitRoot, '.haystack', 'pr-rules.yml');
@@ -263,13 +303,13 @@ export async function runTriage(gitRoot, baseBranch) {
     const agentPolicyFiles = discoverAgentPolicyFiles(gitRoot);
     if (hasRulesYaml || agentPolicyFiles.length > 0) {
         const rulesValidatorOutput = join(triageDir, 'rules-validator.json');
-        const rulesPrompt = buildRulesValidatorPrompt(baseBranch, rulesYaml, rulesValidatorOutput, agentPolicyFiles, precomputedDiff);
+        const rulesPrompt = buildRulesValidatorPrompt(baseBranch, rulesYaml, rulesValidatorOutput, maxTurns['rules-validator'], timeoutMs, agentPolicyFiles, precomputedDiff);
         if (rulesPrompt) {
             checkers.push({
                 name: 'rules-validator',
                 prompt: rulesPrompt,
                 outputFile: rulesValidatorOutput,
-                maxTurns: MAX_TURNS['rules-validator'],
+                maxTurns: maxTurns['rules-validator'],
             });
         }
     }
@@ -277,13 +317,13 @@ export async function runTriage(gitRoot, baseBranch) {
     const traceFiles = findRelevantTraces(gitRoot, baseBranch);
     if (traceFiles.length > 0) {
         const intentDriftOutput = join(triageDir, 'intent-drift.json');
-        const driftPrompt = buildIntentDriftPrompt(baseBranch, traceFiles, intentDriftOutput, precomputedDiff);
+        const driftPrompt = buildIntentDriftPrompt(baseBranch, traceFiles, intentDriftOutput, maxTurns['intent-drift'], timeoutMs, precomputedDiff);
         if (driftPrompt) {
             checkers.push({
                 name: 'intent-drift',
                 prompt: driftPrompt,
                 outputFile: intentDriftOutput,
-                maxTurns: MAX_TURNS['intent-drift'],
+                maxTurns: maxTurns['intent-drift'],
             });
         }
     }
@@ -298,7 +338,7 @@ export async function runTriage(gitRoot, baseBranch) {
     const spawnResults = await Promise.allSettled(checkers.map(async (checker) => {
         const startLabel = chalk.dim(`  [${checker.name}]`);
         console.log(`${startLabel} Starting...`);
-        const result = await spawnChecker(cli, checker, gitRoot);
+        const result = await spawnChecker(cli, checker, gitRoot, timeoutMs);
         if (result.exitCode === 0) {
             console.log(`${startLabel} ${chalk.green('Done')}`);
         }
@@ -310,30 +350,55 @@ export async function runTriage(gitRoot, baseBranch) {
     // Collect results
     const results = [];
     const errors = [];
+    const warnings = [];
     for (const spawnResult of spawnResults) {
         if (spawnResult.status === 'rejected') {
             errors.push(`Checker failed: ${spawnResult.reason}`);
+            trackError('triage_checker_failed', {
+                checker: 'unknown',
+                kind: 'spawn_rejected',
+                cli,
+                reason: String(spawnResult.reason),
+            });
             continue;
         }
         const { checker, result } = spawnResult.value;
         const checkerResult = readCheckerResult(checker.outputFile, checker.name);
         if (checkerResult) {
             results.push(checkerResult);
+            continue;
+        }
+        // Sub-agent didn't produce valid output — classify as warning vs hard error.
+        const classification = classifyCheckerFailure(result.output);
+        if (classification.kind === 'max_turns') {
+            warnings.push(`${checker.name}: hit max turns (${checker.maxTurns}) — raise via --max-turns or .haystack.json triage.maxTurns, or split the PR into smaller changes`);
+        }
+        else if (classification.kind === 'timeout') {
+            warnings.push(`${checker.name}: wall-clock timeout after ${Math.round(timeoutMs / 1000)}s — consider splitting the PR`);
         }
         else {
-            // Sub-agent didn't produce valid output
-            const failureSummary = summarizeCheckerFailureOutput(result.output);
-            const errMsg = result.exitCode !== 0
-                ? `${checker.name}: process exited with code ${result.exitCode}${failureSummary ? ` (${failureSummary})` : ''}`
-                : `${checker.name}: no valid result file produced`;
-            errors.push(errMsg);
+            const exitPart = result.exitCode !== 0 ? ` (exit ${result.exitCode})` : '';
+            errors.push(`${checker.name}: ${classification.summary}${exitPart}`);
         }
+        // Emit telemetry for every failed checker so we can tune defaults empirically.
+        trackError('triage_checker_failed', {
+            checker: checker.name,
+            kind: classification.kind,
+            cli,
+            max_turns: checker.maxTurns,
+            timeout_ms: timeoutMs,
+            exit_code: result.exitCode,
+            summary: classification.summary,
+        });
     }
+    // Warnings are non-blocking by design — they're expected outcomes of the
+    // turn/time caps, not signs of real problems.
     const passed = results.every(r => r.passed) && errors.length === 0;
     return {
         passed,
         results,
         errors,
+        warnings,
         duration: Date.now() - startTime,
     };
 }

package/dist/triage/types.d.ts

@@ -39,8 +39,10 @@ export type CheckerResult = CodeReviewResult | RulesValidatorResult | IntentDrif
 export interface TriageResult {
     passed: boolean;
     results: CheckerResult[];
-    /** Errors from sub-agent crashes or missing output */
+    /** Hard errors — auth failures, crashed sub-agents, unknown failures. Block submit. */
     errors: string[];
+    /** Soft failures — sub-agent hit max turns or wall-clock timeout. Do NOT block submit. */
+    warnings: string[];
     /** Total duration in ms */
     duration: number;
 }

package/dist/types.d.ts

@@ -702,6 +702,18 @@ declare const SecretDeclarationSchema: z.ZodObject<{
     services?: string[] | undefined;
     description?: string | undefined;
 }>;
+declare const TriageConfigSchema: z.ZodObject<{
+    /** Per-checker max agentic turns. Unspecified checkers use built-in defaults. */
+    maxTurns: z.ZodOptional<z.ZodRecord<z.ZodEnum<["code-review", "rules-validator", "intent-drift"]>, z.ZodNumber>>;
+    /** Wall-clock timeout per checker, in milliseconds. */
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    maxTurns?: Partial<Record<"code-review" | "rules-validator" | "intent-drift", number>> | undefined;
+    timeoutMs?: number | undefined;
+}, {
+    maxTurns?: Partial<Record<"code-review" | "rules-validator" | "intent-drift", number>> | undefined;
+    timeoutMs?: number | undefined;
+}>;
 export declare const HaystackConfigSchema: z.ZodObject<{
     /** Config version (must be "1") */
     version: z.ZodLiteral<"1">;
@@ -1249,6 +1261,19 @@ export declare const HaystackConfigSchema: z.ZodObject<{
             timeout_minutes?: number | undefined;
         } | undefined;
     }>>;
+    /** Pre-PR triage configuration (turn budgets, timeouts) */
+    triage: z.ZodOptional<z.ZodObject<{
+        /** Per-checker max agentic turns. Unspecified checkers use built-in defaults. */
+        maxTurns: z.ZodOptional<z.ZodRecord<z.ZodEnum<["code-review", "rules-validator", "intent-drift"]>, z.ZodNumber>>;
+        /** Wall-clock timeout per checker, in milliseconds. */
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        maxTurns?: Partial<Record<"code-review" | "rules-validator" | "intent-drift", number>> | undefined;
+        timeoutMs?: number | undefined;
+    }, {
+        maxTurns?: Partial<Record<"code-review" | "rules-validator" | "intent-drift", number>> | undefined;
+        timeoutMs?: number | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     version: "1";
     name?: string | undefined;
@@ -1371,6 +1396,10 @@ export declare const HaystackConfigSchema: z.ZodObject<{
         services?: string[] | undefined;
         description?: string | undefined;
     }> | undefined;
+    triage?: {
+        maxTurns?: Partial<Record<"code-review" | "rules-validator" | "intent-drift", number>> | undefined;
+        timeoutMs?: number | undefined;
+    } | undefined;
 }, {
     version: "1";
     name?: string | undefined;
@@ -1493,6 +1522,10 @@ export declare const HaystackConfigSchema: z.ZodObject<{
         services?: string[] | undefined;
         description?: string | undefined;
     }> | undefined;
+    triage?: {
+        maxTurns?: Partial<Record<"code-review" | "rules-validator" | "intent-drift", number>> | undefined;
+        timeoutMs?: number | undefined;
+    } | undefined;
 }>;
 export type HaystackConfig = z.infer<typeof HaystackConfigSchema>;
 export type VerificationCommand = z.infer<typeof VerificationCommandSchema>;
@@ -1513,6 +1546,7 @@ export type DatabaseConfig = z.infer<typeof DatabaseConfigSchema>;
 export type NetworkConfig = z.infer<typeof NetworkConfigSchema>;
 export type SecretDeclaration = z.infer<typeof SecretDeclarationSchema>;
 export type MergeQueueConfig = z.infer<typeof MergeQueueConfigSchema>;
+export type TriageConfig = z.infer<typeof TriageConfigSchema>;
 /**
  * Project detection results
  */

package/dist/types.js

@@ -267,6 +267,16 @@ const SecretDeclarationSchema = z.object({
     services: z.array(z.string()).optional(),
 });
 // =============================================================================
+// TRIAGE CONFIGURATION
+// =============================================================================
+const TriageCheckerNameSchema = z.enum(['code-review', 'rules-validator', 'intent-drift']);
+const TriageConfigSchema = z.object({
+    /** Per-checker max agentic turns. Unspecified checkers use built-in defaults. */
+    maxTurns: z.record(TriageCheckerNameSchema, z.number().int().positive()).optional(),
+    /** Wall-clock timeout per checker, in milliseconds. */
+    timeoutMs: z.number().int().positive().optional(),
+});
+// =============================================================================
 // MAIN CONFIG
 // =============================================================================
 export const HaystackConfigSchema = z.object({
@@ -294,4 +304,6 @@ export const HaystackConfigSchema = z.object({
     secrets: z.record(z.string(), SecretDeclarationSchema).optional(),
     /** Merge queue configuration for autonomous PR maintenance */
     merge_queue: MergeQueueConfigSchema.optional(),
+    /** Pre-PR triage configuration (turn budgets, timeouts) */
+    triage: TriageConfigSchema.optional(),
 });

package/dist/utils/auth.d.ts

@@ -0,0 +1,50 @@
+export interface StoredAccount {
+    github_token: string;
+    created_at: string;
+}
+export interface CredentialsStore {
+    version: 2;
+    activeLogin: string | null;
+    accounts: Record<string, StoredAccount>;
+    repoDefaults: Record<string, string>;
+}
+export interface GitHubUser {
+    login: string;
+    id: number;
+}
+export type VerifyGitHubTokenResult = {
+    status: 'ok';
+    user: GitHubUser;
+} | {
+    status: 'invalid';
+} | {
+    status: 'error';
+    message: string;
+};
+export interface ResolveAuthOptions {
+    preferredLogin?: string;
+    owner?: string;
+    repo?: string;
+}
+export interface ResolvedAuthContext {
+    login: string;
+    token: string;
+    source: 'preferred' | 'repo-default' | 'active';
+}
+export interface AccountSummary {
+    login: string;
+    createdAt: string;
+    isActive: boolean;
+    repoDefaultCount: number;
+}
+export declare function verifyGitHubToken(token: string): Promise<VerifyGitHubTokenResult>;
+export declare function loadCredentialsStore(): Promise<CredentialsStore>;
+export declare function saveAuthenticatedToken(token: string): Promise<GitHubUser>;
+export declare function listStoredAccounts(): Promise<AccountSummary[]>;
+export declare function setActiveAccount(login: string): Promise<void>;
+export declare function removeAccount(login?: string): Promise<string | null>;
+export declare function getActiveLogin(): Promise<string | null>;
+export declare function getRepoDefaultAccount(owner: string, repo: string): Promise<string | null>;
+export declare function setRepoDefaultAccount(owner: string, repo: string, login: string): Promise<void>;
+export declare function resolveAuthContext(options?: ResolveAuthOptions): Promise<ResolvedAuthContext>;
+export declare function loadToken(options?: ResolveAuthOptions): Promise<string | null>;