npm - @haystackeditor/cli - Versions diffs - 0.13.0 → 0.13.1 - Mend

@haystackeditor/cli 0.13.0 → 0.13.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/dist/commands/config.js +7 -5
package/dist/commands/dismiss.js +16 -10
package/dist/commands/login.d.ts +4 -5
package/dist/commands/login.js +95 -71
package/dist/commands/pr-status.js +8 -4
package/dist/commands/request-review.js +10 -8
package/dist/commands/setup.js +8 -4
package/dist/commands/submit.d.ts +1 -0
package/dist/commands/submit.js +114 -18
package/dist/commands/triage.js +12 -3
package/dist/index.js +22 -5
package/dist/utils/auth.d.ts +50 -0
package/dist/utils/auth.js +386 -0
package/dist/utils/github-api.d.ts +36 -15
package/dist/utils/github-api.js +52 -44
package/package.json +1 -1

package/dist/index.js CHANGED Viewed

@@ -22,7 +22,7 @@
 import { Command } from 'commander';
 import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
-import { loginCommand, logoutCommand } from './commands/login.js';
+import { authListCommand, authUseCommand, loginCommand, logoutCommand, whoamiCommand, } from './commands/login.js';
 import { handleAgenticTool, handleAutoMerge, handleWaitForReviewers, isAutoMergeEnabled } from './commands/config.js';
 import { installSkills, listSkills } from './commands/skills.js';
 import { hooksInstall, hooksStatus, hooksUpdate } from './commands/hooks.js';
@@ -38,7 +38,7 @@ const program = new Command();
 program
     .name('haystack')
     .description('Haystack CLI — automated PR review, triage, and merge queue')
-    .version('0.13.0');
+    .version('0.13.1');
 program
     .command('init')
     .description('Create .haystack.json configuration')
@@ -78,15 +78,31 @@ program
     .action(statusCommand);
 program
     .command('login')
-    .description('Authenticate with GitHub')
+    .description('Add or refresh a saved GitHub account')
     .action(loginCommand);
 program
-    .command('logout')
-    .description('Remove stored credentials')
+    .command('logout [login]')
+    .description('Remove a saved GitHub account (defaults to the active account)')
     .action(logoutCommand);
+program
+    .command('whoami')
+    .description('Show the active Haystack GitHub account')
+    .action(whoamiCommand);
+const authProgram = program
+    .command('auth')
+    .description('Manage saved Haystack GitHub accounts');
+authProgram
+    .command('list')
+    .description('List saved Haystack GitHub accounts')
+    .action(authListCommand);
+authProgram
+    .command('use <login>')
+    .description('Set the active Haystack GitHub account')
+    .action(authUseCommand);
 program
     .command('submit')
     .description('Create a PR from current changes')
+    .option('--account <login>', 'Saved Haystack account login to use for GitHub API calls')
     .option('--title <title>', 'PR title (default: last commit message)')
     .option('--body <body>', 'PR body (default: commit messages since base)')
     .option('--body-file <path>', 'Read PR body from file (use "-" for stdin)')
@@ -164,6 +180,7 @@ Examples:
   haystack submit --draft              # Create as draft PR
   haystack submit --review             # ⚠ Blocks auto-merge, needs human approval
   haystack submit --review octocat     # ⚠ Blocks auto-merge, requests review from octocat
+  haystack submit --account octocat    # Use a specific saved Haystack account for this submit
   haystack submit --max-turns 12       # Raise triage turn cap to 12 per checker
   haystack submit --triage-timeout 300 # Raise triage wall-clock to 5 minutes
 `)

package/dist/utils/auth.d.ts ADDED Viewed

@@ -0,0 +1,50 @@
+export interface StoredAccount {
+    github_token: string;
+    created_at: string;
+}
+export interface CredentialsStore {
+    version: 2;
+    activeLogin: string | null;
+    accounts: Record<string, StoredAccount>;
+    repoDefaults: Record<string, string>;
+}
+export interface GitHubUser {
+    login: string;
+    id: number;
+}
+export type VerifyGitHubTokenResult = {
+    status: 'ok';
+    user: GitHubUser;
+} | {
+    status: 'invalid';
+} | {
+    status: 'error';
+    message: string;
+};
+export interface ResolveAuthOptions {
+    preferredLogin?: string;
+    owner?: string;
+    repo?: string;
+}
+export interface ResolvedAuthContext {
+    login: string;
+    token: string;
+    source: 'preferred' | 'repo-default' | 'active';
+}
+export interface AccountSummary {
+    login: string;
+    createdAt: string;
+    isActive: boolean;
+    repoDefaultCount: number;
+}
+export declare function verifyGitHubToken(token: string): Promise<VerifyGitHubTokenResult>;
+export declare function loadCredentialsStore(): Promise<CredentialsStore>;
+export declare function saveAuthenticatedToken(token: string): Promise<GitHubUser>;
+export declare function listStoredAccounts(): Promise<AccountSummary[]>;
+export declare function setActiveAccount(login: string): Promise<void>;
+export declare function removeAccount(login?: string): Promise<string | null>;
+export declare function getActiveLogin(): Promise<string | null>;
+export declare function getRepoDefaultAccount(owner: string, repo: string): Promise<string | null>;
+export declare function setRepoDefaultAccount(owner: string, repo: string, login: string): Promise<void>;
+export declare function resolveAuthContext(options?: ResolveAuthOptions): Promise<ResolvedAuthContext>;
+export declare function loadToken(options?: ResolveAuthOptions): Promise<string | null>;

package/dist/utils/auth.js ADDED Viewed

@@ -0,0 +1,386 @@
+import * as fs from 'fs/promises';
+import * as os from 'os';
+import * as path from 'path';
+const CONFIG_DIR = path.join(os.homedir(), '.haystack');
+const TOKEN_FILE = path.join(CONFIG_DIR, 'credentials.json');
+const TOKEN_FILE_DISPLAY = '~/.haystack/credentials.json';
+const GITHUB_LOGIN_PATTERN = /^[A-Za-z\d](?:[A-Za-z\d]|-(?=[A-Za-z\d])){0,38}$/;
+function emptyStore() {
+    return {
+        version: 2,
+        activeLogin: null,
+        accounts: {},
+        repoDefaults: {},
+    };
+}
+function isLegacyCredentials(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    const keys = Object.keys(candidate);
+    return keys.length === 2
+        && keys.includes('github_token')
+        && keys.includes('created_at')
+        && typeof candidate.github_token === 'string'
+        && typeof candidate.created_at === 'string';
+}
+function hasAmbiguousLegacyCredentialsShape(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    const hasLegacyFields = 'github_token' in candidate || 'created_at' in candidate;
+    const hasV2Fields = 'version' in candidate
+        || 'accounts' in candidate
+        || 'activeLogin' in candidate
+        || 'repoDefaults' in candidate;
+    return hasLegacyFields && hasV2Fields;
+}
+function isStoredCredentialsShape(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return 'version' in candidate
+        || 'accounts' in candidate
+        || 'activeLogin' in candidate
+        || 'repoDefaults' in candidate;
+}
+function normalizeGitHubLogin(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.trim();
+    if (!normalized || !GITHUB_LOGIN_PATTERN.test(normalized)) {
+        return null;
+    }
+    return normalized;
+}
+function findStoredLogin(accounts, login) {
+    const normalized = normalizeGitHubLogin(login);
+    if (!normalized)
+        return null;
+    const lookupKey = normalized.toLowerCase();
+    for (const storedLogin of Object.keys(accounts)) {
+        if (storedLogin.toLowerCase() === lookupKey) {
+            return storedLogin;
+        }
+    }
+    return null;
+}
+async function readGitHubErrorMessage(response) {
+    const body = await response.text().catch(() => '');
+    if (!body)
+        return '';
+    try {
+        const parsed = JSON.parse(body);
+        return typeof parsed.message === 'string' ? parsed.message : body;
+    }
+    catch {
+        return body;
+    }
+}
+function isInvalidTokenForbidden(response, message) {
+    const ssoHeader = response.headers.get('x-github-sso');
+    if (ssoHeader && !ssoHeader.startsWith('partial-results')) {
+        return true;
+    }
+    const normalizedMessage = message.toLowerCase();
+    return normalizedMessage.includes('resource protected by organization saml enforcement')
+        || normalizedMessage.includes('single sign-on')
+        || normalizedMessage.includes('must grant your oauth token access')
+        || normalizedMessage.includes('resource not accessible by personal access token');
+}
+function normalizeStore(value) {
+    if (!value || typeof value !== 'object') {
+        return emptyStore();
+    }
+    const raw = value;
+    const accounts = {};
+    if (raw.accounts && typeof raw.accounts === 'object') {
+        for (const [login, account] of Object.entries(raw.accounts)) {
+            const normalizedLogin = normalizeGitHubLogin(login);
+            if (normalizedLogin &&
+                !findStoredLogin(accounts, normalizedLogin) &&
+                account &&
+                typeof account === 'object' &&
+                typeof account.github_token === 'string' &&
+                typeof account.created_at === 'string') {
+                accounts[normalizedLogin] = {
+                    github_token: account.github_token,
+                    created_at: account.created_at,
+                };
+            }
+        }
+    }
+    const accountLogins = Object.keys(accounts);
+    const activeLogin = findStoredLogin(accounts, raw.activeLogin) ?? accountLogins[0] ?? null;
+    const repoDefaults = {};
+    if (raw.repoDefaults && typeof raw.repoDefaults === 'object') {
+        for (const [repoFullName, login] of Object.entries(raw.repoDefaults)) {
+            const storedLogin = findStoredLogin(accounts, login);
+            if (storedLogin) {
+                repoDefaults[repoFullName] = storedLogin;
+            }
+        }
+    }
+    return {
+        version: 2,
+        activeLogin,
+        accounts,
+        repoDefaults,
+    };
+}
+async function ensureConfigDir() {
+    await fs.mkdir(CONFIG_DIR, { recursive: true });
+}
+async function saveStore(store) {
+    const normalized = normalizeStore(store);
+    if (Object.keys(normalized.accounts).length === 0) {
+        await fs.rm(TOKEN_FILE, { force: true });
+        return;
+    }
+    await ensureConfigDir();
+    await fs.writeFile(TOKEN_FILE, JSON.stringify(normalized, null, 2), {
+        mode: 0o600,
+    });
+    await fs.chmod(TOKEN_FILE, 0o600);
+}
+export async function verifyGitHubToken(token) {
+    try {
+        const response = await fetch('https://api.github.com/user', {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'User-Agent': 'Haystack-CLI',
+            },
+        });
+        if (response.status === 401) {
+            return { status: 'invalid' };
+        }
+        if (!response.ok) {
+            const rateLimitRemaining = response.headers.get('x-ratelimit-remaining');
+            if (response.status === 403 && rateLimitRemaining === '0') {
+                return {
+                    status: 'error',
+                    message: 'GitHub API rate limit exceeded while verifying credentials.',
+                };
+            }
+            const message = await readGitHubErrorMessage(response);
+            if (response.status === 403 && isInvalidTokenForbidden(response, message)) {
+                return { status: 'invalid' };
+            }
+            return {
+                status: 'error',
+                message: message
+                    ? `GitHub API returned ${response.status} while verifying credentials: ${message}`
+                    : `GitHub API returned ${response.status} while verifying credentials.`,
+            };
+        }
+        return {
+            status: 'ok',
+            user: await response.json(),
+        };
+    }
+    catch (error) {
+        return {
+            status: 'error',
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+async function migrateLegacyCredentials(legacy) {
+    const verification = await verifyGitHubToken(legacy.github_token);
+    if (verification.status === 'invalid') {
+        const store = emptyStore();
+        await saveStore(store);
+        return store;
+    }
+    if (verification.status === 'error') {
+        throw new Error(`Could not migrate legacy credentials from ${TOKEN_FILE_DISPLAY}: ${verification.message}`);
+    }
+    const user = verification.user;
+    const store = {
+        version: 2,
+        activeLogin: user.login,
+        accounts: {
+            [user.login]: {
+                github_token: legacy.github_token,
+                created_at: legacy.created_at,
+            },
+        },
+        repoDefaults: {},
+    };
+    await saveStore(store);
+    return store;
+}
+export async function loadCredentialsStore() {
+    let content;
+    try {
+        content = await fs.readFile(TOKEN_FILE, 'utf-8');
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return emptyStore();
+        }
+        throw new Error(`Failed to read ${TOKEN_FILE_DISPLAY}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (isLegacyCredentials(parsed)) {
+        return migrateLegacyCredentials(parsed);
+    }
+    if (hasAmbiguousLegacyCredentialsShape(parsed)) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: unsupported mixed legacy/v2 credentials format.`);
+    }
+    if (!isStoredCredentialsShape(parsed)) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: unsupported credentials format.`);
+    }
+    if (parsed.version !== undefined && parsed.version !== 2) {
+        throw new Error(`Failed to parse ${TOKEN_FILE_DISPLAY}: unsupported credentials version ${String(parsed.version)}.`);
+    }
+    return normalizeStore(parsed);
+}
+function repoKey(owner, repo) {
+    if (!owner || !repo)
+        return null;
+    return `${owner}/${repo}`;
+}
+export async function saveAuthenticatedToken(token) {
+    const verification = await verifyGitHubToken(token);
+    if (verification.status === 'invalid') {
+        throw new Error('GitHub token expired or invalid. Run `haystack login` again.');
+    }
+    if (verification.status === 'error') {
+        throw new Error(`Failed to verify token: ${verification.message}`);
+    }
+    const user = verification.user;
+    const store = await loadCredentialsStore();
+    store.accounts[user.login] = {
+        github_token: token,
+        created_at: new Date().toISOString(),
+    };
+    store.activeLogin = user.login;
+    await saveStore(store);
+    return user;
+}
+export async function listStoredAccounts() {
+    const store = await loadCredentialsStore();
+    const repoDefaultCounts = new Map();
+    for (const login of Object.values(store.repoDefaults)) {
+        repoDefaultCounts.set(login, (repoDefaultCounts.get(login) ?? 0) + 1);
+    }
+    return Object.entries(store.accounts)
+        .map(([login, account]) => ({
+        login,
+        createdAt: account.created_at,
+        isActive: store.activeLogin === login,
+        repoDefaultCount: repoDefaultCounts.get(login) ?? 0,
+    }))
+        .sort((a, b) => {
+        if (a.isActive !== b.isActive)
+            return a.isActive ? -1 : 1;
+        return a.login.localeCompare(b.login);
+    });
+}
+export async function setActiveAccount(login) {
+    const store = await loadCredentialsStore();
+    const storedLogin = findStoredLogin(store.accounts, login);
+    if (!storedLogin) {
+        throw new Error(`No saved Haystack account for ${login}.`);
+    }
+    store.activeLogin = storedLogin;
+    await saveStore(store);
+}
+export async function removeAccount(login) {
+    const store = await loadCredentialsStore();
+    const targetLogin = login ? findStoredLogin(store.accounts, login) : store.activeLogin;
+    if (login && !targetLogin) {
+        throw new Error(`No saved Haystack account for ${login}.`);
+    }
+    if (!targetLogin || !store.accounts[targetLogin]) {
+        return null;
+    }
+    delete store.accounts[targetLogin];
+    for (const [repoFullName, mappedLogin] of Object.entries(store.repoDefaults)) {
+        if (mappedLogin === targetLogin) {
+            delete store.repoDefaults[repoFullName];
+        }
+    }
+    if (store.activeLogin === targetLogin) {
+        store.activeLogin = Object.keys(store.accounts)[0] ?? null;
+    }
+    await saveStore(store);
+    return targetLogin;
+}
+export async function getActiveLogin() {
+    const store = await loadCredentialsStore();
+    return store.activeLogin;
+}
+export async function getRepoDefaultAccount(owner, repo) {
+    const store = await loadCredentialsStore();
+    const key = repoKey(owner, repo);
+    if (!key)
+        return null;
+    return store.repoDefaults[key] ?? null;
+}
+export async function setRepoDefaultAccount(owner, repo, login) {
+    const store = await loadCredentialsStore();
+    const storedLogin = findStoredLogin(store.accounts, login);
+    if (!storedLogin) {
+        throw new Error(`No saved Haystack account for ${login}.`);
+    }
+    const key = repoKey(owner, repo);
+    if (!key)
+        return;
+    store.repoDefaults[key] = storedLogin;
+    await saveStore(store);
+}
+export async function resolveAuthContext(options = {}) {
+    const store = await loadCredentialsStore();
+    const { preferredLogin, owner, repo } = options;
+    if (preferredLogin) {
+        const storedLogin = findStoredLogin(store.accounts, preferredLogin);
+        if (!storedLogin) {
+            throw new Error(`No saved Haystack account for ${preferredLogin}. Run \`haystack login\` to add it or \`haystack auth list\` to inspect saved accounts.`);
+        }
+        const account = store.accounts[storedLogin];
+        return {
+            login: storedLogin,
+            token: account.github_token,
+            source: 'preferred',
+        };
+    }
+    const repoFullName = repoKey(owner, repo);
+    if (repoFullName) {
+        const repoLogin = store.repoDefaults[repoFullName];
+        if (repoLogin && store.accounts[repoLogin]) {
+            return {
+                login: repoLogin,
+                token: store.accounts[repoLogin].github_token,
+                source: 'repo-default',
+            };
+        }
+    }
+    if (store.activeLogin && store.accounts[store.activeLogin]) {
+        return {
+            login: store.activeLogin,
+            token: store.accounts[store.activeLogin].github_token,
+            source: 'active',
+        };
+    }
+    throw new Error('Not logged in. Run `haystack login` first.');
+}
+export async function loadToken(options = {}) {
+    try {
+        const context = await resolveAuthContext(options);
+        return context.token;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('Not logged in.')) {
+            return null;
+        }
+        throw error;
+    }
+}

package/dist/utils/github-api.d.ts CHANGED Viewed

@@ -11,6 +11,7 @@ export interface CreatePROptions {
     base: string;
     body?: string;
     draft?: boolean;
+    token?: string;
 }
 export interface PRResponse {
     number: number;
@@ -29,11 +30,33 @@ export interface LabelInfo {
     color: string;
     description?: string;
 }
+export interface GitHubUser {
+    login: string;
+    id: number;
+}
+export interface RepositoryPermissions {
+    admin?: boolean;
+    maintain?: boolean;
+    push?: boolean;
+    triage?: boolean;
+    pull?: boolean;
+}
+export interface RepositoryAccess {
+    full_name: string;
+    owner: {
+        login: string;
+    };
+    permissions?: RepositoryPermissions;
+}
 export declare const HAYSTACK_LABELS: Record<string, LabelInfo>;
 /**
- * Get stored GitHub token, throw if not authenticated
+ * Get a GitHub token, throw if not authenticated
  */
-export declare function requireGitHubAuth(): Promise<string>;
+export declare function requireGitHubAuth(options?: {
+    preferredLogin?: string;
+    owner?: string;
+    repo?: string;
+}): Promise<string>;
 /**
  * Create a pull request
  */
@@ -41,43 +64,41 @@ export declare function createPullRequest(options: CreatePROptions): Promise<PRR
 /**
  * Check if a PR already exists for a branch
  */
-export declare function findExistingPR(owner: string, repo: string, head: string): Promise<PRResponse | null>;
+export declare function findExistingPR(owner: string, repo: string, head: string, token?: string): Promise<PRResponse | null>;
 /**
  * Add labels to an issue/PR
  */
-export declare function addLabelsToIssue(owner: string, repo: string, issueNumber: number, labels: string[]): Promise<void>;
+export declare function addLabelsToIssue(owner: string, repo: string, issueNumber: number, labels: string[], token?: string): Promise<void>;
 /**
  * Get all labels from an issue/PR
  */
-export declare function getLabelsFromIssue(owner: string, repo: string, issueNumber: number): Promise<string[]>;
+export declare function getLabelsFromIssue(owner: string, repo: string, issueNumber: number, token?: string): Promise<string[]>;
 /**
  * Remove a label from an issue/PR
  */
-export declare function removeLabelFromIssue(owner: string, repo: string, issueNumber: number, labelName: string): Promise<void>;
+export declare function removeLabelFromIssue(owner: string, repo: string, issueNumber: number, labelName: string, token?: string): Promise<void>;
 /**
  * Check if a label exists in the repo
  */
-export declare function labelExists(owner: string, repo: string, labelName: string): Promise<boolean>;
+export declare function labelExists(owner: string, repo: string, labelName: string, token?: string): Promise<boolean>;
 /**
  * Create a label in the repo
  */
-export declare function createLabel(owner: string, repo: string, label: LabelInfo): Promise<void>;
+export declare function createLabel(owner: string, repo: string, label: LabelInfo, token?: string): Promise<void>;
 /**
  * Ensure all required Haystack labels exist in the repo
  */
-export declare function ensureHaystackLabels(owner: string, repo: string, labelNames: string[]): Promise<void>;
+export declare function ensureHaystackLabels(owner: string, repo: string, labelNames: string[], token?: string): Promise<void>;
 /**
  * Request reviewers on a pull request
  */
-export declare function requestReviewers(owner: string, repo: string, prNumber: number, reviewers: string[]): Promise<void>;
+export declare function requestReviewers(owner: string, repo: string, prNumber: number, reviewers: string[], token?: string): Promise<void>;
 /**
  * Get the authenticated user's info
  */
-export declare function getCurrentUser(): Promise<{
-    login: string;
-    id: number;
-}>;
+export declare function getCurrentUser(token?: string): Promise<GitHubUser>;
+export declare function getRepositoryAccess(owner: string, repo: string, token?: string): Promise<RepositoryAccess>;
 /**
  * Check if user has push access to a repo
  */
-export declare function hasPushAccess(owner: string, repo: string): Promise<boolean>;
+export declare function hasPushAccess(owner: string, repo: string, token?: string): Promise<boolean>;