@haystackeditor/cli 0.13.2 → 0.13.4

package/dist/assets/skills/submit.md

@@ -85,6 +85,23 @@ Use `--auto-fix` only for issues like:
 haystack submit --auto-fix
 ```
 
+Repos that want auto-fix on by default for every `haystack submit` can opt
+in via `.haystack.json`:
+
+```json
+{
+  "preferences": {
+    "auto_fix": true
+  }
+}
+```
+
+When set, `haystack submit` applies the `haystack:auto-fix` label without
+needing the explicit flag. Auto-fix is still alpha — use the repo-level
+opt-in only when the team is comfortable with the sandbox fixer running on
+mechanical findings. `haystack submit --no-auto-fix` overrides the repo
+default for a single submission.
+
 ### Review Mode
 
 > **Do NOT use `--review` unless the user explicitly asks for human review.**

package/dist/commands/config.d.ts

@@ -21,5 +21,17 @@ export declare function getAutoMergeStatus(): Promise<void>;
 export declare function enableAutoMerge(): Promise<void>;
 export declare function disableAutoMerge(): Promise<void>;
 export declare function handleAutoMerge(action?: string): Promise<void>;
+/**
+ * Check if auto-fix is enabled for the current repo.
+ * Returns false if .haystack.json is missing or on error.
+ *
+ * Mirrors isAutoMergeEnabled() — direct file read so missing config returns
+ * false instead of process.exit(1).
+ */
+export declare function isAutoFixEnabled(): Promise<boolean>;
+export declare function getAutoFixStatus(): Promise<void>;
+export declare function enableAutoFix(): Promise<void>;
+export declare function disableAutoFix(): Promise<void>;
+export declare function handleAutoFix(action?: string): Promise<void>;
 export declare function handleWaitForReviewers(action?: string, reviewers?: string[]): Promise<void>;
 export {};

package/dist/commands/config.js

@@ -11,6 +11,10 @@ import { execSync } from 'child_process';
 import { resolveAuthContext } from '../utils/auth.js';
 import { AI_REVIEWER_SOURCES, AI_REVIEWER_DISPLAY_NAMES, AI_REVIEWER_BOT_USERNAMES } from '../types.js';
 const API_BASE = 'https://haystackeditor.com/api/preferences';
+const REPO_PREFERENCE_DEFAULTS = {
+    auto_merge: false,
+    auto_fix: false,
+};
 const AGENTIC_TOOL_LABELS = {
     'opencode': 'OpenCode (Haystack billing)',
     'claude-code': 'Claude Code (your Claude Max subscription)',
@@ -49,8 +53,7 @@ function saveHaystackConfig(config, configPath) {
 }
 function getPreference(key) {
     const { config } = loadHaystackConfig();
-    const defaults = { auto_merge: false };
-    return config.preferences?.[key] ?? defaults[key];
+    return config.preferences?.[key] ?? REPO_PREFERENCE_DEFAULTS[key];
 }
 function setPreference(key, value) {
     const { config, path } = loadHaystackConfig();
@@ -165,6 +168,19 @@ export async function handleAgenticTool(tool) {
 // ============================================================================
 // Auto-merge (repo-level via .haystack.json)
 // ============================================================================
+/**
+ * Surface unexpected errors when reading repo-level preferences while keeping
+ * the silent fallback for the expected "no .haystack.json" case. ENOENT means
+ * the user simply hasn't opted in; everything else (parse errors, permission
+ * denied, not-a-git-repo) is a config problem the user should see — silently
+ * defaulting to disabled would otherwise hide the misconfiguration.
+ */
+function logPreferenceLookupFailure(preference, err) {
+    if (err?.code === 'ENOENT')
+        return;
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(chalk.dim(`[haystack] Could not resolve ${preference} preference (${message}); defaulting to disabled.`));
+}
 /**
  * Check if auto-merge is enabled for the current repo.
  * Returns false if .haystack.json is missing or on error.
@@ -180,7 +196,8 @@ export async function isAutoMergeEnabled() {
         const config = JSON.parse(raw);
         return config.preferences?.auto_merge ?? false;
     }
-    catch {
+    catch (err) {
+        logPreferenceLookupFailure('auto_merge', err);
         return false;
     }
 }
@@ -235,6 +252,82 @@ export async function handleAutoMerge(action) {
     }
 }
 // ============================================================================
+// Auto-fix (repo-level via .haystack.json) — alpha
+// ============================================================================
+/**
+ * Check if auto-fix is enabled for the current repo.
+ * Returns false if .haystack.json is missing or on error.
+ *
+ * Mirrors isAutoMergeEnabled() — direct file read so missing config returns
+ * false instead of process.exit(1).
+ */
+export async function isAutoFixEnabled() {
+    try {
+        const root = execSync('git rev-parse --show-toplevel', { encoding: 'utf-8' }).trim();
+        const raw = readFileSync(resolve(root, '.haystack.json'), 'utf-8');
+        const config = JSON.parse(raw);
+        return config.preferences?.auto_fix ?? false;
+    }
+    catch (err) {
+        logPreferenceLookupFailure('auto_fix', err);
+        return false;
+    }
+}
+export async function getAutoFixStatus() {
+    const enabled = getPreference('auto_fix');
+    console.log(chalk.bold('\nAuto-fix (alpha):'), enabled
+        ? chalk.green('enabled')
+        : chalk.yellow('disabled'));
+    console.log();
+    if (enabled) {
+        console.log(chalk.dim('PRs submitted via `haystack submit` will be labeled'));
+        console.log(chalk.dim('haystack:auto-fix. Analysis will dispatch the alpha'));
+        console.log(chalk.dim('sandbox fixer for straightforward mechanical issues.'));
+    }
+    else {
+        console.log(chalk.dim('Auto-fix is disabled. Issues surface in the Feed for review.'));
+        console.log(chalk.dim('Enable with: haystack config auto-fix on'));
+    }
+    console.log(chalk.yellow('⚠ Auto-fix is alpha. Expect rough edges.'));
+    console.log(chalk.dim('(Stored in .haystack.json — applies to all repo contributors)'));
+    console.log();
+}
+export async function enableAutoFix() {
+    setPreference('auto_fix', true);
+    console.log(chalk.green('\nAuto-fix (alpha) enabled.\n'));
+    console.log(chalk.dim('PRs submitted via `haystack submit` will be labeled'));
+    console.log(chalk.dim('haystack:auto-fix. The sandbox fixer will attempt'));
+    console.log(chalk.dim('straightforward mechanical fixes before issues hit the Feed.'));
+    console.log(chalk.yellow('⚠ Auto-fix is alpha. Expect rough edges.'));
+    console.log(chalk.dim('Commit .haystack.json to share with your team.\n'));
+}
+export async function disableAutoFix() {
+    setPreference('auto_fix', false);
+    console.log(chalk.yellow('\nAuto-fix disabled.\n'));
+    console.log(chalk.dim('Issues will surface in the Feed for human review.'));
+    console.log(chalk.dim('Re-enable with: haystack config auto-fix on'));
+    console.log(chalk.dim('Commit .haystack.json to share with your team.\n'));
+}
+export async function handleAutoFix(action) {
+    switch (action?.toLowerCase()) {
+        case 'on':
+        case 'enable':
+        case 'true':
+            return enableAutoFix();
+        case 'off':
+        case 'disable':
+        case 'false':
+            return disableAutoFix();
+        case 'status':
+        case undefined:
+            return getAutoFixStatus();
+        default:
+            console.error(chalk.red(`\nUnknown action: ${action}`));
+            console.log('\nUsage: haystack config auto-fix [on|off|status]\n');
+            process.exit(1);
+    }
+}
+// ============================================================================
 // Wait-for-reviewers (repo-level via .haystack.json)
 // ============================================================================
 /** Reverse map: bot username → friendly source name */

package/dist/commands/submit.js

@@ -367,11 +367,7 @@ export async function submitCommand(options) {
         process.exit(1);
     }
     try {
-        pushBranch('origin', currentBranch, {
-            token: githubToken,
-            owner: remoteInfo.owner,
-            repo: remoteInfo.repo,
-        });
+        pushBranch('origin', currentBranch, { token: githubToken });
         console.log(chalk.green('✓ Branch pushed'));
     }
     catch (err) {

package/dist/index.js

@@ -23,7 +23,7 @@ import { Command } from 'commander';
 import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
 import { authListCommand, authUseCommand, loginCommand, logoutCommand, whoamiCommand, } from './commands/login.js';
-import { handleAgenticTool, handleAutoMerge, handleWaitForReviewers, isAutoMergeEnabled } from './commands/config.js';
+import { handleAgenticTool, handleAutoMerge, handleAutoFix, handleWaitForReviewers, isAutoMergeEnabled, isAutoFixEnabled } from './commands/config.js';
 import { installSkills, listSkills } from './commands/skills.js';
 import { hooksInstall, hooksStatus, hooksUpdate } from './commands/hooks.js';
 import { submitCommand } from './commands/submit.js';
@@ -38,7 +38,7 @@ const program = new Command();
 program
     .name('haystack')
     .description('Haystack CLI — automated PR review, triage, and merge queue')
-    .version('0.13.2');
+    .version('0.13.4');
 program
     .command('init')
     .description('Create .haystack.json configuration')
@@ -110,7 +110,7 @@ program
     .option('--draft', 'Create as draft PR')
     .option('--review [reviewer]', 'Request human review (BLOCKS auto-merge — only use when explicitly asked)')
     .option('--force', 'Skip pre-PR triage checks')
-    .option('--auto-fix', 'Alpha auto-fix for straightforward mechanical issues (discouraged)')
+    .option('--auto-fix', 'Alpha auto-fix for straightforward mechanical issues (default: from .haystack.json preferences.auto_fix; --no-auto-fix to disable)')
     .option('--auto-merge', 'Apply auto-merge label (default: from .haystack.json, --no-auto-merge to disable)')
     .option('--no-wait', 'Skip waiting for analysis results')
     .option('--max-turns <n>', 'Max agentic turns per triage checker (overrides .haystack.json triage.maxTurns)', (v) => parseInt(v, 10))
@@ -189,6 +189,12 @@ Examples:
     if (options.autoMerge === undefined) {
         options.autoMerge = await isAutoMergeEnabled();
     }
+    // Resolve --auto-fix default from .haystack.json (preferences.auto_fix).
+    // Auto-fix remains alpha — the explicit --auto-fix flag still surfaces
+    // discouragement warnings; opting in via repo config is the supported path.
+    if (options.autoFix === undefined) {
+        options.autoFix = await isAutoFixEnabled();
+    }
     return submitCommand(options);
 });
 program
@@ -373,6 +379,27 @@ Examples:
   haystack config auto-merge off     # Disable auto-merge
 `)
     .action(handleAutoMerge);
+config
+    .command('auto-fix [action]')
+    .description('(Alpha) Auto-fix mechanical issues on PRs submitted via haystack submit (on|off|status)')
+    .addHelpText('after', `
+Actions:
+  on, enable    Enable auto-fix for mechanical issues
+  off, disable  Disable auto-fix
+  status        Show current status (default)
+
+⚠ Auto-fix is alpha. When enabled, PRs submitted via \`haystack submit\`
+are labeled haystack:auto-fix. The Haystack analysis pipeline then
+dispatches the sandbox fixer for issues classified as straightforward
+and mechanical. Judgment calls, policy violations, and weak coverage
+findings still surface in the Feed for human review.
+
+Examples:
+  haystack config auto-fix           # Show current status
+  haystack config auto-fix on        # Enable auto-fix (alpha)
+  haystack config auto-fix off       # Disable auto-fix
+`)
+    .action(handleAutoFix);
 config
     .command('wait-for-reviewers [action] [reviewers...]')
     .description('Configure which AI reviewers the merge queue waits for')

package/dist/utils/git.d.ts

@@ -54,17 +54,16 @@ export declare function remoteBranchExists(remoteName: string, branchName: strin
 export declare function checkoutBranch(branchName: string): void;
 export interface PushAuth {
     token: string;
-    owner: string;
-    repo: string;
 }
 /**
  * Push current branch to remote with upstream tracking.
  *
  * When `auth` is provided, the push is authenticated with the given GitHub
- * token via GIT_ASKPASS against `https://github.com/{owner}/{repo}.git` —
- * independent of the user's ambient git credential helper. Upstream tracking
- * is then set against the original `remoteName` so the token URL never lands
- * in `.git/config`.
+ * token via GIT_ASKPASS against an explicit HTTPS URL, independent of the
+ * user's ambient git credential helper and independent of whatever
+ * `remote.<name>.url` / `pushurl` they have configured. Remote-tracking
+ * refs are then seeded locally so upstream tracking (`-u`-style) works on
+ * first push. `.git/config` is never touched.
  *
  * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */

package/dist/utils/git.js

@@ -166,16 +166,17 @@ export function checkoutBranch(branchName) {
  * Push current branch to remote with upstream tracking.
  *
  * When `auth` is provided, the push is authenticated with the given GitHub
- * token via GIT_ASKPASS against `https://github.com/{owner}/{repo}.git` —
- * independent of the user's ambient git credential helper. Upstream tracking
- * is then set against the original `remoteName` so the token URL never lands
- * in `.git/config`.
+ * token via GIT_ASKPASS against an explicit HTTPS URL, independent of the
+ * user's ambient git credential helper and independent of whatever
+ * `remote.<name>.url` / `pushurl` they have configured. Remote-tracking
+ * refs are then seeded locally so upstream tracking (`-u`-style) works on
+ * first push. `.git/config` is never touched.
  *
  * Without `auth`, falls back to `git push -u <remote>` using ambient creds.
  */
 export function pushBranch(remoteName, branchName, auth) {
     if (auth) {
-        pushBranchWithToken(remoteName, branchName, auth);
+        pushBranchWithToken(remoteName, branchName, auth.token);
         return;
     }
     try {
@@ -188,28 +189,37 @@ export function pushBranch(remoteName, branchName, auth) {
         throw translatePushError(err);
     }
 }
-function pushBranchWithToken(remoteName, branchName, auth) {
+function pushBranchWithToken(remoteName, branchName, token) {
+    // Derive owner/repo from the remote itself so the push URL always matches
+    // the tracking ref we'll seed below. No way for caller and remote identity
+    // to silently disagree.
+    const { owner, repo } = parseRemoteUrl(remoteName);
+    const pushUrl = `https://github.com/${owner}/${repo}.git`;
+    const repoSlug = `${owner}/${repo}`;
     const askpassPath = path.join(os.tmpdir(), `haystack-askpass-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.sh`);
     // Script reads token from env at call time — keeps it out of the script contents and argv.
     const script = `#!/bin/sh\ncase "$1" in\n  Username*) printf '%s' "x-access-token" ;;\n  *) printf '%s' "$HAYSTACK_GIT_TOKEN" ;;\nesac\n`;
     fs.writeFileSync(askpassPath, script, { mode: 0o700 });
+    const authedEnv = {
+        ...process.env,
+        GIT_ASKPASS: askpassPath,
+        GIT_TERMINAL_PROMPT: '0',
+        HAYSTACK_GIT_TOKEN: token,
+    };
     try {
-        const pushUrl = `https://github.com/${auth.owner}/${auth.repo}.git`;
-        execSync(`git push "${pushUrl}" "HEAD:refs/heads/${branchName}"`, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-            env: {
-                ...process.env,
-                GIT_ASKPASS: askpassPath,
-                GIT_TERMINAL_PROMPT: '0',
-                HAYSTACK_GIT_TOKEN: auth.token,
-            },
-        });
+        // Push to an explicit HTTPS URL with GIT_ASKPASS, bypassing ambient
+        // credential helpers entirely. Using a raw URL (not the named remote)
+        // means the user's configured url/pushurl/credential-helper settings
+        // are untouched — sidesteps precedence and multi-value edge cases
+        // around `remote.<name>.url` vs `remote.<name>.pushurl`.
+        execSync(`git -c credential.helper= push "${pushUrl}" "HEAD:refs/heads/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+        // Pushing to a raw URL doesn't update refs/remotes/<name>/<branch>. Seed
+        // it from the server's authoritative state with a targeted fetch — this
+        // reflects any server-side rewrite or hook side effects, not a fabricated
+        // pre-push SHA. Then set upstream tracking to the named remote.
         try {
-            execSync(`git branch --set-upstream-to=${remoteName}/${branchName} "${branchName}"`, {
-                encoding: 'utf-8',
-                stdio: ['pipe', 'pipe', 'pipe'],
-            });
+            execSync(`git -c credential.helper= fetch "${pushUrl}" "refs/heads/${branchName}:refs/remotes/${remoteName}/${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], env: authedEnv });
+            execSync(`git branch --set-upstream-to=${remoteName}/${branchName} "${branchName}"`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
         }
         catch (err) {
             // Non-fatal: push succeeded; upstream tracking is a convenience.
@@ -218,7 +228,7 @@ function pushBranchWithToken(remoteName, branchName, auth) {
         }
     }
     catch (err) {
-        throw translatePushError(err, auth);
+        throw translatePushError(err, repoSlug);
     }
     finally {
         try {
@@ -231,11 +241,11 @@ function pushBranchWithToken(remoteName, branchName, auth) {
         }
     }
 }
-function translatePushError(err, auth) {
+function translatePushError(err, repoSlug) {
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes('permission denied') || message.includes('403')) {
-        if (auth) {
-            return new Error(`Permission denied pushing to ${auth.owner}/${auth.repo}. The Haystack account token lacks write access to this repo — run \`haystack auth list\` and pick an account that's a collaborator.`);
+        if (repoSlug) {
+            return new Error(`Permission denied pushing to ${repoSlug}. The Haystack account token lacks write access to this repo — run \`haystack auth list\` and pick an account that's a collaborator.`);
         }
         return new Error('Permission denied. Check your GitHub credentials.');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {