@haystackeditor/cli 0.14.4 → 0.14.6

package/dist/commands/setup.js

@@ -356,8 +356,17 @@ class GitHubWriteError extends Error {
  *  the file, and surfaces a real error if the write itself fails. */
 async function fetchFileSha(owner, repo, path, token) {
     const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/contents/${path}`, { headers: ghHeaders(token) });
-    if (!res.ok)
+    if (!res.ok) {
+        if (res.status !== 404) {
+            trackError('haystack_setup_fetch_file_sha_failed', {
+                owner,
+                repo,
+                path,
+                status: res.status,
+            });
+        }
         return null;
+    }
     const data = (await res.json());
     return data.sha ?? null;
 }
@@ -463,9 +472,11 @@ async function writeOnboardingFilesToRepo(owner, repo, files, autoMergeEnabled,
     for (const f of files) {
         shaByPath.set(f.path, await fetchFileSha(owner, repo, f.path, token));
     }
+    let successfulWrites = 0;
     try {
         for (const f of files) {
             await putFile(owner, repo, f.path, f.content, f.message, shaByPath.get(f.path) ?? null, token);
+            successfulWrites++;
         }
         return {};
     }
@@ -475,6 +486,9 @@ async function writeOnboardingFilesToRepo(owner, repo, files, autoMergeEnabled,
         const status = err instanceof GitHubWriteError ? err.status : 0;
         if (status !== 409 && status !== 422)
             throw err;
+        if (successfulWrites > 0) {
+            throw err;
+        }
         // Probe GitHub's *structured* protection signals to decide: protection
         // (→ PR fallback) vs. a genuine bad request / sha conflict (→ surface the
         // error). This replaces brittle error-message substring matching.
@@ -514,6 +528,8 @@ async function runUnifiedScan(repo, token) {
     if (!runId)
         throw new Error('Scan kickoff returned no runId');
     let lastProgressKey = '';
+    let loggedPollFetchError = false;
+    let loggedPollStatusError = false;
     // eslint-disable-next-line no-constant-condition
     while (true) {
         await new Promise((resolve) => setTimeout(resolve, SCAN_POLL_INTERVAL_MS));
@@ -523,14 +539,14 @@ async function runUnifiedScan(repo, token) {
         }
         catch (err) {
             // Transient network blip — the KV state is authoritative and won't vanish
-            // from one failed poll, so keep going. Record it (non-disruptive, no
-            // terminal noise) so a persistently-failing poll isn't invisible
-            // (PR001: no silent failure).
-            trackError('onboarding_scan_poll_network_error', {
-                repo,
-                run_id: runId,
-                error_message: err instanceof Error ? err.message : String(err),
-            });
+            // from one failed poll, so keep going.
+            if (!loggedPollFetchError) {
+                loggedPollFetchError = true;
+                trackError('haystack_setup_scan_status_poll_fetch_error', {
+                    repo,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
             continue;
         }
         if (statusResp.status === 404) {
@@ -540,6 +556,13 @@ async function runUnifiedScan(repo, token) {
         }
         if (!statusResp.ok) {
             // Transient (5xx etc.) — back off and retry on the next tick.
+            if (!loggedPollStatusError) {
+                loggedPollStatusError = true;
+                trackError('haystack_setup_scan_status_poll_non_ok', {
+                    repo,
+                    status: statusResp.status,
+                });
+            }
             continue;
         }
         const state = (await statusResp.json());
@@ -618,26 +641,33 @@ class InstallationsAuthError extends Error {
     }
 }
 async function fetchHaystackInstallations(token) {
-    // /user/installations lists App installations the OAuth-authenticated user
-    // can manage. Returns 200 with `installations: []` when none exist.
-    const res = await fetch(`${GITHUB_API}/user/installations?per_page=100`, {
+    // Detect the Haystack App via the auth-worker, NOT GitHub's
+    // `GET /user/installations`. That GitHub endpoint requires a GitHub App
+    // user-to-server token; the CLI's `haystack login` token is a classic OAuth
+    // token, so GitHub answers 403 ("must authenticate with an access token
+    // authorized to a GitHub App") — which made step 0 falsely report the App as
+    // uninstalled and exit. The auth-worker resolves installations server-side
+    // with the App's own JWT, so it works with the CLI's token. Every entry it
+    // returns IS a Haystack installation (the worker only knows about this App),
+    // so there's no app_slug to filter on.
+    const res = await fetch(`${HAYSTACK_API}/api/github/user-installations`, {
         headers: {
             Authorization: `Bearer ${token}`,
-            Accept: 'application/vnd.github.v3+json',
+            Accept: 'application/json',
             'User-Agent': 'Haystack-CLI',
         },
     });
     if (!res.ok) {
-        // 401/403 are auth-bucket failures — token revoked, expired, or missing
-        // the right scopes. Retrying never recovers; bail with a distinct error
-        // type so the poll loop can short-circuit and prompt re-auth.
+        // 401/403 here are genuine auth failures (the token the worker validates is
+        // bad), unlike the GitHub endpoint's spurious 403. Retrying won't recover;
+        // bail with a distinct error type so the poll loop can prompt re-auth.
         if (res.status === 401 || res.status === 403) {
             throw new InstallationsAuthError(res.status, `${res.status} ${await res.text()}`);
         }
         throw new Error(`failed to fetch installations: ${res.status} ${await res.text()}`);
     }
     const data = (await res.json());
-    return (data.installations ?? []).filter((i) => i.app_slug === HAYSTACK_APP_SLUG);
+    return data.installations ?? [];
 }
 function tryOpenBrowser(url) {
     // Best-effort browser open. Never blocks setup — the URL is also printed.

package/dist/triage/prompts.js

@@ -45,7 +45,7 @@ const INTENT_DRIFT_SCHEMA = `{
       "line": 42,
       "severity": "error | warning | info",
       "message": "Description of the drift or incomplete fulfillment",
-      "pattern": "intent_drift | incomplete_fulfillment | scope_creep"
+      "pattern": "intent_drift | incomplete_fulfillment | scope_creep | unspecified_decision | ignored_correction | weakened_posture | claimed_but_not_done"
     }
   ],
   "summary": "Brief 1-sentence summary",
@@ -286,6 +286,36 @@ The agent added functionality the user never asked for:
 - User asks for one feature → agent bundles in extra features "while we're at it"
 - Any new mechanism not traceable to a user instruction
 
+### Unspecified Decision
+The user authorized the task's GOAL, but the agent made a specific decision in HOW it carried it out that shapes the program's end output, externally observable behavior, or the data end-users/callers see — and the user never specified or approved that particular decision, and a reasonable user would plausibly want a say in it. Examples (general — do NOT pattern-match on specific keywords):
+- Silently dropping, capping, sampling, or transforming data that flows to the output
+- Picking a default that determines what end-users see
+- Resolving an ambiguous requirement one way when other materially different behaviors were equally valid
+- Choosing a fixed value where the choice changes results
+Do NOT flag internal implementation choices with no observable effect (naming, file layout, helper structure), decisions forced by correctness, or cosmetic defaults a user would not care about. When unsure whether a user would care, do not flag it — reserve this for decisions with real, user-visible ramifications. The difference from scope creep: scope creep is an unrequested *flow*; an unspecified decision is an unrequested, output-shaping choice *inside a requested flow*.
+
+### Ignored Correction
+The user gave an explicit correction or redirection and the final code does NOT honor it:
+- User said "don't use a global / use X instead / that's racy, do Y" and the agent shipped the thing it was told not to
+- Agent applied the correction, then quietly reverted it in a later step
+- A general later "looks good" does NOT cancel a specific earlier correction
+This is high severity by default: the user actively steered and was overridden.
+
+### Weakened Posture
+In service of an authorized goal, the agent relaxed or removed a security, safety, or correctness guard the user never asked to weaken:
+- Loosened an auth/permission/validation check, or broadened access (CORS, scopes)
+- Swallowed or silenced an error, removed an assertion/guard, hardcoded a bypass or credential
+- Disabled a test (.skip / xit), suppressed a type or lint check (any, @ts-ignore, disable comments)
+- Lowered a threshold/timeout that existed as a safeguard
+High severity by default. (If the user explicitly asked to remove the guard, it is not a finding.)
+
+### Claimed But Not Done
+The agent told the user it completed work that the diff does not actually contain, or contains only in a materially weaker form:
+- "I added error handling for timeouts" but no timeout handling exists in the diff
+- "Added tests for the edge case" but no test assertions exercise it
+- "Made the limit configurable" but the value is still hardcoded
+Compare each concrete claim the agent made to the user against what the diff actually shows. Only flag when the diff clearly contradicts or fails to support the claim; when unsure, do not flag.
+
 ## Red flags to search for in the diff
 
 - Fixed/hardcoded values where dynamic behavior was requested
@@ -293,6 +323,7 @@ The agent added functionality the user never asked for:
 - Empty function bodies or early returns
 - Interface fields that are declared but never assigned anywhere
 - New mechanisms (cooldowns, retries, caches, rate limits) not requested by the user
+- Decisions that drop, limit, or reshape data flowing to the output, or pick a default that changes what end-users see, with no instruction specifying it
 
 ## Output
 
@@ -303,9 +334,9 @@ ${INTENT_DRIFT_SCHEMA}
 \`\`\`
 
 - Set \`sessionsChecked\` to the number of trace files you read
-- Set \`passed\` to \`true\` if no drift, incomplete fulfillment, or scope creep found
-- Set \`passed\` to \`false\` if any issues with severity "error" were found
-- For each issue, set \`pattern\` to "intent_drift", "incomplete_fulfillment", or "scope_creep"
+- Set \`passed\` to \`true\` only when no intent-drift issues are found
+- Set \`passed\` to \`false\` when any issue is found (any pattern, any severity)
+- For each issue, set \`pattern\` to one of: "intent_drift", "incomplete_fulfillment", "scope_creep", "unspecified_decision", "ignored_correction", "weakened_posture", "claimed_but_not_done"
 - You MUST write the result file even if no issues are found
 
 ## Severity guidelines

package/dist/triage/types.d.ts

@@ -13,7 +13,7 @@ export interface TriageIssue {
     /** For rules validator: rule ID (e.g., PR001) */
     rule?: string;
     /** For intent drift: drift pattern */
-    pattern?: 'intent_drift' | 'incomplete_fulfillment' | 'scope_creep';
+    pattern?: 'intent_drift' | 'incomplete_fulfillment' | 'scope_creep' | 'unspecified_decision' | 'ignored_correction' | 'weakened_posture' | 'claimed_but_not_done';
 }
 export interface CodeReviewResult {
     checker: 'code-review';

package/dist/utils/github-api.js

@@ -84,7 +84,7 @@ async function githubApiRequest(method, path, token, body) {
     // (e.g. the App isn't installed on this owner), fall back to the original
     // response so handleApiError surfaces GitHub's actual "org restricted" 403.
     const proxied = await fetch(`${GITHUB_PROXY_BASE}${path}`, init);
-    return proxied.ok ? proxied : direct;
+    return proxied.status === 403 ? direct : proxied;
 }
 /**
  * Handle API errors consistently

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.14.4",
+  "version": "0.14.6",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {