@haystackeditor/cli 0.15.10 → 0.15.11

package/dist/index.js

@@ -22,6 +22,7 @@
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+import chalk from 'chalk';
 import { Command } from 'commander';
 import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
@@ -37,6 +38,16 @@ import { dismissCommand, markReviewedCommand, undismissCommand } from './command
 import { requestReviewCommand } from './commands/request-review.js';
 import { prStatusCommand } from './commands/pr-status.js';
 import { setupCommand } from './commands/setup.js';
+import { schemaCommand, listSchemas } from './commands/schema-cmd.js';
+import { registerWebhook, listWebhooks, rotateWebhookSecret, setWebhookEnabled, listDeliveries, replayDelivery, } from './commands/webhooks.js';
+import { editRulesCommand, validateRulesCommand } from './commands/rules.js';
+import { headlessLoginCommand, headlessLogoutCommand, listTokensCommand, revokeTokenCommand, } from './commands/tokens.js';
+import { runMcpServer } from './commands/mcp.js';
+// pr-state read helpers (parsePrRef, prReadCommand) are imported by the MCP
+// server directly from ./commands/pr.js; no top-level CLI command is wired
+// here. The previous `pr <ref> [show|merge|snooze|dismiss]` and `fix <ref>`
+// surfaces were scope creep on the CLI-as-platform spec; `haystack pr-status`
+// already covered the read use case.
 /** Read the published version from package.json (dist/index.js → ../package.json)
  *  so `haystack --version` can't drift from the package version. Falls back
  *  gracefully so the flag never throws if the file can't be read. */
@@ -58,6 +69,16 @@ program
     .name('haystack')
     .description('Haystack CLI — automated PR review, triage, and merge queue')
     .version(getVersion());
+program
+    .command('schema [name]')
+    .description('Print the JSON Schema for a command\'s --json output (triage, setup, inbox, pr, chat)')
+    .action((name) => {
+    if (!name) {
+        listSchemas();
+        return;
+    }
+    schemaCommand(name);
+});
 program
     .command('init')
     .description('Create .haystack.json configuration')
@@ -122,12 +143,68 @@ program
     .action(statusCommand);
 program
     .command('login')
-    .description('Add or refresh a saved GitHub account')
-    .action(loginCommand);
+    .description('Add or refresh a saved GitHub account (use --headless for CI tokens)')
+    .option('--headless', 'Mint a long-lived hsk_live_* token instead of an interactive OAuth session')
+    .option('--label <name>', '(--headless) Label to display in the dashboard for this token')
+    .option('--scope <repos>', '(--headless) Comma-separated repos to scope the token to (or "all")', (val) => val.split(',').map((s) => s.trim()).filter(Boolean))
+    .option('--token <hsk_live_...>', '(--headless) Skip the browser handshake — paste a token minted in the dashboard')
+    .action(async (opts) => {
+    if (opts.headless) {
+        try {
+            await headlessLoginCommand({ label: opts.label, scope: opts.scope, token: opts.token });
+        }
+        catch (err) {
+            console.error(chalk.red('headless login failed:'), err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+        return;
+    }
+    return loginCommand();
+});
 program
     .command('logout [login]')
-    .description('Remove a saved GitHub account (defaults to the active account)')
-    .action(logoutCommand);
+    .description('Remove a saved GitHub account (use --headless to remove the local CLI token)')
+    .option('--headless', 'Remove the local hsk_live_* token file (does not revoke server-side — use `haystack tokens revoke <id>`)')
+    .action(async (login, opts) => {
+    if (opts.headless) {
+        try {
+            await headlessLogoutCommand();
+        }
+        catch (err) {
+            console.error(chalk.red('headless logout failed:'), err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+        return;
+    }
+    return logoutCommand(login);
+});
+// ─── tokens (server-side hsk_live_*) ─────────────────────────────────────────
+const tokens = program.command('tokens').description('Manage server-side hsk_live_* tokens');
+tokens
+    .command('list')
+    .description('List your CLI tokens')
+    .option('--json', 'Machine-readable output')
+    .action(async (opts) => {
+    try {
+        await listTokensCommand(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('list failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+tokens
+    .command('revoke <id>')
+    .description('Revoke a token by id (cannot be undone)')
+    .action(async (id) => {
+    try {
+        await revokeTokenCommand(id);
+    }
+    catch (err) {
+        console.error(chalk.red('revoke failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
 program
     .command('whoami')
     .description('Show the active Haystack GitHub account')
@@ -606,6 +683,148 @@ The generated policies appear in Haystack's "Human Review Needed"
 section when a PR touches matching files.
 `)
     .action(initPolicies);
+// ─── webhooks ────────────────────────────────────────────────────────────────
+//
+// `haystack webhooks ...` — register outbound webhook subscriptions and inspect
+// delivery status. Talks to the haystack-webhooks worker.
+//
+// See docs/SPEC-CLI-FIRST-CLASS.md §1 for the wire protocol (HMAC, retries,
+// idempotency).
+const webhooks = program
+    .command('webhooks')
+    .description('Manage outbound webhooks (events: triage.completed, fixer.completed, ...)');
+webhooks
+    .command('register')
+    .description('Register a webhook URL for the current repo and mint a fresh HMAC secret')
+    .requiredOption('-u, --url <url>', 'Receiver URL (https only)')
+    .option('-e, --events <events>', 'Comma-separated event list', (val) => val.split(',').map((s) => s.trim()).filter(Boolean))
+    .option('--secret-env <name>', 'Environment-variable name where you\'ll stash the secret (recorded in .haystack.json)')
+    .option('--repo <owner/name>', 'Override the inferred repo')
+    .action(async (opts) => {
+    try {
+        await registerWebhook(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('register failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('list')
+    .description('List active webhook registrations for the current repo')
+    .option('--repo <owner/name>', 'Override the inferred repo')
+    .option('--json', 'Machine-readable JSON output')
+    .action(async (opts) => {
+    try {
+        await listWebhooks(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('list failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('rotate-secret <id>')
+    .description('Rotate the HMAC secret for a registration (prints the new secret once)')
+    .action(async (id) => {
+    try {
+        await rotateWebhookSecret(id);
+    }
+    catch (err) {
+        console.error(chalk.red('rotate-secret failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('disable <id>')
+    .description('Disable a registration (stops delivery; existing in-flight retries continue)')
+    .action(async (id) => {
+    try {
+        await setWebhookEnabled(id, false);
+    }
+    catch (err) {
+        console.error(chalk.red('disable failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('enable <id>')
+    .description('Re-enable a previously disabled registration')
+    .action(async (id) => {
+    try {
+        await setWebhookEnabled(id, true);
+    }
+    catch (err) {
+        console.error(chalk.red('enable failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('deliveries')
+    .description('Show recent webhook delivery attempts for the current repo')
+    .option('--repo <owner/name>', 'Override the inferred repo')
+    .option('--limit <n>', 'Number of deliveries (default 20)', (v) => parseInt(v, 10))
+    .option('--json', 'Machine-readable JSON output')
+    .action(async (opts) => {
+    try {
+        await listDeliveries(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('deliveries failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('replay <id>')
+    .description('Replay a previous delivery (idempotent via X-Haystack-Delivery)')
+    .action(async (id) => {
+    try {
+        await replayDelivery(id);
+    }
+    catch (err) {
+        console.error(chalk.red('replay failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+// ─── rules ───────────────────────────────────────────────────────────────────
+const rules = program.command('rules').description('Manage .haystack/pr-rules.yml');
+rules
+    .command('edit')
+    .description('Open .haystack/pr-rules.yml in $EDITOR (creates a starter if missing)')
+    .action(async () => {
+    try {
+        await editRulesCommand();
+    }
+    catch (err) {
+        console.error(chalk.red('edit failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+rules
+    .command('validate')
+    .description('Parse pr-rules.yml with the same parser the server uses')
+    .action(async () => {
+    try {
+        await validateRulesCommand();
+    }
+    catch (err) {
+        console.error(chalk.red('validate failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+// ─── mcp ─────────────────────────────────────────────────────────────────────
+program
+    .command('mcp')
+    .description('Run a stdio MCP server exposing Haystack tools to Claude Code, Cursor, etc.')
+    .action(async () => {
+    try {
+        await runMcpServer();
+    }
+    catch (err) {
+        console.error(chalk.red('mcp server failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
 // Show help if no command provided
 if (process.argv.length === 2) {
     program.help();

package/dist/schema.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Stable machine-readable schema versions for each `--json` output.
+ *
+ * Bump semantics (per docs/SPEC-CLI-FIRST-CLASS.md):
+ *   patch — additive fields only
+ *   minor — field deprecated (kept emitting for one minor with _deprecated: true)
+ *   major — removal / rename
+ *
+ * One schema, two transports: every webhook payload for the corresponding noun
+ * uses the same envelope as the `--json` output, byte-for-byte.
+ */
+export declare const SCHEMA_VERSIONS: {
+    readonly triage: "1.0.0";
+    readonly setup: "1.0.0";
+    readonly pr: "1.0.0";
+};
+export type SchemaName = keyof typeof SCHEMA_VERSIONS;
+/** Wrap a payload with the `schema_version` envelope. */
+export declare function withSchema<T extends Record<string, unknown>>(name: SchemaName, payload: T): T & {
+    schema_version: string;
+};

package/dist/schema.js

@@ -0,0 +1,20 @@
+/**
+ * Stable machine-readable schema versions for each `--json` output.
+ *
+ * Bump semantics (per docs/SPEC-CLI-FIRST-CLASS.md):
+ *   patch — additive fields only
+ *   minor — field deprecated (kept emitting for one minor with _deprecated: true)
+ *   major — removal / rename
+ *
+ * One schema, two transports: every webhook payload for the corresponding noun
+ * uses the same envelope as the `--json` output, byte-for-byte.
+ */
+export const SCHEMA_VERSIONS = {
+    triage: '1.0.0',
+    setup: '1.0.0',
+    pr: '1.0.0',
+};
+/** Wrap a payload with the `schema_version` envelope. */
+export function withSchema(name, payload) {
+    return { schema_version: SCHEMA_VERSIONS[name], ...payload };
+}

package/dist/utils/analysis-api.d.ts

@@ -15,8 +15,18 @@ export interface AnalysisVerdict {
     summary: string;
     issues: AnalysisIssue[];
     reviewUrl: string;
-    /** Whether the PR was auto-merged after analysis */
+    /**
+     * Whether the PR has actually been merged on GitHub. Read from the GH
+     * REST PR endpoint — NOT inferred from review policy / canAutoMerge /
+     * haystackRating, all of which mean "eligible", not "merged".
+     */
     autoMerged?: boolean;
+    /**
+     * Whether the rating synthesis flagged that a human reviewer is required
+     * (review policy, security-sensitive paths, etc.). Distinct from
+     * `state === 'needs-input'` — analysis can be clean AND still need a human.
+     */
+    needsHumanReview?: boolean;
 }
 export interface AnalysisIssue {
     file: string;
@@ -55,7 +65,7 @@ export interface HumanReviewReason {
 }
 export interface RatingSynthesis {
     haystackRating: 1 | 2 | 3 | 4 | 5;
-    analysisVerdict?: 'clean' | 'has-issues';
+    analysisVerdict?: 'clean' | 'has-issues' | 'needs-review';
     synthesis: string;
     synthesisDisplay?: SynthesisDisplayIssue[];
     verifiedBugs: VerifiedBug[];
@@ -99,9 +109,6 @@ export type AnalysisReadyResult = {
  * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.
  */
 export declare function checkAnalysisReady(owner: string, repo: string, prNumber: number, token?: string): Promise<AnalysisReadyResult>;
-/**
- * Fetch analysis results once complete. Combines bug detection and rule violations.
- */
 export declare function fetchAnalysisResults(owner: string, repo: string, prNumber: number, token?: string): Promise<AnalysisVerdict>;
 /**
  * Fetch the full rating synthesis for a PR.

package/dist/utils/analysis-api.js

@@ -10,17 +10,54 @@
 // ============================================================================
 // Constants
 // ============================================================================
-const PROD_API_BASE = 'https://8z9ssbamdj.execute-api.us-west-2.amazonaws.com/prod';
+/**
+ * Analysis API base.
+ *
+ * IMPORTANT: this used to point directly at AWS API Gateway. That worked
+ * when the CLI carried a GitHub token (X-GitHub-Token header to the
+ * Lambda), but BROKE for `haystack login --headless` users — an
+ * hsk_live_* token would land on AWS as if it were a GH token, the
+ * Lambda would 401, and triage / pr / chat / MCP would silently return
+ * nothing. The right move is to route reads through the auth-worker,
+ * which:
+ *
+ *   1. Knows how to introspect hsk_live tokens (and GH tokens, agent JWTs,
+ *      session cookies) — single normalized auth path.
+ *   2. Applies the hsk_live scope gate (denyForCliScope) before forwarding
+ *      to AWS, so a repo-scoped CI token can't read other repos' synthesis.
+ *   3. Adds the right backend token (install token for org-installed reads,
+ *      fallback otherwise) — so private-repo reads work without the CLI
+ *      ever holding a GH token.
+ *
+ * Override with HAYSTACK_API_BASE for local dev (e.g., http://localhost:8788
+ * pointing at a local auth-worker).
+ */
+const ANALYSIS_API_BASE = process.env.HAYSTACK_API_BASE ?? 'https://haystackeditor.com';
+/** Build the auth-worker URL for a v3 result file (rating_synthesis.json, etc). */
+function v3ResultUrl(owner, repo, prNumber, file) {
+    // The auth-worker exposes `/api/analysis/{prIdentifier}/{file}` (see
+    // V3_API_PATTERNS in infra/auth-worker/index.js). prIdentifier format:
+    // owner/repo#prnum, URL-encoded as %2F + %23.
+    const prId = encodeURIComponent(`${owner}/${repo}#${prNumber}`);
+    return `${ANALYSIS_API_BASE}/api/analysis/${prId}${file ? `/${file}` : ''}`;
+}
 // ============================================================================
 // API helpers
 // ============================================================================
+/**
+ * Build headers for an auth-worker-proxied analysis request.
+ *
+ * Auth-worker accepts hsk_live_*, GH tokens, agent JWTs, and session
+ * cookies on `Authorization: Bearer`. The legacy `X-GitHub-Token` header
+ * targeted AWS directly and is no longer used.
+ */
 function apiHeaders(token) {
     const headers = {
         'Cache-Control': 'no-cache',
         'User-Agent': 'Haystack-CLI',
     };
     if (token) {
-        headers['X-GitHub-Token'] = token;
+        headers['Authorization'] = `Bearer ${token}`;
     }
     return headers;
 }
@@ -32,7 +69,7 @@ function apiHeaders(token) {
  * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.
  */
 export async function checkAnalysisReady(owner, repo, prNumber, token) {
-    const url = `${PROD_API_BASE}/v3/result/${owner}/${repo}/${prNumber}`;
+    const url = v3ResultUrl(owner, repo, prNumber);
     let response;
     try {
         response = await fetch(url, {
@@ -57,97 +94,130 @@ export async function checkAnalysisReady(owner, repo, prNumber, token) {
     return data.status === 'COMPLETED' ? { status: 'ready' } : { status: 'pending' };
 }
 /**
- * Fetch analysis results once complete. Combines bug detection and rule violations.
+ * Fetch analysis results once complete. Used by `haystack submit`'s
+ * wait-for-triage loop to render a verdict block.
+ *
+ * Verdict semantics — three distinct signals, never conflated:
+ *
+ *   state                 = is the analysis itself clean?
+ *                           → 'good-to-merge' iff analysisVerdict === 'clean'
+ *                              AND !needsHumanReview. canAutoMerge is NOT
+ *                              the source of truth (it only means "analysis
+ *                              would let this through" — review policy,
+ *                              grace period, or a missing auto-merge label
+ *                              can still block).
+ *                              Falls back to haystackRating ≥ 5 only when
+ *                              analysisVerdict is absent (legacy payloads).
+ *   needsHumanReview      = preserved on the return shape so callers can
+ *                           distinguish "clean + needs human" from clean.
+ *   autoMerged            = was the PR ACTUALLY merged? Read from the
+ *                           GitHub REST endpoint, not from anything in
+ *                           the synthesis. canAutoMerge is eligibility,
+ *                           not outcome — never claim "auto-merged" from
+ *                           the analysis side.
+ *
+ * Sources from the v3 rating-synthesis path (auth-worker-proxied — so
+ * hsk_live tokens, GH tokens, agent JWTs, and cookies all work, and the
+ * scope gate runs). The legacy v2 bug-detection / rule-violation /
+ * merge-decision JSONs are no longer queried (no auth-worker proxy).
  */
-export async function fetchAnalysisResults(owner, repo, prNumber, token) {
-    const prIdentifier = `${owner}/${repo}#${prNumber}`;
-    const encodedId = encodeURIComponent(prIdentifier);
-    const reviewUrl = `https://haystackeditor.com/review/${owner}/${repo}/${prNumber}`;
-    const issues = [];
-    // Fetch bug detection
-    try {
-        const bugUrl = `${PROD_API_BASE}/v2/analysis/${encodedId}/bug_detection.json`;
-        const bugResp = await fetch(bugUrl, {
-            headers: apiHeaders(token),
-        });
-        if (bugResp.ok) {
-            const bugData = await bugResp.json();
-            if (bugData.bugs) {
-                for (const bug of bugData.bugs) {
-                    issues.push({
-                        file: bug.file || 'unknown',
-                        line: bug.line,
-                        message: bug.description || 'Bug detected',
-                        severity: bug.severity === 'critical' || bug.severity === 'high' ? 'error' : 'warning',
-                        source: 'bug-detection',
-                    });
-                }
-            }
-        }
-    }
-    catch {
-        // Bug detection not available — not fatal
-    }
-    // Fetch rule violations
+async function isPrMerged(owner, repo, prNumber, token) {
+    // Authoritative merge check. We hit the same auth-worker proxy as the
+    // rest of the CLI so hsk_live / OAuth / install tokens all work, AND
+    // scope enforcement happens here too (a token not scoped to this repo
+    // would 403; we treat that as "unknown → not merged" rather than
+    // crashing the submit flow).
+    if (!token)
+        return false;
     try {
-        const rulesUrl = `${PROD_API_BASE}/v2/analysis/${encodedId}/rule_violations.json`;
-        const rulesResp = await fetch(rulesUrl, {
-            headers: apiHeaders(token),
+        const base = process.env.HAYSTACK_API_BASE ?? 'https://haystackeditor.com';
+        const res = await fetch(`${base}/api/github/repos/${owner}/${repo}/pulls/${prNumber}`, {
+            headers: {
+                Accept: 'application/vnd.github+json',
+                Authorization: `Bearer ${token}`,
+                'User-Agent': 'Haystack-CLI',
+            },
         });
-        if (rulesResp.ok) {
-            const rulesData = await rulesResp.json();
-            if (rulesData.violations) {
-                for (const v of rulesData.violations) {
-                    issues.push({
-                        file: v.file || 'unknown',
-                        line: v.line,
-                        message: v.message || `Rule violation: ${v.rule || 'unknown'}`,
-                        severity: v.severity === 'error' ? 'error' : 'warning',
-                        source: 'rule-violation',
-                    });
-                }
-            }
-        }
+        if (!res.ok)
+            return false;
+        const data = (await res.json());
+        return data.merged === true;
     }
     catch {
-        // Rule violations not available — not fatal
+        return false;
     }
-    // Fetch merge decision (to check if auto-merged)
-    let autoMerged = false;
-    try {
-        const mergeUrl = `${PROD_API_BASE}/v2/analysis/${encodedId}/merge_decision.json`;
-        const mergeResp = await fetch(mergeUrl, {
-            headers: apiHeaders(token),
-        });
-        if (mergeResp.ok) {
-            const mergeData = await mergeResp.json();
-            autoMerged = mergeData.autoMerged === true;
-        }
+}
+export async function fetchAnalysisResults(owner, repo, prNumber, token) {
+    const reviewUrl = `https://haystackeditor.com/review/${owner}/${repo}/${prNumber}`;
+    const [synthesis, autoMerged] = await Promise.all([
+        fetchRatingSynthesis(owner, repo, prNumber, token),
+        isPrMerged(owner, repo, prNumber, token),
+    ]);
+    if (!synthesis) {
+        return {
+            state: 'needs-input',
+            bugCount: 0,
+            warningCount: 0,
+            ruleViolationCount: 0,
+            summary: 'Analysis is ready but synthesis could not be loaded.',
+            issues: [],
+            reviewUrl,
+            autoMerged,
+        };
     }
-    catch {
-        // Merge decision not available — not fatal
-    }
-    const bugCount = issues.filter(i => i.source === 'bug-detection').length;
-    const ruleViolationCount = issues.filter(i => i.source === 'rule-violation').length;
-    const warningCount = issues.filter(i => i.severity === 'warning').length;
-    const errorCount = issues.filter(i => i.severity === 'error').length;
-    const state = errorCount === 0 && warningCount === 0 ? 'good-to-merge' : 'needs-input';
-    // Build summary
+    const display = synthesis.synthesisDisplay ?? [];
+    const issues = display.map((d) => ({
+        file: 'unknown', // synthesis findings don't always carry a path; the rich data lives on the feed
+        message: d.summary || d.detail || `Finding (${d.category})`,
+        severity: 'warning',
+        // Map the synthesis source onto the verdict's two-bucket model.
+        // Anything other than an explicit rule violation lands on bug-detection.
+        source: d.source === 'rule-violation' ? 'rule-violation' : 'bug-detection',
+    }));
+    const bugCount = issues.filter((i) => i.source === 'bug-detection').length;
+    const ruleViolationCount = issues.filter((i) => i.source === 'rule-violation').length;
+    const warningCount = issues.length;
+    // Three discrete signals, NEVER conflated:
+    //   verdictKind     : 'clean' | 'has-issues' | 'needs-review'
+    //                     (legacy payloads without analysisVerdict fall back
+    //                     to haystackRating ≥ 5 → 'clean')
+    //   needsHumanReview: true if review policy demands a human, OR if the
+    //                     orchestrator escalated verdict to 'needs-review'
+    //                     (which carries the same semantic).
+    //   analysisIsClean : true iff verdict is 'clean' OR 'needs-review'
+    //                     (both mean: no bugs/violations were found; the
+    //                     review-policy gate is the separate axis).
+    //
+    // good-to-merge = analysis clean AND no human required.
+    // 'has-issues'   → state 'needs-input'.
+    // 'needs-review' → state 'needs-input' + needsHumanReview true.
+    // 'clean' + needsHumanReview → same as 'needs-review' (defensive — the
+    //  orchestrator should already have escalated, but we handle the case
+    //  where it didn't).
+    const verdictKind = synthesis.analysisVerdict
+        ?? (synthesis.haystackRating >= 5 ? 'clean' : 'has-issues');
+    const analysisIsClean = verdictKind === 'clean' || verdictKind === 'needs-review';
+    const needsHumanReview = synthesis.needsHumanReview === true || verdictKind === 'needs-review';
+    const isGoodToMerge = analysisIsClean && !needsHumanReview;
+    const state = isGoodToMerge ? 'good-to-merge' : 'needs-input';
     let summary;
     if (state === 'good-to-merge') {
-        summary = autoMerged ? 'No issues found. PR was auto-merged.' : 'No issues found. Safe to merge.';
+        summary = autoMerged
+            ? 'No blocking issues. PR was merged.'
+            : 'No blocking issues. Safe to merge.';
+    }
+    else if (analysisIsClean && needsHumanReview) {
+        summary = 'Analysis is clean, but review policy requires a human reviewer.';
     }
     else {
         const parts = [];
-        if (errorCount > 0)
-            parts.push(`${errorCount} error(s)`);
-        if (warningCount > 0)
-            parts.push(`${warningCount} warning(s)`);
         if (bugCount > 0)
-            parts.push(`${bugCount} bug(s)`);
+            parts.push(`${bugCount} finding(s)`);
         if (ruleViolationCount > 0)
             parts.push(`${ruleViolationCount} rule violation(s)`);
-        summary = parts.join(', ') + ' found.';
+        summary = parts.length > 0
+            ? parts.join(', ') + ' found.'
+            : `Rating ${synthesis.haystackRating}/5 — see the feed for details.`;
     }
     return {
         state,
@@ -158,10 +228,11 @@ export async function fetchAnalysisResults(owner, repo, prNumber, token) {
         issues,
         reviewUrl,
         autoMerged,
+        needsHumanReview,
     };
 }
 export async function fetchAutoFixManifest(owner, repo, prNumber, token) {
-    const url = `${PROD_API_BASE}/v3/result/${owner}/${repo}/${prNumber}/auto-fix-manifest.json`;
+    const url = v3ResultUrl(owner, repo, prNumber, 'auto-fix-manifest.json');
     try {
         const response = await fetch(url, {
             headers: apiHeaders(token),
@@ -184,8 +255,10 @@ export async function fetchAutoFixManifest(owner, repo, prNumber, token) {
     }
 }
 export async function fetchRatingSynthesis(owner, repo, prNumber, token) {
-    // Use v3/result endpoint (same as the Lambda serves generic files)
-    const url = `${PROD_API_BASE}/v3/result/${owner}/${repo}/${prNumber}/rating_synthesis.json`;
+    // Route through the auth-worker (/api/analysis/{prId}/rating_synthesis.json)
+    // so hsk_live tokens are introspected and the scope gate applies — see
+    // ANALYSIS_API_BASE comment above.
+    const url = v3ResultUrl(owner, repo, prNumber, 'rating_synthesis.json');
     try {
         const response = await fetch(url, {
             headers: apiHeaders(token),