@haystackeditor/cli 0.15.10 → 0.15.12

package/dist/commands/tokens.js

@@ -0,0 +1,184 @@
+/**
+ * Long-lived CLI tokens (hsk_live_*).
+ *
+ * Operator stories:
+ *   - `haystack login --headless [--label NAME] [--scope repo:owner/name,...]`
+ *       Opens the browser to mint a token via the auth-worker, then writes it
+ *       locally so subsequent CLI calls auth via Bearer.
+ *   - `haystack tokens list`
+ *       Lists tokens on the server side (the local file only stores ONE
+ *       active token at a time; the server may have many tied to your user).
+ *   - `haystack tokens revoke <id>`
+ *       Revokes a server-side token. If the revoked token is the one
+ *       currently on disk, the local file is wiped so the next CLI call
+ *       doesn't keep using a dead token.
+ *   - `haystack logout --headless`
+ *       Removes the local headless token without touching the server.
+ *
+ * The mint flow uses a short-lived browser handshake (the auth-worker has
+ * existing cookie-session auth — we can't replicate it in pure CLI). The
+ * dashboard renders a "Generate CLI token" page that POSTs to
+ * /api/cli-tokens/mint, then redirects back to a one-time URL the CLI
+ * polls (deeper headless flow can be added later, see follow-ups).
+ *
+ * For initial bootstrapping (and CI), `--token <value>` lets the operator
+ * paste a server-minted token directly.
+ */
+import chalk from 'chalk';
+import { loadToken, readHeadlessToken, writeHeadlessToken, clearHeadlessToken } from '../utils/auth.js';
+const HEADLESS_BASE = process.env.HAYSTACK_API_BASE ?? 'https://haystackeditor.com';
+export async function headlessLoginCommand(opts) {
+    if (opts.token) {
+        if (!opts.token.startsWith('hsk_live_')) {
+            console.error(chalk.red('Expected a token starting with hsk_live_.'));
+            process.exit(2);
+        }
+        const path = await writeHeadlessToken({
+            token: opts.token,
+            label: opts.label ?? 'paste',
+            created_at: new Date().toISOString(),
+        });
+        console.log(chalk.green('✓ Headless token saved'));
+        console.log(`  ${chalk.dim('path:')} ${path}`);
+        console.log(`  ${chalk.dim('label:')} ${opts.label ?? 'paste'}`);
+        console.log(chalk.dim('  Subsequent `haystack` calls will use this token.'));
+        return;
+    }
+    // Polled handshake: the CLI asks the server for a ticket, prints the
+    // approval URL, then long-polls for the token. The user clicks "Approve"
+    // in the dashboard while logged in.
+    //
+    // Scope normalization: `--scope all` arrives here as `['all']` (commander
+    // splits on commas). The server treats only the literal string `'all'` as
+    // the wildcard; an array of `['all']` would deny every repo because the
+    // string "all" isn't a real `owner/name`. Detect and unwrap.
+    const scopePayload = !opts.scope
+        ? undefined
+        : opts.scope.length === 1 && opts.scope[0].toLowerCase() === 'all'
+            ? { repos: 'all' }
+            : { repos: opts.scope };
+    const startRes = await fetch(`${HEADLESS_BASE}/api/cli-tokens/start-handshake`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'User-Agent': 'Haystack-CLI' },
+        body: JSON.stringify({ label: opts.label, scope: scopePayload }),
+    });
+    if (!startRes.ok) {
+        console.error(chalk.red(`Could not start handshake: ${startRes.status}`));
+        console.error('  ' + (await startRes.text()).slice(0, 400));
+        process.exit(1);
+    }
+    const start = (await startRes.json());
+    console.log(chalk.bold('\nHaystack headless login\n'));
+    console.log('  Open this URL in a browser logged in to Haystack:');
+    console.log(`    ${chalk.cyan(start.approval_url)}`);
+    if (opts.label)
+        console.log(`    ${chalk.dim('Label:')} ${opts.label}`);
+    if (opts.scope)
+        console.log(`    ${chalk.dim('Scope:')} ${opts.scope.join(', ')}`);
+    console.log('');
+    process.stdout.write(chalk.dim('  Waiting for approval... (Ctrl-C to cancel)'));
+    const deadline = Date.now() + start.expires_in * 1000;
+    const pollUrl = `${HEADLESS_BASE}/api/cli-tokens/handshake/${encodeURIComponent(start.ticket)}`;
+    let result = null;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, 2000));
+        process.stdout.write(chalk.dim('.'));
+        // Transient network errors during long-polling are expected (CF can
+        // close idle connections, ISP hiccups). Log to stderr so the user
+        // sees that we're retrying and not just silently looping.
+        const res = await fetch(pollUrl, { headers: { 'User-Agent': 'Haystack-CLI' } }).catch((err) => {
+            process.stderr.write(chalk.dim(`\n  poll error: ${err instanceof Error ? err.message : String(err)}; retrying\n`));
+            return null;
+        });
+        if (!res)
+            continue;
+        if (res.status === 202)
+            continue;
+        if (res.status === 404) {
+            process.stdout.write('\n');
+            console.error(chalk.red('Handshake expired before approval. Re-run `haystack login --headless`.'));
+            process.exit(1);
+        }
+        if (!res.ok) {
+            // Transient — keep polling. Log loudly on stderr so it's not silent.
+            process.stderr.write(chalk.dim(`\n  poll ${res.status}; retrying\n`));
+            continue;
+        }
+        result = (await res.json());
+        break;
+    }
+    process.stdout.write('\n');
+    if (!result) {
+        console.error(chalk.red('Timed out waiting for approval.'));
+        process.exit(1);
+    }
+    const path = await writeHeadlessToken({
+        token: result.token,
+        id: result.id,
+        label: opts.label ?? 'cli',
+        created_at: new Date().toISOString(),
+    });
+    console.log(chalk.green('✓ Headless token saved'));
+    console.log(`  ${chalk.dim('path:')} ${path}`);
+    console.log(`  ${chalk.dim('id:')}   ${result.id}`);
+    console.log(chalk.dim('  Subsequent `haystack` calls will use this token.'));
+    console.log(chalk.dim('  Revoke server-side with: haystack tokens revoke ' + result.id));
+}
+export async function headlessLogoutCommand() {
+    await clearHeadlessToken();
+    console.log(chalk.green('✓ Headless token removed from disk.'));
+    console.log(chalk.dim('  Server-side token is still active. Revoke it with `haystack tokens revoke <id>`.'));
+}
+export async function listTokensCommand(opts) {
+    const token = await loadToken();
+    if (!token) {
+        console.error(chalk.red('Not authenticated.'));
+        process.exit(1);
+    }
+    const res = await fetch(`${HEADLESS_BASE}/api/cli-tokens/list`, {
+        headers: { Authorization: `Bearer ${token}`, 'User-Agent': 'Haystack-CLI' },
+    });
+    if (!res.ok) {
+        console.error(chalk.red(`list failed: ${res.status} ${await res.text()}`));
+        process.exit(1);
+    }
+    const data = (await res.json());
+    if (opts.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    if (data.tokens.length === 0) {
+        console.log(chalk.dim('No tokens.'));
+        return;
+    }
+    for (const t of data.tokens) {
+        const status = t.revoked_at ? chalk.red('revoked') : chalk.green('active');
+        console.log(`${status}  ${chalk.bold(t.id)}  ${t.label}`);
+        console.log(`  ${chalk.dim('created:')} ${new Date(t.created_at).toISOString()}` +
+            (t.last_used_at ? `  ${chalk.dim('last used:')} ${new Date(t.last_used_at).toISOString()}` : ''));
+    }
+}
+export async function revokeTokenCommand(id) {
+    const token = await loadToken();
+    if (!token) {
+        console.error(chalk.red('Not authenticated.'));
+        process.exit(1);
+    }
+    const res = await fetch(`${HEADLESS_BASE}/api/cli-tokens/${encodeURIComponent(id)}/revoke`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'User-Agent': 'Haystack-CLI' },
+    });
+    if (!res.ok) {
+        console.error(chalk.red(`revoke failed: ${res.status} ${await res.text()}`));
+        process.exit(1);
+    }
+    // If the revoked token is the one currently on disk, clear it so we
+    // don't keep using a dead credential next call. We compare by the id
+    // we stored at mint time — no extra network call needed.
+    const local = await readHeadlessToken();
+    if (local?.id === id) {
+        await clearHeadlessToken();
+        console.log(chalk.dim('  Local headless token file cleared.'));
+    }
+    console.log(chalk.green(`✓ Token ${id} revoked`));
+}

package/dist/commands/triage.js

@@ -24,6 +24,7 @@ import { checkAnalysisReady, fetchRatingSynthesis, fetchAutoFixManifest } from '
 import { parseRemoteUrl } from '../utils/git.js';
 import { loadToken } from '../utils/auth.js';
 import { loadPendingSubmit, updatePendingSubmit, clearPendingSubmit } from '../utils/pending-state.js';
+import { withSchema } from '../schema.js';
 // ============================================================================
 // PR identifier parsing
 // ============================================================================
@@ -137,7 +138,7 @@ function printRichOutput(pr, synthesis, manifest) {
     console.log(`  ${chalk.dim(reviewUrl)}\n`);
 }
 function printJsonOutput(pr, synthesis, manifest) {
-    const output = {
+    const output = withSchema('triage', {
         owner: pr.owner,
         repo: pr.repo,
         prNumber: pr.prNumber,
@@ -154,7 +155,7 @@ function printJsonOutput(pr, synthesis, manifest) {
             // True when the auto-fixer is handling this finding — don't fix it yourself.
             autoFixing: isAutoFixing(f, manifest),
         })),
-    };
+    });
     console.log(JSON.stringify(output, null, 2));
 }
 function ratingStars(rating) {

package/dist/commands/webhooks.d.ts

@@ -0,0 +1,18 @@
+export declare function registerWebhook(opts: {
+    url: string;
+    events?: string[];
+    secretEnv?: string;
+    repo?: string;
+}): Promise<void>;
+export declare function listWebhooks(opts: {
+    repo?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function rotateWebhookSecret(id: string): Promise<void>;
+export declare function setWebhookEnabled(id: string, enabled: boolean): Promise<void>;
+export declare function listDeliveries(opts: {
+    repo?: string;
+    limit?: number;
+    json?: boolean;
+}): Promise<void>;
+export declare function replayDelivery(id: string): Promise<void>;

package/dist/commands/webhooks.js

@@ -0,0 +1,210 @@
+/**
+ * `haystack webhooks ...` — register and inspect outbound webhooks.
+ *
+ * Two responsibilities split intentionally:
+ *
+ *   Local edits to .haystack.json (`register`)
+ *     The .haystack.json file IS the source of truth for which URLs a repo
+ *     wants to receive events on. The wizard writes it; humans edit it;
+ *     `haystack webhooks register` is a typed UI over the same edit. After
+ *     writing the file, this command POSTs to the haystack-webhooks worker
+ *     to create the registration row and obtain the HMAC secret.
+ *
+ *   Remote queries (`list`, `deliveries`, `rotate-secret`, `replay`, etc.)
+ *     Hit the worker's /admin endpoints. Auth is CF Access on the worker
+ *     side; the CLI relies on the operator having a CF Access session
+ *     (cookie or service-token).
+ *
+ * Secret handling:
+ *   The worker returns the freshly-minted HMAC secret ONCE, on register or
+ *   rotate-secret. We print it to the operator and do not persist it. They
+ *   are expected to stash it in their CI's secret store and reference it
+ *   from .haystack.json via "secret_ref": "env:HAYSTACK_WEBHOOK_SECRET".
+ */
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import chalk from 'chalk';
+import { parseRemoteUrl } from '../utils/git.js';
+import { loadToken } from '../utils/auth.js';
+const DEFAULT_WORKER_URL = process.env.HAYSTACK_WEBHOOKS_URL ??
+    'https://haystack-webhooks.akshaysg.workers.dev';
+// Keep in lockstep with infra/webhooks-worker/src/types.ts ALLOWED_EVENTS
+// and agent/cloudflare/src/webhook-emitter.ts WebhookEvent. The three
+// lists must agree: a CLI-accepted event with no worker/emitter support
+// either 400s at registration or silently never fires.
+const ALLOWED_EVENTS = [
+    'triage.completed',
+    'triage.failed',
+    'fixer.completed',
+    'merge_queue.state_changed',
+    // 'review_chat.response_ready' deferred — chat CLI was cut, no producer.
+    'pr.classified',
+];
+function configPath() {
+    return resolve(process.cwd(), '.haystack.json');
+}
+function readConfig() {
+    const p = configPath();
+    if (!existsSync(p)) {
+        throw new Error(`.haystack.json not found in ${process.cwd()}. Run \`haystack init\` first.`);
+    }
+    return JSON.parse(readFileSync(p, 'utf8'));
+}
+function writeConfig(cfg) {
+    writeFileSync(configPath(), JSON.stringify(cfg, null, 2) + '\n', 'utf8');
+}
+function currentRepo() {
+    const r = parseRemoteUrl('origin');
+    return `${r.owner}/${r.repo}`;
+}
+async function adminFetch(path, init = {}) {
+    const token = await loadToken();
+    const headers = {
+        'Content-Type': 'application/json',
+        ...(init.headers ?? {}),
+    };
+    if (token)
+        headers['Authorization'] = `Bearer ${token}`;
+    return fetch(`${DEFAULT_WORKER_URL}${path}`, {
+        method: init.method,
+        headers,
+        body: init.body == null
+            ? undefined
+            : typeof init.body === 'string'
+                ? init.body
+                : JSON.stringify(init.body),
+    });
+}
+async function readJsonOrFail(res) {
+    const body = await res.text();
+    if (!res.ok) {
+        throw new Error(`worker ${res.status}: ${body.slice(0, 512)}`);
+    }
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new Error(`worker returned non-JSON: ${body.slice(0, 200)}`);
+    }
+}
+// ─── register ────────────────────────────────────────────────────────────────
+export async function registerWebhook(opts) {
+    const repo = opts.repo ?? currentRepo();
+    const events = opts.events ?? ['triage.completed', 'triage.failed', 'fixer.completed'];
+    for (const e of events) {
+        if (!ALLOWED_EVENTS.includes(e)) {
+            throw new Error(`Unknown event "${e}". Allowed: ${ALLOWED_EVENTS.join(', ')}`);
+        }
+    }
+    const res = await adminFetch('/admin/registrations', {
+        method: 'POST',
+        body: { repo, url: opts.url, events },
+    });
+    const data = (await readJsonOrFail(res));
+    // Update .haystack.json. Append; do not overwrite an existing entry — the
+    // operator may want multiple webhooks pointing at different endpoints.
+    const cfg = readConfig();
+    cfg.webhooks = cfg.webhooks ?? [];
+    cfg.webhooks.push({
+        url: opts.url,
+        events,
+        secret_ref: opts.secretEnv ? `env:${opts.secretEnv}` : undefined,
+    });
+    writeConfig(cfg);
+    console.log(chalk.green('✓ Webhook registered'));
+    console.log(`  ${chalk.dim('repo:')}        ${repo}`);
+    console.log(`  ${chalk.dim('url:')}         ${opts.url}`);
+    console.log(`  ${chalk.dim('events:')}      ${events.join(', ')}`);
+    console.log(`  ${chalk.dim('id:')}          ${data.id}`);
+    console.log('');
+    console.log(chalk.yellow.bold('HMAC secret (save this now — it cannot be retrieved again):'));
+    console.log('');
+    console.log(`  ${chalk.bold(data.secret)}`);
+    console.log('');
+    if (opts.secretEnv) {
+        console.log(chalk.dim(`Stash it in your secret store and expose it as $${opts.secretEnv}.`));
+    }
+    else {
+        console.log(chalk.dim('Tip: pass --secret-env NAME to record where the secret will live.'));
+    }
+    console.log(chalk.dim('Lost the secret? Run: haystack webhooks rotate-secret ' + data.id));
+}
+// ─── list ────────────────────────────────────────────────────────────────────
+export async function listWebhooks(opts) {
+    const repo = opts.repo ?? currentRepo();
+    const res = await adminFetch(`/admin/registrations?repo=${encodeURIComponent(repo)}`);
+    const data = (await readJsonOrFail(res));
+    if (opts.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    if (data.registrations.length === 0) {
+        console.log(chalk.dim(`No webhooks registered for ${repo}.`));
+        return;
+    }
+    for (const r of data.registrations) {
+        const state = r.disabled ? chalk.red(`disabled (${r.disabled_reason ?? 'unknown'})`) : chalk.green('active');
+        console.log(`${chalk.bold(r.url)} ${state}`);
+        console.log(`  ${chalk.dim('id:')}      ${r.id}`);
+        console.log(`  ${chalk.dim('events:')}  ${r.events.join(', ')}`);
+        if (r.consecutive_5xx > 0) {
+            console.log(`  ${chalk.dim('5xx:')}     ${r.consecutive_5xx} consecutive`);
+        }
+        console.log('');
+    }
+}
+// ─── rotate-secret ───────────────────────────────────────────────────────────
+export async function rotateWebhookSecret(id) {
+    const res = await adminFetch(`/admin/registrations/${encodeURIComponent(id)}/rotate-secret`, {
+        method: 'POST',
+    });
+    const data = (await readJsonOrFail(res));
+    console.log(chalk.green('✓ Secret rotated'));
+    console.log('');
+    console.log(chalk.yellow.bold('New HMAC secret:'));
+    console.log(`  ${chalk.bold(data.secret)}`);
+    console.log('');
+    console.log(chalk.red.bold('The previous secret is now invalid. Update your receiver before the next event fires.'));
+}
+// ─── enable / disable ────────────────────────────────────────────────────────
+export async function setWebhookEnabled(id, enabled) {
+    const action = enabled ? 'enable' : 'disable';
+    const res = await adminFetch(`/admin/registrations/${encodeURIComponent(id)}/${action}`, {
+        method: 'POST',
+    });
+    await readJsonOrFail(res);
+    console.log(chalk.green(`✓ Webhook ${id} ${action}d`));
+}
+// ─── deliveries / replay ─────────────────────────────────────────────────────
+export async function listDeliveries(opts) {
+    const repo = opts.repo ?? currentRepo();
+    const limit = opts.limit ?? 20;
+    const res = await adminFetch(`/admin/deliveries?repo=${encodeURIComponent(repo)}&limit=${limit}`);
+    const data = (await readJsonOrFail(res));
+    if (opts.json) {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    if (data.deliveries.length === 0) {
+        console.log(chalk.dim(`No deliveries for ${repo}.`));
+        return;
+    }
+    for (const d of data.deliveries) {
+        const color = d.status === 'delivered' ? chalk.green
+            : d.status === 'dead' ? chalk.red
+                : d.status === 'failed' ? chalk.yellow
+                    : chalk.dim;
+        const code = d.last_status_code != null ? ` ${d.last_status_code}` : '';
+        console.log(`${color(d.status.padEnd(10))} ${chalk.bold(d.event.padEnd(28))} ` +
+            `attempts=${d.attempts}${code} ${chalk.dim(d.id)}`);
+        if (d.last_error)
+            console.log(`  ${chalk.dim('error:')} ${d.last_error}`);
+    }
+}
+export async function replayDelivery(id) {
+    const res = await adminFetch(`/admin/deliveries/${encodeURIComponent(id)}/replay`, {
+        method: 'POST',
+    });
+    await readJsonOrFail(res);
+    console.log(chalk.green(`✓ Replay queued for ${id}`));
+}