@haystackeditor/cli 0.15.10 → 0.15.12

package/dist/index.js

@@ -22,6 +22,7 @@
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+import chalk from 'chalk';
 import { Command } from 'commander';
 import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
@@ -37,6 +38,16 @@ import { dismissCommand, markReviewedCommand, undismissCommand } from './command
 import { requestReviewCommand } from './commands/request-review.js';
 import { prStatusCommand } from './commands/pr-status.js';
 import { setupCommand } from './commands/setup.js';
+import { schemaCommand, listSchemas } from './commands/schema-cmd.js';
+import { registerWebhook, listWebhooks, rotateWebhookSecret, setWebhookEnabled, listDeliveries, replayDelivery, } from './commands/webhooks.js';
+import { editRulesCommand, validateRulesCommand } from './commands/rules.js';
+import { headlessLoginCommand, headlessLogoutCommand, listTokensCommand, revokeTokenCommand, } from './commands/tokens.js';
+import { runMcpServer } from './commands/mcp.js';
+// pr-state read helpers (parsePrRef, prReadCommand) are imported by the MCP
+// server directly from ./commands/pr.js; no top-level CLI command is wired
+// here. The previous `pr <ref> [show|merge|snooze|dismiss]` and `fix <ref>`
+// surfaces were scope creep on the CLI-as-platform spec; `haystack pr-status`
+// already covered the read use case.
 /** Read the published version from package.json (dist/index.js → ../package.json)
  *  so `haystack --version` can't drift from the package version. Falls back
  *  gracefully so the flag never throws if the file can't be read. */
@@ -58,6 +69,16 @@ program
     .name('haystack')
     .description('Haystack CLI — automated PR review, triage, and merge queue')
     .version(getVersion());
+program
+    .command('schema [name]')
+    .description('Print the JSON Schema for a command\'s --json output (triage, setup, inbox, pr, chat)')
+    .action((name) => {
+    if (!name) {
+        listSchemas();
+        return;
+    }
+    schemaCommand(name);
+});
 program
     .command('init')
     .description('Create .haystack.json configuration')
@@ -122,12 +143,68 @@ program
     .action(statusCommand);
 program
     .command('login')
-    .description('Add or refresh a saved GitHub account')
-    .action(loginCommand);
+    .description('Add or refresh a saved GitHub account (use --headless for CI tokens)')
+    .option('--headless', 'Mint a long-lived hsk_live_* token instead of an interactive OAuth session')
+    .option('--label <name>', '(--headless) Label to display in the dashboard for this token')
+    .option('--scope <repos>', '(--headless) Comma-separated repos to scope the token to (or "all")', (val) => val.split(',').map((s) => s.trim()).filter(Boolean))
+    .option('--token <hsk_live_...>', '(--headless) Skip the browser handshake — paste a token minted in the dashboard')
+    .action(async (opts) => {
+    if (opts.headless) {
+        try {
+            await headlessLoginCommand({ label: opts.label, scope: opts.scope, token: opts.token });
+        }
+        catch (err) {
+            console.error(chalk.red('headless login failed:'), err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+        return;
+    }
+    return loginCommand();
+});
 program
     .command('logout [login]')
-    .description('Remove a saved GitHub account (defaults to the active account)')
-    .action(logoutCommand);
+    .description('Remove a saved GitHub account (use --headless to remove the local CLI token)')
+    .option('--headless', 'Remove the local hsk_live_* token file (does not revoke server-side — use `haystack tokens revoke <id>`)')
+    .action(async (login, opts) => {
+    if (opts.headless) {
+        try {
+            await headlessLogoutCommand();
+        }
+        catch (err) {
+            console.error(chalk.red('headless logout failed:'), err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+        return;
+    }
+    return logoutCommand(login);
+});
+// ─── tokens (server-side hsk_live_*) ─────────────────────────────────────────
+const tokens = program.command('tokens').description('Manage server-side hsk_live_* tokens');
+tokens
+    .command('list')
+    .description('List your CLI tokens')
+    .option('--json', 'Machine-readable output')
+    .action(async (opts) => {
+    try {
+        await listTokensCommand(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('list failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+tokens
+    .command('revoke <id>')
+    .description('Revoke a token by id (cannot be undone)')
+    .action(async (id) => {
+    try {
+        await revokeTokenCommand(id);
+    }
+    catch (err) {
+        console.error(chalk.red('revoke failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
 program
     .command('whoami')
     .description('Show the active Haystack GitHub account')
@@ -606,6 +683,148 @@ The generated policies appear in Haystack's "Human Review Needed"
 section when a PR touches matching files.
 `)
     .action(initPolicies);
+// ─── webhooks ────────────────────────────────────────────────────────────────
+//
+// `haystack webhooks ...` — register outbound webhook subscriptions and inspect
+// delivery status. Talks to the haystack-webhooks worker.
+//
+// See docs/SPEC-CLI-FIRST-CLASS.md §1 for the wire protocol (HMAC, retries,
+// idempotency).
+const webhooks = program
+    .command('webhooks')
+    .description('Manage outbound webhooks (events: triage.completed, fixer.completed, ...)');
+webhooks
+    .command('register')
+    .description('Register a webhook URL for the current repo and mint a fresh HMAC secret')
+    .requiredOption('-u, --url <url>', 'Receiver URL (https only)')
+    .option('-e, --events <events>', 'Comma-separated event list', (val) => val.split(',').map((s) => s.trim()).filter(Boolean))
+    .option('--secret-env <name>', 'Environment-variable name where you\'ll stash the secret (recorded in .haystack.json)')
+    .option('--repo <owner/name>', 'Override the inferred repo')
+    .action(async (opts) => {
+    try {
+        await registerWebhook(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('register failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('list')
+    .description('List active webhook registrations for the current repo')
+    .option('--repo <owner/name>', 'Override the inferred repo')
+    .option('--json', 'Machine-readable JSON output')
+    .action(async (opts) => {
+    try {
+        await listWebhooks(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('list failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('rotate-secret <id>')
+    .description('Rotate the HMAC secret for a registration (prints the new secret once)')
+    .action(async (id) => {
+    try {
+        await rotateWebhookSecret(id);
+    }
+    catch (err) {
+        console.error(chalk.red('rotate-secret failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('disable <id>')
+    .description('Disable a registration (stops delivery; existing in-flight retries continue)')
+    .action(async (id) => {
+    try {
+        await setWebhookEnabled(id, false);
+    }
+    catch (err) {
+        console.error(chalk.red('disable failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('enable <id>')
+    .description('Re-enable a previously disabled registration')
+    .action(async (id) => {
+    try {
+        await setWebhookEnabled(id, true);
+    }
+    catch (err) {
+        console.error(chalk.red('enable failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('deliveries')
+    .description('Show recent webhook delivery attempts for the current repo')
+    .option('--repo <owner/name>', 'Override the inferred repo')
+    .option('--limit <n>', 'Number of deliveries (default 20)', (v) => parseInt(v, 10))
+    .option('--json', 'Machine-readable JSON output')
+    .action(async (opts) => {
+    try {
+        await listDeliveries(opts);
+    }
+    catch (err) {
+        console.error(chalk.red('deliveries failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+webhooks
+    .command('replay <id>')
+    .description('Replay a previous delivery (idempotent via X-Haystack-Delivery)')
+    .action(async (id) => {
+    try {
+        await replayDelivery(id);
+    }
+    catch (err) {
+        console.error(chalk.red('replay failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+// ─── rules ───────────────────────────────────────────────────────────────────
+const rules = program.command('rules').description('Manage .haystack/pr-rules.yml');
+rules
+    .command('edit')
+    .description('Open .haystack/pr-rules.yml in $EDITOR (creates a starter if missing)')
+    .action(async () => {
+    try {
+        await editRulesCommand();
+    }
+    catch (err) {
+        console.error(chalk.red('edit failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+rules
+    .command('validate')
+    .description('Parse pr-rules.yml with the same parser the server uses')
+    .action(async () => {
+    try {
+        await validateRulesCommand();
+    }
+    catch (err) {
+        console.error(chalk.red('validate failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+// ─── mcp ─────────────────────────────────────────────────────────────────────
+program
+    .command('mcp')
+    .description('Run a stdio MCP server exposing Haystack tools to Claude Code, Cursor, etc.')
+    .action(async () => {
+    try {
+        await runMcpServer();
+    }
+    catch (err) {
+        console.error(chalk.red('mcp server failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
 // Show help if no command provided
 if (process.argv.length === 2) {
     program.help();

package/dist/schema.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Stable machine-readable schema versions for each `--json` output.
+ *
+ * Bump semantics (per docs/SPEC-CLI-FIRST-CLASS.md):
+ *   patch — additive fields only
+ *   minor — field deprecated (kept emitting for one minor with _deprecated: true)
+ *   major — removal / rename
+ *
+ * One schema, two transports: every webhook payload for the corresponding noun
+ * uses the same envelope as the `--json` output, byte-for-byte.
+ */
+export declare const SCHEMA_VERSIONS: {
+    readonly triage: "1.0.0";
+    readonly setup: "1.0.0";
+    readonly pr: "1.0.0";
+};
+export type SchemaName = keyof typeof SCHEMA_VERSIONS;
+/** Wrap a payload with the `schema_version` envelope. */
+export declare function withSchema<T extends Record<string, unknown>>(name: SchemaName, payload: T): T & {
+    schema_version: string;
+};

package/dist/schema.js

@@ -0,0 +1,20 @@
+/**
+ * Stable machine-readable schema versions for each `--json` output.
+ *
+ * Bump semantics (per docs/SPEC-CLI-FIRST-CLASS.md):
+ *   patch — additive fields only
+ *   minor — field deprecated (kept emitting for one minor with _deprecated: true)
+ *   major — removal / rename
+ *
+ * One schema, two transports: every webhook payload for the corresponding noun
+ * uses the same envelope as the `--json` output, byte-for-byte.
+ */
+export const SCHEMA_VERSIONS = {
+    triage: '1.0.0',
+    setup: '1.0.0',
+    pr: '1.0.0',
+};
+/** Wrap a payload with the `schema_version` envelope. */
+export function withSchema(name, payload) {
+    return { schema_version: SCHEMA_VERSIONS[name], ...payload };
+}

package/dist/triage/runner.js

@@ -10,6 +10,7 @@ import { join } from 'path';
 import chalk from 'chalk';
 import { buildCodeReviewPrompt, buildRulesValidatorPrompt, buildIntentDriftPrompt } from './prompts.js';
 import { findRelevantTraces } from './traces.js';
+import { resolveDiffBaseRef } from '../utils/git.js';
 import { trackError } from '../utils/telemetry.js';
 // ============================================================================
 // Constants
@@ -272,11 +273,20 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
         rmSync(triageDir, { recursive: true });
     }
     mkdirSync(triageDir, { recursive: true });
+    // Resolve the ref to diff against once. Prefers origin/<base> over the bare
+    // local <base> ref (which is often stale and balloons the diff with already-
+    // merged code). Every git read below — the precomputed diff, the agent diff
+    // commands in the prompts, and the changed-file scan in findRelevantTraces —
+    // uses this single resolved ref so they all see the same fork point.
+    const diffBaseRef = resolveDiffBaseRef(baseBranch);
+    if (diffBaseRef !== baseBranch) {
+        console.log(chalk.dim(`  Diff base: ${diffBaseRef}`));
+    }
     // Pre-compute the diff once so sub-agents don't waste turns running git diff.
     // Includes 10 lines of context around each hunk for reviewability.
     let precomputedDiff = null;
     try {
-        const diffOutput = execSync(`git diff ${baseBranch}...HEAD -U10`, { cwd: gitRoot, encoding: 'utf-8', maxBuffer: 5 * 1024 * 1024 }).trim();
+        const diffOutput = execSync(`git diff ${diffBaseRef}...HEAD -U10`, { cwd: gitRoot, encoding: 'utf-8', maxBuffer: 5 * 1024 * 1024 }).trim();
         // Only inline if the diff is under 100K chars — beyond that, let the agent
         // run git diff itself (it can paginate or review file-by-file).
         if (diffOutput.length > 0 && diffOutput.length <= 100_000) {
@@ -292,7 +302,7 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
     const codeReviewOutput = join(triageDir, 'code-review.json');
     checkers.push({
         name: 'code-review',
-        prompt: buildCodeReviewPrompt(baseBranch, codeReviewOutput, maxTurns['code-review'], timeoutMs, precomputedDiff),
+        prompt: buildCodeReviewPrompt(diffBaseRef, codeReviewOutput, maxTurns['code-review'], timeoutMs, precomputedDiff),
         outputFile: codeReviewOutput,
         maxTurns: maxTurns['code-review'],
     });
@@ -303,7 +313,7 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
     const agentPolicyFiles = discoverAgentPolicyFiles(gitRoot);
     if (hasRulesYaml || agentPolicyFiles.length > 0) {
         const rulesValidatorOutput = join(triageDir, 'rules-validator.json');
-        const rulesPrompt = buildRulesValidatorPrompt(baseBranch, rulesYaml, rulesValidatorOutput, maxTurns['rules-validator'], timeoutMs, agentPolicyFiles, precomputedDiff);
+        const rulesPrompt = buildRulesValidatorPrompt(diffBaseRef, rulesYaml, rulesValidatorOutput, maxTurns['rules-validator'], timeoutMs, agentPolicyFiles, precomputedDiff);
         if (rulesPrompt) {
             checkers.push({
                 name: 'rules-validator',
@@ -314,10 +324,10 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
         }
     }
     // 3. Intent drift (only if relevant trace files exist)
-    const traceFiles = findRelevantTraces(gitRoot, baseBranch);
+    const traceFiles = findRelevantTraces(gitRoot, diffBaseRef);
     if (traceFiles.length > 0) {
         const intentDriftOutput = join(triageDir, 'intent-drift.json');
-        const driftPrompt = buildIntentDriftPrompt(baseBranch, traceFiles, intentDriftOutput, maxTurns['intent-drift'], timeoutMs, precomputedDiff);
+        const driftPrompt = buildIntentDriftPrompt(diffBaseRef, traceFiles, intentDriftOutput, maxTurns['intent-drift'], timeoutMs, precomputedDiff);
         if (driftPrompt) {
             checkers.push({
                 name: 'intent-drift',

package/dist/utils/analysis-api.d.ts

@@ -15,8 +15,18 @@ export interface AnalysisVerdict {
     summary: string;
     issues: AnalysisIssue[];
     reviewUrl: string;
-    /** Whether the PR was auto-merged after analysis */
+    /**
+     * Whether the PR has actually been merged on GitHub. Read from the GH
+     * REST PR endpoint — NOT inferred from review policy / canAutoMerge /
+     * haystackRating, all of which mean "eligible", not "merged".
+     */
     autoMerged?: boolean;
+    /**
+     * Whether the rating synthesis flagged that a human reviewer is required
+     * (review policy, security-sensitive paths, etc.). Distinct from
+     * `state === 'needs-input'` — analysis can be clean AND still need a human.
+     */
+    needsHumanReview?: boolean;
 }
 export interface AnalysisIssue {
     file: string;
@@ -55,7 +65,7 @@ export interface HumanReviewReason {
 }
 export interface RatingSynthesis {
     haystackRating: 1 | 2 | 3 | 4 | 5;
-    analysisVerdict?: 'clean' | 'has-issues';
+    analysisVerdict?: 'clean' | 'has-issues' | 'needs-review';
     synthesis: string;
     synthesisDisplay?: SynthesisDisplayIssue[];
     verifiedBugs: VerifiedBug[];
@@ -99,9 +109,6 @@ export type AnalysisReadyResult = {
  * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.
  */
 export declare function checkAnalysisReady(owner: string, repo: string, prNumber: number, token?: string): Promise<AnalysisReadyResult>;
-/**
- * Fetch analysis results once complete. Combines bug detection and rule violations.
- */
 export declare function fetchAnalysisResults(owner: string, repo: string, prNumber: number, token?: string): Promise<AnalysisVerdict>;
 /**
  * Fetch the full rating synthesis for a PR.