@haystackeditor/cli 0.15.11 → 0.15.12

package/dist/commands/submit.js

@@ -433,7 +433,16 @@ export async function submitCommand(options) {
         try {
             await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-merge'], githubToken);
             await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-merge'], githubToken);
-            console.log(chalk.green('✓ Auto-merge enabled for this PR'));
+            // With --review, the PR still enters the auto-merge queue but the
+            // merge queue's needs-review gate holds it until a human approves
+            // (removes haystack:needs-review or marks it reviewed). Don't print a
+            // bare "Auto-merge enabled" that reads as if it'll merge unreviewed.
+            if (options.review) {
+                console.log(chalk.green('✓ Auto-merge enabled (held until a human approves this PR)'));
+            }
+            else {
+                console.log(chalk.green('✓ Auto-merge enabled for this PR'));
+            }
         }
         catch (err) {
             console.log(chalk.yellow(`⚠ Could not set auto-merge label: ${err.message}`));
@@ -482,7 +491,15 @@ export async function submitCommand(options) {
     console.log(`  ${chalk.dim('Title:')}  ${options.title || getLastCommitMessage()}`);
     console.log(`  ${chalk.dim('Branch:')} ${currentBranch} → ${baseBranch}`);
     if (options.autoMerge) {
-        console.log(`  ${chalk.dim('Merge:')}  ${chalk.green('Auto-merge if safe')}`);
+        // --review and auto-merge are not contradictory: the PR is queued but the
+        // merge queue's needs-review gate blocks the merge until a human approves.
+        // Report it that way instead of a flat "Auto-merge if safe".
+        if (options.review) {
+            console.log(`  ${chalk.dim('Merge:')}  ${chalk.yellow('Held for human review, then auto-merge')}`);
+        }
+        else {
+            console.log(`  ${chalk.dim('Merge:')}  ${chalk.green('Auto-merge if safe')}`);
+        }
     }
     if (options.autoFix) {
         console.log(`  ${chalk.dim('Fix:')}    ${chalk.cyan('Auto-fix alpha enabled')}`);

package/dist/triage/runner.js

@@ -10,6 +10,7 @@ import { join } from 'path';
 import chalk from 'chalk';
 import { buildCodeReviewPrompt, buildRulesValidatorPrompt, buildIntentDriftPrompt } from './prompts.js';
 import { findRelevantTraces } from './traces.js';
+import { resolveDiffBaseRef } from '../utils/git.js';
 import { trackError } from '../utils/telemetry.js';
 // ============================================================================
 // Constants
@@ -272,11 +273,20 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
         rmSync(triageDir, { recursive: true });
     }
     mkdirSync(triageDir, { recursive: true });
+    // Resolve the ref to diff against once. Prefers origin/<base> over the bare
+    // local <base> ref (which is often stale and balloons the diff with already-
+    // merged code). Every git read below — the precomputed diff, the agent diff
+    // commands in the prompts, and the changed-file scan in findRelevantTraces —
+    // uses this single resolved ref so they all see the same fork point.
+    const diffBaseRef = resolveDiffBaseRef(baseBranch);
+    if (diffBaseRef !== baseBranch) {
+        console.log(chalk.dim(`  Diff base: ${diffBaseRef}`));
+    }
     // Pre-compute the diff once so sub-agents don't waste turns running git diff.
     // Includes 10 lines of context around each hunk for reviewability.
     let precomputedDiff = null;
     try {
-        const diffOutput = execSync(`git diff ${baseBranch}...HEAD -U10`, { cwd: gitRoot, encoding: 'utf-8', maxBuffer: 5 * 1024 * 1024 }).trim();
+        const diffOutput = execSync(`git diff ${diffBaseRef}...HEAD -U10`, { cwd: gitRoot, encoding: 'utf-8', maxBuffer: 5 * 1024 * 1024 }).trim();
         // Only inline if the diff is under 100K chars — beyond that, let the agent
         // run git diff itself (it can paginate or review file-by-file).
         if (diffOutput.length > 0 && diffOutput.length <= 100_000) {
@@ -292,7 +302,7 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
     const codeReviewOutput = join(triageDir, 'code-review.json');
     checkers.push({
         name: 'code-review',
-        prompt: buildCodeReviewPrompt(baseBranch, codeReviewOutput, maxTurns['code-review'], timeoutMs, precomputedDiff),
+        prompt: buildCodeReviewPrompt(diffBaseRef, codeReviewOutput, maxTurns['code-review'], timeoutMs, precomputedDiff),
         outputFile: codeReviewOutput,
         maxTurns: maxTurns['code-review'],
     });
@@ -303,7 +313,7 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
     const agentPolicyFiles = discoverAgentPolicyFiles(gitRoot);
     if (hasRulesYaml || agentPolicyFiles.length > 0) {
         const rulesValidatorOutput = join(triageDir, 'rules-validator.json');
-        const rulesPrompt = buildRulesValidatorPrompt(baseBranch, rulesYaml, rulesValidatorOutput, maxTurns['rules-validator'], timeoutMs, agentPolicyFiles, precomputedDiff);
+        const rulesPrompt = buildRulesValidatorPrompt(diffBaseRef, rulesYaml, rulesValidatorOutput, maxTurns['rules-validator'], timeoutMs, agentPolicyFiles, precomputedDiff);
         if (rulesPrompt) {
             checkers.push({
                 name: 'rules-validator',
@@ -314,10 +324,10 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
         }
     }
     // 3. Intent drift (only if relevant trace files exist)
-    const traceFiles = findRelevantTraces(gitRoot, baseBranch);
+    const traceFiles = findRelevantTraces(gitRoot, diffBaseRef);
     if (traceFiles.length > 0) {
         const intentDriftOutput = join(triageDir, 'intent-drift.json');
-        const driftPrompt = buildIntentDriftPrompt(baseBranch, traceFiles, intentDriftOutput, maxTurns['intent-drift'], timeoutMs, precomputedDiff);
+        const driftPrompt = buildIntentDriftPrompt(diffBaseRef, traceFiles, intentDriftOutput, maxTurns['intent-drift'], timeoutMs, precomputedDiff);
         if (driftPrompt) {
             checkers.push({
                 name: 'intent-drift',

package/dist/utils/git.d.ts

@@ -90,6 +90,38 @@ export declare function getLastCommitSha(): string;
  * Returns the combined log, or empty string if no commits or on error.
  */
 export declare function getCommitMessagesSinceBase(baseBranch: string): string;
+/**
+ * Resolve the git ref to diff a PR branch against for review.
+ *
+ * A bare local `<base>` ref is frequently stale (not checked out or pulled in a
+ * while). When it sits behind HEAD's true fork point, the three-dot merge-base
+ * jumps far back in history and inflates the review diff to include code from
+ * already-merged PRs — reviewers then mis-attribute pre-existing code to this
+ * PR. So we prefer the freshly-fetched remote base. This mirrors
+ * getCommitMessagesSinceBase, which already compares against the remote base.
+ *
+ * Returns a fully-qualified ref (`refs/remotes/origin/<base>` or
+ * `refs/heads/<base>`) so a tag that happens to share the name can never shadow
+ * the ref we mean — `git rev-parse <name>` prefers refs/tags/* over both
+ * refs/heads/* and refs/remotes/*. The bare `<base>` name is only returned as a
+ * last resort when nothing qualified resolves (the eventual `git diff` then
+ * errors and the caller falls back to running it itself).
+ *
+ * Resolution:
+ *   1. Best-effort fetch the remote base (`haystack submit` is already online —
+ *      it pushes and opens a PR — so one ref fetch is cheap).
+ *   2. If the fetch succeeded, the remote-tracking ref is the authoritative
+ *      remote tip — use it (even over a local <base> with unpushed commits; the
+ *      PR will merge into the remote base, not the local one).
+ *   3. If the fetch failed (offline, private origin without ambient git creds,
+ *      base not on remote), don't blindly trust a possibly-stale *cached*
+ *      remote-tracking ref — pick whichever of it and local <base> is more
+ *      advanced (the one that is not an ancestor of the other), since a base
+ *      behind HEAD's fork point is exactly what balloons the diff.
+ *   4. Fall back to whatever single qualified ref resolves, then the bare
+ *      <base> name (preserves prior behavior rather than breaking triage).
+ */
+export declare function resolveDiffBaseRef(baseBranch: string): string;
 /**
  * Get the number of commits ahead of base branch
  */

package/dist/utils/git.js

@@ -366,6 +366,107 @@ export function getCommitMessagesSinceBase(baseBranch) {
         }
     }
 }
+/** True if `ref` resolves to a commit in the current repo. */
+function gitRefResolves(ref) {
+    try {
+        execSync(`git rev-parse --verify --quiet ${ref}^{commit}`, {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** True if `ancestor` is an ancestor of (or equal to) `descendant`. */
+function gitIsAncestor(ancestor, descendant) {
+    try {
+        // exit 0 => ancestor; exit 1 => not; both non-throwing for us via stdio pipe
+        execSync(`git merge-base --is-ancestor ${ancestor} ${descendant}`, {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolve the git ref to diff a PR branch against for review.
+ *
+ * A bare local `<base>` ref is frequently stale (not checked out or pulled in a
+ * while). When it sits behind HEAD's true fork point, the three-dot merge-base
+ * jumps far back in history and inflates the review diff to include code from
+ * already-merged PRs — reviewers then mis-attribute pre-existing code to this
+ * PR. So we prefer the freshly-fetched remote base. This mirrors
+ * getCommitMessagesSinceBase, which already compares against the remote base.
+ *
+ * Returns a fully-qualified ref (`refs/remotes/origin/<base>` or
+ * `refs/heads/<base>`) so a tag that happens to share the name can never shadow
+ * the ref we mean — `git rev-parse <name>` prefers refs/tags/* over both
+ * refs/heads/* and refs/remotes/*. The bare `<base>` name is only returned as a
+ * last resort when nothing qualified resolves (the eventual `git diff` then
+ * errors and the caller falls back to running it itself).
+ *
+ * Resolution:
+ *   1. Best-effort fetch the remote base (`haystack submit` is already online —
+ *      it pushes and opens a PR — so one ref fetch is cheap).
+ *   2. If the fetch succeeded, the remote-tracking ref is the authoritative
+ *      remote tip — use it (even over a local <base> with unpushed commits; the
+ *      PR will merge into the remote base, not the local one).
+ *   3. If the fetch failed (offline, private origin without ambient git creds,
+ *      base not on remote), don't blindly trust a possibly-stale *cached*
+ *      remote-tracking ref — pick whichever of it and local <base> is more
+ *      advanced (the one that is not an ancestor of the other), since a base
+ *      behind HEAD's fork point is exactly what balloons the diff.
+ *   4. Fall back to whatever single qualified ref resolves, then the bare
+ *      <base> name (preserves prior behavior rather than breaking triage).
+ */
+export function resolveDiffBaseRef(baseBranch) {
+    const remoteRef = `refs/remotes/origin/${baseBranch}`;
+    const localRef = `refs/heads/${baseBranch}`;
+    // Freshen the remote base so the merge-base reflects the true fork point.
+    // Fetch with a fully-qualified refspec rather than a bare
+    // `git fetch origin <base>`:
+    //   - Explicit destination: in clones whose configured fetch refspec does
+    //     not cover <base> — a `--single-branch` clone, or `haystack submit
+    //     --base release/x` — a bare fetch updates only FETCH_HEAD and leaves
+    //     refs/remotes/origin/<base> stale or absent.
+    //   - Qualified source (`refs/heads/<base>`): if the remote has both a
+    //     branch and a tag named <base> (e.g. a `release` / `v1.0` base), an
+    //     unqualified source could resolve to the tag and force the
+    //     remote-tracking ref to it, making triage diff against the tag.
+    // `+` force-updates the remote-tracking ref to the remote tip (correct even
+    // if <base> was rewound on the remote).
+    let fetched = false;
+    try {
+        execSync(`git fetch origin +refs/heads/${baseBranch}:${remoteRef}`, {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        fetched = true;
+    }
+    catch {
+        // Offline / no creds / base not on remote — fall through to degraded
+        // selection below using whatever refs already exist locally.
+    }
+    const remoteResolves = gitRefResolves(remoteRef);
+    // Happy path: we just refreshed the remote base, so it's authoritative.
+    if (fetched && remoteResolves)
+        return remoteRef;
+    // Degraded path: fetch failed (or didn't produce the ref). Prefer the more
+    // up-to-date of the cached remote ref and the local branch; only a base that
+    // lags HEAD's fork point balloons the diff, so pick the one that's ahead.
+    const localResolves = gitRefResolves(localRef);
+    if (remoteResolves && localResolves) {
+        // If the remote ref is an ancestor of the local ref, local is ahead → use it.
+        return gitIsAncestor(remoteRef, localRef) ? localRef : remoteRef;
+    }
+    if (remoteResolves)
+        return remoteRef;
+    if (localResolves)
+        return localRef;
+    return baseBranch;
+}
 /**
  * Get the number of commits ahead of base branch
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.11",
+  "version": "0.15.12",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {
@@ -11,7 +11,8 @@
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "check:schemas": "node scripts/check-schemas.mjs",
-    "prepublishOnly": "npm run build"
+    "release": "node scripts/release.mjs",
+    "prepublishOnly": "node scripts/no-direct-publish.mjs"
   },
   "keywords": [
     "haystack",