@haystackeditor/cli 0.15.12 → 0.15.14

package/dist/commands/init.js

@@ -4,8 +4,10 @@
  * Creates .haystack.json with auto-detected settings.
  */
 import chalk from 'chalk';
+import * as fs from 'fs/promises';
 import * as path from 'path';
 import { detectProject } from '../utils/detect.js';
+import { parseRemoteUrl, UnsupportedRemoteUrlError } from '../utils/git.js';
 import { saveConfig, configExists } from '../utils/config.js';
 import { validateConfigSecurity, formatSecurityReport } from '../utils/secrets.js';
 export async function initCommand(options) {
@@ -32,7 +34,10 @@ export async function initCommand(options) {
     }
     console.log('');
     // Build config from detection (no interactive prompts)
-    const config = buildConfigFromDetection(detected);
+    const config = await buildConfigFromDetection(detected);
+    if (config.dev_server) {
+        console.log(`  Dev server: ${chalk.bold(config.dev_server.command)} (port ${config.dev_server.port})\n`);
+    }
     const configPath = await saveConfig(config);
     console.log(chalk.green(`✓ Created ${configPath}`));
     // Security validation
@@ -53,12 +58,14 @@ async function runSecurityCheck(configPath) {
         console.log(chalk.dim('\n' + formatSecurityReport(findings)));
     }
 }
-function buildConfigFromDetection(detected) {
+async function buildConfigFromDetection(detected) {
     const env = {};
     if (detected.suggestedAuthBypass) {
         const [key, value] = detected.suggestedAuthBypass.split('=');
         env[key] = value || 'true';
     }
+    const pkgJson = await readPackageJson();
+    const name = resolveProjectName(pkgJson);
     if (detected.isMonorepo && detected.services?.length) {
         const services = {};
         for (const s of detected.services) {
@@ -74,12 +81,72 @@ function buildConfigFromDetection(detected) {
         }
         return {
             version: '1',
-            name: path.basename(process.cwd()),
+            name,
             services,
         };
     }
+    const devServer = buildDevServer(detected, pkgJson?.scripts, env);
     return {
         version: '1',
-        name: path.basename(process.cwd()),
+        name,
+        ...(devServer ? { dev_server: devServer } : {}),
     };
 }
+/**
+ * Prefer the GitHub repo name, then package.json name, then the directory
+ * name. The directory basename alone is often a worktree or clone-dir name
+ * that has nothing to do with the project.
+ */
+function resolveProjectName(pkgJson) {
+    try {
+        return parseRemoteUrl().repo;
+    }
+    catch (err) {
+        // Classify by type, not message text (PR007). A remote that exists but
+        // isn't recognized deserves a warning — the fallback name may not match
+        // the repo. A missing remote/repo is normal for fresh projects.
+        if (err instanceof UnsupportedRemoteUrlError) {
+            console.log(chalk.yellow(`⚠ Git remote URL not recognized (${err.message}); using package.json/directory name instead`));
+        }
+        else {
+            console.log(chalk.dim('  No git remote found; using package.json/directory name'));
+        }
+    }
+    return pkgJson?.name || path.basename(process.cwd());
+}
+/**
+ * Build a dev_server block for single-repo projects, but only when there is
+ * real evidence of one: a dev/start script in package.json. Without that
+ * gate we'd fabricate commands like `npm dev` that don't exist.
+ */
+function buildDevServer(detected, scripts, env) {
+    const script = scripts?.dev ? 'dev' : scripts?.start ? 'start' : null;
+    if (!script)
+        return undefined;
+    const pm = detected.packageManager;
+    // npm and bun need the `run` form; pnpm/yarn run scripts directly.
+    const command = pm === 'npm' || pm === 'bun' ? `${pm} run ${script}` : `${pm} ${script}`;
+    return {
+        command,
+        port: detected.suggestedPort || 3000,
+        ready_pattern: detected.suggestedReadyPattern || 'ready|started|listening|Local:',
+        ...(Object.keys(env).length > 0 ? { env } : {}),
+    };
+}
+async function readPackageJson() {
+    try {
+        const raw = await fs.readFile(path.join(process.cwd(), 'package.json'), 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        // A missing package.json is normal (non-Node projects). Anything else —
+        // unreadable file, malformed JSON — degrades name resolution and
+        // dev-server detection, so say so instead of silently falling back.
+        if (err.code === 'ENOENT') {
+            return null;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        console.log(chalk.yellow(`⚠ Could not read package.json (${message}); skipping dev-server detection`));
+        return null;
+    }
+}

package/dist/commands/setup.js

@@ -94,32 +94,31 @@ const SEVERITY_LABELS = {
     medium: 'Medium',
     low: 'Low',
 };
-async function fetchUserRepos(token) {
-    const repos = [];
-    let page = 1;
-    // Fetch up to 200 repos (non-archived, sorted by recent push)
-    while (page <= 2) {
-        const response = await fetch(`${GITHUB_API}/user/repos?sort=pushed&per_page=100&page=${page}&type=owner`, {
-            headers: {
-                Authorization: `Bearer ${token}`,
-                Accept: 'application/vnd.github.v3+json',
-                'User-Agent': 'Haystack-CLI',
-            },
-        });
-        if (!response.ok) {
-            throw new Error(`Failed to fetch repos: ${response.status}`);
+// =============================================================================
+// GitHub API helpers
+// =============================================================================
+/**
+ * Source the onboarding repo list from the user's Haystack GitHub App
+ * installations (resolved server-side with the App JWT via
+ * /api/github/user-installations) instead of `GET /user/repos` with the user's
+ * OAuth token. Every repo here is covered by an installation, so the picker can
+ * only ever offer repos Haystack can actually access — no OAuth GitHub-data call,
+ * and no "access denied" downstream when a chosen repo turns out not to be
+ * install-covered. Sorted most-recently-pushed first.
+ */
+async function fetchInstallCoveredRepos(token) {
+    const installations = await fetchHaystackInstallations(token);
+    const pushedByName = new Map();
+    for (const inst of installations) {
+        for (const repo of inst.repositories ?? []) {
+            if (repo?.full_name && !pushedByName.has(repo.full_name)) {
+                pushedByName.set(repo.full_name, repo.pushed_at ?? '');
+            }
         }
-        const batch = (await response.json());
-        if (batch.length === 0)
-            break;
-        repos.push(...batch);
-        if (batch.length < 100)
-            break;
-        page++;
     }
-    return repos
-        .filter((r) => !r.archived)
-        .map((r) => r.full_name);
+    return [...pushedByName.entries()]
+        .sort((a, b) => b[1].localeCompare(a[1])) // ISO pushed_at desc → recent first
+        .map(([fullName]) => fullName);
 }
 // Bootstrap PR constants — kept in sync with the web wizard
 // (src/features/onboarding/services/onboardingApi.ts). The branch prefix and
@@ -762,9 +761,10 @@ async function stepEnsureAppInstalled(token) {
 async function stepSelectRepos(token) {
     console.log(chalk.bold('\n  Step 1: Select repositories\n'));
     console.log(chalk.dim('  Fetching your repositories...'));
-    const repos = await fetchUserRepos(token);
+    const repos = await fetchInstallCoveredRepos(token);
     if (repos.length === 0) {
-        console.log(chalk.yellow('\n  No repositories found.\n'));
+        console.log(chalk.yellow('\n  No repositories found on your Haystack App installation(s).'));
+        console.log(chalk.dim(`  Add repositories to the install at ${HAYSTACK_APP_INSTALL_URL}, then re-run \`haystack setup\`.\n`));
         process.exit(1);
     }
     let selectedRepos = [];

package/dist/index.js

@@ -42,7 +42,12 @@ import { schemaCommand, listSchemas } from './commands/schema-cmd.js';
 import { registerWebhook, listWebhooks, rotateWebhookSecret, setWebhookEnabled, listDeliveries, replayDelivery, } from './commands/webhooks.js';
 import { editRulesCommand, validateRulesCommand } from './commands/rules.js';
 import { headlessLoginCommand, headlessLogoutCommand, listTokensCommand, revokeTokenCommand, } from './commands/tokens.js';
-import { runMcpServer } from './commands/mcp.js';
+// `mcp` is imported lazily inside its command action (below), NOT at the top level.
+// It is the only module that pulls in `@modelcontextprotocol/sdk`; keeping it out of
+// the startup import graph means a missing/broken SDK can never crash core commands
+// like `triage`/`submit`. (0.15.12 shipped `mcp.js` but published its package.json
+// WITHOUT `@modelcontextprotocol/sdk`, so the eager import here hard-crashed every
+// command at startup with ERR_MODULE_NOT_FOUND.)
 // pr-state read helpers (parsePrRef, prReadCommand) are imported by the MCP
 // server directly from ./commands/pr.js; no top-level CLI command is wired
 // here. The previous `pr <ref> [show|merge|snooze|dismiss]` and `fix <ref>`
@@ -818,10 +823,19 @@ program
     .description('Run a stdio MCP server exposing Haystack tools to Claude Code, Cursor, etc.')
     .action(async () => {
     try {
+        // Lazy import: only this command needs @modelcontextprotocol/sdk, so we keep it
+        // out of the startup graph (see the note where the eager import used to be).
+        const { runMcpServer } = await import('./commands/mcp.js');
         await runMcpServer();
     }
     catch (err) {
-        console.error(chalk.red('mcp server failed:'), err instanceof Error ? err.message : err);
+        const code = err?.code;
+        if (code === 'ERR_MODULE_NOT_FOUND') {
+            console.error(chalk.red('mcp server failed:'), 'the @modelcontextprotocol/sdk package is missing. Reinstall the CLI to pull it in (e.g. `npm i -g @haystackeditor/cli@latest`).');
+        }
+        else {
+            console.error(chalk.red('mcp server failed:'), err instanceof Error ? err.message : err);
+        }
         process.exit(1);
     }
 });

package/dist/utils/detect.js

@@ -283,7 +283,9 @@ async function detectAuthBypass(rootDir) {
             // File not found
         }
     }
-    return 'SKIP_AUTH=true'; // Default suggestion
+    // No evidence of an auth-bypass variable — suggest nothing rather than
+    // fabricating a SKIP_AUTH the app doesn't read.
+    return undefined;
 }
 /**
  * Set suggestions based on detected framework

package/dist/utils/git.js

@@ -3,7 +3,7 @@
  *
  * Provides functions for git operations: branch management, push, remote parsing.
  */
-import { execSync } from 'child_process';
+import { execFileSync, execSync } from 'child_process';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -369,7 +369,7 @@ export function getCommitMessagesSinceBase(baseBranch) {
 /** True if `ref` resolves to a commit in the current repo. */
 function gitRefResolves(ref) {
     try {
-        execSync(`git rev-parse --verify --quiet ${ref}^{commit}`, {
+        execFileSync('git', ['rev-parse', '--verify', '--quiet', '--', `${ref}^{commit}`], {
             stdio: ['pipe', 'pipe', 'pipe'],
         });
         return true;
@@ -382,7 +382,7 @@ function gitRefResolves(ref) {
 function gitIsAncestor(ancestor, descendant) {
     try {
         // exit 0 => ancestor; exit 1 => not; both non-throwing for us via stdio pipe
-        execSync(`git merge-base --is-ancestor ${ancestor} ${descendant}`, {
+        execFileSync('git', ['merge-base', '--is-ancestor', '--', ancestor, descendant], {
             stdio: ['pipe', 'pipe', 'pipe'],
         });
         return true;
@@ -440,7 +440,7 @@ export function resolveDiffBaseRef(baseBranch) {
     // if <base> was rewound on the remote).
     let fetched = false;
     try {
-        execSync(`git fetch origin +refs/heads/${baseBranch}:${remoteRef}`, {
+        execFileSync('git', ['fetch', 'origin', `+refs/heads/${baseBranch}:${remoteRef}`], {
             stdio: ['pipe', 'pipe', 'pipe'],
         });
         fetched = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.12",
+  "version": "0.15.14",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {
@@ -34,6 +34,7 @@
     "url": "https://github.com/haystackeditor/haystack-review/issues"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "1.26.0",
     "chalk": "5.6.2",
     "commander": "12.1.0",
     "fast-glob": "3.3.3",