@haystackeditor/cli 0.15.13 → 0.15.14

package/dist/commands/init.js

@@ -4,8 +4,10 @@
  * Creates .haystack.json with auto-detected settings.
  */
 import chalk from 'chalk';
+import * as fs from 'fs/promises';
 import * as path from 'path';
 import { detectProject } from '../utils/detect.js';
+import { parseRemoteUrl, UnsupportedRemoteUrlError } from '../utils/git.js';
 import { saveConfig, configExists } from '../utils/config.js';
 import { validateConfigSecurity, formatSecurityReport } from '../utils/secrets.js';
 export async function initCommand(options) {
@@ -32,7 +34,10 @@ export async function initCommand(options) {
     }
     console.log('');
     // Build config from detection (no interactive prompts)
-    const config = buildConfigFromDetection(detected);
+    const config = await buildConfigFromDetection(detected);
+    if (config.dev_server) {
+        console.log(`  Dev server: ${chalk.bold(config.dev_server.command)} (port ${config.dev_server.port})\n`);
+    }
     const configPath = await saveConfig(config);
     console.log(chalk.green(`✓ Created ${configPath}`));
     // Security validation
@@ -53,12 +58,14 @@ async function runSecurityCheck(configPath) {
         console.log(chalk.dim('\n' + formatSecurityReport(findings)));
     }
 }
-function buildConfigFromDetection(detected) {
+async function buildConfigFromDetection(detected) {
     const env = {};
     if (detected.suggestedAuthBypass) {
         const [key, value] = detected.suggestedAuthBypass.split('=');
         env[key] = value || 'true';
     }
+    const pkgJson = await readPackageJson();
+    const name = resolveProjectName(pkgJson);
     if (detected.isMonorepo && detected.services?.length) {
         const services = {};
         for (const s of detected.services) {
@@ -74,12 +81,72 @@ function buildConfigFromDetection(detected) {
         }
         return {
             version: '1',
-            name: path.basename(process.cwd()),
+            name,
             services,
         };
     }
+    const devServer = buildDevServer(detected, pkgJson?.scripts, env);
     return {
         version: '1',
-        name: path.basename(process.cwd()),
+        name,
+        ...(devServer ? { dev_server: devServer } : {}),
     };
 }
+/**
+ * Prefer the GitHub repo name, then package.json name, then the directory
+ * name. The directory basename alone is often a worktree or clone-dir name
+ * that has nothing to do with the project.
+ */
+function resolveProjectName(pkgJson) {
+    try {
+        return parseRemoteUrl().repo;
+    }
+    catch (err) {
+        // Classify by type, not message text (PR007). A remote that exists but
+        // isn't recognized deserves a warning — the fallback name may not match
+        // the repo. A missing remote/repo is normal for fresh projects.
+        if (err instanceof UnsupportedRemoteUrlError) {
+            console.log(chalk.yellow(`⚠ Git remote URL not recognized (${err.message}); using package.json/directory name instead`));
+        }
+        else {
+            console.log(chalk.dim('  No git remote found; using package.json/directory name'));
+        }
+    }
+    return pkgJson?.name || path.basename(process.cwd());
+}
+/**
+ * Build a dev_server block for single-repo projects, but only when there is
+ * real evidence of one: a dev/start script in package.json. Without that
+ * gate we'd fabricate commands like `npm dev` that don't exist.
+ */
+function buildDevServer(detected, scripts, env) {
+    const script = scripts?.dev ? 'dev' : scripts?.start ? 'start' : null;
+    if (!script)
+        return undefined;
+    const pm = detected.packageManager;
+    // npm and bun need the `run` form; pnpm/yarn run scripts directly.
+    const command = pm === 'npm' || pm === 'bun' ? `${pm} run ${script}` : `${pm} ${script}`;
+    return {
+        command,
+        port: detected.suggestedPort || 3000,
+        ready_pattern: detected.suggestedReadyPattern || 'ready|started|listening|Local:',
+        ...(Object.keys(env).length > 0 ? { env } : {}),
+    };
+}
+async function readPackageJson() {
+    try {
+        const raw = await fs.readFile(path.join(process.cwd(), 'package.json'), 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        // A missing package.json is normal (non-Node projects). Anything else —
+        // unreadable file, malformed JSON — degrades name resolution and
+        // dev-server detection, so say so instead of silently falling back.
+        if (err.code === 'ENOENT') {
+            return null;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        console.log(chalk.yellow(`⚠ Could not read package.json (${message}); skipping dev-server detection`));
+        return null;
+    }
+}

package/dist/commands/setup.js

@@ -94,32 +94,31 @@ const SEVERITY_LABELS = {
     medium: 'Medium',
     low: 'Low',
 };
-async function fetchUserRepos(token) {
-    const repos = [];
-    let page = 1;
-    // Fetch up to 200 repos (non-archived, sorted by recent push)
-    while (page <= 2) {
-        const response = await fetch(`${GITHUB_API}/user/repos?sort=pushed&per_page=100&page=${page}&type=owner`, {
-            headers: {
-                Authorization: `Bearer ${token}`,
-                Accept: 'application/vnd.github.v3+json',
-                'User-Agent': 'Haystack-CLI',
-            },
-        });
-        if (!response.ok) {
-            throw new Error(`Failed to fetch repos: ${response.status}`);
+// =============================================================================
+// GitHub API helpers
+// =============================================================================
+/**
+ * Source the onboarding repo list from the user's Haystack GitHub App
+ * installations (resolved server-side with the App JWT via
+ * /api/github/user-installations) instead of `GET /user/repos` with the user's
+ * OAuth token. Every repo here is covered by an installation, so the picker can
+ * only ever offer repos Haystack can actually access — no OAuth GitHub-data call,
+ * and no "access denied" downstream when a chosen repo turns out not to be
+ * install-covered. Sorted most-recently-pushed first.
+ */
+async function fetchInstallCoveredRepos(token) {
+    const installations = await fetchHaystackInstallations(token);
+    const pushedByName = new Map();
+    for (const inst of installations) {
+        for (const repo of inst.repositories ?? []) {
+            if (repo?.full_name && !pushedByName.has(repo.full_name)) {
+                pushedByName.set(repo.full_name, repo.pushed_at ?? '');
+            }
         }
-        const batch = (await response.json());
-        if (batch.length === 0)
-            break;
-        repos.push(...batch);
-        if (batch.length < 100)
-            break;
-        page++;
     }
-    return repos
-        .filter((r) => !r.archived)
-        .map((r) => r.full_name);
+    return [...pushedByName.entries()]
+        .sort((a, b) => b[1].localeCompare(a[1])) // ISO pushed_at desc → recent first
+        .map(([fullName]) => fullName);
 }
 // Bootstrap PR constants — kept in sync with the web wizard
 // (src/features/onboarding/services/onboardingApi.ts). The branch prefix and
@@ -762,9 +761,10 @@ async function stepEnsureAppInstalled(token) {
 async function stepSelectRepos(token) {
     console.log(chalk.bold('\n  Step 1: Select repositories\n'));
     console.log(chalk.dim('  Fetching your repositories...'));
-    const repos = await fetchUserRepos(token);
+    const repos = await fetchInstallCoveredRepos(token);
     if (repos.length === 0) {
-        console.log(chalk.yellow('\n  No repositories found.\n'));
+        console.log(chalk.yellow('\n  No repositories found on your Haystack App installation(s).'));
+        console.log(chalk.dim(`  Add repositories to the install at ${HAYSTACK_APP_INSTALL_URL}, then re-run \`haystack setup\`.\n`));
         process.exit(1);
     }
     let selectedRepos = [];

package/dist/utils/detect.js

@@ -283,7 +283,9 @@ async function detectAuthBypass(rootDir) {
             // File not found
         }
     }
-    return 'SKIP_AUTH=true'; // Default suggestion
+    // No evidence of an auth-bypass variable — suggest nothing rather than
+    // fabricating a SKIP_AUTH the app doesn't read.
+    return undefined;
 }
 /**
  * Set suggestions based on detected framework

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.13",
+  "version": "0.15.14",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {