@haystackeditor/cli 0.15.15 → 0.15.17

package/dist/commands/webhooks.d.ts

@@ -1,3 +1,15 @@
+/** currentRepo() for token-account resolution. Outside a git repo there is
+ *  simply no repo context — expected for id-based commands run from anywhere,
+ *  so that case stays quiet. A remote that EXISTS but isn't recognized is a
+ *  different story: repo-scoped account defaults silently won't apply, so say
+ *  so (classified by error type per PR007). */
+export declare function tryCurrentRepo(): string | null;
+/** Token-resolution scope for adminFetch: explicit repo wins, else the cwd's
+ *  origin remote, else no scope (active account). Exported for tests. */
+export declare function resolveTokenScope(repoFullName?: string): {
+    owner: string;
+    repo: string;
+} | Record<string, never>;
 export declare function registerWebhook(opts: {
     url: string;
     events?: string[];
@@ -8,11 +20,11 @@ export declare function listWebhooks(opts: {
     repo?: string;
     json?: boolean;
 }): Promise<void>;
-export declare function rotateWebhookSecret(id: string): Promise<void>;
-export declare function setWebhookEnabled(id: string, enabled: boolean): Promise<void>;
+export declare function rotateWebhookSecret(id: string, repo?: string): Promise<void>;
+export declare function setWebhookEnabled(id: string, enabled: boolean, repo?: string): Promise<void>;
 export declare function listDeliveries(opts: {
     repo?: string;
     limit?: number;
     json?: boolean;
 }): Promise<void>;
-export declare function replayDelivery(id: string): Promise<void>;
+export declare function replayDelivery(id: string, repo?: string): Promise<void>;

package/dist/commands/webhooks.js

@@ -11,9 +11,11 @@
  *     to create the registration row and obtain the HMAC secret.
  *
  *   Remote queries (`list`, `deliveries`, `rotate-secret`, `replay`, etc.)
- *     Hit the worker's /admin endpoints. Auth is CF Access on the worker
- *     side; the CLI relies on the operator having a CF Access session
- *     (cookie or service-token).
+ *     Hit the worker's /admin endpoints with the user's Bearer token
+ *     (introspected server-side; push access to the target repo required).
+ *     Account resolution is repo-scoped so `haystack login` repoDefaults
+ *     apply; id-based commands accept --repo when run outside the repo's
+ *     checkout.
  *
  * Secret handling:
  *   The worker returns the freshly-minted HMAC secret ONCE, on register or
@@ -24,7 +26,7 @@
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { resolve } from 'node:path';
 import chalk from 'chalk';
-import { parseRemoteUrl } from '../utils/git.js';
+import { parseRemoteUrl, UnsupportedRemoteUrlError } from '../utils/git.js';
 import { loadToken } from '../utils/auth.js';
 const DEFAULT_WORKER_URL = process.env.HAYSTACK_WEBHOOKS_URL ??
     'https://haystack-webhooks.akshaysg.workers.dev';
@@ -57,8 +59,40 @@ function currentRepo() {
     const r = parseRemoteUrl('origin');
     return `${r.owner}/${r.repo}`;
 }
-async function adminFetch(path, init = {}) {
-    const token = await loadToken();
+/** currentRepo() for token-account resolution. Outside a git repo there is
+ *  simply no repo context — expected for id-based commands run from anywhere,
+ *  so that case stays quiet. A remote that EXISTS but isn't recognized is a
+ *  different story: repo-scoped account defaults silently won't apply, so say
+ *  so (classified by error type per PR007). */
+export function tryCurrentRepo() {
+    try {
+        return currentRepo();
+    }
+    catch (err) {
+        if (err instanceof UnsupportedRemoteUrlError) {
+            process.stderr.write(chalk.dim(`  [origin remote not recognized (${err.message}); using the active account, not repo defaults]\n`));
+        }
+        return null;
+    }
+}
+/** Token-resolution scope for adminFetch: explicit repo wins, else the cwd's
+ *  origin remote, else no scope (active account). Exported for tests. */
+export function resolveTokenScope(repoFullName) {
+    const target = repoFullName ?? tryCurrentRepo();
+    if (!target || !target.includes('/'))
+        return {};
+    const [owner, repo] = target.split('/');
+    if (!owner || !repo)
+        return {};
+    return { owner, repo };
+}
+async function adminFetch(path, init = {}, repoFullName) {
+    // Resolve the token FOR THE TARGET REPO so `haystack login`'s repoDefaults
+    // apply, matching every other repo-scoped command (triage, submit). A bare
+    // loadToken() used the active account regardless of repo — with multiple
+    // saved accounts, register/list could 403 with "no push access" even
+    // though the repo's default account had admin (found 2026-07-06).
+    const token = await loadToken(resolveTokenScope(repoFullName));
     const headers = {
         'Content-Type': 'application/json',
         ...(init.headers ?? {}),
@@ -99,7 +133,7 @@ export async function registerWebhook(opts) {
     const res = await adminFetch('/admin/registrations', {
         method: 'POST',
         body: { repo, url: opts.url, events },
-    });
+    }, repo);
     const data = (await readJsonOrFail(res));
     // Update .haystack.json. Append; do not overwrite an existing entry — the
     // operator may want multiple webhooks pointing at different endpoints.
@@ -132,7 +166,7 @@ export async function registerWebhook(opts) {
 // ─── list ────────────────────────────────────────────────────────────────────
 export async function listWebhooks(opts) {
     const repo = opts.repo ?? currentRepo();
-    const res = await adminFetch(`/admin/registrations?repo=${encodeURIComponent(repo)}`);
+    const res = await adminFetch(`/admin/registrations?repo=${encodeURIComponent(repo)}`, {}, repo);
     const data = (await readJsonOrFail(res));
     if (opts.json) {
         console.log(JSON.stringify(data, null, 2));
@@ -154,10 +188,10 @@ export async function listWebhooks(opts) {
     }
 }
 // ─── rotate-secret ───────────────────────────────────────────────────────────
-export async function rotateWebhookSecret(id) {
+export async function rotateWebhookSecret(id, repo) {
     const res = await adminFetch(`/admin/registrations/${encodeURIComponent(id)}/rotate-secret`, {
         method: 'POST',
-    });
+    }, repo);
     const data = (await readJsonOrFail(res));
     console.log(chalk.green('✓ Secret rotated'));
     console.log('');
@@ -167,11 +201,11 @@ export async function rotateWebhookSecret(id) {
     console.log(chalk.red.bold('The previous secret is now invalid. Update your receiver before the next event fires.'));
 }
 // ─── enable / disable ────────────────────────────────────────────────────────
-export async function setWebhookEnabled(id, enabled) {
+export async function setWebhookEnabled(id, enabled, repo) {
     const action = enabled ? 'enable' : 'disable';
     const res = await adminFetch(`/admin/registrations/${encodeURIComponent(id)}/${action}`, {
         method: 'POST',
-    });
+    }, repo);
     await readJsonOrFail(res);
     console.log(chalk.green(`✓ Webhook ${id} ${action}d`));
 }
@@ -179,7 +213,7 @@ export async function setWebhookEnabled(id, enabled) {
 export async function listDeliveries(opts) {
     const repo = opts.repo ?? currentRepo();
     const limit = opts.limit ?? 20;
-    const res = await adminFetch(`/admin/deliveries?repo=${encodeURIComponent(repo)}&limit=${limit}`);
+    const res = await adminFetch(`/admin/deliveries?repo=${encodeURIComponent(repo)}&limit=${limit}`, {}, repo);
     const data = (await readJsonOrFail(res));
     if (opts.json) {
         console.log(JSON.stringify(data, null, 2));
@@ -201,10 +235,10 @@ export async function listDeliveries(opts) {
             console.log(`  ${chalk.dim('error:')} ${d.last_error}`);
     }
 }
-export async function replayDelivery(id) {
+export async function replayDelivery(id, repo) {
     const res = await adminFetch(`/admin/deliveries/${encodeURIComponent(id)}/replay`, {
         method: 'POST',
-    });
+    }, repo);
     await readJsonOrFail(res);
     console.log(chalk.green(`✓ Replay queued for ${id}`));
 }

package/dist/index.js

@@ -732,9 +732,10 @@ webhooks
 webhooks
     .command('rotate-secret <id>')
     .description('Rotate the HMAC secret for a registration (prints the new secret once)')
-    .action(async (id) => {
+    .option('--repo <owner/name>', 'Repo the registration belongs to (for account resolution outside its checkout)')
+    .action(async (id, opts) => {
     try {
-        await rotateWebhookSecret(id);
+        await rotateWebhookSecret(id, opts.repo);
     }
     catch (err) {
         console.error(chalk.red('rotate-secret failed:'), err instanceof Error ? err.message : err);
@@ -744,9 +745,10 @@ webhooks
 webhooks
     .command('disable <id>')
     .description('Disable a registration (stops delivery; existing in-flight retries continue)')
-    .action(async (id) => {
+    .option('--repo <owner/name>', 'Repo the registration belongs to (for account resolution outside its checkout)')
+    .action(async (id, opts) => {
     try {
-        await setWebhookEnabled(id, false);
+        await setWebhookEnabled(id, false, opts.repo);
     }
     catch (err) {
         console.error(chalk.red('disable failed:'), err instanceof Error ? err.message : err);
@@ -756,9 +758,10 @@ webhooks
 webhooks
     .command('enable <id>')
     .description('Re-enable a previously disabled registration')
-    .action(async (id) => {
+    .option('--repo <owner/name>', 'Repo the registration belongs to (for account resolution outside its checkout)')
+    .action(async (id, opts) => {
     try {
-        await setWebhookEnabled(id, true);
+        await setWebhookEnabled(id, true, opts.repo);
     }
     catch (err) {
         console.error(chalk.red('enable failed:'), err instanceof Error ? err.message : err);
@@ -783,9 +786,10 @@ webhooks
 webhooks
     .command('replay <id>')
     .description('Replay a previous delivery (idempotent via X-Haystack-Delivery)')
-    .action(async (id) => {
+    .option('--repo <owner/name>', 'Repo the delivery belongs to (for account resolution outside its checkout)')
+    .action(async (id, opts) => {
     try {
-        await replayDelivery(id);
+        await replayDelivery(id, opts.repo);
     }
     catch (err) {
         console.error(chalk.red('replay failed:'), err instanceof Error ? err.message : err);

package/dist/triage/prompts.js

@@ -313,7 +313,10 @@ In service of an authorized goal, the agent relaxed or removed a security, safet
 - Swallowed or silenced an error, removed an assertion/guard, hardcoded a bypass or credential
 - Disabled a test (.skip / xit), suppressed a type or lint check (any, @ts-ignore, disable comments)
 - Lowered a threshold/timeout that existed as a safeguard
+- Relaxed a CI/pipeline security or quality gate (a workflow check, audit, or validation policy) — especially so that the agent's OWN change would pass that gate
 High severity by default. (If the user explicitly asked to remove the guard, it is not a finding.)
+Tie-breaker for gate relaxations: when the agent's own work was failing a CI gate and the agent changed the gate so it would pass, that is weakened_posture even when the old gate looks buggy or overly strict, and even when a delegation ("shepherd this", "get it merged") covered the goal — whether the relaxation was right is exactly the judgment this flag hands to a human.
+Wording for weakened_posture findings: describe the decision reflectively, lede first, in plain English — sentence 1 says who weakened which protection and why ("To get this change through CI, the agent loosened the check that was blocking it"), sentence 2 gives the concrete change, then hand the call to a human. If a delegation covered the surrounding goal, say so; never claim "no user directive" when one exists. This is not an accusation of violating intent — it is a consequential decision a human should confirm.
 
 ### Claimed But Not Done
 The agent told the user it completed work that the diff does not actually contain, or contains only in a materially weaker form:
@@ -347,6 +350,7 @@ ${INTENT_DRIFT_SCHEMA}
 - Set \`passed\` to \`true\` only when no intent-drift issues are found
 - Set \`passed\` to \`false\` when any issue is found (any pattern, any severity)
 - For each issue, set \`pattern\` to one of: "intent_drift", "incomplete_fulfillment", "scope_creep", "unspecified_decision", "ignored_correction", "weakened_posture", "claimed_but_not_done"
+- Write each issue's \`message\` in plain English for the PR author, lede first (what concretely happened, then why it matters); never reference this checker's machinery ("per policy", "extracted directives", "session shape")
 - You MUST write the result file even if no issues are found
 
 ## Severity guidelines

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.15",
+  "version": "0.15.17",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {
@@ -12,7 +12,8 @@
     "start": "node dist/index.js",
     "check:schemas": "node scripts/check-schemas.mjs",
     "release": "node scripts/release.mjs",
-    "prepublishOnly": "node scripts/no-direct-publish.mjs"
+    "prepublishOnly": "node scripts/no-direct-publish.mjs",
+    "test": "vitest run"
   },
   "keywords": [
     "haystack",
@@ -48,7 +49,8 @@
     "@types/inquirer": "9.0.9",
     "@types/node": "20.19.30",
     "@types/ws": "8.18.1",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "vitest": "4.1.10"
   },
   "files": [
     "dist",