@haystackeditor/cli 0.15.16 → 0.15.18

package/dist/index.js

@@ -23,7 +23,7 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import chalk from 'chalk';
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
 import { authListCommand, authUseCommand, loginCommand, logoutCommand, whoamiCommand, } from './commands/login.js';
@@ -37,11 +37,14 @@ import { triageCommand } from './commands/triage.js';
 import { dismissCommand, markReviewedCommand, undismissCommand } from './commands/dismiss.js';
 import { requestReviewCommand } from './commands/request-review.js';
 import { prStatusCommand } from './commands/pr-status.js';
+import { prReadCommand } from './commands/pr.js';
+import { inboxListCommand } from './commands/inbox.js';
+import { askHaystackCommand } from './commands/ask.js';
+import { tracesGetCommand, tracesListCommand } from './commands/traces.js';
 import { setupCommand } from './commands/setup.js';
 import { schemaCommand, listSchemas } from './commands/schema-cmd.js';
 import { registerWebhook, listWebhooks, rotateWebhookSecret, setWebhookEnabled, listDeliveries, replayDelivery, } from './commands/webhooks.js';
 import { editRulesCommand, validateRulesCommand } from './commands/rules.js';
-import { verificationInitCommand, verificationValidateCommand, verificationPreflightCommand, verificationRunCommand, verificationCollectCommand, verificationCheckSafetyCommand, } from './commands/verification.js';
 import { headlessLoginCommand, headlessLogoutCommand, listTokensCommand, revokeTokenCommand, } from './commands/tokens.js';
 // `mcp` is imported lazily inside its command action (below), NOT at the top level.
 // It is the only module that pulls in `@modelcontextprotocol/sdk`; keeping it out of
@@ -49,11 +52,15 @@ import { headlessLoginCommand, headlessLogoutCommand, listTokensCommand, revokeT
 // like `triage`/`submit`. (0.15.12 shipped `mcp.js` but published its package.json
 // WITHOUT `@modelcontextprotocol/sdk`, so the eager import here hard-crashed every
 // command at startup with ERR_MODULE_NOT_FOUND.)
-// pr-state read helpers (parsePrRef, prReadCommand) are imported by the MCP
-// server directly from ./commands/pr.js; no top-level CLI command is wired
-// here. The previous `pr <ref> [show|merge|snooze|dismiss]` and `fix <ref>`
-// surfaces were scope creep on the CLI-as-platform spec; `haystack pr-status`
-// already covered the read use case.
+async function runPublicCommand(action) {
+    try {
+        await action();
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        process.exitCode = 1;
+    }
+}
 /** Read the published version from package.json (dist/index.js → ../package.json)
  *  so `haystack --version` can't drift from the package version. Falls back
  *  gracefully so the flag never throws if the file can't be read. */
@@ -77,7 +84,7 @@ program
     .version(getVersion());
 program
     .command('schema [name]')
-    .description('Print the JSON Schema for a command\'s --json output (triage, setup, inbox, pr, chat)')
+    .description('Print the JSON Schema for a command\'s --json output')
     .action((name) => {
     if (!name) {
         listSchemas();
@@ -237,7 +244,7 @@ program
     .option('--draft', 'Create as draft PR')
     .option('--review [reviewer]', 'Request human review (BLOCKS auto-merge — only use when explicitly asked)')
     .option('--force', 'Skip pre-PR triage checks')
-    .option('--auto-fix', 'Alpha auto-fix for straightforward mechanical issues (default: from .haystack.json preferences.auto_fix; --no-auto-fix to disable)')
+    .addOption(new Option('--auto-fix', 'Alpha auto-fix for entitled repositories').hideHelp())
     .option('--auto-merge', 'Apply auto-merge label (default: from .haystack.json, --no-auto-merge to disable)')
     .option('--no-wait', 'Skip waiting for analysis results')
     .option('--max-turns <n>', 'Max agentic turns per triage checker (overrides .haystack.json triage.maxTurns)', (v) => parseInt(v, 10))
@@ -258,8 +265,6 @@ Pre-PR Triage:
 
   Use --force to skip triage entirely.
   Use --no-wait to skip waiting for analysis results.
-  Use --auto-fix only when explicitly opting into the alpha fixer for
-  straightforward mechanical issues.
 
   Triage budgets:
   • --max-turns <n>         Raise/lower the per-checker tool-use turn cap.
@@ -282,10 +287,6 @@ Review Routing:
   enters the auto-merge queue after submission. Otherwise it still runs the
   same Haystack analysis workflow without enabling auto-merge.
 
-  ⚠ --auto-fix is currently alpha and discouraged by default. Prefer plain
-  haystack submit unless you explicitly want the sandbox fixer to attempt
-  straightforward mechanical fixes before issues hit the Feed.
-
   ⚠ Only use --review when the user EXPLICITLY asks for human review.
   --review BLOCKS auto-merge — the PR will NOT merge until a human approves,
   which delays merging. Do not add --review "just to be safe".
@@ -296,7 +297,6 @@ Review Routing:
 
 Examples:
   haystack submit                      # Recommended: triage, create PR, auto-merge queue
-  haystack submit --auto-fix           # Discouraged alpha: auto-fix straightforward mechanical issues
   haystack submit --force              # Skip triage
   haystack submit --no-wait            # Don't wait for analysis
   haystack submit --title "Fix auth"   # Custom PR title
@@ -358,6 +358,37 @@ Examples:
   haystack triage --clear                     # Clear pending state
 `)
     .action(triageCommand);
+const inbox = program.command('inbox').description('List Haystack work needing your attention');
+inbox
+    .command('list')
+    .description('List PRs in your Haystack inbox')
+    .option('--json', 'Output as JSON')
+    .action((options) => runPublicCommand(() => inboxListCommand(options)));
+const prProgram = program.command('pr').description('Inspect one pull request');
+prProgram
+    .command('get <ref>')
+    .description('Get triage, merge blockers, and trace availability')
+    .option('--json', 'Output as JSON')
+    .action((ref, options) => runPublicCommand(() => prReadCommand(ref, options)));
+program
+    .command('ask <ref> <question>')
+    .description('Ask Haystack about a pull request')
+    .option('--json', 'Output the answer and every consulted customer-facing source as JSON')
+    .option('--session <id>', 'Continue a previous Ask Haystack session')
+    .action((ref, question, options) => runPublicCommand(() => askHaystackCommand(ref, question, options)));
+const traces = program.command('traces').description('Inspect customer-owned Entire traces');
+traces
+    .command('list <ref>')
+    .description('List retained checkpoints for a pull request')
+    .option('--json', 'Output as JSON')
+    .action((ref, options) => runPublicCommand(() => tracesListCommand(ref, options)));
+traces
+    .command('get <ref> <checkpoint>')
+    .description('Get retained transcript chunks for one checkpoint')
+    .option('--cursor <cursor>', 'Zero-based chunk cursor')
+    .option('--limit <count>', 'Chunks per page', '20')
+    .option('--json', 'Output as JSON')
+    .action((ref, checkpoint, options) => runPublicCommand(() => tracesGetCommand(ref, checkpoint, options)));
 program
     .command('dismiss <pr>')
     .description('Dismiss analysis findings for a PR')
@@ -447,7 +478,7 @@ program
     .option('--json', 'Output as JSON')
     .addHelpText('after', `
 Show what bucket a PR is in within the Haystack pipeline:
-  analyzing, auto-fixing, good-to-merge, issues, needs-assignment, etc.
+  analyzing, good-to-merge, issues, needs-assignment, etc.
 
 PR identifier formats:
   123                                     PR number (uses current repo)
@@ -507,7 +538,7 @@ Examples:
 `)
     .action(handleAutoMerge);
 config
-    .command('auto-fix [action]')
+    .command('auto-fix [action]', { hidden: true })
     .description('(Alpha) Auto-fix mechanical issues on PRs submitted via haystack submit (on|off|status)')
     .addHelpText('after', `
 Actions:
@@ -698,7 +729,7 @@ section when a PR touches matching files.
 // idempotency).
 const webhooks = program
     .command('webhooks')
-    .description('Manage outbound webhooks (events: triage.completed, fixer.completed, ...)');
+    .description('Manage outbound webhooks');
 webhooks
     .command('register')
     .description('Register a webhook URL for the current repo and mint a fresh HMAC secret')
@@ -822,135 +853,6 @@ rules
         process.exit(1);
     }
 });
-// ─── verification ────────────────────────────────────────────────────────────
-//
-// Repo-local verification contract (.haystack/verification.yml): how to boot
-// the app, prove it's ready, log in as test personas, run scenarios, and
-// collect evidence into a standard artifact manifest + review packet.
-// See docs/VERIFICATION-CONTRACT.md.
-const verification = program
-    .command('verification')
-    .description('Repo verification contract — validate, run scenarios, collect evidence');
-verification
-    .command('init')
-    .description('Scaffold .haystack/verification.yml, preflight/smoke scripts, and the agent skill')
-    .option('-f, --force', 'Overwrite existing files')
-    .option('--skill', 'Only write the install-verification agent skill (hand the integration to a coding agent)')
-    .addHelpText('after', `
-Creates:
-  .haystack/verification.yml                       the verification contract
-  scripts/haystack-preflight                       app-is-ready check
-  scripts/haystack-smoke                           boot + capture-evidence smoke scenario
-  .haystack/AGENTS.md                              how agents should use the contract
-  .haystack/skills/install-verification/SKILL.md   skill for completing the integration
-
-Detection fills in framework, package manager, dev command, port, and any
-auth-bypass env var found in the repo's own env examples. Review the output —
-detection is a starting point, not truth.
-`)
-    .action(async (opts) => {
-    try {
-        await verificationInitCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('init failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('validate')
-    .description('Check whether the repo satisfies the verification contract')
-    .option('--json', 'Machine-readable report')
-    .addHelpText('after', `
-Readiness verdicts:
-  ready            all checks pass (exit 0)
-  partially_ready  usable, with gaps (exit 0)
-  not_ready        contract missing/invalid or commands broken (exit 1)
-  unsafe           contract permits real side effects, or login helpers
-                   lack a production-disabled proof (exit 2)
-`)
-    .action(async (opts) => {
-    try {
-        await verificationValidateCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('validate failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('preflight')
-    .description('Run the contract preflight — is the app up and answering?')
-    .action(async () => {
-    try {
-        await verificationPreflightCommand();
-    }
-    catch (err) {
-        console.error(chalk.red('preflight failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('run <scenario>')
-    .description('Run a contract scenario and write the artifact manifest + review packet')
-    .option('--json', 'Print the manifest as JSON')
-    .option('--setup', 'Run environment.setup first (clean-clone mode)')
-    .option('--skip-preflight', 'Skip the preflight check')
-    .option('--timeout <seconds>', 'Override the scenario timeout', (v) => parseInt(v, 10))
-    .addHelpText('after', `
-Runs preflight, then the scenario command, capturing stdout/stderr to the
-artifact directory. Ends with a status:
-  verified               scenario passed (exit 0)
-  failed                 scenario failed (exit 1)
-  environment_not_ready  setup/preflight failed before the scenario ran (exit 1)
-  unsafe_to_verify       safety policy permits real side effects (exit 2)
-
-Evidence lands in the contract's artifact_dir:
-  manifest-<scenario>.json        machine-readable evidence manifest
-  review-packet-<scenario>.md     human-readable review packet
-  logs/                           captured command output
-
-Examples:
-  haystack verification run smoke
-  haystack verification run billing_upgrade --json
-  haystack verification run smoke --setup            # clean-clone mode (CI)
-`)
-    .action(async (scenario, opts) => {
-    try {
-        await verificationRunCommand(scenario, opts);
-    }
-    catch (err) {
-        console.error(chalk.red('run failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('collect-artifacts')
-    .description('Rebuild an evidence manifest from artifacts already on disk (status: inconclusive)')
-    .option('--scenario <name>', 'Scenario name to record in the manifest')
-    .option('--json', 'Print the manifest as JSON')
-    .action(async (opts) => {
-    try {
-        await verificationCollectCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('collect-artifacts failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('check-safety')
-    .description('Verify the verification setup is safe (policy, prod-disabled proof, dev-route gating, secret scan)')
-    .option('--json', 'Machine-readable report')
-    .action(async (opts) => {
-    try {
-        await verificationCheckSafetyCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('check-safety failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
 // ─── mcp ─────────────────────────────────────────────────────────────────────
 program
     .command('mcp')

package/dist/schema.d.ts

@@ -10,9 +10,12 @@
  * uses the same envelope as the `--json` output, byte-for-byte.
  */
 export declare const SCHEMA_VERSIONS: {
-    readonly triage: "1.0.0";
+    readonly triage: "2.0.0";
     readonly setup: "1.0.0";
-    readonly pr: "1.0.0";
+    readonly pr: "2.0.0";
+    readonly inbox: "1.0.0";
+    readonly ask: "1.0.0";
+    readonly traces: "1.0.0";
 };
 export type SchemaName = keyof typeof SCHEMA_VERSIONS;
 /** Wrap a payload with the `schema_version` envelope. */

package/dist/schema.js

@@ -10,9 +10,12 @@
  * uses the same envelope as the `--json` output, byte-for-byte.
  */
 export const SCHEMA_VERSIONS = {
-    triage: '1.0.0',
+    triage: '2.0.0',
     setup: '1.0.0',
-    pr: '1.0.0',
+    pr: '2.0.0',
+    inbox: '1.0.0',
+    ask: '1.0.0',
+    traces: '1.0.0',
 };
 /** Wrap a payload with the `schema_version` envelope. */
 export function withSchema(name, payload) {

package/dist/triage/prompts.js

@@ -313,7 +313,10 @@ In service of an authorized goal, the agent relaxed or removed a security, safet
 - Swallowed or silenced an error, removed an assertion/guard, hardcoded a bypass or credential
 - Disabled a test (.skip / xit), suppressed a type or lint check (any, @ts-ignore, disable comments)
 - Lowered a threshold/timeout that existed as a safeguard
+- Relaxed a CI/pipeline security or quality gate (a workflow check, audit, or validation policy) — especially so that the agent's OWN change would pass that gate
 High severity by default. (If the user explicitly asked to remove the guard, it is not a finding.)
+Tie-breaker for gate relaxations: when the agent's own work was failing a CI gate and the agent changed the gate so it would pass, that is weakened_posture even when the old gate looks buggy or overly strict, and even when a delegation ("shepherd this", "get it merged") covered the goal — whether the relaxation was right is exactly the judgment this flag hands to a human.
+Wording for weakened_posture findings: describe the decision reflectively, lede first, in plain English — sentence 1 says who weakened which protection and why ("To get this change through CI, the agent loosened the check that was blocking it"), sentence 2 gives the concrete change, then hand the call to a human. If a delegation covered the surrounding goal, say so; never claim "no user directive" when one exists. This is not an accusation of violating intent — it is a consequential decision a human should confirm.
 
 ### Claimed But Not Done
 The agent told the user it completed work that the diff does not actually contain, or contains only in a materially weaker form:
@@ -347,6 +350,7 @@ ${INTENT_DRIFT_SCHEMA}
 - Set \`passed\` to \`true\` only when no intent-drift issues are found
 - Set \`passed\` to \`false\` when any issue is found (any pattern, any severity)
 - For each issue, set \`pattern\` to one of: "intent_drift", "incomplete_fulfillment", "scope_creep", "unspecified_decision", "ignored_correction", "weakened_posture", "claimed_but_not_done"
+- Write each issue's \`message\` in plain English for the PR author, lede first (what concretely happened, then why it matters); never reference this checker's machinery ("per policy", "extracted directives", "session shape")
 - You MUST write the result file even if no issues are found
 
 ## Severity guidelines

package/dist/utils/analysis-api.d.ts

@@ -44,6 +44,12 @@ export interface SynthesisDisplayIssue {
     detail: string;
     agentFixPrompt?: string;
     source?: string;
+    changeKey?: string;
+    filePath?: string;
+    startLine?: number;
+    endLine?: number;
+    severity?: 'critical' | 'high' | 'medium' | 'low';
+    mechanicalFix?: boolean;
 }
 export interface VerifiedBug {
     originalTitle: string;
@@ -131,6 +137,7 @@ export interface AutoFixManifest {
         reason: string;
     }>;
     timestamp: string;
+    resultSha?: string;
 }
 export declare function fetchAutoFixManifest(owner: string, repo: string, prNumber: number, token?: string): Promise<AutoFixManifest | null>;
 export declare function fetchRatingSynthesis(owner: string, repo: string, prNumber: number, token?: string): Promise<RatingSynthesis | null>;

package/dist/utils/haystack-api.d.ts

@@ -0,0 +1,20 @@
+export interface UserInstallation {
+    id: number;
+    account?: {
+        login?: string;
+    } | null;
+    repositories?: Array<{
+        full_name: string;
+        pushed_at?: string | null;
+    }>;
+}
+export interface CliIdentity {
+    login: string;
+    id: number;
+}
+export declare function haystackJson<T>(path: string, token: string, init?: RequestInit): Promise<T>;
+export declare function fetchCliIdentity(token: string): Promise<CliIdentity>;
+export declare function fetchHaystackInstallations(token: string): Promise<UserInstallation[]>;
+export declare function fetchGitHubJson<T>(path: string, token: string, init?: RequestInit): Promise<T>;
+export declare function fetchAnalysisArtifact<T>(owner: string, repo: string, prNumber: number, file: string, token: string): Promise<T | null>;
+export declare function postAskHaystack<T>(owner: string, repo: string, prNumber: number, question: string, sessionId: string | undefined, token: string): Promise<T>;

package/dist/utils/haystack-api.js

@@ -0,0 +1,66 @@
+const HAYSTACK_API_BASE = process.env.HAYSTACK_API_BASE ?? 'https://haystackeditor.com';
+function headers(token, extra) {
+    const result = new Headers(extra);
+    result.set('Authorization', `Bearer ${token}`);
+    result.set('Accept', 'application/json');
+    result.set('User-Agent', 'Haystack-CLI');
+    return result;
+}
+async function errorMessage(response) {
+    const text = await response.text().catch(() => '');
+    if (!text)
+        return `HTTP ${response.status}`;
+    try {
+        const parsed = JSON.parse(text);
+        return parsed.message ?? parsed.error ?? text;
+    }
+    catch {
+        return text;
+    }
+}
+export async function haystackJson(path, token, init = {}) {
+    const response = await fetch(`${HAYSTACK_API_BASE}${path}`, {
+        ...init,
+        headers: headers(token, init.headers),
+    });
+    if (!response.ok) {
+        throw new Error(`${response.status} ${await errorMessage(response)}`);
+    }
+    return response.json();
+}
+export async function fetchCliIdentity(token) {
+    return haystackJson('/api/cli/me', token);
+}
+export async function fetchHaystackInstallations(token) {
+    const data = await haystackJson('/api/github/user-installations', token);
+    return data.installations ?? [];
+}
+export async function fetchGitHubJson(path, token, init = {}) {
+    return haystackJson(`/api/github${path}`, token, init);
+}
+export async function fetchAnalysisArtifact(owner, repo, prNumber, file, token) {
+    const ref = encodeURIComponent(`${owner}/${repo}#${prNumber}`);
+    const response = await fetch(`${HAYSTACK_API_BASE}/api/analysis/${ref}/${file}`, {
+        headers: headers(token, { 'Cache-Control': 'no-cache' }),
+    });
+    if (response.status === 404)
+        return null;
+    if (!response.ok) {
+        throw new Error(`${response.status} ${await errorMessage(response)}`);
+    }
+    const data = await response.json();
+    if (!data || typeof data !== 'object' || !('download_url' in data) || !data.download_url) {
+        return data;
+    }
+    const download = await fetch(data.download_url, { headers: { 'User-Agent': 'Haystack-CLI' } });
+    if (!download.ok)
+        throw new Error(`Artifact download failed: HTTP ${download.status}`);
+    return download.json();
+}
+export async function postAskHaystack(owner, repo, prNumber, question, sessionId, token) {
+    return haystackJson(`/api/review-chat/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${prNumber}/ask`, token, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ question, session_id: sessionId }),
+    });
+}

package/package.json

@@ -1,19 +1,19 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.16",
+  "version": "0.15.18",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {
     "haystack": "./dist/index.js"
   },
   "scripts": {
-    "build": "tsc && rm -rf dist/assets && cp -r src/assets dist/assets",
+    "build": "rm -rf dist && tsc && cp -r src/assets dist/assets",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "check:schemas": "node scripts/check-schemas.mjs",
     "release": "node scripts/release.mjs",
     "prepublishOnly": "node scripts/no-direct-publish.mjs",
-    "test": "vitest run"
+    "test": "pnpm build && vitest run && node --test tests/*.test.mjs"
   },
   "keywords": [
     "haystack",
@@ -41,7 +41,7 @@
     "fast-glob": "3.3.3",
     "glob": "10.5.0",
     "inquirer": "9.3.8",
-    "ws": "8.19.0",
+    "ws": "8.21.0",
     "yaml": "2.8.2",
     "zod": "3.25.76"
   },

package/schemas/ask.v1.json

@@ -0,0 +1,40 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.haystackeditor.com/cli/schemas/ask.v1.json",
+  "title": "haystack ask <ref> <question> --json",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "ref", "head_sha", "answer", "evidence", "session_id"],
+  "properties": {
+    "schema_version": { "type": "string", "const": "1.0.0" },
+    "ref": { "type": "string" },
+    "head_sha": { "type": "string" },
+    "answer": { "type": "string" },
+    "session_id": { "type": "string" },
+    "evidence": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["evidence_id", "type"],
+        "propertyNames": {
+          "enum": [
+            "evidence_id", "type", "title", "body", "author", "state", "isDraft", "labels", "reviewers", "requestedReviewers", "sha",
+            "section_number", "summary", "explanation", "changes", "path", "base_sha", "head_sha", "patch", "start_line", "end_line", "content",
+            "query", "file_pattern", "matches", "files", "totalMatches", "truncated", "scope", "result", "locations", "functions", "change_key", "nodes", "caller", "context",
+            "finding_id", "category", "detail", "suggested_fix", "source", "severity", "source_changes", "test_changes", "changeKey", "testFiles",
+            "uncoveredScenarios", "coverageDescription", "assessment", "id", "filePath", "line", "side", "comments", "isResolved", "isOutdated",
+            "checks", "status", "reason", "blockingChecks", "action", "checkpointId", "commitSha", "commitMessage", "overviewSummary", "userPrompt",
+            "filesTouched", "branch", "checkpoint_id", "chunks", "total_chars", "users", "teams", "result_sha"
+          ]
+        },
+        "properties": {
+          "evidence_id": { "type": "string" },
+          "type": {
+            "type": "string",
+            "enum": ["pr_context", "change_summary", "diff", "source", "search", "call_relationship", "finding", "test_coverage", "review_thread", "ci", "merge", "trace", "suggested_reviewers", "fixer"]
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/inbox.v1.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.haystackeditor.com/cli/schemas/inbox.v1.json",
+  "title": "haystack inbox list --json",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "pull_requests"],
+  "properties": {
+    "schema_version": { "type": "string", "const": "1.0.0" },
+    "pull_requests": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["ref", "title", "head_sha", "bucket", "reason", "action"],
+        "properties": {
+          "ref": { "type": "string" },
+          "title": { "type": "string" },
+          "head_sha": { "type": "string" },
+          "bucket": { "type": "string", "enum": ["analyzing", "needs_shepherding", "needs_review", "good_to_merge"] },
+          "reason": { "type": "string" },
+          "action": { "type": "string" }
+        }
+      }
+    }
+  }
+}

package/schemas/pr.v2.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.haystackeditor.com/cli/schemas/pr.v2.json",
+  "title": "haystack pr get <ref> --json",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "ref", "title", "head_sha", "triage", "merge", "traces"],
+  "properties": {
+    "schema_version": { "type": "string", "const": "2.0.0" },
+    "ref": { "type": "string" },
+    "title": { "type": "string" },
+    "head_sha": { "type": "string" },
+    "triage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "verdict", "findings_count"],
+      "properties": {
+        "status": { "type": "string", "enum": ["pending", "complete", "failed", "stale", "unavailable"] },
+        "verdict": { "type": ["string", "null"], "enum": ["good_to_merge", "needs_review", "needs_input", null] },
+        "findings_count": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "merge": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "reason", "blocking_checks", "action"],
+      "properties": {
+        "status": { "type": "string" },
+        "reason": { "type": "string" },
+        "blocking_checks": { "type": "array", "items": { "type": "string" } },
+        "action": { "type": ["string", "null"] }
+      }
+    },
+    "traces": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["available", "count"],
+      "properties": {
+        "available": { "type": "boolean" },
+        "count": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "fixer": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "result_sha", "summary"],
+      "properties": {
+        "status": { "type": "string", "enum": ["completed", "failed"] },
+        "result_sha": { "type": "string" },
+        "summary": { "type": "string" }
+      }
+    }
+  }
+}