@haystackeditor/cli 0.15.17 → 0.15.19

package/dist/index.js

@@ -23,7 +23,7 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import chalk from 'chalk';
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
 import { authListCommand, authUseCommand, loginCommand, logoutCommand, whoamiCommand, } from './commands/login.js';
@@ -36,12 +36,16 @@ import { listPolicies, addPolicy, removePolicy, initPolicies, addInstruction } f
 import { triageCommand } from './commands/triage.js';
 import { dismissCommand, markReviewedCommand, undismissCommand } from './commands/dismiss.js';
 import { requestReviewCommand } from './commands/request-review.js';
+import { reviewCommand } from './commands/review.js';
 import { prStatusCommand } from './commands/pr-status.js';
+import { prReadCommand } from './commands/pr.js';
+import { inboxListCommand } from './commands/inbox.js';
+import { askHaystackCommand } from './commands/ask.js';
+import { tracesGetCommand, tracesListCommand } from './commands/traces.js';
 import { setupCommand } from './commands/setup.js';
 import { schemaCommand, listSchemas } from './commands/schema-cmd.js';
 import { registerWebhook, listWebhooks, rotateWebhookSecret, setWebhookEnabled, listDeliveries, replayDelivery, } from './commands/webhooks.js';
 import { editRulesCommand, validateRulesCommand } from './commands/rules.js';
-import { verificationInitCommand, verificationValidateCommand, verificationPreflightCommand, verificationRunCommand, verificationCollectCommand, verificationCheckSafetyCommand, } from './commands/verification.js';
 import { headlessLoginCommand, headlessLogoutCommand, listTokensCommand, revokeTokenCommand, } from './commands/tokens.js';
 // `mcp` is imported lazily inside its command action (below), NOT at the top level.
 // It is the only module that pulls in `@modelcontextprotocol/sdk`; keeping it out of
@@ -49,11 +53,15 @@ import { headlessLoginCommand, headlessLogoutCommand, listTokensCommand, revokeT
 // like `triage`/`submit`. (0.15.12 shipped `mcp.js` but published its package.json
 // WITHOUT `@modelcontextprotocol/sdk`, so the eager import here hard-crashed every
 // command at startup with ERR_MODULE_NOT_FOUND.)
-// pr-state read helpers (parsePrRef, prReadCommand) are imported by the MCP
-// server directly from ./commands/pr.js; no top-level CLI command is wired
-// here. The previous `pr <ref> [show|merge|snooze|dismiss]` and `fix <ref>`
-// surfaces were scope creep on the CLI-as-platform spec; `haystack pr-status`
-// already covered the read use case.
+async function runPublicCommand(action) {
+    try {
+        await action();
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        process.exitCode = 1;
+    }
+}
 /** Read the published version from package.json (dist/index.js → ../package.json)
  *  so `haystack --version` can't drift from the package version. Falls back
  *  gracefully so the flag never throws if the file can't be read. */
@@ -77,7 +85,7 @@ program
     .version(getVersion());
 program
     .command('schema [name]')
-    .description('Print the JSON Schema for a command\'s --json output (triage, setup, inbox, pr, chat)')
+    .description('Print the JSON Schema for a command\'s --json output')
     .action((name) => {
     if (!name) {
         listSchemas();
@@ -237,7 +245,7 @@ program
     .option('--draft', 'Create as draft PR')
     .option('--review [reviewer]', 'Request human review (BLOCKS auto-merge — only use when explicitly asked)')
     .option('--force', 'Skip pre-PR triage checks')
-    .option('--auto-fix', 'Alpha auto-fix for straightforward mechanical issues (default: from .haystack.json preferences.auto_fix; --no-auto-fix to disable)')
+    .addOption(new Option('--auto-fix', 'Alpha auto-fix for entitled repositories').hideHelp())
     .option('--auto-merge', 'Apply auto-merge label (default: from .haystack.json, --no-auto-merge to disable)')
     .option('--no-wait', 'Skip waiting for analysis results')
     .option('--max-turns <n>', 'Max agentic turns per triage checker (overrides .haystack.json triage.maxTurns)', (v) => parseInt(v, 10))
@@ -258,8 +266,6 @@ Pre-PR Triage:
 
   Use --force to skip triage entirely.
   Use --no-wait to skip waiting for analysis results.
-  Use --auto-fix only when explicitly opting into the alpha fixer for
-  straightforward mechanical issues.
 
   Triage budgets:
   • --max-turns <n>         Raise/lower the per-checker tool-use turn cap.
@@ -282,10 +288,6 @@ Review Routing:
   enters the auto-merge queue after submission. Otherwise it still runs the
   same Haystack analysis workflow without enabling auto-merge.
 
-  ⚠ --auto-fix is currently alpha and discouraged by default. Prefer plain
-  haystack submit unless you explicitly want the sandbox fixer to attempt
-  straightforward mechanical fixes before issues hit the Feed.
-
   ⚠ Only use --review when the user EXPLICITLY asks for human review.
   --review BLOCKS auto-merge — the PR will NOT merge until a human approves,
   which delays merging. Do not add --review "just to be safe".
@@ -296,7 +298,6 @@ Review Routing:
 
 Examples:
   haystack submit                      # Recommended: triage, create PR, auto-merge queue
-  haystack submit --auto-fix           # Discouraged alpha: auto-fix straightforward mechanical issues
   haystack submit --force              # Skip triage
   haystack submit --no-wait            # Don't wait for analysis
   haystack submit --title "Fix auth"   # Custom PR title
@@ -358,6 +359,37 @@ Examples:
   haystack triage --clear                     # Clear pending state
 `)
     .action(triageCommand);
+const inbox = program.command('inbox').description('List Haystack work needing your attention');
+inbox
+    .command('list')
+    .description('List PRs in your Haystack inbox')
+    .option('--json', 'Output as JSON')
+    .action((options) => runPublicCommand(() => inboxListCommand(options)));
+const prProgram = program.command('pr').description('Inspect one pull request');
+prProgram
+    .command('get <ref>')
+    .description('Get triage, merge blockers, and trace availability')
+    .option('--json', 'Output as JSON')
+    .action((ref, options) => runPublicCommand(() => prReadCommand(ref, options)));
+program
+    .command('ask <ref> <question>')
+    .description('Ask Haystack about a pull request')
+    .option('--json', 'Output the answer and every consulted customer-facing source as JSON')
+    .option('--session <id>', 'Continue a previous Ask Haystack session')
+    .action((ref, question, options) => runPublicCommand(() => askHaystackCommand(ref, question, options)));
+const traces = program.command('traces').description('Inspect customer-owned Entire traces');
+traces
+    .command('list <ref>')
+    .description('List retained checkpoints for a pull request')
+    .option('--json', 'Output as JSON')
+    .action((ref, options) => runPublicCommand(() => tracesListCommand(ref, options)));
+traces
+    .command('get <ref> <checkpoint>')
+    .description('Get retained transcript chunks for one checkpoint')
+    .option('--cursor <cursor>', 'Zero-based chunk cursor')
+    .option('--limit <count>', 'Chunks per page', '20')
+    .option('--json', 'Output as JSON')
+    .action((ref, checkpoint, options) => runPublicCommand(() => tracesGetCommand(ref, checkpoint, options)));
 program
     .command('dismiss <pr>')
     .description('Dismiss analysis findings for a PR')
@@ -418,6 +450,34 @@ Examples:
   haystack undismiss acme/widgets#99     # Undo for specific repo
 `)
     .action(undismissCommand);
+program
+    .command('review [pr]')
+    .description('Trigger a fresh Haystack analysis for a PR')
+    .option('--no-wait', 'Exit after triggering instead of waiting for results')
+    .addHelpText('after', `
+Re-run full Haystack analysis on a PR's current head.
+
+Haystack analyzes a PR once when it's opened (or marked ready); later
+pushes only get a resolution check against the existing findings. Use
+this command when new commits deserve fresh detection, or any time you
+want a second opinion.
+
+When called without a PR identifier, uses the last submitted PR.
+
+PR identifier formats:
+  (none)                                  Last submitted PR
+  123                                     PR number (uses current repo)
+  #123                                    PR number with hash
+  owner/repo#123                          Fully qualified
+  https://github.com/owner/repo/pull/123  GitHub URL
+
+Examples:
+  haystack review                             # Last submitted PR
+  haystack review 42                          # Current repo, PR #42
+  haystack review acme/widgets#99             # Specific repo
+  haystack review 42 --no-wait                # Trigger and exit
+`)
+    .action(reviewCommand);
 program
     .command('request-review <pr> [reviewer]')
     .description('Tag a PR as needing human review')
@@ -447,7 +507,7 @@ program
     .option('--json', 'Output as JSON')
     .addHelpText('after', `
 Show what bucket a PR is in within the Haystack pipeline:
-  analyzing, auto-fixing, good-to-merge, issues, needs-assignment, etc.
+  analyzing, good-to-merge, issues, needs-assignment, etc.
 
 PR identifier formats:
   123                                     PR number (uses current repo)
@@ -507,7 +567,7 @@ Examples:
 `)
     .action(handleAutoMerge);
 config
-    .command('auto-fix [action]')
+    .command('auto-fix [action]', { hidden: true })
     .description('(Alpha) Auto-fix mechanical issues on PRs submitted via haystack submit (on|off|status)')
     .addHelpText('after', `
 Actions:
@@ -698,7 +758,7 @@ section when a PR touches matching files.
 // idempotency).
 const webhooks = program
     .command('webhooks')
-    .description('Manage outbound webhooks (events: triage.completed, fixer.completed, ...)');
+    .description('Manage outbound webhooks');
 webhooks
     .command('register')
     .description('Register a webhook URL for the current repo and mint a fresh HMAC secret')
@@ -822,135 +882,6 @@ rules
         process.exit(1);
     }
 });
-// ─── verification ────────────────────────────────────────────────────────────
-//
-// Repo-local verification contract (.haystack/verification.yml): how to boot
-// the app, prove it's ready, log in as test personas, run scenarios, and
-// collect evidence into a standard artifact manifest + review packet.
-// See docs/VERIFICATION-CONTRACT.md.
-const verification = program
-    .command('verification')
-    .description('Repo verification contract — validate, run scenarios, collect evidence');
-verification
-    .command('init')
-    .description('Scaffold .haystack/verification.yml, preflight/smoke scripts, and the agent skill')
-    .option('-f, --force', 'Overwrite existing files')
-    .option('--skill', 'Only write the install-verification agent skill (hand the integration to a coding agent)')
-    .addHelpText('after', `
-Creates:
-  .haystack/verification.yml                       the verification contract
-  scripts/haystack-preflight                       app-is-ready check
-  scripts/haystack-smoke                           boot + capture-evidence smoke scenario
-  .haystack/AGENTS.md                              how agents should use the contract
-  .haystack/skills/install-verification/SKILL.md   skill for completing the integration
-
-Detection fills in framework, package manager, dev command, port, and any
-auth-bypass env var found in the repo's own env examples. Review the output —
-detection is a starting point, not truth.
-`)
-    .action(async (opts) => {
-    try {
-        await verificationInitCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('init failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('validate')
-    .description('Check whether the repo satisfies the verification contract')
-    .option('--json', 'Machine-readable report')
-    .addHelpText('after', `
-Readiness verdicts:
-  ready            all checks pass (exit 0)
-  partially_ready  usable, with gaps (exit 0)
-  not_ready        contract missing/invalid or commands broken (exit 1)
-  unsafe           contract permits real side effects, or login helpers
-                   lack a production-disabled proof (exit 2)
-`)
-    .action(async (opts) => {
-    try {
-        await verificationValidateCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('validate failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('preflight')
-    .description('Run the contract preflight — is the app up and answering?')
-    .action(async () => {
-    try {
-        await verificationPreflightCommand();
-    }
-    catch (err) {
-        console.error(chalk.red('preflight failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('run <scenario>')
-    .description('Run a contract scenario and write the artifact manifest + review packet')
-    .option('--json', 'Print the manifest as JSON')
-    .option('--setup', 'Run environment.setup first (clean-clone mode)')
-    .option('--skip-preflight', 'Skip the preflight check')
-    .option('--timeout <seconds>', 'Override the scenario timeout', (v) => parseInt(v, 10))
-    .addHelpText('after', `
-Runs preflight, then the scenario command, capturing stdout/stderr to the
-artifact directory. Ends with a status:
-  verified               scenario passed (exit 0)
-  failed                 scenario failed (exit 1)
-  environment_not_ready  setup/preflight failed before the scenario ran (exit 1)
-  unsafe_to_verify       safety policy permits real side effects (exit 2)
-
-Evidence lands in the contract's artifact_dir:
-  manifest-<scenario>.json        machine-readable evidence manifest
-  review-packet-<scenario>.md     human-readable review packet
-  logs/                           captured command output
-
-Examples:
-  haystack verification run smoke
-  haystack verification run billing_upgrade --json
-  haystack verification run smoke --setup            # clean-clone mode (CI)
-`)
-    .action(async (scenario, opts) => {
-    try {
-        await verificationRunCommand(scenario, opts);
-    }
-    catch (err) {
-        console.error(chalk.red('run failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('collect-artifacts')
-    .description('Rebuild an evidence manifest from artifacts already on disk (status: inconclusive)')
-    .option('--scenario <name>', 'Scenario name to record in the manifest')
-    .option('--json', 'Print the manifest as JSON')
-    .action(async (opts) => {
-    try {
-        await verificationCollectCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('collect-artifacts failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-verification
-    .command('check-safety')
-    .description('Verify the verification setup is safe (policy, prod-disabled proof, dev-route gating, secret scan)')
-    .option('--json', 'Machine-readable report')
-    .action(async (opts) => {
-    try {
-        await verificationCheckSafetyCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('check-safety failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
 // ─── mcp ─────────────────────────────────────────────────────────────────────
 program
     .command('mcp')

package/dist/schema.d.ts

@@ -10,9 +10,12 @@
  * uses the same envelope as the `--json` output, byte-for-byte.
  */
 export declare const SCHEMA_VERSIONS: {
-    readonly triage: "1.0.0";
+    readonly triage: "2.0.0";
     readonly setup: "1.0.0";
-    readonly pr: "1.0.0";
+    readonly pr: "2.0.0";
+    readonly inbox: "1.0.0";
+    readonly ask: "1.0.0";
+    readonly traces: "1.0.0";
 };
 export type SchemaName = keyof typeof SCHEMA_VERSIONS;
 /** Wrap a payload with the `schema_version` envelope. */

package/dist/schema.js

@@ -10,9 +10,12 @@
  * uses the same envelope as the `--json` output, byte-for-byte.
  */
 export const SCHEMA_VERSIONS = {
-    triage: '1.0.0',
+    triage: '2.0.0',
     setup: '1.0.0',
-    pr: '1.0.0',
+    pr: '2.0.0',
+    inbox: '1.0.0',
+    ask: '1.0.0',
+    traces: '1.0.0',
 };
 /** Wrap a payload with the `schema_version` envelope. */
 export function withSchema(name, payload) {

package/dist/utils/analysis-api.d.ts

@@ -44,6 +44,12 @@ export interface SynthesisDisplayIssue {
     detail: string;
     agentFixPrompt?: string;
     source?: string;
+    changeKey?: string;
+    filePath?: string;
+    startLine?: number;
+    endLine?: number;
+    severity?: 'critical' | 'high' | 'medium' | 'low';
+    mechanicalFix?: boolean;
 }
 export interface VerifiedBug {
     originalTitle: string;
@@ -104,6 +110,39 @@ export type AnalysisReadyResult = {
     status: 'error';
     message: string;
 };
+export type TriggerAnalysisResult = {
+    status: 'started';
+    requestId: string;
+} | {
+    status: 'already_processing';
+    requestId: string;
+} | {
+    status: 'rate_limited';
+    message: string;
+    retryAfterSeconds?: number;
+} | {
+    status: 'denied';
+    message: string;
+} | {
+    status: 'error';
+    message: string;
+};
+/**
+ * Trigger a fresh full analysis for a PR via the auth-worker
+ * (`/api/analysis-trigger/{owner}/{repo}/{pr}`). Requires auth — triggers
+ * start a real analysis run. Returns the request id to wait on.
+ */
+export declare function triggerAnalysis(owner: string, repo: string, prNumber: number, token: string, headSha?: string): Promise<TriggerAnalysisResult>;
+export type TriggerRunStatus = 'pending' | 'COMPLETED' | 'FAILED' | 'SUPERSEDED' | 'error';
+/**
+ * Poll the status of a triggered run by request id. The PR-level result
+ * endpoint can't distinguish a fresh re-run on the same head from the
+ * previous completed analysis — the request id can.
+ */
+export declare function fetchTriggerStatus(requestId: string, token: string): Promise<{
+    status: TriggerRunStatus;
+    message?: string;
+}>;
 /**
  * Check if analysis results are available for a PR by polling the result endpoint.
  * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.
@@ -131,6 +170,7 @@ export interface AutoFixManifest {
         reason: string;
     }>;
     timestamp: string;
+    resultSha?: string;
 }
 export declare function fetchAutoFixManifest(owner: string, repo: string, prNumber: number, token?: string): Promise<AutoFixManifest | null>;
 export declare function fetchRatingSynthesis(owner: string, repo: string, prNumber: number, token?: string): Promise<RatingSynthesis | null>;

package/dist/utils/analysis-api.js

@@ -61,9 +61,114 @@ function apiHeaders(token) {
     }
     return headers;
 }
-// ============================================================================
-// API functions
-// ============================================================================
+/**
+ * Trigger a fresh full analysis for a PR via the auth-worker
+ * (`/api/analysis-trigger/{owner}/{repo}/{pr}`). Requires auth — triggers
+ * start a real analysis run. Returns the request id to wait on.
+ */
+export async function triggerAnalysis(owner, repo, prNumber, token, headSha) {
+    const url = `${ANALYSIS_API_BASE}/api/analysis-trigger/${owner}/${repo}/${prNumber}`;
+    let response;
+    try {
+        // Force semantics ride on a server-set header at the trigger route.
+        // commitSha matters for dedup: without it, ingestion matches this
+        // request onto any in-flight run for an OLDER head and the CLI would
+        // wait on (and render) stale results.
+        response = await fetch(url, {
+            method: 'POST',
+            headers: { ...apiHeaders(token), 'Content-Type': 'application/json' },
+            body: JSON.stringify(headSha ? { commitSha: headSha } : {}),
+        });
+    }
+    catch (err) {
+        return { status: 'error', message: err.message };
+    }
+    let data = {};
+    let parseFailed = false;
+    try {
+        data = await response.json();
+    }
+    catch {
+        // Recorded, not swallowed: for non-OK responses the status-code handling
+        // below surfaces the failure; a 2xx with an unparseable body is its own
+        // explicit error (never "empty data") so callers can't mistake a
+        // malformed response for a normal one.
+        parseFailed = true;
+    }
+    if (parseFailed && response.ok) {
+        return { status: 'error', message: `Trigger endpoint returned invalid JSON (HTTP ${response.status})` };
+    }
+    if (response.status === 429) {
+        return {
+            status: 'rate_limited',
+            message: data.message || 'Too many analysis requests. Please wait before trying again.',
+            retryAfterSeconds: data.retryAfter,
+        };
+    }
+    if (response.status === 401 || response.status === 403) {
+        return {
+            status: 'denied',
+            message: data.message || data.error || `HTTP ${response.status}`,
+        };
+    }
+    if (!response.ok) {
+        return { status: 'error', message: data.message || data.error || `HTTP ${response.status}` };
+    }
+    if (!data.request_id) {
+        return { status: 'error', message: 'Trigger response did not include a request id' };
+    }
+    if (data.status === 'already_processing') {
+        return { status: 'already_processing', requestId: data.request_id };
+    }
+    return { status: 'started', requestId: data.request_id };
+}
+// Terminal states of the v3 status vocabulary (map_status_for_frontend in
+// haystack-v3-request-status). Everything else — QUEUED, PROCESSING,
+// CLONING, PREPARING, ANALYZING, not_found (row lag), and any state a newer
+// backend introduces — reads as pending: misclassifying a healthy
+// in-progress state as an error would abort the wait.
+const TERMINAL_STATUSES = {
+    COMPLETED: 'COMPLETED',
+    FAILED: 'FAILED',
+    TIMED_OUT: 'FAILED',
+    SUPERSEDED: 'SUPERSEDED',
+};
+/**
+ * Poll the status of a triggered run by request id. The PR-level result
+ * endpoint can't distinguish a fresh re-run on the same head from the
+ * previous completed analysis — the request id can.
+ */
+export async function fetchTriggerStatus(requestId, token) {
+    const url = `${ANALYSIS_API_BASE}/api/analysis-trigger/status/${requestId}`;
+    try {
+        const response = await fetch(url, { headers: apiHeaders(token) });
+        // The status Lambda returns not_found as a 404 WITH a JSON body — parse
+        // before rejecting on status code so "not yet written" is distinguishable
+        // from a real transport failure.
+        let data = {};
+        try {
+            data = await response.json();
+        }
+        catch {
+            return { status: 'error', message: `HTTP ${response.status}` };
+        }
+        const status = typeof data.status === 'string' ? data.status : '';
+        const terminal = TERMINAL_STATUSES[status];
+        if (terminal) {
+            return { status: terminal, message: data.message };
+        }
+        // Only successful responses (plus the documented 404 not_found row-lag
+        // case) read as pending — a 5xx carrying {"status":"error"} must count
+        // toward the error budget, not spin the wait for the full timeout.
+        if (response.ok || (response.status === 404 && status === 'not_found')) {
+            return { status: 'pending', message: data.message };
+        }
+        return { status: 'error', message: data.message || `HTTP ${response.status}` };
+    }
+    catch (err) {
+        return { status: 'error', message: err.message };
+    }
+}
 /**
  * Check if analysis results are available for a PR by polling the result endpoint.
  * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.

package/dist/utils/haystack-api.d.ts

@@ -0,0 +1,20 @@
+export interface UserInstallation {
+    id: number;
+    account?: {
+        login?: string;
+    } | null;
+    repositories?: Array<{
+        full_name: string;
+        pushed_at?: string | null;
+    }>;
+}
+export interface CliIdentity {
+    login: string;
+    id: number;
+}
+export declare function haystackJson<T>(path: string, token: string, init?: RequestInit): Promise<T>;
+export declare function fetchCliIdentity(token: string): Promise<CliIdentity>;
+export declare function fetchHaystackInstallations(token: string): Promise<UserInstallation[]>;
+export declare function fetchGitHubJson<T>(path: string, token: string, init?: RequestInit): Promise<T>;
+export declare function fetchAnalysisArtifact<T>(owner: string, repo: string, prNumber: number, file: string, token: string): Promise<T | null>;
+export declare function postAskHaystack<T>(owner: string, repo: string, prNumber: number, question: string, sessionId: string | undefined, token: string): Promise<T>;

package/dist/utils/haystack-api.js

@@ -0,0 +1,66 @@
+const HAYSTACK_API_BASE = process.env.HAYSTACK_API_BASE ?? 'https://haystackeditor.com';
+function headers(token, extra) {
+    const result = new Headers(extra);
+    result.set('Authorization', `Bearer ${token}`);
+    result.set('Accept', 'application/json');
+    result.set('User-Agent', 'Haystack-CLI');
+    return result;
+}
+async function errorMessage(response) {
+    const text = await response.text().catch(() => '');
+    if (!text)
+        return `HTTP ${response.status}`;
+    try {
+        const parsed = JSON.parse(text);
+        return parsed.message ?? parsed.error ?? text;
+    }
+    catch {
+        return text;
+    }
+}
+export async function haystackJson(path, token, init = {}) {
+    const response = await fetch(`${HAYSTACK_API_BASE}${path}`, {
+        ...init,
+        headers: headers(token, init.headers),
+    });
+    if (!response.ok) {
+        throw new Error(`${response.status} ${await errorMessage(response)}`);
+    }
+    return response.json();
+}
+export async function fetchCliIdentity(token) {
+    return haystackJson('/api/cli/me', token);
+}
+export async function fetchHaystackInstallations(token) {
+    const data = await haystackJson('/api/github/user-installations', token);
+    return data.installations ?? [];
+}
+export async function fetchGitHubJson(path, token, init = {}) {
+    return haystackJson(`/api/github${path}`, token, init);
+}
+export async function fetchAnalysisArtifact(owner, repo, prNumber, file, token) {
+    const ref = encodeURIComponent(`${owner}/${repo}#${prNumber}`);
+    const response = await fetch(`${HAYSTACK_API_BASE}/api/analysis/${ref}/${file}`, {
+        headers: headers(token, { 'Cache-Control': 'no-cache' }),
+    });
+    if (response.status === 404)
+        return null;
+    if (!response.ok) {
+        throw new Error(`${response.status} ${await errorMessage(response)}`);
+    }
+    const data = await response.json();
+    if (!data || typeof data !== 'object' || !('download_url' in data) || !data.download_url) {
+        return data;
+    }
+    const download = await fetch(data.download_url, { headers: { 'User-Agent': 'Haystack-CLI' } });
+    if (!download.ok)
+        throw new Error(`Artifact download failed: HTTP ${download.status}`);
+    return download.json();
+}
+export async function postAskHaystack(owner, repo, prNumber, question, sessionId, token) {
+    return haystackJson(`/api/review-chat/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${prNumber}/ask`, token, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ question, session_id: sessionId }),
+    });
+}

package/package.json

@@ -1,19 +1,19 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.17",
+  "version": "0.15.19",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {
     "haystack": "./dist/index.js"
   },
   "scripts": {
-    "build": "tsc && rm -rf dist/assets && cp -r src/assets dist/assets",
+    "build": "rm -rf dist && tsc && cp -r src/assets dist/assets",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "check:schemas": "node scripts/check-schemas.mjs",
     "release": "node scripts/release.mjs",
     "prepublishOnly": "node scripts/no-direct-publish.mjs",
-    "test": "vitest run"
+    "test": "pnpm build && vitest run && node --test tests/*.test.mjs"
   },
   "keywords": [
     "haystack",
@@ -41,7 +41,7 @@
     "fast-glob": "3.3.3",
     "glob": "10.5.0",
     "inquirer": "9.3.8",
-    "ws": "8.19.0",
+    "ws": "8.21.0",
     "yaml": "2.8.2",
     "zod": "3.25.76"
   },