@haystackeditor/cli 0.15.18 → 0.15.19

package/dist/assets/skills/map-your-system.md

@@ -0,0 +1,138 @@
+# Map Your System for Haystack QA
+
+Create `.haystack/system.yml` — a short file of facts about how this
+repository's system works, so Haystack QA can run it.
+
+## Why this file exists
+
+When Haystack reviews a risky PR, it doesn't just read the diff — it runs the
+affected code in a sandbox and captures evidence. Haystack decides **what** to
+test from each PR on its own. What it can't always infer is **how your system
+works**: how to install and build it, how services boot, how to know they're
+ready, how to seed data, how to act as a logged-in test user. That is what
+this file provides. Every fact you add converts risks Haystack identified but
+couldn't execute into checks that actually run.
+
+## Hard rules
+
+1. **Facts only — never test selection.** The file describes how the system
+   works. Keys like `scenarios`, `tests`, `skip`, or `focus` are rejected;
+   Haystack alone decides what to test.
+2. **Only verified facts.** Run every command yourself before declaring it.
+   A wrong fact is worse than a missing one — Haystack tracks which declared
+   facts fail and will flag them on PRs.
+3. **No secrets.** Reference environment variable *names* if needed, never
+   values. Anything that looks like a credential is rejected.
+4. **Personas are seeded FAKE users** reachable through dev/test-only login
+   paths. Never real accounts, never customer data. If a dev login helper
+   exists, it must be disabled in production builds.
+5. **Small and true beats big and aspirational.** Ten verified lines are more
+   useful than sixty guesses. Omit anything you could not verify.
+
+## Steps
+
+### 1. Inspect the repository
+
+Determine, with evidence from the tree (lockfiles, manifests, scripts,
+docker-compose, CI config, READMEs):
+
+- package manager, install command, and any required build/codegen steps
+- each runnable service: start command, port, and how "ready" is observable
+  (health endpoint, log line, or a command that exits 0)
+- how to seed and reset local/test data
+- how existing tests authenticate — is there a seeded test user or dev login?
+- the test runner and any test helpers/factories generated tests should reuse
+- external services the code calls, and how development runs without hitting
+  them for real (mock fixture, log driver, sandbox mode)
+- where runtime logs are written
+
+### 2. Verify each fact by running it
+
+From a clean state where possible: run the install, run the build, boot each
+service and confirm its readiness signal, run the seed command, run the login
+helper. Record the exact commands that worked. Drop anything you could not
+make work — do not declare it with a caveat.
+
+### 3. Ask the developer only what you cannot determine
+
+Typical questions worth asking a human: "Is there a dev-only way to log in as
+a test user?", "Which services must be running for the API to work?", "Is
+there a canonical seed script?". Keep it to the few facts you genuinely
+cannot infer or verify.
+
+### 4. Write `.haystack/system.yml`
+
+```yaml
+version: 1
+
+environment:
+  setup:
+    - run: "pnpm install --frozen-lockfile"
+    - run: "pnpm codegen"
+      rationale: "generated types are imported throughout"
+  toolchain: { node: "20", pnpm: "10" }
+
+services:
+  api:
+    root: "apps/api"                                # optional
+    boot: "pnpm dev"
+    ready: { http: "http://localhost:8080/health" } # or { log_pattern: "listening" } or { command: "pg_isready" }
+    env: { APP_ENV: "test" }
+    depends_on: [postgres]
+
+data:
+  seed: "pnpm db:seed --profile=qa"
+  reset: "pnpm db:reset"
+  personas:
+    admin:
+      login: "pnpm test:login admin"
+      yields: "prints an Authorization header on stdout"
+
+observability:
+  logs: ["apps/api/log/dev.log"]
+  inspect_db: "pnpm db:console --readonly"
+
+external_services:
+  stripe:
+    offline: "repo ships a stripe-mock fixture used by tests"
+    must_not_touch_live: true
+
+testing:
+  runner: "pnpm vitest"
+  probe_helpers: "tests/helpers/ has request builders and DB factories"
+
+constraints:
+  - "full build takes ~6 min; apps/api boots standalone without the web build"
+```
+
+Every section is optional — include only what you verified. All commands run
+from the repo root unless a `cwd`/`root` says otherwise.
+
+### 5. Self-check before opening the PR
+
+- [ ] `version: 1` is present and the file is valid YAML
+- [ ] no test-selection keys (`scenarios`, `tests`, `skip`, `focus`, ...)
+- [ ] no secret values anywhere (env var names only)
+- [ ] every `run`/`boot`/`login`/`seed` command was executed and worked
+- [ ] every service has a `ready` signal you observed
+- [ ] personas are seeded fake users via dev/test-only paths
+
+Haystack re-validates the file on its next QA run and reports precise errors
+if something is wrong.
+
+### 6. Open a small, reviewable PR
+
+Add only `.haystack/system.yml` (plus a dev login helper if one was genuinely
+needed — dev/test-gated, with a test proving it's off in production). In the
+PR description, list which facts you verified by running them and which came
+from the developer's answers.
+
+## What happens next
+
+Haystack treats each entry as a claim. When a QA run executes a declared
+command successfully, the fact is marked **verified** with the run's receipt;
+if it fails at a newer commit it is marked **broken**, and Haystack will ask
+about it on a PR instead of trusting it. When QA hits something the map
+doesn't cover, it asks at most a couple of targeted questions on the affected
+PR, each with a ready-to-paste snippet — answering them grows this file over
+time.

package/dist/commands/review.d.ts

@@ -0,0 +1,24 @@
+/**
+ * review command — Trigger a fresh Haystack analysis for a PR.
+ *
+ * haystack review [pr] [--no-wait]
+ *
+ * Haystack runs a full analysis when a PR is opened (or marked ready);
+ * later pushes only get a resolution check against the existing findings.
+ * This command is the explicit escape hatch: it re-runs full detection on
+ * the PR's current head — use it after substantial new commits, or any
+ * time you want a fresh second opinion.
+ *
+ * When called without a PR identifier, reads the last submitted PR from
+ * `.haystack/pending-submit.json` (written by `haystack submit`).
+ *
+ * Accepts a PR identifier in several formats:
+ *   haystack review                      # Last submitted PR
+ *   haystack review 123                  # Uses current repo's owner/repo
+ *   haystack review owner/repo#123       # Fully qualified
+ *   haystack review https://github.com/owner/repo/pull/123
+ */
+export interface ReviewOptions {
+    wait?: boolean;
+}
+export declare function reviewCommand(identifier: string | undefined, options: ReviewOptions): Promise<void>;

package/dist/commands/review.js

@@ -0,0 +1,193 @@
+/**
+ * review command — Trigger a fresh Haystack analysis for a PR.
+ *
+ * haystack review [pr] [--no-wait]
+ *
+ * Haystack runs a full analysis when a PR is opened (or marked ready);
+ * later pushes only get a resolution check against the existing findings.
+ * This command is the explicit escape hatch: it re-runs full detection on
+ * the PR's current head — use it after substantial new commits, or any
+ * time you want a fresh second opinion.
+ *
+ * When called without a PR identifier, reads the last submitted PR from
+ * `.haystack/pending-submit.json` (written by `haystack submit`).
+ *
+ * Accepts a PR identifier in several formats:
+ *   haystack review                      # Last submitted PR
+ *   haystack review 123                  # Uses current repo's owner/repo
+ *   haystack review owner/repo#123       # Fully qualified
+ *   haystack review https://github.com/owner/repo/pull/123
+ */
+import chalk from 'chalk';
+import { triggerAnalysis, fetchTriggerStatus } from '../utils/analysis-api.js';
+import { fetchTriageHeadSha } from './triage.js';
+import { parseRemoteUrl } from '../utils/git.js';
+import { loadToken } from '../utils/auth.js';
+import { loadPendingSubmit } from '../utils/pending-state.js';
+import { triageCommand } from './triage.js';
+// ============================================================================
+// Constants
+// ============================================================================
+const STATUS_POLL_INTERVAL_MS = 10_000;
+// Full analyses regularly take 10+ minutes on large PRs; this bounds the
+// CLI's wait, not the analysis itself (results land on the feed regardless).
+const STATUS_POLL_TIMEOUT_MS = 25 * 60 * 1000;
+// ============================================================================
+// PR identifier parsing (shared pattern with request-review.ts / triage.ts)
+// ============================================================================
+function parsePRIdentifier(identifier) {
+    const urlMatch = identifier.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/);
+    if (urlMatch) {
+        return { owner: urlMatch[1], repo: urlMatch[2], prNumber: parseInt(urlMatch[3], 10) };
+    }
+    const qualifiedMatch = identifier.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+    if (qualifiedMatch) {
+        return { owner: qualifiedMatch[1], repo: qualifiedMatch[2], prNumber: parseInt(qualifiedMatch[3], 10) };
+    }
+    const numberMatch = identifier.match(/^#?(\d+)$/);
+    if (numberMatch) {
+        const prNumber = parseInt(numberMatch[1], 10);
+        try {
+            const remote = parseRemoteUrl('origin');
+            return { owner: remote.owner, repo: remote.repo, prNumber };
+        }
+        catch {
+            throw new Error(`Cannot determine repository for PR #${prNumber}.\n` +
+                `Use the full format: haystack review owner/repo#${prNumber}`);
+        }
+    }
+    throw new Error(`Invalid PR identifier: "${identifier}"\n\n` +
+        `Accepted formats:\n` +
+        `  haystack review 123\n` +
+        `  haystack review owner/repo#123\n` +
+        `  haystack review https://github.com/owner/repo/pull/123`);
+}
+function resolvePR(identifier) {
+    if (identifier) {
+        try {
+            return parsePRIdentifier(identifier);
+        }
+        catch (err) {
+            console.error(chalk.red(`\n${err.message}\n`));
+            process.exit(1);
+        }
+    }
+    const pending = loadPendingSubmit();
+    if (!pending) {
+        console.log(chalk.dim('No pending submits. Pass a PR number to review a specific PR.\n'));
+        return null;
+    }
+    return { owner: pending.owner, repo: pending.repo, prNumber: pending.prNumber };
+}
+// ============================================================================
+// Waiting
+// ============================================================================
+async function waitForRun(requestId, token) {
+    const deadline = Date.now() + STATUS_POLL_TIMEOUT_MS;
+    let consecutiveErrors = 0;
+    while (Date.now() < deadline) {
+        const result = await fetchTriggerStatus(requestId, token);
+        if (result.status === 'COMPLETED')
+            return 'completed';
+        if (result.status === 'FAILED')
+            return 'failed';
+        if (result.status === 'SUPERSEDED')
+            return 'superseded';
+        if (result.status === 'error') {
+            consecutiveErrors++;
+            if (consecutiveErrors >= 5)
+                return 'failed';
+        }
+        else {
+            consecutiveErrors = 0;
+        }
+        process.stderr.write(`\r  ${chalk.dim('Analysis in progress...')}${'  '.repeat(5)}`);
+        // Deliberately NOT unref'd: during the wait this timer can be the only
+        // live handle, and an unref'd timer lets Node exit mid-wait.
+        await new Promise((resolve) => {
+            setTimeout(resolve, STATUS_POLL_INTERVAL_MS);
+        });
+    }
+    return 'timeout';
+}
+// ============================================================================
+// Main command
+// ============================================================================
+export async function reviewCommand(identifier, options) {
+    const pr = resolvePR(identifier);
+    if (!pr)
+        return;
+    const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
+    let token = null;
+    try {
+        token = await loadToken({ owner: pr.owner, repo: pr.repo });
+    }
+    catch (err) {
+        console.error(chalk.red(`\nCould not load Haystack credentials: ${err.message}\n`));
+        process.exit(1);
+    }
+    if (!token) {
+        console.error(chalk.red('\nTriggering an analysis requires authentication.'));
+        console.log(chalk.dim('  Run ') + chalk.cyan('haystack login') + chalk.dim(' first.\n'));
+        process.exit(1);
+    }
+    console.log(chalk.dim(`\nRequesting a fresh analysis for ${prLabel}...`));
+    // Resolve the current head so ingestion's dedup compares commits — an
+    // in-flight run for an OLDER head must be superseded, not reused. A
+    // failed metadata fetch degrades to a head-less trigger (the dedup is a
+    // freshness aid, not a correctness requirement) instead of crashing.
+    let headSha;
+    try {
+        headSha = await fetchTriageHeadSha(pr, token) ?? undefined;
+    }
+    catch (err) {
+        console.log(chalk.dim(`  Could not resolve the PR head (${err.message}) — continuing without it.`));
+    }
+    const trigger = await triggerAnalysis(pr.owner, pr.repo, pr.prNumber, token, headSha);
+    if (trigger.status === 'rate_limited') {
+        console.error(chalk.red(`\n  ${trigger.message}`));
+        if (trigger.retryAfterSeconds) {
+            console.log(chalk.dim(`  Try again in ~${Math.ceil(trigger.retryAfterSeconds / 60)} minute(s).\n`));
+        }
+        process.exit(1);
+    }
+    if (trigger.status === 'denied') {
+        console.error(chalk.red(`\n  ${trigger.message}\n`));
+        process.exit(1);
+    }
+    if (trigger.status === 'error') {
+        console.error(chalk.red(`\n  Failed to trigger analysis: ${trigger.message}\n`));
+        process.exit(1);
+    }
+    if (trigger.status === 'already_processing') {
+        console.log(chalk.yellow('  An analysis for this PR is already running — waiting on it instead.'));
+    }
+    else {
+        console.log(chalk.green('  Analysis started.'));
+    }
+    if (options.wait === false) {
+        console.log(chalk.dim('  Check results later with: ') + chalk.cyan(`haystack triage ${prLabel}`));
+        console.log(chalk.dim('  Or view the review: ') + chalk.cyan(`https://haystackeditor.com/review/${pr.owner}/${pr.repo}/${pr.prNumber}\n`));
+        return;
+    }
+    const outcome = await waitForRun(trigger.requestId, token);
+    process.stderr.write('\r' + ' '.repeat(60) + '\r');
+    if (outcome === 'failed') {
+        console.error(chalk.red('\n  Analysis run failed.'));
+        console.log(chalk.dim('  Check the review page: ') + chalk.cyan(`https://haystackeditor.com/review/${pr.owner}/${pr.repo}/${pr.prNumber}\n`));
+        process.exit(1);
+    }
+    if (outcome === 'superseded') {
+        console.log(chalk.yellow('\n  This run was superseded by a newer analysis (a push likely landed meanwhile).'));
+        console.log(chalk.dim('  Showing the latest results instead.'));
+        await triageCommand(prLabel, { wait: false });
+        return;
+    }
+    if (outcome === 'timeout') {
+        console.log(chalk.yellow('\n  Still running after 25 minutes — giving up on waiting.'));
+        console.log(chalk.dim('  Check results later with: ') + chalk.cyan(`haystack triage ${prLabel}\n`));
+        return;
+    }
+    // Completed — render results through the triage view (no extra wait).
+    await triageCommand(prLabel, { wait: false });
+}

package/dist/commands/skills.js

@@ -15,6 +15,7 @@ function getSkillsSourceDir() {
 const SKILL_FILES = [
     'setup-haystack.md',
     'submit.md',
+    'map-your-system.md',
 ];
 function installSkillFiles(targetDir) {
     const sourceDir = getSkillsSourceDir();
@@ -55,6 +56,7 @@ export async function installSkills(options) {
     }
     const claudeCommandPath = join(claudeCommandsDir, 'setup-haystack.md');
     writeFileSync(claudeCommandPath, '# Set Up Haystack\n\nFollow .agents/skills/setup-haystack.md to set up Haystack for this repo.\n');
+    writeFileSync(join(claudeCommandsDir, 'map-your-system.md'), '# Map Your System for Haystack QA\n\nFollow .agents/skills/map-your-system.md to create .haystack/system.yml — verified facts about how this system builds, boots, seeds data, and logs in, so Haystack QA can run it.\n');
     showSuccessMessage();
 }
 function showSuccessMessage() {
@@ -62,6 +64,7 @@ function showSuccessMessage() {
     console.log(chalk.white('Available skills:'));
     console.log(chalk.cyan('  /setup-haystack         ') + chalk.gray('- Create .haystack.json with AI assistance'));
     console.log(chalk.cyan('  /submit                 ') + chalk.gray('- Submit a PR via Haystack'));
+    console.log(chalk.cyan('  /map-your-system        ') + chalk.gray('- Write .haystack/system.yml so Haystack QA can run this system'));
     console.log();
     console.log(chalk.white('Run in your coding CLI:'));
     console.log(chalk.cyan('  /setup-haystack'));
@@ -71,5 +74,6 @@ export async function listSkills() {
     console.log(chalk.white('\nAvailable Haystack skills:\n'));
     console.log(chalk.cyan('  /setup-haystack         ') + chalk.gray('- Master setup - creates .haystack.json'));
     console.log(chalk.cyan('  /submit                 ') + chalk.gray('- Submit a PR via Haystack'));
+    console.log(chalk.cyan('  /map-your-system        ') + chalk.gray('- Write .haystack/system.yml so Haystack QA can run this system'));
     console.log();
 }

package/dist/index.js

@@ -36,6 +36,7 @@ import { listPolicies, addPolicy, removePolicy, initPolicies, addInstruction } f
 import { triageCommand } from './commands/triage.js';
 import { dismissCommand, markReviewedCommand, undismissCommand } from './commands/dismiss.js';
 import { requestReviewCommand } from './commands/request-review.js';
+import { reviewCommand } from './commands/review.js';
 import { prStatusCommand } from './commands/pr-status.js';
 import { prReadCommand } from './commands/pr.js';
 import { inboxListCommand } from './commands/inbox.js';
@@ -449,6 +450,34 @@ Examples:
   haystack undismiss acme/widgets#99     # Undo for specific repo
 `)
     .action(undismissCommand);
+program
+    .command('review [pr]')
+    .description('Trigger a fresh Haystack analysis for a PR')
+    .option('--no-wait', 'Exit after triggering instead of waiting for results')
+    .addHelpText('after', `
+Re-run full Haystack analysis on a PR's current head.
+
+Haystack analyzes a PR once when it's opened (or marked ready); later
+pushes only get a resolution check against the existing findings. Use
+this command when new commits deserve fresh detection, or any time you
+want a second opinion.
+
+When called without a PR identifier, uses the last submitted PR.
+
+PR identifier formats:
+  (none)                                  Last submitted PR
+  123                                     PR number (uses current repo)
+  #123                                    PR number with hash
+  owner/repo#123                          Fully qualified
+  https://github.com/owner/repo/pull/123  GitHub URL
+
+Examples:
+  haystack review                             # Last submitted PR
+  haystack review 42                          # Current repo, PR #42
+  haystack review acme/widgets#99             # Specific repo
+  haystack review 42 --no-wait                # Trigger and exit
+`)
+    .action(reviewCommand);
 program
     .command('request-review <pr> [reviewer]')
     .description('Tag a PR as needing human review')

package/dist/utils/analysis-api.d.ts

@@ -110,6 +110,39 @@ export type AnalysisReadyResult = {
     status: 'error';
     message: string;
 };
+export type TriggerAnalysisResult = {
+    status: 'started';
+    requestId: string;
+} | {
+    status: 'already_processing';
+    requestId: string;
+} | {
+    status: 'rate_limited';
+    message: string;
+    retryAfterSeconds?: number;
+} | {
+    status: 'denied';
+    message: string;
+} | {
+    status: 'error';
+    message: string;
+};
+/**
+ * Trigger a fresh full analysis for a PR via the auth-worker
+ * (`/api/analysis-trigger/{owner}/{repo}/{pr}`). Requires auth — triggers
+ * start a real analysis run. Returns the request id to wait on.
+ */
+export declare function triggerAnalysis(owner: string, repo: string, prNumber: number, token: string, headSha?: string): Promise<TriggerAnalysisResult>;
+export type TriggerRunStatus = 'pending' | 'COMPLETED' | 'FAILED' | 'SUPERSEDED' | 'error';
+/**
+ * Poll the status of a triggered run by request id. The PR-level result
+ * endpoint can't distinguish a fresh re-run on the same head from the
+ * previous completed analysis — the request id can.
+ */
+export declare function fetchTriggerStatus(requestId: string, token: string): Promise<{
+    status: TriggerRunStatus;
+    message?: string;
+}>;
 /**
  * Check if analysis results are available for a PR by polling the result endpoint.
  * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.

package/dist/utils/analysis-api.js

@@ -61,9 +61,114 @@ function apiHeaders(token) {
     }
     return headers;
 }
-// ============================================================================
-// API functions
-// ============================================================================
+/**
+ * Trigger a fresh full analysis for a PR via the auth-worker
+ * (`/api/analysis-trigger/{owner}/{repo}/{pr}`). Requires auth — triggers
+ * start a real analysis run. Returns the request id to wait on.
+ */
+export async function triggerAnalysis(owner, repo, prNumber, token, headSha) {
+    const url = `${ANALYSIS_API_BASE}/api/analysis-trigger/${owner}/${repo}/${prNumber}`;
+    let response;
+    try {
+        // Force semantics ride on a server-set header at the trigger route.
+        // commitSha matters for dedup: without it, ingestion matches this
+        // request onto any in-flight run for an OLDER head and the CLI would
+        // wait on (and render) stale results.
+        response = await fetch(url, {
+            method: 'POST',
+            headers: { ...apiHeaders(token), 'Content-Type': 'application/json' },
+            body: JSON.stringify(headSha ? { commitSha: headSha } : {}),
+        });
+    }
+    catch (err) {
+        return { status: 'error', message: err.message };
+    }
+    let data = {};
+    let parseFailed = false;
+    try {
+        data = await response.json();
+    }
+    catch {
+        // Recorded, not swallowed: for non-OK responses the status-code handling
+        // below surfaces the failure; a 2xx with an unparseable body is its own
+        // explicit error (never "empty data") so callers can't mistake a
+        // malformed response for a normal one.
+        parseFailed = true;
+    }
+    if (parseFailed && response.ok) {
+        return { status: 'error', message: `Trigger endpoint returned invalid JSON (HTTP ${response.status})` };
+    }
+    if (response.status === 429) {
+        return {
+            status: 'rate_limited',
+            message: data.message || 'Too many analysis requests. Please wait before trying again.',
+            retryAfterSeconds: data.retryAfter,
+        };
+    }
+    if (response.status === 401 || response.status === 403) {
+        return {
+            status: 'denied',
+            message: data.message || data.error || `HTTP ${response.status}`,
+        };
+    }
+    if (!response.ok) {
+        return { status: 'error', message: data.message || data.error || `HTTP ${response.status}` };
+    }
+    if (!data.request_id) {
+        return { status: 'error', message: 'Trigger response did not include a request id' };
+    }
+    if (data.status === 'already_processing') {
+        return { status: 'already_processing', requestId: data.request_id };
+    }
+    return { status: 'started', requestId: data.request_id };
+}
+// Terminal states of the v3 status vocabulary (map_status_for_frontend in
+// haystack-v3-request-status). Everything else — QUEUED, PROCESSING,
+// CLONING, PREPARING, ANALYZING, not_found (row lag), and any state a newer
+// backend introduces — reads as pending: misclassifying a healthy
+// in-progress state as an error would abort the wait.
+const TERMINAL_STATUSES = {
+    COMPLETED: 'COMPLETED',
+    FAILED: 'FAILED',
+    TIMED_OUT: 'FAILED',
+    SUPERSEDED: 'SUPERSEDED',
+};
+/**
+ * Poll the status of a triggered run by request id. The PR-level result
+ * endpoint can't distinguish a fresh re-run on the same head from the
+ * previous completed analysis — the request id can.
+ */
+export async function fetchTriggerStatus(requestId, token) {
+    const url = `${ANALYSIS_API_BASE}/api/analysis-trigger/status/${requestId}`;
+    try {
+        const response = await fetch(url, { headers: apiHeaders(token) });
+        // The status Lambda returns not_found as a 404 WITH a JSON body — parse
+        // before rejecting on status code so "not yet written" is distinguishable
+        // from a real transport failure.
+        let data = {};
+        try {
+            data = await response.json();
+        }
+        catch {
+            return { status: 'error', message: `HTTP ${response.status}` };
+        }
+        const status = typeof data.status === 'string' ? data.status : '';
+        const terminal = TERMINAL_STATUSES[status];
+        if (terminal) {
+            return { status: terminal, message: data.message };
+        }
+        // Only successful responses (plus the documented 404 not_found row-lag
+        // case) read as pending — a 5xx carrying {"status":"error"} must count
+        // toward the error budget, not spin the wait for the full timeout.
+        if (response.ok || (response.status === 404 && status === 'not_found')) {
+            return { status: 'pending', message: data.message };
+        }
+        return { status: 'error', message: data.message || `HTTP ${response.status}` };
+    }
+    catch (err) {
+        return { status: 'error', message: err.message };
+    }
+}
 /**
  * Check if analysis results are available for a PR by polling the result endpoint.
  * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.18",
+  "version": "0.15.19",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {