@haystackeditor/cli 0.15.22 → 0.15.23

package/README.md

@@ -105,6 +105,17 @@ haystack verify hosted status cv_<48-lowercase-hex-characters> \
   --json
 ```
 
+Agents can use the same production lifecycle over stdio MCP:
+
+```bash
+haystack verify hosted mcp --account <login>
+```
+
+The hosted server exposes only `verify_start`, `verify_status`, and
+`verify_wait`. Tool results use the same `cloud-verifier` schema as the CLI;
+credentials, repository source, provider metadata, and sandbox mutation are
+not exposed.
+
 **`haystack setup --json`** speaks NDJSON: events (`question`, `permission`,
 `progress`, `result`) on stdout, replies on stdin keyed by
 `requestID`/`permissionID`. `haystack schema setup` documents the full

package/dist/commands/verify-hosted-mcp.d.ts

@@ -0,0 +1,12 @@
+import { type Tool } from '@modelcontextprotocol/sdk/types.js';
+export declare const HOSTED_VERIFY_TOOLS: Tool[];
+export interface HostedVerifyMcpOptions {
+    account?: string;
+}
+interface HostedToolContext {
+    token: string;
+    account?: string;
+}
+export declare function executeHostedVerifyTool(name: string, input: Record<string, unknown>, context: HostedToolContext): Promise<Record<string, unknown>>;
+export declare function runHostedVerifyMcpServer(options: HostedVerifyMcpOptions): Promise<void>;
+export {};

package/dist/commands/verify-hosted-mcp.js

@@ -0,0 +1,234 @@
+// Production Cloud Verifier MCP server: `haystack verify hosted mcp`.
+//
+// This intentionally exposes only the durable hosted run lifecycle. The local
+// specimen MCP server has artifact and retained-sandbox tools whose data model
+// does not exist in the source-free production result contract.
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { resolveAuthContext } from '../utils/auth.js';
+import { buildHostedJson, getHostedVerification, hostedResumeCommand, parseHostedRepository, startHostedVerification, waitForHostedVerification, } from './verify-hosted.js';
+const TERMINAL_STATUSES = new Set([
+    'complete',
+    'errored',
+    'expired',
+    'terminated',
+]);
+const DEFAULT_TIMEOUT_SECONDS = 30 * 60;
+const MAX_TIMEOUT_SECONDS = 60 * 60;
+const accountInput = {
+    type: 'string',
+    description: 'Saved Haystack account login. Omit to use the server default or active account.',
+};
+const runIdInput = {
+    type: 'string',
+    pattern: '^cv_[0-9a-f]{48}$',
+    description: 'Owned hosted run id.',
+};
+export const HOSTED_VERIFY_TOOLS = [
+    {
+        name: 'verify_start',
+        description: 'Start an authenticated production verification for an exact GitHub commit pair. Returns immediately; call verify_wait next.',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                repository: {
+                    type: 'string',
+                    pattern: '^[A-Za-z0-9_.-]{1,100}/[A-Za-z0-9_.-]{1,100}$',
+                    description: 'Exact GitHub owner/repository name.',
+                },
+                base_commit: {
+                    type: 'string',
+                    pattern: '^[0-9a-f]{40}$',
+                    description: 'Exact 40-character lowercase base commit SHA.',
+                },
+                head_commit: {
+                    type: 'string',
+                    pattern: '^[0-9a-f]{40}$',
+                    description: 'Exact 40-character lowercase head commit SHA.',
+                },
+                idempotency_key: {
+                    type: 'string',
+                    pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$',
+                    description: 'Optional stable retry key. Omit to derive it from the exact repository and commits.',
+                },
+                account: accountInput,
+            },
+            required: ['repository', 'base_commit', 'head_commit'],
+        },
+    },
+    {
+        name: 'verify_status',
+        description: 'Read the current source-free production receipt for an owned hosted run.',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                run_id: runIdInput,
+                account: accountInput,
+            },
+            required: ['run_id'],
+        },
+    },
+    {
+        name: 'verify_wait',
+        description: 'Wait for an owned production run to finish. A timeout returns the last observed status with timed_out=true; the run keeps going.',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                run_id: runIdInput,
+                timeout_seconds: {
+                    type: 'integer',
+                    minimum: 10,
+                    maximum: MAX_TIMEOUT_SECONDS,
+                    description: 'Bounded wait in seconds (default 1800, maximum 3600).',
+                },
+                account: accountInput,
+            },
+            required: ['run_id'],
+        },
+    },
+];
+function requireInputString(input, field) {
+    const value = input[field];
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`${field} required`);
+    }
+    return value;
+}
+function optionalInputString(input, field) {
+    const value = input[field];
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`${field} must be a non-empty string`);
+    }
+    return value;
+}
+function assertExactInputFields(input, allowed) {
+    const allowedFields = new Set(allowed);
+    const unsupported = Object.keys(input).find(field => !allowedFields.has(field));
+    if (unsupported)
+        throw new Error(`unsupported input field: ${unsupported}`);
+}
+function assertToolInputFields(name, input) {
+    if (name === 'verify_start') {
+        assertExactInputFields(input, [
+            'account',
+            'base_commit',
+            'head_commit',
+            'idempotency_key',
+            'repository',
+        ]);
+        return;
+    }
+    if (name === 'verify_status') {
+        assertExactInputFields(input, ['account', 'run_id']);
+        return;
+    }
+    if (name === 'verify_wait') {
+        assertExactInputFields(input, ['account', 'run_id', 'timeout_seconds']);
+        return;
+    }
+    throw new Error(`unknown tool: ${name}`);
+}
+function nextCommand(state, account) {
+    return TERMINAL_STATUSES.has(state.status)
+        ? undefined
+        : hostedResumeCommand(state.runId, account);
+}
+export async function executeHostedVerifyTool(name, input, context) {
+    assertToolInputFields(name, input);
+    if (name === 'verify_start') {
+        const repository = requireInputString(input, 'repository');
+        const started = await startHostedVerification(repository, {
+            base: requireInputString(input, 'base_commit'),
+            head: requireInputString(input, 'head_commit'),
+            idempotencyKey: optionalInputString(input, 'idempotency_key'),
+            wait: false,
+        }, context.token);
+        return buildHostedJson('start', started.state, {
+            account: context.account,
+            idempotencyKey: started.idempotencyKey,
+            nextCommand: nextCommand(started.state, context.account),
+        });
+    }
+    if (name === 'verify_status') {
+        const state = await getHostedVerification(requireInputString(input, 'run_id'), context.token);
+        return buildHostedJson('status', state, {
+            account: context.account,
+            nextCommand: nextCommand(state, context.account),
+        });
+    }
+    if (name === 'verify_wait') {
+        const runId = requireInputString(input, 'run_id');
+        const rawTimeout = input.timeout_seconds;
+        const timeoutSeconds = rawTimeout === undefined
+            ? DEFAULT_TIMEOUT_SECONDS
+            : rawTimeout;
+        if (typeof timeoutSeconds !== 'number'
+            || !Number.isInteger(timeoutSeconds)
+            || timeoutSeconds < 10
+            || timeoutSeconds > MAX_TIMEOUT_SECONDS) {
+            throw new Error('timeout_seconds must be an integer from 10 to 3600');
+        }
+        const waited = await waitForHostedVerification(runId, context.token, {
+            intervalMs: 3_000,
+            timeoutMs: timeoutSeconds * 1_000,
+        });
+        return buildHostedJson('status', waited.state, {
+            account: context.account,
+            nextCommand: nextCommand(waited.state, context.account),
+            timedOut: waited.timedOut,
+        });
+    }
+    throw new Error(`unknown tool: ${name}`);
+}
+async function resolveToolContext(name, input, options) {
+    const requestedAccount = optionalInputString(input, 'account') ?? options.account;
+    const repository = name === 'verify_start'
+        ? parseHostedRepository(requireInputString(input, 'repository'))
+        : undefined;
+    const auth = await resolveAuthContext({
+        preferredLogin: requestedAccount,
+        owner: repository?.owner,
+        repo: repository?.repository,
+    });
+    return {
+        token: auth.token,
+        account: auth.token.startsWith('hsk_live_') ? undefined : auth.login,
+    };
+}
+export async function runHostedVerifyMcpServer(options) {
+    const mcp = new Server({ name: 'haystack-verify-hosted', version: '1.0.0' }, { capabilities: { tools: {} } });
+    mcp.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: HOSTED_VERIFY_TOOLS }));
+    mcp.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const { name, arguments: args } = request.params;
+        const input = (args ?? {});
+        try {
+            // Reject undeclared fields before account resolution so callers cannot
+            // use an invalid request to trigger credential or repository lookup.
+            assertToolInputFields(name, input);
+            const context = await resolveToolContext(name, input, options);
+            const result = await executeHostedVerifyTool(name, input, context);
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify(result, null, 2),
+                    }],
+            };
+        }
+        catch (error) {
+            return {
+                isError: true,
+                content: [{
+                        type: 'text',
+                        text: error instanceof Error ? error.message : String(error),
+                    }],
+            };
+        }
+    });
+    await mcp.connect(new StdioServerTransport());
+}

package/dist/index.js

@@ -256,6 +256,26 @@ Example:
     const { verifyHostedStatusCommand } = await import('./commands/verify-hosted.js');
     return runPublicCommand(() => verifyHostedStatusCommand(runId, options), options.json);
 });
+hostedVerify
+    .command('mcp')
+    .description('Run a stdio MCP server for the production verifier lifecycle')
+    .option('--account <login>', 'Default saved Haystack account for status and wait tools')
+    .addHelpText('after', `
+Tools: verify_start, verify_status, verify_wait.
+No credential, repository source, provider metadata, or sandbox mutation tool
+is exposed through this production server.
+`)
+    .action(async (_options, cmd) => {
+    const options = { ...cmd.optsWithGlobals(), ...cmd.opts() };
+    try {
+        const { runHostedVerifyMcpServer } = await import('./commands/verify-hosted-mcp.js');
+        await runHostedVerifyMcpServer(options);
+    }
+    catch (err) {
+        console.error(chalk.red('hosted verify mcp server failed:'), err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
 verify
     .command('reproducibility')
     .description('Separate frozen-plan drift from executor/judgment nondeterminism')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.22",
+  "version": "0.15.23",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {