@haystackeditor/cli 0.15.27 → 0.15.28

package/dist/utils/telemetry.js

@@ -11,23 +11,64 @@ import { readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as os from 'os';
+import { createHash } from 'node:crypto';
 const POSTHOG_HOST = 'https://us.i.posthog.com';
 const POSTHOG_API_KEY = process.env.HAYSTACK_POSTHOG_KEY || 'phc_7wHrCoMlcwuftLe6N38hPb9wKHb4OK0wNw9ayeRySad';
 const CURRENT_FILE_DIR = dirname(fileURLToPath(import.meta.url));
 const PACKAGE_JSON_PATH = resolve(CURRENT_FILE_DIR, '../../package.json');
+const SAFE_ENUM = /^[A-Za-z0-9 _.:/-]{1,100}$/;
+const SAFE_STRING_KEYS = new Set([
+    'checker',
+    'cli',
+    'during',
+    'kind',
+    'operation',
+    'outcome',
+    'rate_limit_limit',
+    'rate_limit_reset',
+    'rate_limit_resource',
+]);
+const SAFE_NUMBER_KEYS = new Set([
+    'configured',
+    'exit_code',
+    'max_turns',
+    'status',
+    'timeout_ms',
+    'total',
+    'wall_ms',
+]);
+function telemetryDisabled() {
+    return process.env.DO_NOT_TRACK === '1' || process.env.HAYSTACK_TELEMETRY_DISABLED === '1';
+}
+function minimizeMetadata(metadata) {
+    const minimized = {};
+    for (const [key, value] of Object.entries(metadata ?? {})) {
+        if (typeof value === 'string' && SAFE_STRING_KEYS.has(key) && SAFE_ENUM.test(value)) {
+            minimized[key] = value;
+        }
+        else if (typeof value === 'number' && Number.isFinite(value) && SAFE_NUMBER_KEYS.has(key)) {
+            minimized[key] = value;
+        }
+        else if (typeof value === 'boolean') {
+            minimized[key] = value;
+        }
+    }
+    return minimized;
+}
 /**
- * Stable machine identifier for PostHog distinct_id.
- * Uses hostname + username so events are attributable per-machine.
+ * Pseudonymous stable machine identifier for PostHog distinct_id.
+ * The local username and hostname are never transmitted.
  * Never throws — falls back to hostname-only or 'anonymous'.
  */
 function getDistinctId() {
     try {
         const hostname = os.hostname();
         try {
-            return `cli:${os.userInfo().username}@${hostname}`;
+            const localMachine = `${os.userInfo().username}\0${hostname}`;
+            return `cli:${createHash('sha256').update(localMachine).digest('hex').slice(0, 24)}`;
         }
         catch {
-            return `cli:${hostname}`;
+            return `cli:${createHash('sha256').update(hostname).digest('hex').slice(0, 24)}`;
         }
     }
     catch {
@@ -39,7 +80,7 @@ function getDistinctId() {
  */
 export function trackError(errorType, metadata) {
     try {
-        if (typeof globalThis.fetch !== 'function')
+        if (telemetryDisabled() || typeof globalThis.fetch !== 'function')
             return;
         const event = {
             api_key: POSTHOG_API_KEY,
@@ -52,7 +93,8 @@ export function trackError(errorType, metadata) {
                 arch: process.arch,
                 node_version: process.version,
                 timestamp: new Date().toISOString(),
-                ...metadata,
+                ...minimizeMetadata(metadata),
+                $ip: null,
             },
             timestamp: new Date().toISOString(),
         };
@@ -72,7 +114,7 @@ export function trackError(errorType, metadata) {
  */
 export function trackSetupEvent(step, metadata) {
     try {
-        if (typeof globalThis.fetch !== 'function')
+        if (telemetryDisabled() || typeof globalThis.fetch !== 'function')
             return;
         const event = {
             api_key: POSTHOG_API_KEY,
@@ -84,7 +126,8 @@ export function trackSetupEvent(step, metadata) {
                 os: process.platform,
                 arch: process.arch,
                 timestamp: new Date().toISOString(),
-                ...metadata,
+                ...minimizeMetadata(metadata),
+                $ip: null,
             },
             timestamp: new Date().toISOString(),
         };
@@ -98,6 +141,36 @@ export function trackSetupEvent(step, metadata) {
         // Telemetry must never crash the CLI
     }
 }
+/** Track one bounded front-half precompute result per CLI invocation. */
+export function trackPrecomputeEvent(outcome, wallMs, timeoutMs) {
+    try {
+        if (telemetryDisabled() || typeof globalThis.fetch !== 'function')
+            return;
+        const event = {
+            api_key: POSTHOG_API_KEY,
+            distinct_id: getDistinctId(),
+            event: 'cli_verify_precompute',
+            properties: {
+                cli_version: getCLIVersion(),
+                os: process.platform,
+                arch: process.arch,
+                timestamp: new Date().toISOString(),
+                ...minimizeMetadata({ outcome, wall_ms: wallMs }),
+                $ip: null,
+            },
+            timestamp: new Date().toISOString(),
+        };
+        globalThis.fetch(`${POSTHOG_HOST}/capture/`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(event),
+            signal: AbortSignal.timeout(Math.max(1, timeoutMs)),
+        }).catch(() => { });
+    }
+    catch {
+        // Telemetry must never crash or delay the CLI.
+    }
+}
 function getCLIVersion() {
     try {
         const packageJson = JSON.parse(readFileSync(PACKAGE_JSON_PATH, 'utf8'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.27",
+  "version": "0.15.28",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {
@@ -12,6 +12,7 @@
     "start": "node dist/index.js",
     "benchmark:telemetry": "pnpm build && node scripts/benchmark-telemetry-overhead.mjs",
     "benchmark:telemetry:corpus": "pnpm build && node scripts/benchmark-open-source-telemetry.mjs",
+    "benchmark:telemetry:corpus:guard": "pnpm build && node scripts/benchmark-open-source-telemetry.mjs --quick --require-budget",
     "check:schemas": "node scripts/check-schemas.mjs",
     "release": "node scripts/release.mjs",
     "prepublishOnly": "node scripts/no-direct-publish.mjs",

package/schemas/cloud-verifier.v1.json

@@ -67,6 +67,61 @@
     },
     "error": {
       "type": "string"
+    },
+    "result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "verdict",
+        "summary",
+        "casesTotal",
+        "casesFailed",
+        "regressions",
+        "outputLocation",
+        "wallSeconds"
+      ],
+      "properties": {
+        "verdict": {
+          "type": "string"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "casesTotal": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "casesFailed": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "regressions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "caseId",
+              "title"
+            ],
+            "properties": {
+              "caseId": {
+                "type": "string"
+              },
+              "title": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "outputLocation": {
+          "type": "string"
+        },
+        "wallSeconds": {
+          "type": "number",
+          "minimum": 0
+        }
+      }
     }
   },
   "allOf": [
@@ -86,9 +141,20 @@
           "repository",
           "base_commit",
           "head_commit",
-          "created_at",
-          "completed_at",
-          "output"
+          "created_at"
+        ],
+        "anyOf": [
+          {
+            "required": [
+              "completed_at",
+              "output"
+            ]
+          },
+          {
+            "required": [
+              "result"
+            ]
+          }
         ]
       }
     }

package/schemas/{pr.v2.json → pr.v3.json}

@@ -1,12 +1,12 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://docs.haystackeditor.com/cli/schemas/pr.v2.json",
+  "$id": "https://docs.haystackeditor.com/cli/schemas/pr.v3.json",
   "title": "haystack pr get <ref> --json",
   "type": "object",
   "additionalProperties": false,
-  "required": ["schema_version", "ref", "title", "head_sha", "triage", "merge", "traces"],
+  "required": ["schema_version", "ref", "title", "head_sha", "triage", "merge"],
   "properties": {
-    "schema_version": { "type": "string", "const": "2.0.0" },
+    "schema_version": { "type": "string", "const": "3.0.0" },
     "ref": { "type": "string" },
     "title": { "type": "string" },
     "head_sha": { "type": "string" },
@@ -31,15 +31,6 @@
         "action": { "type": ["string", "null"] }
       }
     },
-    "traces": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["available", "count"],
-      "properties": {
-        "available": { "type": "boolean" },
-        "count": { "type": "integer", "minimum": 0 }
-      }
-    },
     "fixer": {
       "type": "object",
       "additionalProperties": false,

package/dist/commands/traces.d.ts

@@ -1,48 +0,0 @@
-export interface TraceGetOptions {
-    json?: boolean;
-    cursor?: string;
-    limit?: string;
-}
-export declare function fetchTracesListPayload(ref: string): Promise<{
-    operation: string;
-    ref: string;
-    head_sha: string;
-    checkpoints: {
-        checkpoint_id: string;
-        commit_sha: string;
-        commit_message: string;
-        timestamp: string | null;
-        summary: string;
-        user_prompt: string | null;
-        files_touched: string[];
-        branch: string | null;
-    }[];
-} & {
-    schema_version: string;
-}>;
-export declare function tracesListCommand(ref: string, options: {
-    json?: boolean;
-}): Promise<void>;
-export declare function fetchTracesGetPayload(ref: string, checkpointId: string, options: Pick<TraceGetOptions, 'cursor' | 'limit'>): Promise<{
-    operation: string;
-    ref: string;
-    head_sha: string;
-    checkpoint_id: string;
-    checkpoint: {
-        checkpoint_id: string;
-        commit_sha: string;
-        commit_message: string;
-        timestamp: string | null;
-        summary: string;
-        user_prompt: string | null;
-        files_touched: string[];
-        branch: string | null;
-    } | null;
-    chunks: string[];
-    total_chunks: number;
-    total_chars: number;
-    next_cursor: string | null;
-} & {
-    schema_version: string;
-}>;
-export declare function tracesGetCommand(ref: string, checkpointId: string, options: TraceGetOptions): Promise<void>;

package/dist/commands/traces.js

@@ -1,92 +0,0 @@
-import chalk from 'chalk';
-import { loadToken } from '../utils/auth.js';
-import { fetchAnalysisArtifact, fetchGitHubJson } from '../utils/haystack-api.js';
-import { withSchema } from '../schema.js';
-import { parsePrRef } from '../utils/pr-ref.js';
-function publicCheckpoint(trace) {
-    return {
-        checkpoint_id: trace.checkpointId,
-        commit_sha: trace.commitSha,
-        commit_message: trace.commitMessage,
-        timestamp: trace.timestamp ?? null,
-        summary: trace.overviewSummary,
-        user_prompt: trace.userPrompt ?? null,
-        files_touched: trace.filesTouched ?? [],
-        branch: trace.branch ?? null,
-    };
-}
-async function tokenAndHead(ref) {
-    const pr = parsePrRef(ref, 'traces list');
-    const token = await loadToken({ owner: pr.owner, repo: pr.repo });
-    if (!token)
-        throw new Error('Not authenticated. Run `haystack login` first.');
-    const meta = await fetchGitHubJson(`/repos/${pr.owner}/${pr.repo}/pulls/${pr.prNumber}`, token);
-    return { pr, token, headSha: meta.head.sha, ref: `${pr.owner}/${pr.repo}#${pr.prNumber}` };
-}
-export async function fetchTracesListPayload(ref) {
-    const { pr, token, headSha, ref: normalizedRef } = await tokenAndHead(ref);
-    const overview = await fetchAnalysisArtifact(pr.owner, pr.repo, pr.prNumber, 'entire_traces.json', token);
-    return withSchema('traces', {
-        operation: 'list',
-        ref: normalizedRef,
-        head_sha: headSha,
-        checkpoints: (overview?.traces ?? []).map(publicCheckpoint),
-    });
-}
-export async function tracesListCommand(ref, options) {
-    const payload = await fetchTracesListPayload(ref);
-    if (options.json) {
-        console.log(JSON.stringify(payload, null, 2));
-        return;
-    }
-    if (payload.checkpoints.length === 0) {
-        console.log(chalk.dim('\nNo retained customer traces for this PR.\n'));
-        return;
-    }
-    console.log(chalk.bold('\nCustomer traces\n'));
-    for (const trace of payload.checkpoints) {
-        console.log(`${chalk.cyan(trace.checkpoint_id)}  ${trace.commit_message}`);
-        console.log(`  ${trace.summary}\n`);
-    }
-}
-export async function fetchTracesGetPayload(ref, checkpointId, options) {
-    const { pr, token, headSha, ref: normalizedRef } = await tokenAndHead(ref);
-    const [trace, overview] = await Promise.all([
-        fetchAnalysisArtifact(pr.owner, pr.repo, pr.prNumber, `entire_trace_chunks/${encodeURIComponent(checkpointId)}.json`, token),
-        fetchAnalysisArtifact(pr.owner, pr.repo, pr.prNumber, 'entire_traces.json', token),
-    ]);
-    if (!trace)
-        throw new Error(`Trace checkpoint not found: ${checkpointId}`);
-    if (trace.checkpointId !== checkpointId)
-        throw new Error('Trace checkpoint provenance mismatch');
-    const cursor = Math.max(0, Number.parseInt(options.cursor ?? '0', 10) || 0);
-    const limit = Math.min(100, Math.max(1, Number.parseInt(options.limit ?? '20', 10) || 20));
-    const chunks = trace.chunks.slice(cursor, cursor + limit);
-    const next = cursor + chunks.length < trace.chunks.length ? String(cursor + chunks.length) : null;
-    return withSchema('traces', {
-        operation: 'get',
-        ref: normalizedRef,
-        head_sha: headSha,
-        checkpoint_id: trace.checkpointId,
-        checkpoint: (() => {
-            const item = overview?.traces?.find((candidate) => candidate.checkpointId === trace.checkpointId);
-            return item ? publicCheckpoint(item) : null;
-        })(),
-        chunks,
-        total_chunks: trace.chunks.length,
-        total_chars: trace.totalChars,
-        next_cursor: next,
-    });
-}
-export async function tracesGetCommand(ref, checkpointId, options) {
-    const payload = await fetchTracesGetPayload(ref, checkpointId, options);
-    const chunks = payload.chunks;
-    const next = payload.next_cursor;
-    if (options.json) {
-        console.log(JSON.stringify(payload, null, 2));
-        return;
-    }
-    console.log(chunks.join('\n\n---\n\n'));
-    if (next)
-        console.log(chalk.dim(`\nMore available: --cursor ${next}\n`));
-}

package/dist/triage/traces.d.ts

@@ -1,20 +0,0 @@
-/**
- * Local Entire CLI trace discovery for intent drift analysis.
- *
- * Finds .entire/metadata/ session files whose modified files
- * overlap with the current diff's changed files.
- */
-/**
- * Find local Entire CLI trace files relevant to the current diff.
- *
- * Scans .entire/metadata/ for session directories containing full.jsonl,
- * then checks if any files modified in those sessions overlap with the
- * files changed in the current diff.
- *
- * Returns paths to condensed files containing only user messages (not the
- * raw multi-MB traces). This keeps the intent-drift sub-agent focused on
- * user intent without burning its context window on tool outputs.
- *
- * @returns Array of absolute paths to condensed user-messages files
- */
-export declare function findRelevantTraces(gitRoot: string, baseBranch: string): string[];