@haystackeditor/cli 0.15.27 → 0.15.29

package/dist/commands/verify-hosted.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
 import { resolveAuthContext } from '../utils/auth.js';
@@ -11,6 +12,11 @@ const STATUS = /^[a-z][a-z0-9_-]{1,31}$/;
 const TERMINAL_STATUSES = new Set(['complete', 'errored', 'expired', 'terminated']);
 const DEFAULT_INTERVAL_SECONDS = 5;
 const DEFAULT_TIMEOUT_MINUTES = 35;
+const INTENT_FIELDS = [
+    'problem',
+    'goal',
+    'intended_outcomes',
+];
 function requireRecord(value, context) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         throw new Error(`${context} returned an invalid response object.`);
@@ -73,10 +79,22 @@ export function parseHostedRunState(value, expectedRunId) {
     const output = outputValue === undefined
         ? undefined
         : requireRecord(outputValue, 'Hosted verifier output');
+    const resultValue = response.result;
+    const result = resultValue === undefined
+        ? undefined
+        : parseHostedRunnerResult(resultValue);
     const createdAt = optionalTimestamp(response, 'createdAt');
     const completedAt = optionalTimestamp(response, 'completedAt');
     if (status === 'complete') {
-        if (!repository
+        // Two terminal shapes exist: the Workflow receipt envelope (`output`)
+        // and the runner-queue result envelope (`result`). Exactly one must
+        // validate.
+        if (result) {
+            if (!repository || !baseCommit || !headCommit || !createdAt) {
+                throw new Error('Hosted verifier returned a complete run without a matching terminal receipt.');
+            }
+        }
+        else if (!repository
             || !baseCommit
             || !headCommit
             || !createdAt
@@ -100,9 +118,35 @@ export function parseHostedRunState(value, expectedRunId) {
         createdAt,
         completedAt,
         output,
+        result,
         error: optionalString(response, 'error'),
     };
 }
+function parseHostedRunnerResult(value) {
+    const record = requireRecord(value, 'Hosted verifier runner result');
+    const regressionsValue = record.regressions;
+    if (typeof record.verdict !== 'string'
+        || typeof record.summary !== 'string'
+        || !Number.isInteger(record.casesTotal)
+        || !Number.isInteger(record.casesFailed)
+        || typeof record.outputLocation !== 'string'
+        || typeof record.wallSeconds !== 'number'
+        || !Array.isArray(regressionsValue)
+        || !regressionsValue.every(item => !!item && typeof item === 'object' && !Array.isArray(item)
+            && typeof item.caseId === 'string'
+            && typeof item.title === 'string')) {
+        throw new Error('Hosted verifier runner result is malformed.');
+    }
+    return {
+        verdict: record.verdict,
+        summary: record.summary,
+        casesTotal: record.casesTotal,
+        casesFailed: record.casesFailed,
+        regressions: regressionsValue,
+        outputLocation: record.outputLocation,
+        wallSeconds: record.wallSeconds,
+    };
+}
 export function parseHostedRepository(value) {
     const parts = value.split('/');
     if (parts.length !== 2
@@ -121,6 +165,54 @@ function requireCommit(value, flag) {
     }
     return value;
 }
+export function readHostedIntentFile(intentFile) {
+    if (typeof intentFile !== 'string' || intentFile.length === 0) {
+        throw new Error('--intent-file is required and must name a JSON file containing exactly problem, goal, and intended_outcomes.');
+    }
+    let source;
+    try {
+        source = readFileSync(intentFile, 'utf8');
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not read --intent-file "${intentFile}": ${reason}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        throw new Error(`--intent-file "${intentFile}" must contain valid JSON.`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`--intent-file "${intentFile}" must contain exactly problem, goal, and intended_outcomes.`);
+    }
+    const record = parsed;
+    const unknownField = Object.keys(record)
+        .find(field => !INTENT_FIELDS.includes(field));
+    if (unknownField) {
+        throw new Error(`--intent-file "${intentFile}" contains unknown field "${unknownField}"; expected exactly problem, goal, and intended_outcomes.`);
+    }
+    for (const field of ['problem', 'goal']) {
+        if (typeof record[field] !== 'string' || record[field].trim().length === 0) {
+            throw new Error(`--intent-file "${intentFile}" field "${field}" must be a non-empty string.`);
+        }
+    }
+    const outcomes = record.intended_outcomes;
+    if (!Array.isArray(outcomes)
+        || outcomes.length === 0
+        || outcomes.some(item => typeof item !== 'string' || item.trim().length === 0)) {
+        throw new Error(`--intent-file "${intentFile}" field "intended_outcomes" must be a non-empty array of non-empty strings.`);
+    }
+    if (Object.keys(record).length !== INTENT_FIELDS.length) {
+        throw new Error(`--intent-file "${intentFile}" must contain exactly problem, goal, and intended_outcomes.`);
+    }
+    return {
+        problem: record.problem,
+        goal: record.goal,
+        intended_outcomes: record.intended_outcomes,
+    };
+}
 export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom) {
     const digest = createHash('sha256')
         .update(JSON.stringify(replayPlanFrom
@@ -155,25 +247,28 @@ export async function startHostedVerification(repositoryArg, options, token) {
     const repository = parseHostedRepository(repositoryArg);
     const baseCommit = requireCommit(options.base, '--base');
     const headCommit = requireCommit(options.head, '--head');
+    const intent = readHostedIntentFile(options.intentFile);
     const replayPlanFrom = options.replayPlanFrom;
     if (replayPlanFrom !== undefined && !RUN_ID.test(replayPlanFrom)) {
         throw new Error('--replay-plan-from must match cv_ followed by 48 lowercase hex characters.');
     }
     const idempotencyKey = requireIdempotencyKey(options.idempotencyKey
         ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom));
+    const launchBody = {
+        owner: repository.owner,
+        repository: repository.repository,
+        baseCommit,
+        headCommit,
+        idempotencyKey,
+        intent,
+        ...(replayPlanFrom
+            ? { replayPlanFromRunId: replayPlanFrom }
+            : {}),
+    };
     const response = await haystackJson('/api/agent/cloud-verifier/runs', token, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            owner: repository.owner,
-            repository: repository.repository,
-            baseCommit,
-            headCommit,
-            idempotencyKey,
-            ...(replayPlanFrom
-                ? { replayPlanFromRunId: replayPlanFrom }
-                : {}),
-        }),
+        body: JSON.stringify(launchBody),
     });
     const state = parseHostedRunState(response);
     return {
@@ -242,6 +337,7 @@ export function buildHostedJson(operation, state, extras = {}) {
         ...(extras.nextCommand ? { next_command: extras.nextCommand } : {}),
         ...(extras.timedOut !== undefined ? { timed_out: extras.timedOut } : {}),
         ...(state.output ? { output: state.output } : {}),
+        ...(state.result ? { result: state.result } : {}),
         ...(state.error ? { error: state.error } : {}),
     });
 }
@@ -273,6 +369,15 @@ function printHostedState(operation, state, options) {
     if (state.baseCommit && state.headCommit) {
         console.log(`  ${chalk.dim('Commits:')} ${state.baseCommit.slice(0, 12)} → ${state.headCommit.slice(0, 12)}`);
     }
+    if (state.result) {
+        const passed = state.result.casesTotal - state.result.casesFailed;
+        console.log(`  ${chalk.dim('Verdict:')} ${state.result.verdict} `
+            + `(${passed}/${state.result.casesTotal} cases clean, ${Math.round(state.result.wallSeconds)}s)`);
+        for (const regression of state.result.regressions) {
+            console.log(`    ${chalk.red('✗')} ${regression.caseId}: ${regression.title}`);
+        }
+        console.log(`  ${chalk.dim('Artifacts:')} ${state.result.outputLocation}`);
+    }
     if (state.error)
         console.log(`  ${chalk.dim('Error:')} ${state.error}`);
     if (options.timedOut) {
@@ -289,6 +394,9 @@ function markNonSuccess(state, timedOut = false) {
 }
 export async function verifyHostedStartCommand(repositoryArg, options) {
     const repository = parseHostedRepository(repositoryArg);
+    // Fail before account resolution so an invalid local intent never advances
+    // toward a hosted launch.
+    readHostedIntentFile(options.intentFile);
     const auth = await resolveAuthContext({
         preferredLogin: options.account,
         owner: repository.owner,

package/dist/commands/verify-precompute.d.ts

@@ -0,0 +1,19 @@
+export type PrecomputeOutcome = 'enqueued' | 'cached' | 'existing' | 'skipped_no_auth' | 'error';
+export interface VerifyPrecomputeOptions {
+    hook?: boolean;
+}
+export interface FrontHalfEnqueueRequest {
+    owner: string;
+    repository: string;
+    baseCommit: string;
+    workCommit: string;
+    cacheKey: string;
+    patchGzBase64: string;
+    patchSha256: string;
+}
+export interface PrecomputeDerivation {
+    treeSha: string;
+    request: FrontHalfEnqueueRequest;
+}
+export declare function derivePrecomputeRequest(gitRoot: string, owner: string, repository: string, deadline?: number): Promise<PrecomputeDerivation>;
+export declare function verifyPrecomputeCommand(options: VerifyPrecomputeOptions): Promise<void>;

package/dist/commands/verify-precompute.js

@@ -0,0 +1,328 @@
+import { spawn, execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { cpSync, existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { createGzip } from 'node:zlib';
+import { isAbsolute, join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import chalk from 'chalk';
+import { NotLoggedInError, resolveAuthContext } from '../utils/auth.js';
+import { findGitRoot, parseRemoteUrl, resolveDiffBaseRef, } from '../utils/git.js';
+import { HaystackApiError, haystackJson } from '../utils/haystack-api.js';
+import { trackPrecomputeEvent } from '../utils/telemetry.js';
+const TOTAL_WALL_MS = 5_000;
+const REMOTE_COMMAND_MS = 750;
+const COMMIT_SHA = /^[0-9a-f]{40}$/;
+const REPOSITORY_COMPONENT = /^[A-Za-z0-9_.-]{1,100}$/;
+const RUN_ID = /^cv_[0-9a-f]{48}$/;
+const FIXED_COMMIT_ENV = {
+    GIT_AUTHOR_NAME: 'haystack-stop-hook',
+    GIT_AUTHOR_EMAIL: 'stop-hook@haystack.invalid',
+    GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z',
+    GIT_COMMITTER_NAME: 'haystack-stop-hook',
+    GIT_COMMITTER_EMAIL: 'stop-hook@haystack.invalid',
+    GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z',
+};
+class PrecomputeFailure extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PrecomputeFailure';
+    }
+}
+function remainingMs(deadline) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) {
+        throw new PrecomputeFailure('Precompute timed out.');
+    }
+    return remaining;
+}
+function gitOutput(args, gitRoot, deadline, options = {}) {
+    const timeout = Math.max(1, Math.min(remainingMs(deadline), options.timeoutCapMs ?? TOTAL_WALL_MS));
+    try {
+        return execFileSync('git', args, {
+            cwd: gitRoot,
+            encoding: 'utf8',
+            env: options.env ?? process.env,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout,
+        }).trim();
+    }
+    catch {
+        throw new PrecomputeFailure('Could not derive the repository snapshot.');
+    }
+}
+function resolveOriginRepository(gitRoot) {
+    try {
+        const remote = parseRemoteUrl('origin');
+        if (!REPOSITORY_COMPONENT.test(remote.owner)
+            || !REPOSITORY_COMPONENT.test(remote.repo)) {
+            throw new Error('invalid repository identity');
+        }
+        return { owner: remote.owner, repository: remote.repo };
+    }
+    catch {
+        // Keep remote URLs and local paths out of errors.
+        throw new PrecomputeFailure('No supported origin repository was found.');
+    }
+}
+function resolveOriginDefaultBranch(gitRoot, deadline) {
+    try {
+        const remoteHead = gitOutput(['symbolic-ref', '--short', 'refs/remotes/origin/HEAD'], gitRoot, deadline);
+        if (remoteHead.startsWith('origin/') && remoteHead.length > 'origin/'.length) {
+            return remoteHead.slice('origin/'.length);
+        }
+    }
+    catch {
+        // A clone does not have to carry origin/HEAD; ask the remote below.
+    }
+    const remoteSummary = gitOutput(['remote', 'show', 'origin'], gitRoot, deadline, {
+        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+        timeoutCapMs: REMOTE_COMMAND_MS,
+    });
+    const match = remoteSummary.match(/^\s*HEAD branch:\s*(\S+)\s*$/m);
+    if (!match) {
+        throw new PrecomputeFailure('Could not resolve the origin default branch.');
+    }
+    return match[1];
+}
+function deriveBaseSha(gitRoot, deadline) {
+    const defaultBranch = resolveOriginDefaultBranch(gitRoot, deadline);
+    const baseRef = resolveDiffBaseRef(defaultBranch, {
+        cwd: gitRoot,
+        timeoutMs: Math.max(1, Math.min(remainingMs(deadline), REMOTE_COMMAND_MS)),
+    });
+    const baseSha = gitOutput(['merge-base', 'HEAD', baseRef], gitRoot, deadline);
+    if (!COMMIT_SHA.test(baseSha)) {
+        throw new PrecomputeFailure('Could not derive the base commit.');
+    }
+    return baseSha;
+}
+function deriveWorktreeTreeSha(gitRoot, deadline) {
+    const scratchDirectory = mkdtempSync(join(tmpdir(), 'haystack-precompute-index-'));
+    const temporaryIndex = join(scratchDirectory, 'index');
+    try {
+        const gitIndexPath = gitOutput(['rev-parse', '--git-path', 'index'], gitRoot, deadline);
+        const sourceIndex = isAbsolute(gitIndexPath)
+            ? gitIndexPath
+            : resolve(gitRoot, gitIndexPath);
+        const indexEnv = { ...process.env, GIT_INDEX_FILE: temporaryIndex };
+        if (existsSync(sourceIndex)) {
+            // blast_cache_worktree_tree_sha uses `cp -p`: preserving timestamps keeps
+            // git's racy-clean handling byte-identical to the bash implementation.
+            cpSync(sourceIndex, temporaryIndex, { preserveTimestamps: true });
+        }
+        else {
+            gitOutput(['read-tree', 'HEAD'], gitRoot, deadline, { env: indexEnv });
+        }
+        gitOutput(['add', '-A'], gitRoot, deadline, { env: indexEnv });
+        const treeSha = gitOutput(['write-tree'], gitRoot, deadline, { env: indexEnv });
+        if (!COMMIT_SHA.test(treeSha)) {
+            throw new PrecomputeFailure('Could not derive the working-tree snapshot.');
+        }
+        return treeSha;
+    }
+    finally {
+        rmSync(scratchDirectory, { recursive: true, force: true });
+    }
+}
+function deriveWorkCommit(gitRoot, baseSha, treeSha, deadline) {
+    const headSha = gitOutput(['rev-parse', 'HEAD'], gitRoot, deadline);
+    const headTreeSha = gitOutput(['rev-parse', 'HEAD^{tree}'], gitRoot, deadline);
+    if (!COMMIT_SHA.test(headSha) || !COMMIT_SHA.test(headTreeSha)) {
+        throw new PrecomputeFailure('Could not resolve the current commit.');
+    }
+    // A clean checkout of the base already has the exact required identity.
+    if (baseSha === headSha && treeSha === headTreeSha)
+        return headSha;
+    const workCommit = gitOutput(['commit-tree', treeSha, '-p', baseSha, '-m', 'front-half-snapshot'], gitRoot, deadline, { env: { ...process.env, ...FIXED_COMMIT_ENV } });
+    if (!COMMIT_SHA.test(workCommit)) {
+        throw new PrecomputeFailure('Could not derive the working commit.');
+    }
+    return workCommit;
+}
+function slimInputHash() {
+    // Mirrors printf '%s\0%s\0%s\0%s\0' slim agent-deferred none none.
+    return createHash('sha256')
+        .update(Buffer.from('slim\0agent-deferred\0none\0none\0'))
+        .digest('hex');
+}
+async function buildCompressedPatch(gitRoot, baseSha, workCommit, deadline) {
+    return new Promise((resolvePatch, rejectPatch) => {
+        const child = spawn('git', ['diff', '--binary', baseSha, workCommit], {
+            cwd: gitRoot,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const gzip = createGzip();
+        const chunks = [];
+        let compressedBytes = 0;
+        let childClosed = false;
+        let gzipEnded = false;
+        let childSucceeded = false;
+        let settled = false;
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            fail(new PrecomputeFailure('Precompute timed out.'));
+        }, remainingMs(deadline));
+        const clear = () => clearTimeout(timer);
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clear();
+            child.kill('SIGKILL');
+            gzip.destroy();
+            rejectPatch(error);
+        };
+        const finish = () => {
+            if (settled || !childClosed || !gzipEnded)
+                return;
+            if (!childSucceeded) {
+                fail(new PrecomputeFailure('Could not build the working-tree patch.'));
+                return;
+            }
+            settled = true;
+            clear();
+            resolvePatch(Buffer.concat(chunks, compressedBytes));
+        };
+        child.stderr.resume();
+        child.once('error', () => fail(new PrecomputeFailure('Could not build the working-tree patch.')));
+        child.once('close', code => {
+            childClosed = true;
+            childSucceeded = code === 0;
+            finish();
+        });
+        gzip.on('data', (chunk) => {
+            compressedBytes += chunk.length;
+            chunks.push(chunk);
+        });
+        gzip.once('error', () => fail(new PrecomputeFailure('Could not compress the working-tree patch.')));
+        gzip.once('end', () => {
+            gzipEnded = true;
+            finish();
+        });
+        child.stdout.pipe(gzip);
+    });
+}
+export async function derivePrecomputeRequest(gitRoot, owner, repository, deadline = Date.now() + TOTAL_WALL_MS) {
+    const baseSha = deriveBaseSha(gitRoot, deadline);
+    const treeSha = deriveWorktreeTreeSha(gitRoot, deadline);
+    const workCommit = deriveWorkCommit(gitRoot, baseSha, treeSha, deadline);
+    const patchGzip = await buildCompressedPatch(gitRoot, baseSha, workCommit, deadline);
+    const cacheKey = [
+        baseSha.slice(0, 12),
+        workCommit.slice(0, 12),
+        treeSha.slice(0, 16),
+        'slim',
+        slimInputHash(),
+    ].join('-');
+    return {
+        treeSha,
+        request: {
+            owner,
+            repository,
+            baseCommit: baseSha,
+            workCommit,
+            cacheKey,
+            patchGzBase64: patchGzip.toString('base64'),
+            patchSha256: createHash('sha256').update(patchGzip).digest('hex'),
+        },
+    };
+}
+function precomputeResult(response) {
+    if (!response || typeof response !== 'object' || Array.isArray(response)) {
+        throw new PrecomputeFailure('The precompute service returned an invalid response.');
+    }
+    const { status, runId } = response;
+    if (status === 'queued' && typeof runId === 'string' && RUN_ID.test(runId)) {
+        return { outcome: 'enqueued', runId };
+    }
+    if (status === 'cached')
+        return { outcome: 'cached' };
+    if (status === 'existing')
+        return { outcome: 'existing' };
+    throw new PrecomputeFailure('The precompute service returned an invalid response.');
+}
+function normalModeFailure(error) {
+    if (error instanceof PrecomputeFailure)
+        return error;
+    if (error instanceof NotLoggedInError) {
+        return new PrecomputeFailure('Authentication is required. Run `haystack login` first.');
+    }
+    if (error instanceof HaystackApiError) {
+        if (error.status === 401 || error.status === 403) {
+            return new PrecomputeFailure('Authentication was rejected. Run `haystack login` and try again.');
+        }
+        if (error.status === 429) {
+            return new PrecomputeFailure('Precompute requests are temporarily rate limited. Try again later.');
+        }
+        return new PrecomputeFailure(`The precompute request failed (HTTP ${error.status}).`);
+    }
+    return new PrecomputeFailure('The precompute request failed.');
+}
+function printResult(outcome, runId) {
+    if (outcome === 'enqueued') {
+        console.log(chalk.green(`Precompute request queued${runId ? ` (${runId})` : ''}.`));
+    }
+    else if (outcome === 'cached') {
+        console.log(chalk.green('Precompute result is already cached.'));
+    }
+    else if (outcome === 'existing') {
+        console.log(chalk.green('A matching precompute request already exists.'));
+    }
+}
+export async function verifyPrecomputeCommand(options) {
+    const startedAt = Date.now();
+    const deadline = startedAt + TOTAL_WALL_MS;
+    let outcome = 'error';
+    try {
+        const gitRoot = findGitRoot();
+        if (!gitRoot) {
+            throw new PrecomputeFailure('Run this command from a git repository.');
+        }
+        const repository = resolveOriginRepository(gitRoot);
+        const derivation = await derivePrecomputeRequest(gitRoot, repository.owner, repository.repository, deadline);
+        let token;
+        try {
+            const auth = await resolveAuthContext({
+                owner: repository.owner,
+                repo: repository.repository,
+            });
+            token = auth.token;
+        }
+        catch (error) {
+            if (error instanceof NotLoggedInError) {
+                outcome = 'skipped_no_auth';
+                if (options.hook)
+                    return;
+            }
+            throw error;
+        }
+        const controller = new AbortController();
+        const fetchTimer = setTimeout(() => controller.abort(), remainingMs(deadline));
+        let response;
+        try {
+            response = await haystackJson('/api/agent/cloud-verifier/front-half', token, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(derivation.request),
+                signal: controller.signal,
+            });
+        }
+        finally {
+            clearTimeout(fetchTimer);
+        }
+        const result = precomputeResult(response);
+        outcome = result.outcome;
+        if (!options.hook)
+            printResult(outcome, result.runId);
+    }
+    catch (error) {
+        if (!options.hook)
+            throw normalModeFailure(error);
+    }
+    finally {
+        const wallMs = Date.now() - startedAt;
+        trackPrecomputeEvent(outcome, wallMs, Math.max(1, TOTAL_WALL_MS - wallMs));
+        if (options.hook)
+            process.exitCode = 0;
+    }
+}