@haystackeditor/cli 0.15.27 → 0.15.29

package/dist/utils/hooks.js

@@ -1,21 +1,14 @@
 /**
- * Utilities for haystack hooks install/status/update commands.
- *
- * Handles Entire CLI binary download, hook file copying, and git configuration.
+ * Utilities for haystack hooks install/status commands.
  */
 import * as fs from 'fs/promises';
 import { existsSync } from 'fs';
 import * as path from 'path';
-import * as os from 'os';
 import { execSync } from 'child_process';
 import { fileURLToPath } from 'url';
 // ============================================================================
 // Constants
 // ============================================================================
-export const ENTIRE_DEFAULT_VERSION = '0.4.8';
-export const ENTIRE_GITHUB_REPO = 'entireio/cli';
-export const HAYSTACK_BIN_DIR = path.join(os.homedir(), '.haystack', 'bin');
-export const ENTIRE_BIN_PATH = path.join(HAYSTACK_BIN_DIR, 'entire');
 const HOOK_SCRIPTS = [
     'pre-commit',
     'commit-msg',
@@ -24,25 +17,6 @@ const HOOK_SCRIPTS = [
     'prepare-commit-msg',
 ];
 // ============================================================================
-// Platform detection
-// ============================================================================
-const OS_MAP = {
-    darwin: 'darwin',
-    linux: 'linux',
-};
-const ARCH_MAP = {
-    arm64: 'arm64',
-    x64: 'amd64',
-};
-export function getPlatformAssetName() {
-    const osName = OS_MAP[process.platform];
-    const archName = ARCH_MAP[process.arch];
-    if (!osName || !archName) {
-        throw new Error(`Unsupported platform: ${process.platform}-${process.arch}. Entire CLI supports macOS and Linux (amd64/arm64).`);
-    }
-    return `entire_${osName}_${archName}.tar.gz`;
-}
-// ============================================================================
 // Git repo detection
 // ============================================================================
 export function findGitRoot() {
@@ -57,86 +31,6 @@ export function findGitRoot() {
     }
 }
 // ============================================================================
-// Entire binary management
-// ============================================================================
-export async function getInstalledEntireVersion() {
-    if (!existsSync(ENTIRE_BIN_PATH))
-        return null;
-    try {
-        const output = execSync(`"${ENTIRE_BIN_PATH}" --version`, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        // Output is like "entire version 0.4.8" or just "0.4.8"
-        const match = output.match(/(\d+\.\d+\.\d+)/);
-        return match ? match[1] : output;
-    }
-    catch {
-        return null;
-    }
-}
-export async function getLatestEntireVersion() {
-    const response = await fetch(`https://api.github.com/repos/${ENTIRE_GITHUB_REPO}/releases/latest`, {
-        headers: {
-            'User-Agent': 'Haystack-CLI',
-            Accept: 'application/vnd.github.v3+json',
-        },
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to fetch latest Entire release: ${response.status} ${response.statusText}`);
-    }
-    const data = (await response.json());
-    // tag_name is like "v0.4.8"
-    return data.tag_name.replace(/^v/, '');
-}
-export async function downloadEntireBinary(version) {
-    const assetName = getPlatformAssetName();
-    const tag = version.startsWith('v') ? version : `v${version}`;
-    // Fetch release to get asset download URL
-    const releaseResponse = await fetch(`https://api.github.com/repos/${ENTIRE_GITHUB_REPO}/releases/tags/${tag}`, {
-        headers: {
-            'User-Agent': 'Haystack-CLI',
-            Accept: 'application/vnd.github.v3+json',
-        },
-    });
-    if (!releaseResponse.ok) {
-        throw new Error(`Failed to fetch Entire release ${tag}: ${releaseResponse.status}`);
-    }
-    const release = (await releaseResponse.json());
-    const asset = release.assets.find((a) => a.name === assetName);
-    if (!asset) {
-        throw new Error(`No binary found for ${assetName} in Entire release ${tag}. Available: ${release.assets.map((a) => a.name).join(', ')}`);
-    }
-    // Download the tar.gz
-    const downloadResponse = await fetch(asset.browser_download_url, {
-        headers: { 'User-Agent': 'Haystack-CLI' },
-    });
-    if (!downloadResponse.ok) {
-        throw new Error(`Failed to download ${assetName}: ${downloadResponse.status}`);
-    }
-    const buffer = Buffer.from(await downloadResponse.arrayBuffer());
-    // Create temp dir, extract, and move binary
-    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'haystack-entire-'));
-    const tarPath = path.join(tmpDir, assetName);
-    try {
-        await fs.writeFile(tarPath, buffer);
-        execSync(`tar xzf "${tarPath}" -C "${tmpDir}"`, { stdio: 'pipe' });
-        // Ensure bin dir exists
-        await fs.mkdir(HAYSTACK_BIN_DIR, { recursive: true });
-        // Move the binary
-        const extractedBinary = path.join(tmpDir, 'entire');
-        if (!existsSync(extractedBinary)) {
-            throw new Error('Entire binary not found in extracted archive');
-        }
-        await fs.copyFile(extractedBinary, ENTIRE_BIN_PATH);
-        await fs.chmod(ENTIRE_BIN_PATH, 0o755);
-    }
-    finally {
-        // Clean up temp dir
-        await fs.rm(tmpDir, { recursive: true, force: true });
-    }
-}
-// ============================================================================
 // Asset directory resolution
 // ============================================================================
 const __filename = fileURLToPath(import.meta.url);
@@ -188,26 +82,6 @@ export async function copyLlmRulesTemplate(repoRoot) {
     await fs.copyFile(src, dest);
     return true;
 }
-/** Create .entire/settings.json and .entire/.gitignore */
-export async function createEntireConfig(repoRoot) {
-    const entireDir = path.join(repoRoot, '.entire');
-    await fs.mkdir(entireDir, { recursive: true });
-    await fs.writeFile(path.join(entireDir, 'settings.json'), JSON.stringify({ enabled: true, telemetry: false }, null, 2) + '\n', 'utf-8');
-    await fs.writeFile(path.join(entireDir, '.gitignore'), 'tmp/\nsettings.local.json\nmetadata/\nlogs/\n', 'utf-8');
-}
-/** Add .entire/metadata/ to repo .gitignore if not already present */
-export async function updateGitignore(repoRoot) {
-    const gitignorePath = path.join(repoRoot, '.gitignore');
-    let content = '';
-    if (existsSync(gitignorePath)) {
-        content = await fs.readFile(gitignorePath, 'utf-8');
-    }
-    if (content.includes('.entire/metadata'))
-        return false;
-    const addition = '\n# Entire CLI local session data\n.entire/metadata/\n';
-    await fs.writeFile(gitignorePath, content + addition, 'utf-8');
-    return true;
-}
 // ============================================================================
 // Helpers
 // ============================================================================

package/dist/utils/telemetry.d.ts

@@ -15,3 +15,5 @@ export declare function trackError(errorType: string, metadata?: Record<string,
  * Track a setup event (non-error). Fire-and-forget.
  */
 export declare function trackSetupEvent(step: string, metadata?: Record<string, unknown>): void;
+/** Track one bounded front-half precompute result per CLI invocation. */
+export declare function trackPrecomputeEvent(outcome: string, wallMs: number, timeoutMs: number): void;

package/dist/utils/telemetry.js

@@ -11,23 +11,64 @@ import { readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as os from 'os';
+import { createHash } from 'node:crypto';
 const POSTHOG_HOST = 'https://us.i.posthog.com';
 const POSTHOG_API_KEY = process.env.HAYSTACK_POSTHOG_KEY || 'phc_7wHrCoMlcwuftLe6N38hPb9wKHb4OK0wNw9ayeRySad';
 const CURRENT_FILE_DIR = dirname(fileURLToPath(import.meta.url));
 const PACKAGE_JSON_PATH = resolve(CURRENT_FILE_DIR, '../../package.json');
+const SAFE_ENUM = /^[A-Za-z0-9 _.:/-]{1,100}$/;
+const SAFE_STRING_KEYS = new Set([
+    'checker',
+    'cli',
+    'during',
+    'kind',
+    'operation',
+    'outcome',
+    'rate_limit_limit',
+    'rate_limit_reset',
+    'rate_limit_resource',
+]);
+const SAFE_NUMBER_KEYS = new Set([
+    'configured',
+    'exit_code',
+    'max_turns',
+    'status',
+    'timeout_ms',
+    'total',
+    'wall_ms',
+]);
+function telemetryDisabled() {
+    return process.env.DO_NOT_TRACK === '1' || process.env.HAYSTACK_TELEMETRY_DISABLED === '1';
+}
+function minimizeMetadata(metadata) {
+    const minimized = {};
+    for (const [key, value] of Object.entries(metadata ?? {})) {
+        if (typeof value === 'string' && SAFE_STRING_KEYS.has(key) && SAFE_ENUM.test(value)) {
+            minimized[key] = value;
+        }
+        else if (typeof value === 'number' && Number.isFinite(value) && SAFE_NUMBER_KEYS.has(key)) {
+            minimized[key] = value;
+        }
+        else if (typeof value === 'boolean') {
+            minimized[key] = value;
+        }
+    }
+    return minimized;
+}
 /**
- * Stable machine identifier for PostHog distinct_id.
- * Uses hostname + username so events are attributable per-machine.
+ * Pseudonymous stable machine identifier for PostHog distinct_id.
+ * The local username and hostname are never transmitted.
  * Never throws — falls back to hostname-only or 'anonymous'.
  */
 function getDistinctId() {
     try {
         const hostname = os.hostname();
         try {
-            return `cli:${os.userInfo().username}@${hostname}`;
+            const localMachine = `${os.userInfo().username}\0${hostname}`;
+            return `cli:${createHash('sha256').update(localMachine).digest('hex').slice(0, 24)}`;
         }
         catch {
-            return `cli:${hostname}`;
+            return `cli:${createHash('sha256').update(hostname).digest('hex').slice(0, 24)}`;
         }
     }
     catch {
@@ -39,7 +80,7 @@ function getDistinctId() {
  */
 export function trackError(errorType, metadata) {
     try {
-        if (typeof globalThis.fetch !== 'function')
+        if (telemetryDisabled() || typeof globalThis.fetch !== 'function')
             return;
         const event = {
             api_key: POSTHOG_API_KEY,
@@ -52,7 +93,8 @@ export function trackError(errorType, metadata) {
                 arch: process.arch,
                 node_version: process.version,
                 timestamp: new Date().toISOString(),
-                ...metadata,
+                ...minimizeMetadata(metadata),
+                $ip: null,
             },
             timestamp: new Date().toISOString(),
         };
@@ -72,7 +114,7 @@ export function trackError(errorType, metadata) {
  */
 export function trackSetupEvent(step, metadata) {
     try {
-        if (typeof globalThis.fetch !== 'function')
+        if (telemetryDisabled() || typeof globalThis.fetch !== 'function')
             return;
         const event = {
             api_key: POSTHOG_API_KEY,
@@ -84,7 +126,8 @@ export function trackSetupEvent(step, metadata) {
                 os: process.platform,
                 arch: process.arch,
                 timestamp: new Date().toISOString(),
-                ...metadata,
+                ...minimizeMetadata(metadata),
+                $ip: null,
             },
             timestamp: new Date().toISOString(),
         };
@@ -98,6 +141,36 @@ export function trackSetupEvent(step, metadata) {
         // Telemetry must never crash the CLI
     }
 }
+/** Track one bounded front-half precompute result per CLI invocation. */
+export function trackPrecomputeEvent(outcome, wallMs, timeoutMs) {
+    try {
+        if (telemetryDisabled() || typeof globalThis.fetch !== 'function')
+            return;
+        const event = {
+            api_key: POSTHOG_API_KEY,
+            distinct_id: getDistinctId(),
+            event: 'cli_verify_precompute',
+            properties: {
+                cli_version: getCLIVersion(),
+                os: process.platform,
+                arch: process.arch,
+                timestamp: new Date().toISOString(),
+                ...minimizeMetadata({ outcome, wall_ms: wallMs }),
+                $ip: null,
+            },
+            timestamp: new Date().toISOString(),
+        };
+        globalThis.fetch(`${POSTHOG_HOST}/capture/`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(event),
+            signal: AbortSignal.timeout(Math.max(1, timeoutMs)),
+        }).catch(() => { });
+    }
+    catch {
+        // Telemetry must never crash or delay the CLI.
+    }
+}
 function getCLIVersion() {
     try {
         const packageJson = JSON.parse(readFileSync(PACKAGE_JSON_PATH, 'utf8'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.27",
+  "version": "0.15.29",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {
@@ -12,6 +12,7 @@
     "start": "node dist/index.js",
     "benchmark:telemetry": "pnpm build && node scripts/benchmark-telemetry-overhead.mjs",
     "benchmark:telemetry:corpus": "pnpm build && node scripts/benchmark-open-source-telemetry.mjs",
+    "benchmark:telemetry:corpus:guard": "pnpm build && node scripts/benchmark-open-source-telemetry.mjs --quick --require-budget",
     "check:schemas": "node scripts/check-schemas.mjs",
     "release": "node scripts/release.mjs",
     "prepublishOnly": "node scripts/no-direct-publish.mjs",

package/schemas/cloud-verifier.v1.json

@@ -67,6 +67,61 @@
     },
     "error": {
       "type": "string"
+    },
+    "result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "verdict",
+        "summary",
+        "casesTotal",
+        "casesFailed",
+        "regressions",
+        "outputLocation",
+        "wallSeconds"
+      ],
+      "properties": {
+        "verdict": {
+          "type": "string"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "casesTotal": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "casesFailed": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "regressions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "caseId",
+              "title"
+            ],
+            "properties": {
+              "caseId": {
+                "type": "string"
+              },
+              "title": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "outputLocation": {
+          "type": "string"
+        },
+        "wallSeconds": {
+          "type": "number",
+          "minimum": 0
+        }
+      }
     }
   },
   "allOf": [
@@ -86,9 +141,20 @@
           "repository",
           "base_commit",
           "head_commit",
-          "created_at",
-          "completed_at",
-          "output"
+          "created_at"
+        ],
+        "anyOf": [
+          {
+            "required": [
+              "completed_at",
+              "output"
+            ]
+          },
+          {
+            "required": [
+              "result"
+            ]
+          }
         ]
       }
     }

package/schemas/{pr.v2.json → pr.v3.json}

@@ -1,12 +1,12 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://docs.haystackeditor.com/cli/schemas/pr.v2.json",
+  "$id": "https://docs.haystackeditor.com/cli/schemas/pr.v3.json",
   "title": "haystack pr get <ref> --json",
   "type": "object",
   "additionalProperties": false,
-  "required": ["schema_version", "ref", "title", "head_sha", "triage", "merge", "traces"],
+  "required": ["schema_version", "ref", "title", "head_sha", "triage", "merge"],
   "properties": {
-    "schema_version": { "type": "string", "const": "2.0.0" },
+    "schema_version": { "type": "string", "const": "3.0.0" },
     "ref": { "type": "string" },
     "title": { "type": "string" },
     "head_sha": { "type": "string" },
@@ -31,15 +31,6 @@
         "action": { "type": ["string", "null"] }
       }
     },
-    "traces": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["available", "count"],
-      "properties": {
-        "available": { "type": "boolean" },
-        "count": { "type": "integer", "minimum": 0 }
-      }
-    },
     "fixer": {
       "type": "object",
       "additionalProperties": false,

package/dist/commands/traces.d.ts

@@ -1,48 +0,0 @@
-export interface TraceGetOptions {
-    json?: boolean;
-    cursor?: string;
-    limit?: string;
-}
-export declare function fetchTracesListPayload(ref: string): Promise<{
-    operation: string;
-    ref: string;
-    head_sha: string;
-    checkpoints: {
-        checkpoint_id: string;
-        commit_sha: string;
-        commit_message: string;
-        timestamp: string | null;
-        summary: string;
-        user_prompt: string | null;
-        files_touched: string[];
-        branch: string | null;
-    }[];
-} & {
-    schema_version: string;
-}>;
-export declare function tracesListCommand(ref: string, options: {
-    json?: boolean;
-}): Promise<void>;
-export declare function fetchTracesGetPayload(ref: string, checkpointId: string, options: Pick<TraceGetOptions, 'cursor' | 'limit'>): Promise<{
-    operation: string;
-    ref: string;
-    head_sha: string;
-    checkpoint_id: string;
-    checkpoint: {
-        checkpoint_id: string;
-        commit_sha: string;
-        commit_message: string;
-        timestamp: string | null;
-        summary: string;
-        user_prompt: string | null;
-        files_touched: string[];
-        branch: string | null;
-    } | null;
-    chunks: string[];
-    total_chunks: number;
-    total_chars: number;
-    next_cursor: string | null;
-} & {
-    schema_version: string;
-}>;
-export declare function tracesGetCommand(ref: string, checkpointId: string, options: TraceGetOptions): Promise<void>;

package/dist/commands/traces.js

@@ -1,92 +0,0 @@
-import chalk from 'chalk';
-import { loadToken } from '../utils/auth.js';
-import { fetchAnalysisArtifact, fetchGitHubJson } from '../utils/haystack-api.js';
-import { withSchema } from '../schema.js';
-import { parsePrRef } from '../utils/pr-ref.js';
-function publicCheckpoint(trace) {
-    return {
-        checkpoint_id: trace.checkpointId,
-        commit_sha: trace.commitSha,
-        commit_message: trace.commitMessage,
-        timestamp: trace.timestamp ?? null,
-        summary: trace.overviewSummary,
-        user_prompt: trace.userPrompt ?? null,
-        files_touched: trace.filesTouched ?? [],
-        branch: trace.branch ?? null,
-    };
-}
-async function tokenAndHead(ref) {
-    const pr = parsePrRef(ref, 'traces list');
-    const token = await loadToken({ owner: pr.owner, repo: pr.repo });
-    if (!token)
-        throw new Error('Not authenticated. Run `haystack login` first.');
-    const meta = await fetchGitHubJson(`/repos/${pr.owner}/${pr.repo}/pulls/${pr.prNumber}`, token);
-    return { pr, token, headSha: meta.head.sha, ref: `${pr.owner}/${pr.repo}#${pr.prNumber}` };
-}
-export async function fetchTracesListPayload(ref) {
-    const { pr, token, headSha, ref: normalizedRef } = await tokenAndHead(ref);
-    const overview = await fetchAnalysisArtifact(pr.owner, pr.repo, pr.prNumber, 'entire_traces.json', token);
-    return withSchema('traces', {
-        operation: 'list',
-        ref: normalizedRef,
-        head_sha: headSha,
-        checkpoints: (overview?.traces ?? []).map(publicCheckpoint),
-    });
-}
-export async function tracesListCommand(ref, options) {
-    const payload = await fetchTracesListPayload(ref);
-    if (options.json) {
-        console.log(JSON.stringify(payload, null, 2));
-        return;
-    }
-    if (payload.checkpoints.length === 0) {
-        console.log(chalk.dim('\nNo retained customer traces for this PR.\n'));
-        return;
-    }
-    console.log(chalk.bold('\nCustomer traces\n'));
-    for (const trace of payload.checkpoints) {
-        console.log(`${chalk.cyan(trace.checkpoint_id)}  ${trace.commit_message}`);
-        console.log(`  ${trace.summary}\n`);
-    }
-}
-export async function fetchTracesGetPayload(ref, checkpointId, options) {
-    const { pr, token, headSha, ref: normalizedRef } = await tokenAndHead(ref);
-    const [trace, overview] = await Promise.all([
-        fetchAnalysisArtifact(pr.owner, pr.repo, pr.prNumber, `entire_trace_chunks/${encodeURIComponent(checkpointId)}.json`, token),
-        fetchAnalysisArtifact(pr.owner, pr.repo, pr.prNumber, 'entire_traces.json', token),
-    ]);
-    if (!trace)
-        throw new Error(`Trace checkpoint not found: ${checkpointId}`);
-    if (trace.checkpointId !== checkpointId)
-        throw new Error('Trace checkpoint provenance mismatch');
-    const cursor = Math.max(0, Number.parseInt(options.cursor ?? '0', 10) || 0);
-    const limit = Math.min(100, Math.max(1, Number.parseInt(options.limit ?? '20', 10) || 20));
-    const chunks = trace.chunks.slice(cursor, cursor + limit);
-    const next = cursor + chunks.length < trace.chunks.length ? String(cursor + chunks.length) : null;
-    return withSchema('traces', {
-        operation: 'get',
-        ref: normalizedRef,
-        head_sha: headSha,
-        checkpoint_id: trace.checkpointId,
-        checkpoint: (() => {
-            const item = overview?.traces?.find((candidate) => candidate.checkpointId === trace.checkpointId);
-            return item ? publicCheckpoint(item) : null;
-        })(),
-        chunks,
-        total_chunks: trace.chunks.length,
-        total_chars: trace.totalChars,
-        next_cursor: next,
-    });
-}
-export async function tracesGetCommand(ref, checkpointId, options) {
-    const payload = await fetchTracesGetPayload(ref, checkpointId, options);
-    const chunks = payload.chunks;
-    const next = payload.next_cursor;
-    if (options.json) {
-        console.log(JSON.stringify(payload, null, 2));
-        return;
-    }
-    console.log(chunks.join('\n\n---\n\n'));
-    if (next)
-        console.log(chalk.dim(`\nMore available: --cursor ${next}\n`));
-}

package/dist/triage/traces.d.ts

@@ -1,20 +0,0 @@
-/**
- * Local Entire CLI trace discovery for intent drift analysis.
- *
- * Finds .entire/metadata/ session files whose modified files
- * overlap with the current diff's changed files.
- */
-/**
- * Find local Entire CLI trace files relevant to the current diff.
- *
- * Scans .entire/metadata/ for session directories containing full.jsonl,
- * then checks if any files modified in those sessions overlap with the
- * files changed in the current diff.
- *
- * Returns paths to condensed files containing only user messages (not the
- * raw multi-MB traces). This keeps the intent-drift sub-agent focused on
- * user intent without burning its context window on tool outputs.
- *
- * @returns Array of absolute paths to condensed user-messages files
- */
-export declare function findRelevantTraces(gitRoot: string, baseBranch: string): string[];