@haystackeditor/cli 0.15.28 → 0.15.29

package/dist/assets/telemetry/browser-runtime.js

@@ -868,7 +868,7 @@ var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
     return result;
   }
 
-  function axiosAt(token, owner, callable, receiver, configIndex, safeConfig, applicationArguments) {
+  function axiosAt(token, owner, callable, receiver, ownerProperty, configIndex, safeConfig, applicationArguments) {
     if (!nativeArrayIsArray(applicationArguments) || typeof callable !== 'function') {
       return nativeReflectApply(callable, receiver, applicationArguments);
     }
@@ -877,7 +877,10 @@ var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
     if (context && !admitProbe(context)) return nativeReflectApply(callable, receiver, applicationArguments);
     var sites = context && context.runtimeConfig && context.runtimeConfig.fetchSites[token];
     if (!context || !sites) return nativeReflectApply(callable, receiver, applicationArguments);
-    if (safeConfig !== true || !Number.isInteger(configIndex) || configIndex < 0 || configIndex > 8 ||
+    if ((ownerProperty !== null && (typeof ownerProperty !== 'string' || ownerProperty.length === 0 ||
+          ownerProperty.length > 256 || ownerProperty === '__proto__' || ownerProperty === 'constructor' ||
+          ownerProperty === 'prototype')) || safeConfig !== true || !Number.isInteger(configIndex) ||
+        configIndex < 0 || configIndex > 8 ||
         !platformFetchCorrelationAllowed()) {
       omit(context);
       return nativeReflectApply(callable, receiver, applicationArguments);
@@ -886,6 +889,20 @@ var __haystackWebAtlasModuleApi = (function installHaystackWebAtlas(host) {
     var args = [];
     var config;
     try {
+      if (ownerProperty !== null) {
+        if ((typeof receiver !== 'object' || receiver === null) && typeof receiver !== 'function') {
+          axiosOmission(state);
+          return nativeReflectApply(callable, receiver, applicationArguments);
+        }
+        var ownerDescriptor = nativeGetOwnPropertyDescriptor(receiver, ownerProperty);
+        if (!ownerDescriptor || !nativeReflectApply(nativeHasOwnProperty, ownerDescriptor, ['value']) ||
+            ((typeof ownerDescriptor.value !== 'object' || ownerDescriptor.value === null) &&
+              typeof ownerDescriptor.value !== 'function')) {
+          axiosOmission(state);
+          return nativeReflectApply(callable, receiver, applicationArguments);
+        }
+        owner = ownerDescriptor.value;
+      }
       for (var argumentIndex = 0; argumentIndex < applicationArguments.length; argumentIndex++) {
         args[argumentIndex] = applicationArguments[argumentIndex];
       }

package/dist/commands/verify-hosted-mcp.js

@@ -7,7 +7,7 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { buildHostedJson, getHostedVerification, hostedResumeCommand, parseHostedRepository, startHostedVerification, waitForHostedVerification, } from './verify-hosted.js';
+import { buildHostedJson, getHostedVerification, hostedResumeCommand, parseHostedRepository, readHostedIntentFile, startHostedVerification, waitForHostedVerification, } from './verify-hosted.js';
 const TERMINAL_STATUSES = new Set([
     'complete',
     'errored',
@@ -48,6 +48,11 @@ export const HOSTED_VERIFY_TOOLS = [
                     pattern: '^[0-9a-f]{40}$',
                     description: 'Exact 40-character lowercase head commit SHA.',
                 },
+                intent_file: {
+                    type: 'string',
+                    minLength: 1,
+                    description: 'Path to agent-supplied JSON containing exactly problem, goal, and intended_outcomes (a non-empty array of non-empty strings).',
+                },
                 idempotency_key: {
                     type: 'string',
                     pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$',
@@ -59,7 +64,7 @@ export const HOSTED_VERIFY_TOOLS = [
                 },
                 account: accountInput,
             },
-            required: ['repository', 'base_commit', 'head_commit'],
+            required: ['repository', 'base_commit', 'head_commit', 'intent_file'],
         },
     },
     {
@@ -124,6 +129,7 @@ function assertToolInputFields(name, input) {
             'base_commit',
             'head_commit',
             'idempotency_key',
+            'intent_file',
             'replay_plan_from_run_id',
             'repository',
         ]);
@@ -151,6 +157,7 @@ export async function executeHostedVerifyTool(name, input, context) {
         const started = await startHostedVerification(repository, {
             base: requireInputString(input, 'base_commit'),
             head: requireInputString(input, 'head_commit'),
+            intentFile: requireInputString(input, 'intent_file'),
             idempotencyKey: optionalInputString(input, 'idempotency_key'),
             replayPlanFrom: optionalInputString(input, 'replay_plan_from_run_id'),
             wait: false,
@@ -217,6 +224,9 @@ export async function runHostedVerifyMcpServer(options) {
             // Reject undeclared fields before account resolution so callers cannot
             // use an invalid request to trigger credential or repository lookup.
             assertToolInputFields(name, input);
+            if (name === 'verify_start') {
+                readHostedIntentFile(requireInputString(input, 'intent_file'));
+            }
             const context = await resolveToolContext(name, input, options);
             const result = await executeHostedVerifyTool(name, input, context);
             return {

package/dist/commands/verify-hosted-reproducibility.d.ts

@@ -2,6 +2,7 @@ import { type HostedRunState } from './verify-hosted.js';
 export interface HostedReproducibilityOptions {
     base: string;
     head: string;
+    intentFile: string;
     runs?: string;
     seriesKey?: string;
     freshPlans?: boolean;

package/dist/commands/verify-hosted-reproducibility.js

@@ -2,7 +2,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { hostedPollingOptions, parseHostedRepository, startHostedVerification, waitForHostedVerification, } from './verify-hosted.js';
+import { hostedPollingOptions, parseHostedRepository, readHostedIntentFile, startHostedVerification, waitForHostedVerification, } from './verify-hosted.js';
 const CELL_ID = /^cell_[0-9a-f]{32}$/;
 const CAPABILITY_ID = /^repository_driver_[0-9a-f]{64}$/;
 const COMPARISON_ID = /^driver_comparison_[0-9a-f]{64}$/;
@@ -502,6 +502,8 @@ function renderHostedReproducibility(report) {
 }
 export async function verifyHostedReproducibilityCommand(repositoryArg, options) {
     const repository = parseHostedRepository(repositoryArg);
+    // A reproducibility series reuses one explicit agent intent for every run.
+    readHostedIntentFile(options.intentFile);
     const requestedRuns = boundedInteger(options.runs, DEFAULT_RUNS, '--runs', 2, MAX_RUNS);
     const seriesKey = requireSeriesKey(options.seriesKey);
     const mode = options.freshPlans
@@ -521,6 +523,7 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
         const started = await startHostedVerification(repositoryArg, {
             base: options.base,
             head: options.head,
+            intentFile: options.intentFile,
             idempotencyKey: hostedReproducibilityRunKey(seriesKey, repository.fullName, options.base, options.head, index + 1, mode),
             replayPlanFrom: options.freshPlans || index === 0
                 ? undefined

package/dist/commands/verify-hosted.d.ts

@@ -1,6 +1,12 @@
+export interface HostedIntent {
+    problem: string;
+    goal: string;
+    intended_outcomes: string[];
+}
 export interface HostedStartOptions {
     base: string;
     head: string;
+    intentFile: string;
     idempotencyKey?: string;
     replayPlanFrom?: string;
     account?: string;
@@ -55,6 +61,7 @@ export declare function parseHostedRepository(value: string): {
     repository: string;
     fullName: string;
 };
+export declare function readHostedIntentFile(intentFile: string | undefined): HostedIntent;
 export declare function defaultHostedIdempotencyKey(repository: string, baseCommit: string, headCommit: string, replayPlanFrom?: string): string;
 export declare function hostedPollingOptions(interval: string | undefined, timeout: string | undefined, onStatus?: (state: HostedRunState) => void): HostedPollOptions;
 export declare function startHostedVerification(repositoryArg: string, options: HostedStartOptions, token: string): Promise<{

package/dist/commands/verify-hosted.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
 import { resolveAuthContext } from '../utils/auth.js';
@@ -11,6 +12,11 @@ const STATUS = /^[a-z][a-z0-9_-]{1,31}$/;
 const TERMINAL_STATUSES = new Set(['complete', 'errored', 'expired', 'terminated']);
 const DEFAULT_INTERVAL_SECONDS = 5;
 const DEFAULT_TIMEOUT_MINUTES = 35;
+const INTENT_FIELDS = [
+    'problem',
+    'goal',
+    'intended_outcomes',
+];
 function requireRecord(value, context) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         throw new Error(`${context} returned an invalid response object.`);
@@ -159,6 +165,54 @@ function requireCommit(value, flag) {
     }
     return value;
 }
+export function readHostedIntentFile(intentFile) {
+    if (typeof intentFile !== 'string' || intentFile.length === 0) {
+        throw new Error('--intent-file is required and must name a JSON file containing exactly problem, goal, and intended_outcomes.');
+    }
+    let source;
+    try {
+        source = readFileSync(intentFile, 'utf8');
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not read --intent-file "${intentFile}": ${reason}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        throw new Error(`--intent-file "${intentFile}" must contain valid JSON.`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`--intent-file "${intentFile}" must contain exactly problem, goal, and intended_outcomes.`);
+    }
+    const record = parsed;
+    const unknownField = Object.keys(record)
+        .find(field => !INTENT_FIELDS.includes(field));
+    if (unknownField) {
+        throw new Error(`--intent-file "${intentFile}" contains unknown field "${unknownField}"; expected exactly problem, goal, and intended_outcomes.`);
+    }
+    for (const field of ['problem', 'goal']) {
+        if (typeof record[field] !== 'string' || record[field].trim().length === 0) {
+            throw new Error(`--intent-file "${intentFile}" field "${field}" must be a non-empty string.`);
+        }
+    }
+    const outcomes = record.intended_outcomes;
+    if (!Array.isArray(outcomes)
+        || outcomes.length === 0
+        || outcomes.some(item => typeof item !== 'string' || item.trim().length === 0)) {
+        throw new Error(`--intent-file "${intentFile}" field "intended_outcomes" must be a non-empty array of non-empty strings.`);
+    }
+    if (Object.keys(record).length !== INTENT_FIELDS.length) {
+        throw new Error(`--intent-file "${intentFile}" must contain exactly problem, goal, and intended_outcomes.`);
+    }
+    return {
+        problem: record.problem,
+        goal: record.goal,
+        intended_outcomes: record.intended_outcomes,
+    };
+}
 export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom) {
     const digest = createHash('sha256')
         .update(JSON.stringify(replayPlanFrom
@@ -193,25 +247,28 @@ export async function startHostedVerification(repositoryArg, options, token) {
     const repository = parseHostedRepository(repositoryArg);
     const baseCommit = requireCommit(options.base, '--base');
     const headCommit = requireCommit(options.head, '--head');
+    const intent = readHostedIntentFile(options.intentFile);
     const replayPlanFrom = options.replayPlanFrom;
     if (replayPlanFrom !== undefined && !RUN_ID.test(replayPlanFrom)) {
         throw new Error('--replay-plan-from must match cv_ followed by 48 lowercase hex characters.');
     }
     const idempotencyKey = requireIdempotencyKey(options.idempotencyKey
         ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom));
+    const launchBody = {
+        owner: repository.owner,
+        repository: repository.repository,
+        baseCommit,
+        headCommit,
+        idempotencyKey,
+        intent,
+        ...(replayPlanFrom
+            ? { replayPlanFromRunId: replayPlanFrom }
+            : {}),
+    };
     const response = await haystackJson('/api/agent/cloud-verifier/runs', token, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            owner: repository.owner,
-            repository: repository.repository,
-            baseCommit,
-            headCommit,
-            idempotencyKey,
-            ...(replayPlanFrom
-                ? { replayPlanFromRunId: replayPlanFrom }
-                : {}),
-        }),
+        body: JSON.stringify(launchBody),
     });
     const state = parseHostedRunState(response);
     return {
@@ -337,6 +394,9 @@ function markNonSuccess(state, timedOut = false) {
 }
 export async function verifyHostedStartCommand(repositoryArg, options) {
     const repository = parseHostedRepository(repositoryArg);
+    // Fail before account resolution so an invalid local intent never advances
+    // toward a hosted launch.
+    readHostedIntentFile(options.intentFile);
     const auth = await resolveAuthContext({
         preferredLogin: options.account,
         owner: repository.owner,

package/dist/commands/verify-precompute.js

@@ -140,9 +140,9 @@ function deriveWorkCommit(gitRoot, baseSha, treeSha, deadline) {
     return workCommit;
 }
 function slimInputHash() {
-    // Mirrors printf '%s\0%s\0%s\0%s\0' slim codex-harness none none.
+    // Mirrors printf '%s\0%s\0%s\0%s\0' slim agent-deferred none none.
     return createHash('sha256')
-        .update(Buffer.from('slim\0codex-harness\0none\0none\0'))
+        .update(Buffer.from('slim\0agent-deferred\0none\0none\0'))
         .digest('hex');
 }
 async function buildCompressedPatch(gitRoot, baseSha, workCommit, deadline) {

package/dist/index.js

@@ -192,7 +192,7 @@ The local control plane must be running. From the Haystack repository:
   pnpm dev
 
 Examples:
-  haystack verify hosted start owner/repo --base <sha> --head <sha>
+  haystack verify hosted start owner/repo --base <sha> --head <sha> --intent-file <path>
   haystack verify posthog-js-478         # start a run, then:
   haystack verify reproducibility posthog-js-478 --runs 3
   haystack verify watch                  # block until it finishes (exit 1 = tests failed)
@@ -235,6 +235,7 @@ hostedVerify
     // validation below accepts the inherited values and still fails closed.
     .option('--base <sha>', 'Required: exact 40-character lowercase base commit SHA')
     .option('--head <sha>', 'Required: exact 40-character lowercase head commit SHA')
+    .requiredOption('--intent-file <path>', 'Agent-supplied JSON with exactly problem, goal, and intended_outcomes')
     .option('--idempotency-key <key>', 'Stable retry key (default: deterministic from repository and commits)')
     .option('--replay-plan-from <run-id>', 'Reuse the exact validated risk plan from a completed owned run')
     .option('--account <login>', 'Use a specific saved Haystack account')
@@ -250,9 +251,9 @@ fresh production execution of the same commit pair.
 a schema-9 terminal receipt with replay provenance.
 
 Examples:
-  haystack verify hosted start owner/repo --base <sha> --head <sha>
-  haystack verify hosted start owner/repo --base <sha> --head <sha> --replay-plan-from cv_<48 lowercase hex characters>
-  haystack verify hosted start owner/repo --base <sha> --head <sha> --no-wait --json
+  haystack verify hosted start owner/repo --base <sha> --head <sha> --intent-file <path>
+  haystack verify hosted start owner/repo --base <sha> --head <sha> --intent-file <path> --replay-plan-from cv_<48 lowercase hex characters>
+  haystack verify hosted start owner/repo --base <sha> --head <sha> --intent-file <path> --no-wait --json
 `)
     .action(async (repository, _options, cmd) => {
     const options = { ...cmd.optsWithGlobals(), ...cmd.opts() };
@@ -283,6 +284,7 @@ hostedVerify
     .argument('<repository>', 'Exact GitHub owner/repository name')
     .option('--base <sha>', 'Required: exact 40-character lowercase base commit SHA')
     .option('--head <sha>', 'Required: exact 40-character lowercase head commit SHA')
+    .requiredOption('--intent-file <path>', 'Agent-supplied JSON reused for every hosted run in the series')
     .option('--runs <n>', 'Number of sequential production runs (default 3; min 2, max 10)')
     .option('--series-key <key>', 'Stable series key for resumable idempotent retries')
     .option('--fresh-plans', 'Run the planner independently for every run instead of replaying the first plan')
@@ -302,8 +304,8 @@ provenance, and no inconclusive cells. Use this mode to detect planner drift;
 use the default mode to isolate executor or assessment drift.
 
 Example:
-  haystack verify hosted reproducibility owner/repo --base <sha> --head <sha> --runs 3
-  haystack verify hosted reproducibility owner/repo --base <sha> --head <sha> --runs 3 --fresh-plans
+  haystack verify hosted reproducibility owner/repo --base <sha> --head <sha> --intent-file <path> --runs 3
+  haystack verify hosted reproducibility owner/repo --base <sha> --head <sha> --intent-file <path> --runs 3 --fresh-plans
 `)
     .action(async (repository, _options, cmd) => {
     const options = { ...cmd.optsWithGlobals(), ...cmd.opts() };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.28",
+  "version": "0.15.29",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {