@haystackeditor/cli 0.15.28 → 0.15.30

package/dist/commands/verify-hosted.js

@@ -1,8 +1,9 @@
 import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { HaystackApiError, haystackJson } from '../utils/haystack-api.js';
+import { classifyHttpError, HaystackApiError, haystackApiUrl, haystackJson } from '../utils/haystack-api.js';
 const REPOSITORY_COMPONENT = /^[A-Za-z0-9_.-]{1,100}$/;
 const COMMIT_SHA = /^[0-9a-f]{40}$/;
 const IDEMPOTENCY_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/;
@@ -11,6 +12,12 @@ const STATUS = /^[a-z][a-z0-9_-]{1,31}$/;
 const TERMINAL_STATUSES = new Set(['complete', 'errored', 'expired', 'terminated']);
 const DEFAULT_INTERVAL_SECONDS = 5;
 const DEFAULT_TIMEOUT_MINUTES = 35;
+const INTENT_FIELDS = [
+    'problem',
+    'goal',
+    'intended_outcomes',
+];
+const FLEET_PROJECTION_VERSION = 'dv-cloud-verifier-fleet-runner-projection-v1';
 function requireRecord(value, context) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         throw new Error(`${context} returned an invalid response object.`);
@@ -74,12 +81,67 @@ export function parseHostedRunState(value, expectedRunId) {
         ? undefined
         : requireRecord(outputValue, 'Hosted verifier output');
     const resultValue = response.result;
-    const result = resultValue === undefined
+    const fleet = response.provider === 'haystack';
+    if (response.provider !== undefined && !fleet) {
+        throw new Error('Hosted verifier returned an unsupported provider.');
+    }
+    if (fleet && response.version !== FLEET_PROJECTION_VERSION) {
+        throw new Error('Hosted verifier returned an unsupported fleet projection version.');
+    }
+    const result = fleet || resultValue === undefined
         ? undefined
         : parseHostedRunnerResult(resultValue);
     const createdAt = optionalTimestamp(response, 'createdAt');
     const completedAt = optionalTimestamp(response, 'completedAt');
-    if (status === 'complete') {
+    let progress;
+    let fleetResult;
+    if (fleet) {
+        if (response.publicRunId !== runId || !repository || !baseCommit || !headCommit || !createdAt || output) {
+            throw new Error('Hosted fleet projection is missing its immutable run identity.');
+        }
+        if (response.progress !== undefined && response.progress !== null) {
+            progress = requireRecord(response.progress, 'Hosted fleet progress');
+            if (progress.version !== 'dv-verify-progress-v1' || progress.publicRunId !== runId) {
+                throw new Error('Hosted fleet progress does not match the requested run.');
+            }
+            requireString(progress, 'stage');
+            requireString(progress, 'status');
+        }
+        if (resultValue !== undefined && resultValue !== null) {
+            fleetResult = requireRecord(resultValue, 'Hosted fleet result');
+            const mapping = requireRecord(fleetResult.mapping, 'Hosted fleet result mapping');
+            const provenance = requireRecord(fleetResult.provenance, 'Hosted fleet provenance');
+            if (fleetResult.version !== 'dv-verify-result-v1' || fleetResult.provider !== 'haystack'
+                || mapping.publicRunId !== runId || provenance.baseSha !== baseCommit || provenance.headSha !== headCommit) {
+                throw new Error('Hosted fleet result does not match the requested run and commits.');
+            }
+            // CONTRACT-GAP: P0 currently couples its canonical parsers to runner-only
+            // modules outside this published CLI. The server validates the complete
+            // P0 result; the CLI only checks the fields it presents, retaining the
+            // original document instead of defining a second P0 wire contract.
+            requireString(fleetResult, 'lifecycle', /^(complete|failed|cancelled|budget-stopped|account-action)$/);
+            requireString(fleetResult, 'runHealth', /^(healthy|degraded|infrastructure-error|not-executed)$/);
+            const cleanup = requireRecord(fleetResult.cleanup, 'Hosted fleet cleanup');
+            requireString(cleanup, 'status', /^(complete|pending)$/);
+            if (!Array.isArray(cleanup.pending) || !Array.isArray(fleetResult.findings)) {
+                throw new Error('Hosted fleet result has invalid findings or cleanup.');
+            }
+            for (const value of fleetResult.findings) {
+                const finding = requireRecord(value, 'Hosted fleet finding');
+                requireString(finding, 'findingId');
+                requireString(finding, 'caseId');
+                requireString(finding, 'judgment');
+            }
+            requireString(provenance, 'intent', /^(user|inferred)$/);
+            if (status === 'complete' && fleetResult.lifecycle !== 'complete') {
+                throw new Error('Hosted fleet lifecycle disagrees with its completed job.');
+            }
+        }
+        if (status === 'complete' && !fleetResult) {
+            throw new Error('Hosted fleet run completed without a result receipt.');
+        }
+    }
+    else if (status === 'complete') {
         // Two terminal shapes exist: the Workflow receipt envelope (`output`)
         // and the runner-queue result envelope (`result`). Exactly one must
         // validate.
@@ -113,6 +175,7 @@ export function parseHostedRunState(value, expectedRunId) {
         completedAt,
         output,
         result,
+        ...(fleet ? { provider: 'haystack', version: FLEET_PROJECTION_VERSION, progress, fleetResult } : {}),
         error: optionalString(response, 'error'),
     };
 }
@@ -159,11 +222,67 @@ function requireCommit(value, flag) {
     }
     return value;
 }
-export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom) {
+function requireRevision(value, flag) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 1_024 || /[\u0000-\u0020\u007f]/.test(value)) {
+        throw new Error(`${flag} must be a non-empty Git revision of at most 1024 characters without whitespace or control characters.`);
+    }
+    return value;
+}
+export function readHostedIntentFile(intentFile) {
+    if (typeof intentFile !== 'string' || intentFile.length === 0) {
+        throw new Error('--intent-file is required and must name a JSON file containing exactly problem, goal, and intended_outcomes.');
+    }
+    let source;
+    try {
+        source = readFileSync(intentFile, 'utf8');
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not read --intent-file "${intentFile}": ${reason}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        throw new Error(`--intent-file "${intentFile}" must contain valid JSON.`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`--intent-file "${intentFile}" must contain exactly problem, goal, and intended_outcomes.`);
+    }
+    const record = parsed;
+    const unknownField = Object.keys(record)
+        .find(field => !INTENT_FIELDS.includes(field));
+    if (unknownField) {
+        throw new Error(`--intent-file "${intentFile}" contains unknown field "${unknownField}"; expected exactly problem, goal, and intended_outcomes.`);
+    }
+    for (const field of ['problem', 'goal']) {
+        if (typeof record[field] !== 'string' || record[field].trim().length === 0) {
+            throw new Error(`--intent-file "${intentFile}" field "${field}" must be a non-empty string.`);
+        }
+    }
+    const outcomes = record.intended_outcomes;
+    if (!Array.isArray(outcomes)
+        || outcomes.length === 0
+        || outcomes.some(item => typeof item !== 'string' || item.trim().length === 0)) {
+        throw new Error(`--intent-file "${intentFile}" field "intended_outcomes" must be a non-empty array of non-empty strings.`);
+    }
+    if (Object.keys(record).length !== INTENT_FIELDS.length) {
+        throw new Error(`--intent-file "${intentFile}" must contain exactly problem, goal, and intended_outcomes.`);
+    }
+    return {
+        problem: record.problem,
+        goal: record.goal,
+        intended_outcomes: record.intended_outcomes,
+    };
+}
+export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom, fleetRequest) {
     const digest = createHash('sha256')
-        .update(JSON.stringify(replayPlanFrom
-        ? [repository, baseCommit, headCommit, replayPlanFrom]
-        : [repository, baseCommit, headCommit]))
+        .update(JSON.stringify(fleetRequest
+        ? [fleetRequest.provider, repository, baseCommit, headCommit, fleetRequest.intent ?? null]
+        : replayPlanFrom
+            ? [repository, baseCommit, headCommit, replayPlanFrom]
+            : [repository, baseCommit, headCommit]))
         .digest('hex');
     return `cli:${digest}`;
 }
@@ -190,40 +309,78 @@ export function hostedPollingOptions(interval, timeout, onStatus) {
     };
 }
 export async function startHostedVerification(repositoryArg, options, token) {
-    const repository = parseHostedRepository(repositoryArg);
-    const baseCommit = requireCommit(options.base, '--base');
-    const headCommit = requireCommit(options.head, '--head');
-    const replayPlanFrom = options.replayPlanFrom;
-    if (replayPlanFrom !== undefined && !RUN_ID.test(replayPlanFrom)) {
-        throw new Error('--replay-plan-from must match cv_ followed by 48 lowercase hex characters.');
-    }
-    const idempotencyKey = requireIdempotencyKey(options.idempotencyKey
-        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom));
-    const response = await haystackJson('/api/agent/cloud-verifier/runs', token, {
+    const { repository, launchBody, idempotencyKey } = prepareHostedLaunch(repositoryArg, options);
+    const path = '/api/agent/cloud-verifier/runs';
+    const response = await fetch(haystackApiUrl(path), {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            owner: repository.owner,
-            repository: repository.repository,
-            baseCommit,
-            headCommit,
-            idempotencyKey,
-            ...(replayPlanFrom
-                ? { replayPlanFromRunId: replayPlanFrom }
-                : {}),
-        }),
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: 'application/json',
+            'User-Agent': 'Haystack-CLI',
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(launchBody),
     });
-    const state = parseHostedRunState(response);
+    if (!response.ok) {
+        // Keep the shared HTTP classification and raw-body fallback while exposing
+        // the launch service's additional explanation for a retryable failure.
+        const body = response.status === 503
+            ? await response.clone().json().catch(() => null)
+            : null;
+        const error = await classifyHttpError(response, `Haystack API ${path}`);
+        if (body && typeof body === 'object' && 'detail' in body
+            && typeof body.detail === 'string' && body.detail.trim()) {
+            error.message += ` Details: ${body.detail}`;
+        }
+        throw error;
+    }
+    const state = parseHostedRunState(await response.json());
+    if (options.provider === 'haystack' && state.provider !== 'haystack') {
+        throw new Error('Hosted verifier did not acknowledge the fleet-pinned request.');
+    }
     return {
         state: {
             ...state,
             repository: state.repository ?? repository.fullName,
-            baseCommit: state.baseCommit ?? baseCommit,
-            headCommit: state.headCommit ?? headCommit,
+            baseCommit: state.baseCommit ?? launchBody.baseCommit,
+            headCommit: state.headCommit ?? launchBody.headCommit,
         },
         idempotencyKey,
     };
 }
+function prepareHostedLaunch(repositoryArg, options) {
+    const repository = parseHostedRepository(repositoryArg);
+    const fleet = options.provider === 'haystack';
+    const validateRevision = fleet ? requireRevision : requireCommit;
+    const baseCommit = validateRevision(options.base, '--base');
+    const headCommit = validateRevision(options.head, '--head');
+    const intent = fleet && options.intentFile === undefined ? undefined : readHostedIntentFile(options.intentFile);
+    if (fleet && intent && [intent.problem, intent.goal, ...intent.intended_outcomes].some(value => /[\u0000-\u001f\u007f]/.test(value))) {
+        throw new Error('Fleet --intent-file fields must be single-line text without control characters.');
+    }
+    const replayPlanFrom = options.replayPlanFrom;
+    if (fleet && replayPlanFrom !== undefined) {
+        throw new Error('--replay-plan-from is available through the explicit hosted start alias.');
+    }
+    if (replayPlanFrom !== undefined && !RUN_ID.test(replayPlanFrom)) {
+        throw new Error('--replay-plan-from must match cv_ followed by 48 lowercase hex characters.');
+    }
+    const idempotencyKey = requireIdempotencyKey(options.idempotencyKey
+        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom, fleet ? { provider: 'haystack', intent } : undefined));
+    const launchBody = {
+        ...(fleet ? { provider: 'haystack' } : {}),
+        owner: repository.owner,
+        repository: repository.repository,
+        baseCommit,
+        headCommit,
+        idempotencyKey,
+        ...(intent ? { intent } : {}),
+        ...(replayPlanFrom
+            ? { replayPlanFromRunId: replayPlanFrom }
+            : {}),
+    };
+    return { repository, launchBody, idempotencyKey };
+}
 export async function getHostedVerification(runId, token) {
     if (!RUN_ID.test(runId)) {
         throw new Error('Run id must match cv_ followed by 48 lowercase hex characters.');
@@ -246,12 +403,13 @@ function delay(milliseconds) {
 }
 export async function waitForHostedVerification(runId, token, options) {
     const startedAt = Date.now();
-    let lastStatus;
+    let lastProgress;
     for (;;) {
         const state = await getHostedVerification(runId, token);
-        if (state.status !== lastStatus) {
+        const progressKey = JSON.stringify([state.status, state.progress?.sequence, state.progress?.stage, state.progress?.status]);
+        if (progressKey !== lastProgress) {
             options.onStatus?.(state);
-            lastStatus = state.status;
+            lastProgress = progressKey;
         }
         if (TERMINAL_STATUSES.has(state.status)) {
             return { state, timedOut: false };
@@ -281,6 +439,9 @@ export function buildHostedJson(operation, state, extras = {}) {
         ...(extras.timedOut !== undefined ? { timed_out: extras.timedOut } : {}),
         ...(state.output ? { output: state.output } : {}),
         ...(state.result ? { result: state.result } : {}),
+        ...(state.provider ? { provider: state.provider, version: state.version } : {}),
+        ...(state.progress ? { progress: state.progress } : {}),
+        ...(state.fleetResult ? { result: state.fleetResult } : {}),
         ...(state.error ? { error: state.error } : {}),
     });
 }
@@ -300,11 +461,13 @@ function printHostedState(operation, state, options) {
         }), null, 2)}\n`);
         return;
     }
-    const icon = state.status === 'complete'
-        ? chalk.green('✓')
-        : TERMINAL_STATUSES.has(state.status)
-            ? chalk.red('✗')
-            : chalk.cyan('•');
+    const icon = state.provider === 'haystack' && state.status === 'complete'
+        ? chalk.cyan('•')
+        : state.status === 'complete'
+            ? chalk.green('✓')
+            : TERMINAL_STATUSES.has(state.status)
+                ? chalk.red('✗')
+                : chalk.cyan('•');
     console.log(`${icon} Hosted verification ${chalk.bold(state.runId)}: ${state.status}`);
     if (state.repository) {
         console.log(`  ${chalk.dim('Repository:')} ${state.repository}`);
@@ -321,6 +484,22 @@ function printHostedState(operation, state, options) {
         }
         console.log(`  ${chalk.dim('Artifacts:')} ${state.result.outputLocation}`);
     }
+    if (state.progress) {
+        console.log(`  ${chalk.dim('Progress:')} ${state.progress.stage} (${state.progress.status})`);
+    }
+    if (state.fleetResult) {
+        const result = state.fleetResult;
+        const cleanup = requireRecord(result.cleanup, 'Hosted fleet cleanup');
+        const provenance = requireRecord(result.provenance, 'Hosted fleet provenance');
+        console.log(`  ${chalk.dim('Lifecycle:')} ${result.lifecycle}`);
+        console.log(`  ${chalk.dim('Run health:')} ${result.runHealth}`);
+        console.log(`  ${chalk.dim('Intent:')} ${provenance.intent}`);
+        console.log(`  ${chalk.dim('Cleanup:')} ${cleanup.status} (${cleanup.pending.length} pending)`);
+        for (const value of result.findings) {
+            const finding = requireRecord(value, 'Hosted fleet finding');
+            console.log(`  ${chalk.dim('Finding:')} ${finding.findingId} / ${finding.caseId}: ${finding.judgment}`);
+        }
+    }
     if (state.error)
         console.log(`  ${chalk.dim('Error:')} ${state.error}`);
     if (options.timedOut) {
@@ -330,20 +509,38 @@ function printHostedState(operation, state, options) {
         console.log(`  ${chalk.dim('Resume:')} ${nextCommand}`);
 }
 function markNonSuccess(state, timedOut = false) {
+    if (state.fleetResult) {
+        const result = state.fleetResult;
+        const cleanup = requireRecord(result.cleanup, 'Hosted fleet cleanup');
+        if (result.lifecycle !== 'complete' || result.runHealth !== 'healthy' || cleanup.status !== 'complete') {
+            process.exitCode = 2;
+            return;
+        }
+        if (result.findings.some(value => requireRecord(value, 'Hosted fleet finding').judgment === 'regression')) {
+            process.exitCode = 1;
+        }
+    }
     if (timedOut
         || (state.status !== 'complete' && TERMINAL_STATUSES.has(state.status))) {
         process.exitCode = 2;
     }
 }
 export async function verifyHostedStartCommand(repositoryArg, options) {
-    const repository = parseHostedRepository(repositoryArg);
+    // Validate all local input before resolving accounts or submitting a job.
+    const { repository } = prepareHostedLaunch(repositoryArg, options);
+    const polling = hostedPollingOptions(options.interval, options.timeout, current => {
+        if (!options.json)
+            console.error(chalk.dim(hostedProgressMessage(current)));
+    });
     const auth = await resolveAuthContext({
         preferredLogin: options.account,
         owner: repository.owner,
         repo: repository.repository,
     });
     if (!options.json) {
-        console.error(chalk.dim('Submitting the exact commit pair to the hosted verifier…'));
+        console.error(chalk.dim(options.provider === 'haystack'
+            ? 'Submitting repository revisions to the hosted fleet verifier…'
+            : 'Submitting the exact commit pair to the hosted verifier…'));
     }
     const started = await startHostedVerification(repositoryArg, options, auth.token);
     const selectedAccount = auth.token.startsWith('hsk_live_')
@@ -352,11 +549,7 @@ export async function verifyHostedStartCommand(repositoryArg, options) {
     let state = started.state;
     let timedOut;
     if (options.wait !== false && !TERMINAL_STATUSES.has(state.status)) {
-        const waited = await waitForHostedVerification(state.runId, auth.token, hostedPollingOptions(options.interval, options.timeout, current => {
-            if (!options.json) {
-                console.error(chalk.dim(`Hosted verifier: ${current.status}…`));
-            }
-        }));
+        const waited = await waitForHostedVerification(state.runId, auth.token, polling);
         state = waited.state;
         timedOut = waited.timedOut;
     }
@@ -371,7 +564,14 @@ export async function verifyHostedStartCommand(repositoryArg, options) {
     });
     markNonSuccess(state, timedOut);
 }
+function hostedProgressMessage(state) {
+    return `Hosted verifier: ${state.status}${state.progress ? ` · ${state.progress.stage} (${state.progress.status})` : ''}…`;
+}
 export async function verifyHostedStatusCommand(runId, options) {
+    const polling = hostedPollingOptions(options.interval, options.timeout, current => {
+        if (!options.json)
+            console.error(chalk.dim(hostedProgressMessage(current)));
+    });
     const auth = await resolveAuthContext({ preferredLogin: options.account });
     const selectedAccount = auth.token.startsWith('hsk_live_')
         ? undefined
@@ -379,11 +579,7 @@ export async function verifyHostedStatusCommand(runId, options) {
     let state = await getHostedVerification(runId, auth.token);
     let timedOut;
     if (options.wait && !TERMINAL_STATUSES.has(state.status)) {
-        const waited = await waitForHostedVerification(runId, auth.token, hostedPollingOptions(options.interval, options.timeout, current => {
-            if (!options.json) {
-                console.error(chalk.dim(`Hosted verifier: ${current.status}…`));
-            }
-        }));
+        const waited = await waitForHostedVerification(runId, auth.token, polling);
         state = waited.state;
         timedOut = waited.timedOut;
     }

package/dist/commands/verify-precompute.d.ts

@@ -1,4 +1,12 @@
-export type PrecomputeOutcome = 'enqueued' | 'cached' | 'existing' | 'skipped_no_auth' | 'error';
+import type { DeliverPrecomputeRequest } from './precompute-delivery-contract.js';
+export type RepoWalkHookStatus = {
+    status: 'queued' | 'existing';
+    runId: string;
+} | {
+    status: 'unavailable';
+    reason: 'runner-unavailable' | 'enqueue-failed';
+};
+export type PrecomputeOutcome = 'pending' | 'enqueued' | 'cached' | 'existing' | 'skipped_no_auth' | 'error';
 export interface VerifyPrecomputeOptions {
     hook?: boolean;
 }
@@ -7,6 +15,7 @@ export interface FrontHalfEnqueueRequest {
     repository: string;
     baseCommit: string;
     workCommit: string;
+    observedAt: number;
     cacheKey: string;
     patchGzBase64: string;
     patchSha256: string;
@@ -16,4 +25,6 @@ export interface PrecomputeDerivation {
     request: FrontHalfEnqueueRequest;
 }
 export declare function derivePrecomputeRequest(gitRoot: string, owner: string, repository: string, deadline?: number): Promise<PrecomputeDerivation>;
+/** One authenticated submission of the already captured request. No source reads or retries. */
+export declare const deliverPrecomputeRequest: DeliverPrecomputeRequest;
 export declare function verifyPrecomputeCommand(options: VerifyPrecomputeOptions): Promise<void>;