@haystackeditor/cli 0.15.29 → 0.15.30

package/dist/commands/verify-explore.js

@@ -0,0 +1,180 @@
+import { randomUUID } from 'node:crypto';
+import { resolveAuthContext } from '../utils/auth.js';
+import { haystackJson } from '../utils/haystack-api.js';
+const RUN_ID = /^cv_[0-9a-f]{48}$/;
+const CASE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const ACTION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const TERMINAL = new Set(['complete', 'errored', 'uncertain']);
+function object(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function timestamp(value) {
+    return typeof value === 'string' && Number.isFinite(Date.parse(value));
+}
+function terminalSafe(value) {
+    return value.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/g, '');
+}
+async function context(runId, repository) {
+    if (!RUN_ID.test(runId))
+        throw new Error('Use the exact cv_… run ID from verification.');
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository || '')) {
+        throw new Error('--repo must be owner/repository.');
+    }
+    const [owner, repo] = repository.split('/');
+    if ([owner, repo].some(part => part === '.' || part === '..'))
+        throw new Error('Invalid repository.');
+    const { token } = await resolveAuthContext({ owner, repo });
+    return {
+        token,
+        path: `/api/agent/cloud-verifier/runs/${runId}/cases`,
+        query: `?repository=${encodeURIComponent(repository)}`,
+    };
+}
+export async function verifyCasesCommand(runId, options) {
+    const ctx = await context(runId, options.repo);
+    const payload = await haystackJson(ctx.path + ctx.query, ctx.token, {
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!object(payload) || !Array.isArray(payload.cases)
+        || payload.cases.some(item => !object(item) || item.runId !== runId
+            || typeof item.caseId !== 'string' || !CASE_ID.test(item.caseId)
+            || (item.side !== 'base' && item.side !== 'head')
+            || typeof item.revisionSha !== 'string' || !/^[0-9a-f]{40}$/.test(item.revisionSha)
+            || !timestamp(item.expiresAt) || !Array.isArray(item.capabilities)
+            || item.capabilities.join(',') !== 'open,exec,close')) {
+        throw new Error('Server returned an invalid retained-case catalog.');
+    }
+    const cases = payload.cases;
+    const seen = new Set();
+    for (const item of cases) {
+        const key = JSON.stringify([item.runId, item.caseId, item.side]);
+        if (seen.has(key))
+            throw new Error('Server returned duplicate case identities.');
+        seen.add(key);
+    }
+    if (options.json) {
+        console.log(JSON.stringify({ runId, cases }));
+        return;
+    }
+    if (!cases.length) {
+        console.log('No saved cases are available. They appear after completion and expire 24 hours later.');
+        return;
+    }
+    for (const item of cases)
+        console.log(`${item.caseId} ${item.side} — available until ${item.expiresAt}`);
+    console.log(`Open a copy: haystack verify explore ${runId} CASE_ID --repo ${options.repo} --side head`);
+}
+function parseAction(payload, runId, caseId, side, actionId) {
+    if (!object(payload) || !object(payload.action))
+        throw new Error('Invalid action response.');
+    const action = payload.action;
+    if (action.runId !== runId || action.caseId !== caseId || action.side !== side || action.actionId !== actionId
+        || typeof action.state !== 'string'
+        || !['queued', 'claimed', 'running', 'complete', 'errored', 'uncertain'].includes(action.state)
+        || !timestamp(action.expiresAt)
+        || (action.error !== null && typeof action.error !== 'string')
+        || (action.output !== null && (!object(action.output)
+            || typeof action.output.stdout !== 'string' || typeof action.output.stderr !== 'string'
+            || typeof action.output.exitCode !== 'number' || !Number.isInteger(action.output.exitCode)))) {
+        throw new Error('Server returned an action for the wrong case or an invalid result.');
+    }
+    return action;
+}
+function newRequest(options, actionId) {
+    if (options.close) {
+        if (options.execJson !== undefined || options.cwd || options.commandTimeout) {
+            throw new Error('--close cannot be combined with a command.');
+        }
+        return { actionId, kind: 'close' };
+    }
+    if (options.execJson === undefined) {
+        if (options.cwd || options.commandTimeout)
+            throw new Error('--cwd and --command-timeout require --exec-json.');
+        return { actionId, kind: 'open' };
+    }
+    const argv = JSON.parse(options.execJson);
+    if (!Array.isArray(argv) || argv.length < 1 || argv.length > 128 || !argv[0]
+        || argv.some(arg => typeof arg !== 'string' || arg.includes('\0'))) {
+        throw new Error('--exec-json must contain 1–128 string arguments with a non-empty executable.');
+    }
+    const cwd = options.cwd ?? '/home/user/pj';
+    const timeoutMs = Number(options.commandTimeout ?? '60') * 1_000;
+    if (!cwd.startsWith('/') || /[\0\r\n]/.test(cwd) || cwd.length > 4_096) {
+        throw new Error('--cwd must be an absolute path inside the sandbox.');
+    }
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1_000 || timeoutMs > 300_000) {
+        throw new Error('--command-timeout must be between 1 and 300 seconds.');
+    }
+    const request = { actionId, kind: 'exec', argv, cwd, timeoutMs };
+    if (Buffer.byteLength(JSON.stringify(request)) > 32 * 1_024)
+        throw new Error('Command request exceeds 32 KiB.');
+    return request;
+}
+export async function verifyExploreCommand(runId, caseId, options) {
+    if (!CASE_ID.test(caseId))
+        throw new Error('Use the exact case ID from `haystack verify cases`.');
+    const side = options.side ?? 'head';
+    if (side !== 'base' && side !== 'head')
+        throw new Error('--side must be base or head.');
+    if (options.action && (options.requestId || options.execJson !== undefined || options.close || options.cwd || options.commandTimeout)) {
+        throw new Error('--action reads an existing action; do not combine it with a new command.');
+    }
+    const actionId = options.action ?? options.requestId ?? randomUUID();
+    if (!ACTION_ID.test(actionId))
+        throw new Error('Action/request ID must be a UUID v4.');
+    const request = options.action ? null : newRequest(options, actionId);
+    const ctx = await context(runId, options.repo);
+    const actionPath = `${ctx.path}/${encodeURIComponent(caseId)}/${side}/actions`;
+    const pollCommand = `haystack verify explore ${runId} ${caseId} --repo ${options.repo} --side ${side} --action ${actionId}`;
+    const read = async () => parseAction(await haystackJson(`${actionPath}/${actionId}${ctx.query}`, ctx.token, {
+        signal: AbortSignal.timeout(30_000),
+    }), runId, caseId, side, actionId);
+    let action;
+    try {
+        action = request
+            ? parseAction(await haystackJson(actionPath + ctx.query, ctx.token, {
+                method: 'POST', headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(request), signal: AbortSignal.timeout(30_000),
+            }), runId, caseId, side, actionId)
+            : await read();
+    }
+    catch (error) {
+        throw new Error(`${error instanceof Error ? error.message : String(error)}\nCheck whether it was accepted before sending another command:\n${pollCommand}`);
+    }
+    if (options.wait !== false) {
+        const deadline = Date.now() + 10 * 60_000;
+        while (!TERMINAL.has(action.state) && Date.now() < deadline) {
+            await new Promise(resolve => setTimeout(resolve, 2_000));
+            try {
+                action = await read();
+            }
+            catch (error) {
+                throw new Error(`${String(error)}\nThe command was not resubmitted. Check it with:\n${pollCommand}`);
+            }
+        }
+    }
+    if (options.json)
+        console.log(JSON.stringify({ action }));
+    else {
+        console.log(`${caseId}/${side}: ${action.state}; available until ${action.expiresAt}`);
+        if (action.output) {
+            process.stdout.write(terminalSafe(action.output.stdout));
+            process.stderr.write(terminalSafe(action.output.stderr));
+            console.error(`Exit code: ${action.output.exitCode}`);
+        }
+        if (action.error)
+            console.error(terminalSafe(action.error));
+        if (!TERMINAL.has(action.state))
+            console.log(`Follow this action:\n${pollCommand}`);
+        else if (action.state === 'complete' && !action.output) {
+            console.log(options.close ? 'Working copy discarded. The saved case is unchanged.'
+                : 'Your working copy is ready. Add --exec-json to run commands in it.');
+        }
+    }
+    if (action.state === 'errored' || action.state === 'uncertain')
+        process.exitCode = 2;
+    else if (action.output?.exitCode)
+        process.exitCode = 1;
+    else if (!TERMINAL.has(action.state) && options.wait !== false)
+        process.exitCode = 2;
+}

package/dist/commands/verify-hosted.d.ts

@@ -1,12 +1,14 @@
+declare const FLEET_PROJECTION_VERSION = "dv-cloud-verifier-fleet-runner-projection-v1";
 export interface HostedIntent {
     problem: string;
     goal: string;
     intended_outcomes: string[];
 }
 export interface HostedStartOptions {
+    provider?: 'haystack';
     base: string;
     head: string;
-    intentFile: string;
+    intentFile?: string;
     idempotencyKey?: string;
     replayPlanFrom?: string;
     account?: string;
@@ -44,6 +46,11 @@ export interface HostedRunState {
     completedAt?: string;
     output?: Record<string, unknown>;
     result?: HostedRunnerResult;
+    provider?: 'haystack';
+    version?: typeof FLEET_PROJECTION_VERSION;
+    /** Opaque P0 documents, authoritatively validated by the hosted service. */
+    progress?: Record<string, unknown>;
+    fleetResult?: Record<string, unknown>;
     error?: string;
 }
 export interface HostedPollOptions {
@@ -62,7 +69,10 @@ export declare function parseHostedRepository(value: string): {
     fullName: string;
 };
 export declare function readHostedIntentFile(intentFile: string | undefined): HostedIntent;
-export declare function defaultHostedIdempotencyKey(repository: string, baseCommit: string, headCommit: string, replayPlanFrom?: string): string;
+export declare function defaultHostedIdempotencyKey(repository: string, baseCommit: string, headCommit: string, replayPlanFrom?: string, fleetRequest?: {
+    provider: 'haystack';
+    intent?: HostedIntent;
+}): string;
 export declare function hostedPollingOptions(interval: string | undefined, timeout: string | undefined, onStatus?: (state: HostedRunState) => void): HostedPollOptions;
 export declare function startHostedVerification(repositoryArg: string, options: HostedStartOptions, token: string): Promise<{
     state: HostedRunState;

package/dist/commands/verify-hosted.js

@@ -3,7 +3,7 @@ import { readFileSync } from 'node:fs';
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { HaystackApiError, haystackJson } from '../utils/haystack-api.js';
+import { classifyHttpError, HaystackApiError, haystackApiUrl, haystackJson } from '../utils/haystack-api.js';
 const REPOSITORY_COMPONENT = /^[A-Za-z0-9_.-]{1,100}$/;
 const COMMIT_SHA = /^[0-9a-f]{40}$/;
 const IDEMPOTENCY_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/;
@@ -17,6 +17,7 @@ const INTENT_FIELDS = [
     'goal',
     'intended_outcomes',
 ];
+const FLEET_PROJECTION_VERSION = 'dv-cloud-verifier-fleet-runner-projection-v1';
 function requireRecord(value, context) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         throw new Error(`${context} returned an invalid response object.`);
@@ -80,12 +81,67 @@ export function parseHostedRunState(value, expectedRunId) {
         ? undefined
         : requireRecord(outputValue, 'Hosted verifier output');
     const resultValue = response.result;
-    const result = resultValue === undefined
+    const fleet = response.provider === 'haystack';
+    if (response.provider !== undefined && !fleet) {
+        throw new Error('Hosted verifier returned an unsupported provider.');
+    }
+    if (fleet && response.version !== FLEET_PROJECTION_VERSION) {
+        throw new Error('Hosted verifier returned an unsupported fleet projection version.');
+    }
+    const result = fleet || resultValue === undefined
         ? undefined
         : parseHostedRunnerResult(resultValue);
     const createdAt = optionalTimestamp(response, 'createdAt');
     const completedAt = optionalTimestamp(response, 'completedAt');
-    if (status === 'complete') {
+    let progress;
+    let fleetResult;
+    if (fleet) {
+        if (response.publicRunId !== runId || !repository || !baseCommit || !headCommit || !createdAt || output) {
+            throw new Error('Hosted fleet projection is missing its immutable run identity.');
+        }
+        if (response.progress !== undefined && response.progress !== null) {
+            progress = requireRecord(response.progress, 'Hosted fleet progress');
+            if (progress.version !== 'dv-verify-progress-v1' || progress.publicRunId !== runId) {
+                throw new Error('Hosted fleet progress does not match the requested run.');
+            }
+            requireString(progress, 'stage');
+            requireString(progress, 'status');
+        }
+        if (resultValue !== undefined && resultValue !== null) {
+            fleetResult = requireRecord(resultValue, 'Hosted fleet result');
+            const mapping = requireRecord(fleetResult.mapping, 'Hosted fleet result mapping');
+            const provenance = requireRecord(fleetResult.provenance, 'Hosted fleet provenance');
+            if (fleetResult.version !== 'dv-verify-result-v1' || fleetResult.provider !== 'haystack'
+                || mapping.publicRunId !== runId || provenance.baseSha !== baseCommit || provenance.headSha !== headCommit) {
+                throw new Error('Hosted fleet result does not match the requested run and commits.');
+            }
+            // CONTRACT-GAP: P0 currently couples its canonical parsers to runner-only
+            // modules outside this published CLI. The server validates the complete
+            // P0 result; the CLI only checks the fields it presents, retaining the
+            // original document instead of defining a second P0 wire contract.
+            requireString(fleetResult, 'lifecycle', /^(complete|failed|cancelled|budget-stopped|account-action)$/);
+            requireString(fleetResult, 'runHealth', /^(healthy|degraded|infrastructure-error|not-executed)$/);
+            const cleanup = requireRecord(fleetResult.cleanup, 'Hosted fleet cleanup');
+            requireString(cleanup, 'status', /^(complete|pending)$/);
+            if (!Array.isArray(cleanup.pending) || !Array.isArray(fleetResult.findings)) {
+                throw new Error('Hosted fleet result has invalid findings or cleanup.');
+            }
+            for (const value of fleetResult.findings) {
+                const finding = requireRecord(value, 'Hosted fleet finding');
+                requireString(finding, 'findingId');
+                requireString(finding, 'caseId');
+                requireString(finding, 'judgment');
+            }
+            requireString(provenance, 'intent', /^(user|inferred)$/);
+            if (status === 'complete' && fleetResult.lifecycle !== 'complete') {
+                throw new Error('Hosted fleet lifecycle disagrees with its completed job.');
+            }
+        }
+        if (status === 'complete' && !fleetResult) {
+            throw new Error('Hosted fleet run completed without a result receipt.');
+        }
+    }
+    else if (status === 'complete') {
         // Two terminal shapes exist: the Workflow receipt envelope (`output`)
         // and the runner-queue result envelope (`result`). Exactly one must
         // validate.
@@ -119,6 +175,7 @@ export function parseHostedRunState(value, expectedRunId) {
         completedAt,
         output,
         result,
+        ...(fleet ? { provider: 'haystack', version: FLEET_PROJECTION_VERSION, progress, fleetResult } : {}),
         error: optionalString(response, 'error'),
     };
 }
@@ -165,6 +222,12 @@ function requireCommit(value, flag) {
     }
     return value;
 }
+function requireRevision(value, flag) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 1_024 || /[\u0000-\u0020\u007f]/.test(value)) {
+        throw new Error(`${flag} must be a non-empty Git revision of at most 1024 characters without whitespace or control characters.`);
+    }
+    return value;
+}
 export function readHostedIntentFile(intentFile) {
     if (typeof intentFile !== 'string' || intentFile.length === 0) {
         throw new Error('--intent-file is required and must name a JSON file containing exactly problem, goal, and intended_outcomes.');
@@ -213,11 +276,13 @@ export function readHostedIntentFile(intentFile) {
         intended_outcomes: record.intended_outcomes,
     };
 }
-export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom) {
+export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom, fleetRequest) {
     const digest = createHash('sha256')
-        .update(JSON.stringify(replayPlanFrom
-        ? [repository, baseCommit, headCommit, replayPlanFrom]
-        : [repository, baseCommit, headCommit]))
+        .update(JSON.stringify(fleetRequest
+        ? [fleetRequest.provider, repository, baseCommit, headCommit, fleetRequest.intent ?? null]
+        : replayPlanFrom
+            ? [repository, baseCommit, headCommit, replayPlanFrom]
+            : [repository, baseCommit, headCommit]))
         .digest('hex');
     return `cli:${digest}`;
 }
@@ -244,42 +309,77 @@ export function hostedPollingOptions(interval, timeout, onStatus) {
     };
 }
 export async function startHostedVerification(repositoryArg, options, token) {
+    const { repository, launchBody, idempotencyKey } = prepareHostedLaunch(repositoryArg, options);
+    const path = '/api/agent/cloud-verifier/runs';
+    const response = await fetch(haystackApiUrl(path), {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: 'application/json',
+            'User-Agent': 'Haystack-CLI',
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(launchBody),
+    });
+    if (!response.ok) {
+        // Keep the shared HTTP classification and raw-body fallback while exposing
+        // the launch service's additional explanation for a retryable failure.
+        const body = response.status === 503
+            ? await response.clone().json().catch(() => null)
+            : null;
+        const error = await classifyHttpError(response, `Haystack API ${path}`);
+        if (body && typeof body === 'object' && 'detail' in body
+            && typeof body.detail === 'string' && body.detail.trim()) {
+            error.message += ` Details: ${body.detail}`;
+        }
+        throw error;
+    }
+    const state = parseHostedRunState(await response.json());
+    if (options.provider === 'haystack' && state.provider !== 'haystack') {
+        throw new Error('Hosted verifier did not acknowledge the fleet-pinned request.');
+    }
+    return {
+        state: {
+            ...state,
+            repository: state.repository ?? repository.fullName,
+            baseCommit: state.baseCommit ?? launchBody.baseCommit,
+            headCommit: state.headCommit ?? launchBody.headCommit,
+        },
+        idempotencyKey,
+    };
+}
+function prepareHostedLaunch(repositoryArg, options) {
     const repository = parseHostedRepository(repositoryArg);
-    const baseCommit = requireCommit(options.base, '--base');
-    const headCommit = requireCommit(options.head, '--head');
-    const intent = readHostedIntentFile(options.intentFile);
+    const fleet = options.provider === 'haystack';
+    const validateRevision = fleet ? requireRevision : requireCommit;
+    const baseCommit = validateRevision(options.base, '--base');
+    const headCommit = validateRevision(options.head, '--head');
+    const intent = fleet && options.intentFile === undefined ? undefined : readHostedIntentFile(options.intentFile);
+    if (fleet && intent && [intent.problem, intent.goal, ...intent.intended_outcomes].some(value => /[\u0000-\u001f\u007f]/.test(value))) {
+        throw new Error('Fleet --intent-file fields must be single-line text without control characters.');
+    }
     const replayPlanFrom = options.replayPlanFrom;
+    if (fleet && replayPlanFrom !== undefined) {
+        throw new Error('--replay-plan-from is available through the explicit hosted start alias.');
+    }
     if (replayPlanFrom !== undefined && !RUN_ID.test(replayPlanFrom)) {
         throw new Error('--replay-plan-from must match cv_ followed by 48 lowercase hex characters.');
     }
     const idempotencyKey = requireIdempotencyKey(options.idempotencyKey
-        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom));
+        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom, fleet ? { provider: 'haystack', intent } : undefined));
     const launchBody = {
+        ...(fleet ? { provider: 'haystack' } : {}),
         owner: repository.owner,
         repository: repository.repository,
         baseCommit,
         headCommit,
         idempotencyKey,
-        intent,
+        ...(intent ? { intent } : {}),
         ...(replayPlanFrom
             ? { replayPlanFromRunId: replayPlanFrom }
             : {}),
     };
-    const response = await haystackJson('/api/agent/cloud-verifier/runs', token, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(launchBody),
-    });
-    const state = parseHostedRunState(response);
-    return {
-        state: {
-            ...state,
-            repository: state.repository ?? repository.fullName,
-            baseCommit: state.baseCommit ?? baseCommit,
-            headCommit: state.headCommit ?? headCommit,
-        },
-        idempotencyKey,
-    };
+    return { repository, launchBody, idempotencyKey };
 }
 export async function getHostedVerification(runId, token) {
     if (!RUN_ID.test(runId)) {
@@ -303,12 +403,13 @@ function delay(milliseconds) {
 }
 export async function waitForHostedVerification(runId, token, options) {
     const startedAt = Date.now();
-    let lastStatus;
+    let lastProgress;
     for (;;) {
         const state = await getHostedVerification(runId, token);
-        if (state.status !== lastStatus) {
+        const progressKey = JSON.stringify([state.status, state.progress?.sequence, state.progress?.stage, state.progress?.status]);
+        if (progressKey !== lastProgress) {
             options.onStatus?.(state);
-            lastStatus = state.status;
+            lastProgress = progressKey;
         }
         if (TERMINAL_STATUSES.has(state.status)) {
             return { state, timedOut: false };
@@ -338,6 +439,9 @@ export function buildHostedJson(operation, state, extras = {}) {
         ...(extras.timedOut !== undefined ? { timed_out: extras.timedOut } : {}),
         ...(state.output ? { output: state.output } : {}),
         ...(state.result ? { result: state.result } : {}),
+        ...(state.provider ? { provider: state.provider, version: state.version } : {}),
+        ...(state.progress ? { progress: state.progress } : {}),
+        ...(state.fleetResult ? { result: state.fleetResult } : {}),
         ...(state.error ? { error: state.error } : {}),
     });
 }
@@ -357,11 +461,13 @@ function printHostedState(operation, state, options) {
         }), null, 2)}\n`);
         return;
     }
-    const icon = state.status === 'complete'
-        ? chalk.green('✓')
-        : TERMINAL_STATUSES.has(state.status)
-            ? chalk.red('✗')
-            : chalk.cyan('•');
+    const icon = state.provider === 'haystack' && state.status === 'complete'
+        ? chalk.cyan('•')
+        : state.status === 'complete'
+            ? chalk.green('✓')
+            : TERMINAL_STATUSES.has(state.status)
+                ? chalk.red('✗')
+                : chalk.cyan('•');
     console.log(`${icon} Hosted verification ${chalk.bold(state.runId)}: ${state.status}`);
     if (state.repository) {
         console.log(`  ${chalk.dim('Repository:')} ${state.repository}`);
@@ -378,6 +484,22 @@ function printHostedState(operation, state, options) {
         }
         console.log(`  ${chalk.dim('Artifacts:')} ${state.result.outputLocation}`);
     }
+    if (state.progress) {
+        console.log(`  ${chalk.dim('Progress:')} ${state.progress.stage} (${state.progress.status})`);
+    }
+    if (state.fleetResult) {
+        const result = state.fleetResult;
+        const cleanup = requireRecord(result.cleanup, 'Hosted fleet cleanup');
+        const provenance = requireRecord(result.provenance, 'Hosted fleet provenance');
+        console.log(`  ${chalk.dim('Lifecycle:')} ${result.lifecycle}`);
+        console.log(`  ${chalk.dim('Run health:')} ${result.runHealth}`);
+        console.log(`  ${chalk.dim('Intent:')} ${provenance.intent}`);
+        console.log(`  ${chalk.dim('Cleanup:')} ${cleanup.status} (${cleanup.pending.length} pending)`);
+        for (const value of result.findings) {
+            const finding = requireRecord(value, 'Hosted fleet finding');
+            console.log(`  ${chalk.dim('Finding:')} ${finding.findingId} / ${finding.caseId}: ${finding.judgment}`);
+        }
+    }
     if (state.error)
         console.log(`  ${chalk.dim('Error:')} ${state.error}`);
     if (options.timedOut) {
@@ -387,23 +509,38 @@ function printHostedState(operation, state, options) {
         console.log(`  ${chalk.dim('Resume:')} ${nextCommand}`);
 }
 function markNonSuccess(state, timedOut = false) {
+    if (state.fleetResult) {
+        const result = state.fleetResult;
+        const cleanup = requireRecord(result.cleanup, 'Hosted fleet cleanup');
+        if (result.lifecycle !== 'complete' || result.runHealth !== 'healthy' || cleanup.status !== 'complete') {
+            process.exitCode = 2;
+            return;
+        }
+        if (result.findings.some(value => requireRecord(value, 'Hosted fleet finding').judgment === 'regression')) {
+            process.exitCode = 1;
+        }
+    }
     if (timedOut
         || (state.status !== 'complete' && TERMINAL_STATUSES.has(state.status))) {
         process.exitCode = 2;
     }
 }
 export async function verifyHostedStartCommand(repositoryArg, options) {
-    const repository = parseHostedRepository(repositoryArg);
-    // Fail before account resolution so an invalid local intent never advances
-    // toward a hosted launch.
-    readHostedIntentFile(options.intentFile);
+    // Validate all local input before resolving accounts or submitting a job.
+    const { repository } = prepareHostedLaunch(repositoryArg, options);
+    const polling = hostedPollingOptions(options.interval, options.timeout, current => {
+        if (!options.json)
+            console.error(chalk.dim(hostedProgressMessage(current)));
+    });
     const auth = await resolveAuthContext({
         preferredLogin: options.account,
         owner: repository.owner,
         repo: repository.repository,
     });
     if (!options.json) {
-        console.error(chalk.dim('Submitting the exact commit pair to the hosted verifier…'));
+        console.error(chalk.dim(options.provider === 'haystack'
+            ? 'Submitting repository revisions to the hosted fleet verifier…'
+            : 'Submitting the exact commit pair to the hosted verifier…'));
     }
     const started = await startHostedVerification(repositoryArg, options, auth.token);
     const selectedAccount = auth.token.startsWith('hsk_live_')
@@ -412,11 +549,7 @@ export async function verifyHostedStartCommand(repositoryArg, options) {
     let state = started.state;
     let timedOut;
     if (options.wait !== false && !TERMINAL_STATUSES.has(state.status)) {
-        const waited = await waitForHostedVerification(state.runId, auth.token, hostedPollingOptions(options.interval, options.timeout, current => {
-            if (!options.json) {
-                console.error(chalk.dim(`Hosted verifier: ${current.status}…`));
-            }
-        }));
+        const waited = await waitForHostedVerification(state.runId, auth.token, polling);
         state = waited.state;
         timedOut = waited.timedOut;
     }
@@ -431,7 +564,14 @@ export async function verifyHostedStartCommand(repositoryArg, options) {
     });
     markNonSuccess(state, timedOut);
 }
+function hostedProgressMessage(state) {
+    return `Hosted verifier: ${state.status}${state.progress ? ` · ${state.progress.stage} (${state.progress.status})` : ''}…`;
+}
 export async function verifyHostedStatusCommand(runId, options) {
+    const polling = hostedPollingOptions(options.interval, options.timeout, current => {
+        if (!options.json)
+            console.error(chalk.dim(hostedProgressMessage(current)));
+    });
     const auth = await resolveAuthContext({ preferredLogin: options.account });
     const selectedAccount = auth.token.startsWith('hsk_live_')
         ? undefined
@@ -439,11 +579,7 @@ export async function verifyHostedStatusCommand(runId, options) {
     let state = await getHostedVerification(runId, auth.token);
     let timedOut;
     if (options.wait && !TERMINAL_STATUSES.has(state.status)) {
-        const waited = await waitForHostedVerification(runId, auth.token, hostedPollingOptions(options.interval, options.timeout, current => {
-            if (!options.json) {
-                console.error(chalk.dim(`Hosted verifier: ${current.status}…`));
-            }
-        }));
+        const waited = await waitForHostedVerification(runId, auth.token, polling);
         state = waited.state;
         timedOut = waited.timedOut;
     }

package/dist/commands/verify-precompute.d.ts

@@ -1,4 +1,12 @@
-export type PrecomputeOutcome = 'enqueued' | 'cached' | 'existing' | 'skipped_no_auth' | 'error';
+import type { DeliverPrecomputeRequest } from './precompute-delivery-contract.js';
+export type RepoWalkHookStatus = {
+    status: 'queued' | 'existing';
+    runId: string;
+} | {
+    status: 'unavailable';
+    reason: 'runner-unavailable' | 'enqueue-failed';
+};
+export type PrecomputeOutcome = 'pending' | 'enqueued' | 'cached' | 'existing' | 'skipped_no_auth' | 'error';
 export interface VerifyPrecomputeOptions {
     hook?: boolean;
 }
@@ -7,6 +15,7 @@ export interface FrontHalfEnqueueRequest {
     repository: string;
     baseCommit: string;
     workCommit: string;
+    observedAt: number;
     cacheKey: string;
     patchGzBase64: string;
     patchSha256: string;
@@ -16,4 +25,6 @@ export interface PrecomputeDerivation {
     request: FrontHalfEnqueueRequest;
 }
 export declare function derivePrecomputeRequest(gitRoot: string, owner: string, repository: string, deadline?: number): Promise<PrecomputeDerivation>;
+/** One authenticated submission of the already captured request. No source reads or retries. */
+export declare const deliverPrecomputeRequest: DeliverPrecomputeRequest;
 export declare function verifyPrecomputeCommand(options: VerifyPrecomputeOptions): Promise<void>;