@haystackeditor/cli 0.15.30 → 0.16.0

package/dist/commands/verify-hosted.js

@@ -76,95 +76,64 @@ export function parseHostedRunState(value, expectedRunId) {
     if (headCommit && !COMMIT_SHA.test(headCommit)) {
         throw new Error('Hosted verifier response has an invalid headCommit.');
     }
-    const outputValue = response.output;
-    const output = outputValue === undefined
-        ? undefined
-        : requireRecord(outputValue, 'Hosted verifier output');
     const resultValue = response.result;
-    const fleet = response.provider === 'haystack';
-    if (response.provider !== undefined && !fleet) {
+    if (response.provider !== 'haystack') {
         throw new Error('Hosted verifier returned an unsupported provider.');
     }
-    if (fleet && response.version !== FLEET_PROJECTION_VERSION) {
+    if (response.version !== FLEET_PROJECTION_VERSION) {
         throw new Error('Hosted verifier returned an unsupported fleet projection version.');
     }
-    const result = fleet || resultValue === undefined
-        ? undefined
-        : parseHostedRunnerResult(resultValue);
     const createdAt = optionalTimestamp(response, 'createdAt');
     const completedAt = optionalTimestamp(response, 'completedAt');
     let progress;
     let fleetResult;
-    if (fleet) {
-        if (response.publicRunId !== runId || !repository || !baseCommit || !headCommit || !createdAt || output) {
-            throw new Error('Hosted fleet projection is missing its immutable run identity.');
+    if (response.publicRunId !== runId || !repository || !baseCommit || !headCommit || !createdAt) {
+        throw new Error('Hosted fleet projection is missing its immutable run identity.');
+    }
+    if (response.progress !== undefined && response.progress !== null) {
+        progress = requireRecord(response.progress, 'Hosted fleet progress');
+        if (progress.version !== 'dv-verify-progress-v1' || progress.publicRunId !== runId) {
+            throw new Error('Hosted fleet progress does not match the requested run.');
         }
-        if (response.progress !== undefined && response.progress !== null) {
-            progress = requireRecord(response.progress, 'Hosted fleet progress');
-            if (progress.version !== 'dv-verify-progress-v1' || progress.publicRunId !== runId) {
-                throw new Error('Hosted fleet progress does not match the requested run.');
-            }
-            requireString(progress, 'stage');
-            requireString(progress, 'status');
+        requireString(progress, 'stage');
+        requireString(progress, 'status');
+    }
+    if (resultValue !== undefined && resultValue !== null) {
+        fleetResult = requireRecord(resultValue, 'Hosted fleet result');
+        const mapping = requireRecord(fleetResult.mapping, 'Hosted fleet result mapping');
+        const provenance = requireRecord(fleetResult.provenance, 'Hosted fleet provenance');
+        if (fleetResult.version !== 'dv-verify-result-v1' || fleetResult.provider !== 'haystack'
+            || mapping.publicRunId !== runId || provenance.baseSha !== baseCommit || provenance.headSha !== headCommit) {
+            throw new Error('Hosted fleet result does not match the requested run and commits.');
         }
-        if (resultValue !== undefined && resultValue !== null) {
-            fleetResult = requireRecord(resultValue, 'Hosted fleet result');
-            const mapping = requireRecord(fleetResult.mapping, 'Hosted fleet result mapping');
-            const provenance = requireRecord(fleetResult.provenance, 'Hosted fleet provenance');
-            if (fleetResult.version !== 'dv-verify-result-v1' || fleetResult.provider !== 'haystack'
-                || mapping.publicRunId !== runId || provenance.baseSha !== baseCommit || provenance.headSha !== headCommit) {
-                throw new Error('Hosted fleet result does not match the requested run and commits.');
-            }
-            // CONTRACT-GAP: P0 currently couples its canonical parsers to runner-only
-            // modules outside this published CLI. The server validates the complete
-            // P0 result; the CLI only checks the fields it presents, retaining the
-            // original document instead of defining a second P0 wire contract.
-            requireString(fleetResult, 'lifecycle', /^(complete|failed|cancelled|budget-stopped|account-action)$/);
-            requireString(fleetResult, 'runHealth', /^(healthy|degraded|infrastructure-error|not-executed)$/);
-            const cleanup = requireRecord(fleetResult.cleanup, 'Hosted fleet cleanup');
-            requireString(cleanup, 'status', /^(complete|pending)$/);
-            if (!Array.isArray(cleanup.pending) || !Array.isArray(fleetResult.findings)) {
-                throw new Error('Hosted fleet result has invalid findings or cleanup.');
-            }
-            for (const value of fleetResult.findings) {
-                const finding = requireRecord(value, 'Hosted fleet finding');
-                requireString(finding, 'findingId');
-                requireString(finding, 'caseId');
-                requireString(finding, 'judgment');
-            }
-            requireString(provenance, 'intent', /^(user|inferred)$/);
-            if (status === 'complete' && fleetResult.lifecycle !== 'complete') {
-                throw new Error('Hosted fleet lifecycle disagrees with its completed job.');
-            }
+        // CONTRACT-GAP: P0 currently couples its canonical parsers to runner-only
+        // modules outside this published CLI. The server validates the complete
+        // P0 result; the CLI only checks the fields it presents, retaining the
+        // original document instead of defining a second P0 wire contract.
+        requireString(fleetResult, 'lifecycle', /^(complete|failed|cancelled|budget-stopped|account-action)$/);
+        requireString(fleetResult, 'runHealth', /^(healthy|degraded|infrastructure-error|not-executed)$/);
+        const cleanup = requireRecord(fleetResult.cleanup, 'Hosted fleet cleanup');
+        requireString(cleanup, 'status', /^(complete|pending)$/);
+        if (!Array.isArray(cleanup.pending) || !Array.isArray(fleetResult.findings)) {
+            throw new Error('Hosted fleet result has invalid findings or cleanup.');
         }
-        if (status === 'complete' && !fleetResult) {
-            throw new Error('Hosted fleet run completed without a result receipt.');
+        for (const value of fleetResult.findings) {
+            const finding = requireRecord(value, 'Hosted fleet finding');
+            requireString(finding, 'findingId');
+            requireString(finding, 'caseId');
+            requireString(finding, 'judgment');
         }
-    }
-    else if (status === 'complete') {
-        // Two terminal shapes exist: the Workflow receipt envelope (`output`)
-        // and the runner-queue result envelope (`result`). Exactly one must
-        // validate.
-        if (result) {
-            if (!repository || !baseCommit || !headCommit || !createdAt) {
-                throw new Error('Hosted verifier returned a complete run without a matching terminal receipt.');
-            }
+        if (fleetResult.savedChecks !== undefined) {
+            parseHostedSavedChecks(fleetResult.savedChecks, runId, headCommit);
         }
-        else if (!repository
-            || !baseCommit
-            || !headCommit
-            || !createdAt
-            || !completedAt
-            || !output
-            || output.runId !== runId
-            || output.repository !== repository
-            || output.baseCommit !== baseCommit
-            || output.headCommit !== headCommit
-            || output.sourceOfflineReady !== true
-            || output.sandboxDeleted !== true) {
-            throw new Error('Hosted verifier returned a complete run without a matching terminal receipt.');
+        requireString(provenance, 'intent', /^(user|inferred)$/);
+        if (status === 'complete' && fleetResult.lifecycle !== 'complete') {
+            throw new Error('Hosted fleet lifecycle disagrees with its completed job.');
         }
     }
+    if (status === 'complete' && !fleetResult) {
+        throw new Error('Hosted fleet run completed without a result receipt.');
+    }
     return {
         runId,
         status,
@@ -173,37 +142,13 @@ export function parseHostedRunState(value, expectedRunId) {
         headCommit,
         createdAt,
         completedAt,
-        output,
-        result,
-        ...(fleet ? { provider: 'haystack', version: FLEET_PROJECTION_VERSION, progress, fleetResult } : {}),
+        provider: 'haystack',
+        version: FLEET_PROJECTION_VERSION,
+        progress,
+        fleetResult,
         error: optionalString(response, 'error'),
     };
 }
-function parseHostedRunnerResult(value) {
-    const record = requireRecord(value, 'Hosted verifier runner result');
-    const regressionsValue = record.regressions;
-    if (typeof record.verdict !== 'string'
-        || typeof record.summary !== 'string'
-        || !Number.isInteger(record.casesTotal)
-        || !Number.isInteger(record.casesFailed)
-        || typeof record.outputLocation !== 'string'
-        || typeof record.wallSeconds !== 'number'
-        || !Array.isArray(regressionsValue)
-        || !regressionsValue.every(item => !!item && typeof item === 'object' && !Array.isArray(item)
-            && typeof item.caseId === 'string'
-            && typeof item.title === 'string')) {
-        throw new Error('Hosted verifier runner result is malformed.');
-    }
-    return {
-        verdict: record.verdict,
-        summary: record.summary,
-        casesTotal: record.casesTotal,
-        casesFailed: record.casesFailed,
-        regressions: regressionsValue,
-        outputLocation: record.outputLocation,
-        wallSeconds: record.wallSeconds,
-    };
-}
 export function parseHostedRepository(value) {
     const parts = value.split('/');
     if (parts.length !== 2
@@ -216,13 +161,95 @@ export function parseHostedRepository(value) {
         fullName: value,
     };
 }
-function requireCommit(value, flag) {
-    if (typeof value !== 'string' || !COMMIT_SHA.test(value)) {
-        throw new Error(`${flag} must be an exact 40-character lowercase commit SHA.`);
+/** The service validates the shared full contract. Check every additional
+ * field used by this published CLI before displaying or accepting a clean run. */
+function parseHostedSavedChecks(value, runId, headSha) {
+    const saved = requireRecord(value, 'Hosted saved checks');
+    if (saved.version !== 'dv-fleet-saved-check-result-v1'
+        || !Array.isArray(saved.descriptors) || !Array.isArray(saved.outcomes)
+        || !Array.isArray(saved.unresolvedFindings) || !Array.isArray(saved.conflicts)) {
+        throw new Error('Hosted saved checks have an invalid version or records.');
+    }
+    const completeness = requireRecord(saved.completeness, 'Hosted saved check completeness');
+    requireString(completeness, 'status', /^(complete|incomplete)$/);
+    if (completeness.status === 'incomplete' && (!Array.isArray(completeness.reasons) || completeness.reasons.length === 0)) {
+        throw new Error('Hosted saved check history has no explanation for missing evidence.');
+    }
+    const ref = (record) => {
+        requireString(record, 'checkId', /^[0-9a-f]{64}$/);
+        requireString(record, 'planRevisionId', /^[0-9a-f]{64}$/);
+        return `${record.checkId}:${record.planRevisionId}`;
+    };
+    const descriptors = new Map();
+    for (const value of saved.descriptors) {
+        const descriptor = requireRecord(value, 'Hosted saved check descriptor');
+        const key = ref(descriptor);
+        if (descriptor.version !== 'dv-fleet-saved-check-v1' || descriptors.has(key)) {
+            throw new Error('Hosted saved check descriptor identity is invalid or duplicated.');
+        }
+        requireString(descriptor, 'captureStatus', /^(captured|unavailable)$/);
+        descriptors.set(key, descriptor);
+    }
+    const outcomes = new Map();
+    for (const value of saved.outcomes) {
+        const outcome = requireRecord(value, 'Hosted saved check outcome');
+        const key = ref(outcome);
+        requireString(outcome, 'status', /^(passed|reproduced|blocked|inconclusive)$/);
+        if (outcome.version !== 'dv-fleet-saved-check-outcome-v1'
+            || (!descriptors.has(key) && completeness.status !== 'incomplete') || outcomes.has(key)
+            || outcome.publicRunId !== runId || outcome.headSha !== headSha
+            || (outcome.currentCaseId !== null && typeof outcome.currentCaseId !== 'string')
+            || (outcome.blockedCode !== null && typeof outcome.blockedCode !== 'string')) {
+            throw new Error('Hosted saved check outcome does not match its current run or original check.');
+        }
+        if ((outcome.status === 'blocked') !== (outcome.blockedCode !== null)
+            || (outcome.status === 'passed' && (descriptors.get(key)?.captureStatus !== 'captured'
+                || outcome.currentCaseId === null || !outcome.receipt || completeness.status !== 'complete'))) {
+            throw new Error('Hosted saved check outcome claims a pass without original execution evidence.');
+        }
+        outcomes.set(key, outcome);
+    }
+    const findings = new Set();
+    for (const value of saved.unresolvedFindings) {
+        const finding = requireRecord(value, 'Hosted unresolved finding');
+        const key = ref(finding);
+        requireString(finding, 'findingId');
+        const source = requireRecord(finding.firstObserved, 'Hosted original finding evidence');
+        requireString(source, 'publicRunId', RUN_ID);
+        requireString(source, 'caseId');
+        requireString(source, 'headSha', COMMIT_SHA);
+        if (finding.version !== 'dv-fleet-unresolved-finding-v1'
+            || (!descriptors.has(key) && completeness.status !== 'incomplete')
+            || findings.has(finding.findingId) || !Array.isArray(source.evidence) || source.evidence.length === 0
+            || outcomes.get(key)?.status === 'passed') {
+            throw new Error('Hosted unresolved finding has invalid original evidence or check identity.');
+        }
+        findings.add(finding.findingId);
+        if (finding.lastOutcome !== null) {
+            const last = requireRecord(finding.lastOutcome, 'Hosted unresolved finding outcome');
+            if (ref(last) !== key || last.status === 'passed')
+                throw new Error('Hosted unresolved finding lost its exact original check.');
+            requireString(last, 'status', /^(reproduced|blocked|inconclusive)$/);
+            if (last.blockedCode !== null)
+                requireString(last, 'blockedCode');
+        }
     }
-    return value;
+    for (const value of saved.conflicts) {
+        const conflict = requireRecord(value, 'Hosted saved check conflict');
+        requireString(conflict, 'checkId', /^[0-9a-f]{64}$/);
+        if (!Array.isArray(conflict.planRevisionIds) || conflict.planRevisionIds.length < 2
+            || conflict.planRevisionIds.some(id => typeof id !== 'string' || !/^[0-9a-f]{64}$/.test(id))) {
+            throw new Error('Hosted saved check conflict is invalid.');
+        }
+    }
+    return saved;
+}
+function savedCheckDisplay(value) {
+    // eslint-disable-next-line no-control-regex -- rejecting/stripping control characters is the point
+    return String(value).replace(/[\u0000-\u001f\u007f-\u009f]/g, '');
 }
 function requireRevision(value, flag) {
+    // eslint-disable-next-line no-control-regex -- rejecting/stripping control characters is the point
     if (typeof value !== 'string' || value.length === 0 || value.length > 1_024 || /[\u0000-\u0020\u007f]/.test(value)) {
         throw new Error(`${flag} must be a non-empty Git revision of at most 1024 characters without whitespace or control characters.`);
     }
@@ -276,13 +303,9 @@ export function readHostedIntentFile(intentFile) {
         intended_outcomes: record.intended_outcomes,
     };
 }
-export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom, fleetRequest) {
+export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, intent) {
     const digest = createHash('sha256')
-        .update(JSON.stringify(fleetRequest
-        ? [fleetRequest.provider, repository, baseCommit, headCommit, fleetRequest.intent ?? null]
-        : replayPlanFrom
-            ? [repository, baseCommit, headCommit, replayPlanFrom]
-            : [repository, baseCommit, headCommit]))
+        .update(JSON.stringify(['haystack', repository, baseCommit, headCommit, intent ?? null]))
         .digest('hex');
     return `cli:${digest}`;
 }
@@ -309,7 +332,7 @@ export function hostedPollingOptions(interval, timeout, onStatus) {
     };
 }
 export async function startHostedVerification(repositoryArg, options, token) {
-    const { repository, launchBody, idempotencyKey } = prepareHostedLaunch(repositoryArg, options);
+    const { launchBody, idempotencyKey } = prepareHostedLaunch(repositoryArg, options);
     const path = '/api/agent/cloud-verifier/runs';
     const response = await fetch(haystackApiUrl(path), {
         method: 'POST',
@@ -335,49 +358,27 @@ export async function startHostedVerification(repositoryArg, options, token) {
         throw error;
     }
     const state = parseHostedRunState(await response.json());
-    if (options.provider === 'haystack' && state.provider !== 'haystack') {
-        throw new Error('Hosted verifier did not acknowledge the fleet-pinned request.');
-    }
-    return {
-        state: {
-            ...state,
-            repository: state.repository ?? repository.fullName,
-            baseCommit: state.baseCommit ?? launchBody.baseCommit,
-            headCommit: state.headCommit ?? launchBody.headCommit,
-        },
-        idempotencyKey,
-    };
+    return { state, idempotencyKey };
 }
 function prepareHostedLaunch(repositoryArg, options) {
     const repository = parseHostedRepository(repositoryArg);
-    const fleet = options.provider === 'haystack';
-    const validateRevision = fleet ? requireRevision : requireCommit;
-    const baseCommit = validateRevision(options.base, '--base');
-    const headCommit = validateRevision(options.head, '--head');
-    const intent = fleet && options.intentFile === undefined ? undefined : readHostedIntentFile(options.intentFile);
-    if (fleet && intent && [intent.problem, intent.goal, ...intent.intended_outcomes].some(value => /[\u0000-\u001f\u007f]/.test(value))) {
+    const baseCommit = requireRevision(options.base, '--base');
+    const headCommit = requireRevision(options.head, '--head');
+    const intent = options.intentFile === undefined ? undefined : readHostedIntentFile(options.intentFile);
+    // eslint-disable-next-line no-control-regex -- rejecting/stripping control characters is the point
+    if (intent && [intent.problem, intent.goal, ...intent.intended_outcomes].some(value => /[\u0000-\u001f\u007f]/.test(value))) {
         throw new Error('Fleet --intent-file fields must be single-line text without control characters.');
     }
-    const replayPlanFrom = options.replayPlanFrom;
-    if (fleet && replayPlanFrom !== undefined) {
-        throw new Error('--replay-plan-from is available through the explicit hosted start alias.');
-    }
-    if (replayPlanFrom !== undefined && !RUN_ID.test(replayPlanFrom)) {
-        throw new Error('--replay-plan-from must match cv_ followed by 48 lowercase hex characters.');
-    }
     const idempotencyKey = requireIdempotencyKey(options.idempotencyKey
-        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom, fleet ? { provider: 'haystack', intent } : undefined));
+        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, intent));
     const launchBody = {
-        ...(fleet ? { provider: 'haystack' } : {}),
+        provider: 'haystack',
         owner: repository.owner,
         repository: repository.repository,
         baseCommit,
         headCommit,
         idempotencyKey,
         ...(intent ? { intent } : {}),
-        ...(replayPlanFrom
-            ? { replayPlanFromRunId: replayPlanFrom }
-            : {}),
     };
     return { repository, launchBody, idempotencyKey };
 }
@@ -437,9 +438,8 @@ export function buildHostedJson(operation, state, extras = {}) {
             : {}),
         ...(extras.nextCommand ? { next_command: extras.nextCommand } : {}),
         ...(extras.timedOut !== undefined ? { timed_out: extras.timedOut } : {}),
-        ...(state.output ? { output: state.output } : {}),
-        ...(state.result ? { result: state.result } : {}),
-        ...(state.provider ? { provider: state.provider, version: state.version } : {}),
+        provider: state.provider,
+        version: state.version,
         ...(state.progress ? { progress: state.progress } : {}),
         ...(state.fleetResult ? { result: state.fleetResult } : {}),
         ...(state.error ? { error: state.error } : {}),
@@ -461,13 +461,11 @@ function printHostedState(operation, state, options) {
         }), null, 2)}\n`);
         return;
     }
-    const icon = state.provider === 'haystack' && state.status === 'complete'
+    const icon = state.status === 'complete'
         ? chalk.cyan('•')
-        : state.status === 'complete'
-            ? chalk.green('✓')
-            : TERMINAL_STATUSES.has(state.status)
-                ? chalk.red('✗')
-                : chalk.cyan('•');
+        : TERMINAL_STATUSES.has(state.status)
+            ? chalk.red('✗')
+            : chalk.cyan('•');
     console.log(`${icon} Hosted verification ${chalk.bold(state.runId)}: ${state.status}`);
     if (state.repository) {
         console.log(`  ${chalk.dim('Repository:')} ${state.repository}`);
@@ -475,15 +473,6 @@ function printHostedState(operation, state, options) {
     if (state.baseCommit && state.headCommit) {
         console.log(`  ${chalk.dim('Commits:')} ${state.baseCommit.slice(0, 12)} → ${state.headCommit.slice(0, 12)}`);
     }
-    if (state.result) {
-        const passed = state.result.casesTotal - state.result.casesFailed;
-        console.log(`  ${chalk.dim('Verdict:')} ${state.result.verdict} `
-            + `(${passed}/${state.result.casesTotal} cases clean, ${Math.round(state.result.wallSeconds)}s)`);
-        for (const regression of state.result.regressions) {
-            console.log(`    ${chalk.red('✗')} ${regression.caseId}: ${regression.title}`);
-        }
-        console.log(`  ${chalk.dim('Artifacts:')} ${state.result.outputLocation}`);
-    }
     if (state.progress) {
         console.log(`  ${chalk.dim('Progress:')} ${state.progress.stage} (${state.progress.status})`);
     }
@@ -499,6 +488,26 @@ function printHostedState(operation, state, options) {
             const finding = requireRecord(value, 'Hosted fleet finding');
             console.log(`  ${chalk.dim('Finding:')} ${finding.findingId} / ${finding.caseId}: ${finding.judgment}`);
         }
+        if (result.savedChecks !== undefined) {
+            const saved = requireRecord(result.savedChecks, 'Hosted saved checks');
+            const completeness = requireRecord(saved.completeness, 'Hosted saved check completeness');
+            const unresolved = saved.unresolvedFindings;
+            console.log(`  ${chalk.dim('Saved checks:')} ${completeness.status}; ${saved.conflicts.length} conflicts; ${unresolved.length} unresolved bugs`);
+            for (const value of unresolved) {
+                const finding = requireRecord(value, 'Hosted unresolved finding');
+                const source = requireRecord(finding.firstObserved, 'Hosted original finding evidence');
+                const last = finding.lastOutcome === null ? null : requireRecord(finding.lastOutcome, 'Hosted unresolved finding outcome');
+                console.log(`  ${chalk.yellow('Unresolved:')} ${savedCheckDisplay(finding.findingId)} / ${savedCheckDisplay(source.caseId)}`);
+                console.log(`    First reproduced at ${String(source.headSha).slice(0, 12)}; latest check: ${savedCheckDisplay(last?.status ?? 'not executed')}${last?.blockedCode ? ` (${savedCheckDisplay(last.blockedCode)})` : ''}`);
+            }
+            if (unresolved.length)
+                console.log('  Earlier bug evidence remains open until the exact saved check passes.');
+            if (completeness.status === 'incomplete')
+                console.log('  Saved check history is incomplete; this run cannot confirm earlier bugs are fixed.');
+        }
+        else {
+            console.log(`  ${chalk.dim('Saved checks:')} unavailable for this run`);
+        }
     }
     if (state.error)
         console.log(`  ${chalk.dim('Error:')} ${state.error}`);
@@ -516,6 +525,16 @@ function markNonSuccess(state, timedOut = false) {
             process.exitCode = 2;
             return;
         }
+        if (result.savedChecks !== undefined) {
+            const saved = requireRecord(result.savedChecks, 'Hosted saved checks');
+            const completeness = requireRecord(saved.completeness, 'Hosted saved check completeness');
+            if (completeness.status !== 'complete' || saved.conflicts.length > 0) {
+                process.exitCode = 2;
+                return;
+            }
+            if (saved.unresolvedFindings.length > 0)
+                process.exitCode = 1;
+        }
         if (result.findings.some(value => requireRecord(value, 'Hosted fleet finding').judgment === 'regression')) {
             process.exitCode = 1;
         }
@@ -538,9 +557,7 @@ export async function verifyHostedStartCommand(repositoryArg, options) {
         repo: repository.repository,
     });
     if (!options.json) {
-        console.error(chalk.dim(options.provider === 'haystack'
-            ? 'Submitting repository revisions to the hosted fleet verifier…'
-            : 'Submitting the exact commit pair to the hosted verifier…'));
+        console.error(chalk.dim('Submitting repository revisions to the hosted fleet verifier…'));
     }
     const started = await startHostedVerification(repositoryArg, options, auth.token);
     const selectedAccount = auth.token.startsWith('hsk_live_')

package/dist/commands/verify-precompute.js

@@ -9,7 +9,9 @@ import { NotLoggedInError, resolveAuthContext } from '../utils/auth.js';
 import { findGitRoot, parseRemoteUrl, resolveDiffBaseRef, } from '../utils/git.js';
 import { HaystackApiError, haystackJson } from '../utils/haystack-api.js';
 import { trackPrecomputeEvent } from '../utils/telemetry.js';
+import { findSecretsInPatch, isSecretBearingPath } from '../utils/secret-paths.js';
 import { startPrecomputeDelivery } from './precompute-delivery.js';
+import { captureCombinationSearchHook, readCombinationSearchHookStatus } from './combination-search-hook.js';
 // --hook has five seconds to capture the exact source and publish local custody.
 // Its detached sender owns the bounded network delivery and acknowledgement.
 // An explicit invocation still waits synchronously for the server response.
@@ -48,13 +50,16 @@ function remainingMs(deadline) {
 function gitOutput(args, gitRoot, deadline, options = {}) {
     const timeout = Math.max(1, Math.min(remainingMs(deadline), options.timeoutCapMs ?? HOOK_WALL_MS));
     try {
-        return execFileSync('git', args, {
+        const output = execFileSync('git', args, {
             cwd: gitRoot,
             encoding: 'utf8',
             env: options.env ?? process.env,
             stdio: ['pipe', 'pipe', 'pipe'],
             timeout,
-        }).trim();
+            ...(options.input === undefined ? {} : { input: options.input }),
+            ...(options.maxBuffer === undefined ? {} : { maxBuffer: options.maxBuffer }),
+        });
+        return options.raw ? output : output.trim();
     }
     catch {
         throw new PrecomputeFailure('Could not derive the repository snapshot.');
@@ -110,7 +115,41 @@ function deriveBaseSha(gitRoot, deadline) {
     }
     return baseSha;
 }
-function deriveWorktreeTreeSha(gitRoot, deadline) {
+// The -U0 scan text omits binary content and context, so it stays far below
+// the uploaded patch; this only guards against git's 1 MiB default.
+const SCAN_PATCH_MAX_BYTES = 256 * 1024 * 1024;
+/**
+ * Withholds secret-bearing changes from the snapshot index before the tree is
+ * written, so the tree, work commit, uploaded patch and combination-search
+ * patches all agree. A withheld path keeps its base version (or is absent when
+ * base has none). Every withheld path is named on stderr; secret values never are.
+ */
+function withholdSecretBearingChanges(gitRoot, baseSha, indexEnv, deadline) {
+    const changed = gitOutput(['diff', '--cached', '--no-renames', '--diff-filter=d', '--name-only', '-z', baseSha, '--'], gitRoot, deadline, { env: indexEnv, maxBuffer: SCAN_PATCH_MAX_BYTES, raw: true }).split('\0').filter(path => path.length > 0);
+    const withheld = new Map();
+    for (const path of changed) {
+        if (isSecretBearingPath(path))
+            withheld.set(path, 'secret-bearing file name');
+    }
+    if (changed.length > withheld.size) {
+        const patch = gitOutput(['-c', 'core.quotePath=false', 'diff', '--cached', '--no-renames', '--diff-filter=d', '-U0',
+            '--no-color', '--no-ext-diff', '--no-textconv',
+            // pathFromDiffHeader expects `a/` and `b/`; pin them so diff.noprefix
+            // or diff.mnemonicPrefix in the user's git config cannot break parsing.
+            '--src-prefix=a/', '--dst-prefix=b/', baseSha, '--'], gitRoot, deadline, { env: indexEnv, maxBuffer: SCAN_PATCH_MAX_BYTES });
+        for (const [path, pattern] of findSecretsInPatch(patch)) {
+            if (!withheld.has(path))
+                withheld.set(path, `possible secret: ${pattern}`);
+        }
+    }
+    if (withheld.size === 0)
+        return;
+    gitOutput(['reset', '-q', baseSha, '--pathspec-from-file=-', '--pathspec-file-nul'], gitRoot, deadline, { env: { ...indexEnv, GIT_LITERAL_PATHSPECS: '1' }, input: `${[...withheld.keys()].join('\0')}\0` });
+    for (const [path, reason] of withheld) {
+        process.stderr.write(`haystack: withheld ${JSON.stringify(path)} from the precompute upload (${reason}).\n`);
+    }
+}
+function deriveWorktreeTreeSha(gitRoot, baseSha, deadline) {
     const scratchDirectory = mkdtempSync(join(tmpdir(), 'haystack-precompute-index-'));
     const temporaryIndex = join(scratchDirectory, 'index');
     try {
@@ -128,6 +167,7 @@ function deriveWorktreeTreeSha(gitRoot, deadline) {
             gitOutput(['read-tree', 'HEAD'], gitRoot, deadline, { env: indexEnv });
         }
         gitOutput(['add', '-A'], gitRoot, deadline, { env: indexEnv });
+        withholdSecretBearingChanges(gitRoot, baseSha, indexEnv, deadline);
         const treeSha = gitOutput(['write-tree'], gitRoot, deadline, { env: indexEnv });
         if (!isCommitSha(treeSha)) {
             throw new PrecomputeFailure('Could not derive the working-tree snapshot.');
@@ -221,7 +261,7 @@ export async function derivePrecomputeRequest(gitRoot, owner, repository, deadli
     // make an older stop look newer than a later one.
     const observedAt = Date.now();
     const baseSha = deriveBaseSha(gitRoot, deadline);
-    const treeSha = deriveWorktreeTreeSha(gitRoot, deadline);
+    const treeSha = deriveWorktreeTreeSha(gitRoot, baseSha, deadline);
     const workCommit = deriveWorkCommit(gitRoot, baseSha, treeSha, deadline);
     const patchGzip = await buildCompressedPatch(gitRoot, baseSha, workCommit, deadline);
     const cacheKey = [
@@ -231,6 +271,7 @@ export async function derivePrecomputeRequest(gitRoot, owner, repository, deadli
         'slim',
         slimInputHash(),
     ].join('-');
+    const combinationSearch = captureCombinationSearchHook(gitRoot, `${owner}/${repository}`, baseSha, workCommit, deadline);
     return {
         treeSha,
         request: {
@@ -242,6 +283,7 @@ export async function derivePrecomputeRequest(gitRoot, owner, repository, deadli
             cacheKey,
             patchGzBase64: patchGzip.toString('base64'),
             patchSha256: createHash('sha256').update(patchGzip).digest('hex'),
+            ...(combinationSearch ? { combinationSearch } : {}),
         },
     };
 }
@@ -249,15 +291,16 @@ function precomputeResult(response) {
     if (!response || typeof response !== 'object' || Array.isArray(response)) {
         throw new PrecomputeFailure('The precompute service returned an invalid response.');
     }
-    const { status, runId, walker: rawWalker } = response;
+    const { status, runId, walker: rawWalker, search: rawSearch } = response;
     const walker = rawWalker === undefined ? undefined : readWalkerStatus(rawWalker);
+    const search = rawSearch === undefined ? undefined : readCombinationSearchHookStatus(rawSearch);
     if (status === 'queued' && typeof runId === 'string' && isRunId(runId)) {
-        return { outcome: 'enqueued', runId, ...(walker === undefined ? {} : { walker }) };
+        return { outcome: 'enqueued', runId, ...(walker === undefined ? {} : { walker }), ...(search === undefined ? {} : { search }) };
     }
     if (status === 'cached')
-        return { outcome: 'cached', ...(walker === undefined ? {} : { walker }) };
+        return { outcome: 'cached', ...(walker === undefined ? {} : { walker }), ...(search === undefined ? {} : { search }) };
     if (status === 'existing')
-        return { outcome: 'existing', ...(walker === undefined ? {} : { walker }) };
+        return { outcome: 'existing', ...(walker === undefined ? {} : { walker }), ...(search === undefined ? {} : { search }) };
     throw new PrecomputeFailure('The precompute service returned an invalid response.');
 }
 /** One authenticated submission of the already captured request. No source reads or retries. */
@@ -340,7 +383,7 @@ function normalModeFailure(error) {
     }
     return new PrecomputeFailure('The precompute request failed.');
 }
-function printResult(outcome, runId, walker) {
+function printResult(outcome, runId, walker, search) {
     if (outcome === 'enqueued') {
         console.log(chalk.green(`Precompute request queued${runId ? ` (${runId})` : ''}.`));
     }
@@ -360,6 +403,10 @@ function printResult(outcome, runId, walker) {
             : 'Walker unavailable: the enqueue request failed.');
     else
         console.log('Walker status was not reported by the service.');
+    if (search?.status === 'queued' || search?.status === 'existing')
+        console.log(`Browser search ${search.status} (${search.runId}).`);
+    else if (search?.status === 'unavailable' && search.reason !== 'not-configured')
+        console.log(`Browser search unavailable: ${search.reason}.`);
 }
 export async function verifyPrecomputeCommand(options) {
     const startedAt = Date.now();
@@ -421,7 +468,7 @@ export async function verifyPrecomputeCommand(options) {
             }
         }
         if (!options.hook)
-            printResult(outcome, result.runId, result.walker);
+            printResult(outcome, result.runId, result.walker, result.search);
     }
     catch (error) {
         if (!options.hook)