@haystackeditor/cli 0.15.31 → 0.16.0

package/dist/commands/verify-reseal.js

@@ -1,148 +0,0 @@
-// `haystack verify reseal <specimen>` — rebuild a sealed specimen bundle and
-// restart the control plane so it actually serves it.
-//
-// The control plane resolves specimen checkouts at import time: rebuilding a
-// bundle under a running server leaves every new run on the OLD checkout, and
-// deleting the checkout is worse (runs die in tar). The safe sequence, encoded
-// here, is: reseal (the script's own diff guard decides whether to ship),
-// then restart the dev server and wait until the re-materialized checkout's
-// refs match the new bundle. Restart is triggered by touching vite.config.ts —
-// Vite watches its config file (which imports the control-plane plugin) and
-// performs a full restart, re-importing specimens.ts, which re-materializes
-// the bundle atomically (replace, never delete-first).
-import { execFileSync, spawnSync } from 'node:child_process';
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import chalk from 'chalk';
-import { discoverVerifyRoot, fetchRunFromServer, resolveServer, setVerifyToken, TERMINAL_RUN_STATUSES, VerifyUnauthorizedError, } from './verify-core.js';
-// Kept in step with demo/cloud-verifier/specimenRepo.ts by hand (same
-// arrangement as the SPECIMENS list in verify.ts).
-const RESEAL_TARGETS = {
-    'posthog-js-3191': {
-        bundleName: 'posthog-js-pr-3191.bundle',
-        checkoutName: 'posthog-js-pr-3191',
-        defaultSourceDir: path.join(os.homedir(), 'haystack-demo-specimens', 'ph3191-specimen'),
-    },
-    'posthog-js-478': {
-        bundleName: 'posthog-js-pr-478.bundle',
-        checkoutName: 'posthog-js-pr-478',
-        defaultSourceDir: null,
-    },
-    'bootstrap-text-muted': {
-        bundleName: 'bootstrap-text-muted.bundle',
-        checkoutName: 'bootstrap-text-muted',
-        defaultSourceDir: null,
-    },
-};
-function git(args, cwd) {
-    return execFileSync('git', args, { ...(cwd ? { cwd } : {}), encoding: 'utf8' }).trim();
-}
-function bundleRefs(bundlePath) {
-    const refs = new Map();
-    for (const line of git(['bundle', 'list-heads', bundlePath]).split('\n')) {
-        const match = line.match(/^([0-9a-f]{40}) refs\/heads\/(.+)$/);
-        if (match)
-            refs.set(match[2], match[1]);
-    }
-    return refs;
-}
-function checkoutMatches(checkoutDir, expected) {
-    if (!fs.existsSync(path.join(checkoutDir, '.git')))
-        return false;
-    try {
-        for (const [ref, sha] of expected) {
-            if (git(['rev-parse', `refs/heads/${ref}`], checkoutDir) !== sha)
-                return false;
-        }
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function serverAlive(server) {
-    try {
-        // Any HTTP answer means the dev server is up; 404 for a missing run is fine.
-        await fetch(`${server}/api/cloud-verifier/runs/latest`, { signal: AbortSignal.timeout(3000) });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function verifyResealCommand(specimen, options) {
-    setVerifyToken(options.token);
-    const target = RESEAL_TARGETS[specimen];
-    if (!target) {
-        throw new Error(`No reseal mapping for "${specimen}". Known: ${Object.keys(RESEAL_TARGETS).join(', ')}.`);
-    }
-    const sourceDir = path.resolve(options.source || target.defaultSourceDir || '');
-    if (!options.source && !target.defaultSourceDir) {
-        throw new Error(`Specimen "${specimen}" has no known source directory — pass --source <dir> pointing at the directory that holds reseal.sh.`);
-    }
-    const script = path.join(sourceDir, 'reseal.sh');
-    if (!fs.existsSync(script)) {
-        throw new Error(`${script} does not exist. Point --source at the specimen source directory.`);
-    }
-    const repoRoot = discoverVerifyRoot(options.repoRoot);
-    if (!repoRoot || !fs.existsSync(path.join(repoRoot, 'demo', 'cloud-verifier', 'specimens'))) {
-        throw new Error('Could not locate the control-plane repository (demo/cloud-verifier/specimens). Run from it or set HAYSTACK_VERIFY_REPO.');
-    }
-    const bundlePath = path.join(repoRoot, 'demo', 'cloud-verifier', 'specimens', target.bundleName);
-    const checkoutDir = path.join(repoRoot, '.haystack', 'verify', 'specimens', target.checkoutName);
-    const server = resolveServer(options.server);
-    // Never restart the control plane out from under an active run — the
-    // orchestrator lives in the dev-server process and dies with it.
-    const alive = await serverAlive(server);
-    if (alive) {
-        const latest = await fetchRunFromServer(server, 'latest');
-        // An unauthorized answer means the guard could not check anything — do not
-        // restart a control plane whose runs we cannot see.
-        if (latest.outcome === 'unauthorized')
-            throw new VerifyUnauthorizedError(server);
-        if (latest.outcome === 'ok' && !TERMINAL_RUN_STATUSES.has(latest.run.status)) {
-            throw new Error(`Run ${latest.run.runId} is still ${latest.run.status}; resealing restarts the control plane and would kill it. `
-                + 'Wait for it (haystack verify watch) or accept the loss by re-running after it finishes.');
-        }
-    }
-    console.error(chalk.dim(`Resealing ${specimen} from ${sourceDir}…`));
-    const reseal = spawnSync('bash', [script], { cwd: sourceDir, stdio: 'inherit' });
-    if (reseal.status !== 0) {
-        // The script's diff guard prints its own refusal; keep it authoritative.
-        throw new Error(`reseal.sh exited ${reseal.status} — bundle NOT shipped.`);
-    }
-    const refs = bundleRefs(bundlePath);
-    if (refs.size === 0)
-        throw new Error(`Reseal reported success but ${bundlePath} has no heads.`);
-    console.error(`${chalk.green('✓')} bundle sealed: ${[...refs.entries()].map(([ref, sha]) => `${ref}=${sha.slice(0, 8)}`).join(' ')}`);
-    if (options.noRestart) {
-        console.error(chalk.yellow('Restart skipped (--no-restart). The running control plane still serves the OLD checkout until restarted.'));
-        return;
-    }
-    if (!alive) {
-        console.log(`${chalk.green('✓')} Control plane is not running; it will materialize the new bundle on next start (pnpm dev).`);
-        return;
-    }
-    const viteConfig = path.join(repoRoot, 'vite.config.ts');
-    if (!fs.existsSync(viteConfig)) {
-        throw new Error(`Cannot restart: ${viteConfig} not found. Restart the dev server by hand; the new bundle materializes at boot.`);
-    }
-    console.error(chalk.dim('Restarting the control plane (touching vite.config.ts) and waiting for re-materialization…'));
-    const now = new Date();
-    fs.utimesSync(viteConfig, now, now);
-    const deadline = Date.now() + 120_000;
-    for (;;) {
-        if (checkoutMatches(checkoutDir, refs) && await serverAlive(server)) {
-            console.log(`${chalk.green('✓')} Control plane restarted on the new bundle; ${path.relative(repoRoot, checkoutDir)} matches ${target.bundleName}.`);
-            return;
-        }
-        if (Date.now() > deadline) {
-            process.exitCode = 2;
-            console.error(chalk.red('The checkout still does not match the new bundle after 120s. Restart the dev server manually '
-                + '(Ctrl-C the `pnpm dev` process and start it again); it will re-materialize the bundle at boot.'));
-            return;
-        }
-        await new Promise(resolve => setTimeout(resolve, 2000));
-    }
-}

package/dist/commands/verify-sandboxes.d.ts

@@ -1,95 +0,0 @@
-export declare function resolveE2BApiKey(): string;
-export interface E2BSandboxInfo {
-    sandboxId: string;
-    templateId: string;
-    alias: string | null;
-    startedAt: string | null;
-    endAt: string | null;
-    cpuCount: number | null;
-    memoryMB: number | null;
-}
-export declare function listE2BSandboxes(apiKey: string): Promise<E2BSandboxInfo[]>;
-export declare function killE2BSandbox(apiKey: string, sandboxId: string): Promise<void>;
-export interface SandboxAttribution {
-    runId: string;
-    chapterId: string;
-    role: 'golden' | 'base' | 'head' | 'kept-alive' | 'bisect-probe';
-    cell: string | null;
-    runStatus: string;
-    expiresAt: string | null;
-}
-export interface AttributionIndex {
-    bySandboxId: Map<string, SandboxAttribution>;
-    /** Golden snapshot ids (fork template ids), with and without the `:tag` suffix. */
-    snapshotIds: Set<string>;
-    newestRunByChapter: Map<string, string>;
-}
-export declare function collectAttribution(repoRoot: string): AttributionIndex;
-/**
- * A run.json can say `running` forever after the dev server restarted mid-run;
- * its mid-flight universes then leak until hard expiry and disk alone will not
- * mark them stale. The control plane reports such runs as failed — fold its
- * answer into the attribution. Unreachable server = leave non-terminal runs
- * alone (conservative: never kill what might still be alive).
- */
-export declare function reconcileAttributionWithServer(index: AttributionIndex, server: string): Promise<void>;
-export interface AnnotatedSandbox extends E2BSandboxInfo {
-    verifier: boolean;
-    attribution: SandboxAttribution | null;
-    /** Attributed via golden-snapshot template but absent from any run record. */
-    templateOnly: boolean;
-    stale: boolean;
-    staleReason: string | null;
-    age: string | null;
-    endsIn: string | null;
-}
-export declare function annotateSandboxes(sandboxes: E2BSandboxInfo[], index: AttributionIndex | null): AnnotatedSandbox[];
-export interface SandboxInventory {
-    schema_version: '1.0.0';
-    total: number;
-    verifier_count: number;
-    other_count: number;
-    stale_count: number;
-    attribution_available: boolean;
-    sandboxes: Array<{
-        sandbox_id: string;
-        template: string;
-        verifier: boolean;
-        stale: boolean;
-        stale_reason: string | null;
-        role: string | null;
-        run_id: string | null;
-        chapter_id: string | null;
-        cell: string | null;
-        age: string | null;
-        ends: string | null;
-    }>;
-}
-export declare function inventoryOf(annotated: AnnotatedSandbox[], attributionAvailable: boolean): SandboxInventory;
-export declare function fetchInventoryFromServer(server: string): Promise<SandboxInventory | null>;
-export declare function killSandboxViaServer(server: string, sandboxId: string, force: boolean): Promise<{
-    ok: boolean;
-    error?: string;
-}>;
-export interface ResolvedInventory {
-    inventory: SandboxInventory;
-    via: 'server' | 'e2b';
-    kill: (sandboxId: string, force: boolean) => Promise<{
-        ok: boolean;
-        error?: string;
-    }>;
-}
-/** Inventory from the control plane when it has the operator API, else direct E2B. */
-export declare function resolveInventory(options: {
-    server: string;
-    repoRoot: string | null;
-}): Promise<ResolvedInventory>;
-export interface VerifySandboxesOptions {
-    repoRoot?: string;
-    server?: string;
-    token?: string;
-    json?: boolean;
-    killStale?: boolean;
-    killRun?: string;
-}
-export declare function verifySandboxesCommand(options: VerifySandboxesOptions): Promise<void>;

package/dist/commands/verify-sandboxes.js

@@ -1,352 +0,0 @@
-// E2B sandbox inventory and cleanup for the cloud verifier.
-//
-// The E2B account is SHARED with other workstreams, and the executor tags
-// sandboxes with no metadata — attribution comes entirely from the run records
-// on disk: each cell's base/head sandboxId, execution-results.json keptAlive +
-// snapshotId, bisect probe sandboxIds, and the golden-sandbox ids the event
-// stream mentions. Anything we cannot attribute is listed but NEVER killed.
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import chalk from 'chalk';
-import { discoverVerifyRoot, fetchRunFromServer, listRunDirs, loadRunFromDisk, formatAge, formatUntil, resolveServer, runDir, setVerifyToken, TERMINAL_RUN_STATUSES, verifyAuthHeaders, VerifyUnauthorizedError, } from './verify-core.js';
-const E2B_API = process.env.E2B_API_URL || 'https://api.e2b.dev';
-/** Template alias every specimen manifest provisions from. */
-const VERIFIER_TEMPLATE_ALIAS = 'haystack-cloud-verifier';
-export function resolveE2BApiKey() {
-    if (process.env.E2B_API_KEY)
-        return process.env.E2B_API_KEY;
-    const configPath = path.join(os.homedir(), '.e2b', 'config.json');
-    let config;
-    try {
-        config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-    }
-    catch (error) {
-        throw new Error(`E2B_API_KEY is not set and ${configPath} could not be read: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    if (typeof config.teamApiKey !== 'string' || !config.teamApiKey) {
-        throw new Error(`E2B_API_KEY is not set and ${configPath} has no teamApiKey`);
-    }
-    return config.teamApiKey;
-}
-export async function listE2BSandboxes(apiKey) {
-    const response = await fetch(`${E2B_API}/sandboxes`, { headers: { 'X-API-KEY': apiKey } });
-    if (!response.ok) {
-        throw new Error(`E2B list failed: HTTP ${response.status} ${await response.text().then(t => t.slice(0, 300))}`);
-    }
-    const raw = (await response.json());
-    return raw.map(entry => ({
-        sandboxId: String(entry.sandboxID ?? entry.sandboxId ?? ''),
-        templateId: String(entry.templateID ?? entry.templateId ?? ''),
-        alias: typeof entry.alias === 'string' ? entry.alias : null,
-        startedAt: typeof entry.startedAt === 'string' ? entry.startedAt : null,
-        endAt: typeof entry.endAt === 'string' ? entry.endAt : null,
-        cpuCount: typeof entry.cpuCount === 'number' ? entry.cpuCount : null,
-        memoryMB: typeof entry.memoryMB === 'number' ? entry.memoryMB : null,
-    })).filter(entry => entry.sandboxId);
-}
-export async function killE2BSandbox(apiKey, sandboxId) {
-    const response = await fetch(`${E2B_API}/sandboxes/${encodeURIComponent(sandboxId)}`, {
-        method: 'DELETE',
-        headers: { 'X-API-KEY': apiKey },
-    });
-    if (!response.ok && response.status !== 404) {
-        throw new Error(`E2B kill ${sandboxId} failed: HTTP ${response.status}`);
-    }
-}
-export function collectAttribution(repoRoot) {
-    const bySandboxId = new Map();
-    const snapshotIds = new Set();
-    const newestRunByChapter = new Map();
-    for (const entry of listRunDirs(repoRoot)) {
-        const run = loadRunFromDisk(repoRoot, entry.runId);
-        if (!run)
-            continue;
-        for (const chapter of run.chapters) {
-            if (!newestRunByChapter.has(chapter.chapterId)) {
-                newestRunByChapter.set(chapter.chapterId, run.runId);
-            }
-            const record = (sandboxId, role, cell, expiresAt) => {
-                if (!sandboxId || bySandboxId.has(sandboxId))
-                    return;
-                bySandboxId.set(sandboxId, {
-                    runId: run.runId,
-                    chapterId: chapter.chapterId,
-                    role,
-                    cell,
-                    runStatus: run.status,
-                    expiresAt: expiresAt ?? null,
-                });
-            };
-            for (const cell of chapter.riskCells ?? []) {
-                const keptAlive = cell.head.status === 'running' && Boolean(cell.head.browserUrl);
-                record(cell.head.sandboxId, keptAlive ? 'kept-alive' : 'head', `${cell.ordinal}. ${cell.title}`, cell.head.expiresAt);
-                record(cell.base.sandboxId, 'base', `${cell.ordinal}. ${cell.title}`, cell.base.expiresAt);
-            }
-            for (const probe of chapter.bisect?.probes ?? []) {
-                record(probe.sandboxId, 'bisect-probe', probe.shortSha);
-            }
-            record(chapter.bisect?.incidentProbe?.sandboxId, 'bisect-probe', 'incident');
-            // Golden sandboxes and snapshots only appear in stage artifacts/events.
-            const chapterDir = path.join(runDir(repoRoot, run.runId), 'chapters', chapter.chapterId);
-            for (const file of ['execution-results.json', 'snapshot-cleanup.json']) {
-                try {
-                    const parsed = JSON.parse(fs.readFileSync(path.join(chapterDir, file), 'utf8'));
-                    if (typeof parsed.snapshotId === 'string') {
-                        snapshotIds.add(parsed.snapshotId);
-                        snapshotIds.add(parsed.snapshotId.split(':')[0]);
-                    }
-                    const cleanupResources = Array.isArray(parsed.cleanupResources)
-                        ? parsed.cleanupResources
-                        : Array.isArray(parsed.resources)
-                            ? parsed.resources
-                            : [];
-                    for (const resource of cleanupResources) {
-                        if (resource?.kind === 'e2b-snapshot'
-                            && typeof resource.id === 'string') {
-                            snapshotIds.add(resource.id);
-                            snapshotIds.add(resource.id.split(':')[0]);
-                        }
-                    }
-                }
-                catch { /* stage artifact absent for this chapter — nothing to index */ }
-            }
-        }
-        for (const event of run.events) {
-            const golden = event.message.match(/Golden sandbox (\S+):/);
-            if (golden && !bySandboxId.has(golden[1])) {
-                bySandboxId.set(golden[1], {
-                    runId: run.runId,
-                    chapterId: event.chapterId ?? run.chapters[0]?.chapterId ?? '?',
-                    role: 'golden',
-                    cell: null,
-                    runStatus: run.status,
-                    expiresAt: null,
-                });
-            }
-        }
-    }
-    return { bySandboxId, snapshotIds, newestRunByChapter };
-}
-/**
- * A run.json can say `running` forever after the dev server restarted mid-run;
- * its mid-flight universes then leak until hard expiry and disk alone will not
- * mark them stale. The control plane reports such runs as failed — fold its
- * answer into the attribution. Unreachable server = leave non-terminal runs
- * alone (conservative: never kill what might still be alive).
- */
-export async function reconcileAttributionWithServer(index, server) {
-    const nonTerminalRuns = new Set();
-    for (const attribution of index.bySandboxId.values()) {
-        if (!TERMINAL_RUN_STATUSES.has(attribution.runStatus))
-            nonTerminalRuns.add(attribution.runId);
-    }
-    for (const runId of nonTerminalRuns) {
-        const fetched = await fetchRunFromServer(server, runId);
-        if (fetched.outcome !== 'ok')
-            continue;
-        for (const attribution of index.bySandboxId.values()) {
-            if (attribution.runId === runId)
-                attribution.runStatus = fetched.run.status;
-        }
-    }
-}
-export function annotateSandboxes(sandboxes, index) {
-    return sandboxes.map(sandbox => {
-        const attribution = index?.bySandboxId.get(sandbox.sandboxId) ?? null;
-        const templateMatch = sandbox.alias === VERIFIER_TEMPLATE_ALIAS
-            || sandbox.templateId === VERIFIER_TEMPLATE_ALIAS
-            || (index ? index.snapshotIds.has(sandbox.templateId) : false);
-        const verifier = Boolean(attribution) || templateMatch;
-        let stale = false;
-        let staleReason = null;
-        if (attribution && index) {
-            const newest = index.newestRunByChapter.get(attribution.chapterId);
-            const runTerminal = TERMINAL_RUN_STATUSES.has(attribution.runStatus);
-            if (newest && attribution.runId !== newest) {
-                stale = true;
-                staleReason = `superseded — newest ${attribution.chapterId} run is ${newest}`;
-            }
-            else if (runTerminal && (attribution.role === 'base' || attribution.role === 'head' || attribution.role === 'golden')) {
-                stale = true;
-                staleReason = `run ${attribution.runId} is ${attribution.runStatus} and should have released this ${attribution.role} sandbox`;
-            }
-            // A kept-alive universe of the newest run is the live exploration
-            // environment — intentionally running until its hard expiry.
-        }
-        return {
-            ...sandbox,
-            verifier,
-            attribution,
-            templateOnly: verifier && !attribution,
-            stale,
-            staleReason,
-            age: formatAge(sandbox.startedAt ?? undefined),
-            endsIn: sandbox.endAt ? formatUntil(sandbox.endAt) : null,
-        };
-    });
-}
-export function inventoryOf(annotated, attributionAvailable) {
-    return {
-        schema_version: '1.0.0',
-        total: annotated.length,
-        verifier_count: annotated.filter(s => s.verifier).length,
-        other_count: annotated.filter(s => !s.verifier).length,
-        stale_count: annotated.filter(s => s.stale).length,
-        attribution_available: attributionAvailable,
-        sandboxes: annotated.map(sandbox => ({
-            sandbox_id: sandbox.sandboxId,
-            template: sandbox.alias ?? sandbox.templateId,
-            verifier: sandbox.verifier,
-            stale: sandbox.stale,
-            stale_reason: sandbox.staleReason,
-            role: sandbox.attribution?.role ?? (sandbox.templateOnly ? 'verifier (unrecorded)' : null),
-            run_id: sandbox.attribution?.runId ?? null,
-            chapter_id: sandbox.attribution?.chapterId ?? null,
-            cell: sandbox.attribution?.cell ?? null,
-            age: sandbox.age,
-            ends: sandbox.endsIn,
-        })),
-    };
-}
-// ---------- server-first resolution ----------
-//
-// A control plane with the operator API owns the E2B account and the run
-// records, so it both lists (with attribution computed against live
-// orchestrator state) and kills (with the shared-account guard enforced
-// server-side). The direct-E2B path stays as the fallback for older servers
-// and for operating while the control plane is down.
-export async function fetchInventoryFromServer(server) {
-    let response;
-    try {
-        response = await fetch(`${server}/api/cloud-verifier/sandboxes`, { headers: verifyAuthHeaders() });
-    }
-    catch {
-        return null;
-    }
-    if (response.status === 401)
-        throw new VerifyUnauthorizedError(server);
-    if (!response.ok)
-        return null;
-    const body = (await response.json());
-    return Array.isArray(body.sandboxes) ? body : null;
-}
-export async function killSandboxViaServer(server, sandboxId, force) {
-    const response = await fetch(`${server}/api/cloud-verifier/sandboxes/${encodeURIComponent(sandboxId)}/kill`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', ...verifyAuthHeaders() },
-        body: JSON.stringify({ force }),
-    });
-    if (response.status === 401)
-        throw new VerifyUnauthorizedError(server);
-    if (response.ok)
-        return { ok: true };
-    let error = `HTTP ${response.status}`;
-    try {
-        error = (await response.json()).error ?? error;
-    }
-    catch { /* keep the status text */ }
-    return { ok: false, error };
-}
-/** Inventory from the control plane when it has the operator API, else direct E2B. */
-export async function resolveInventory(options) {
-    const fromServer = await fetchInventoryFromServer(options.server);
-    if (fromServer) {
-        return {
-            inventory: fromServer,
-            via: 'server',
-            kill: (sandboxId, force) => killSandboxViaServer(options.server, sandboxId, force),
-        };
-    }
-    const apiKey = resolveE2BApiKey();
-    const index = options.repoRoot ? collectAttribution(options.repoRoot) : null;
-    if (index)
-        await reconcileAttributionWithServer(index, options.server);
-    const annotated = annotateSandboxes(await listE2BSandboxes(apiKey), index);
-    const byId = new Map(annotated.map(sandbox => [sandbox.sandboxId, sandbox]));
-    return {
-        inventory: inventoryOf(annotated, Boolean(index)),
-        via: 'e2b',
-        kill: async (sandboxId, force) => {
-            const target = byId.get(sandboxId);
-            if (target && !target.verifier && !force) {
-                return { ok: false, error: 'not attributed to the verifier and the E2B account is shared (pass force to override)' };
-            }
-            try {
-                await killE2BSandbox(apiKey, sandboxId);
-                return { ok: true };
-            }
-            catch (error) {
-                return { ok: false, error: error instanceof Error ? error.message : String(error) };
-            }
-        },
-    };
-}
-export async function verifySandboxesCommand(options) {
-    setVerifyToken(options.token);
-    const server = resolveServer(options.server);
-    const repoRoot = discoverVerifyRoot(options.repoRoot);
-    const { inventory, via, kill } = await resolveInventory({ server, repoRoot });
-    const rows = inventory.sandboxes;
-    const wantKill = Boolean(options.killStale || options.killRun);
-    if (wantKill && !inventory.attribution_available) {
-        throw new Error('Cannot kill without attribution: no run records available (run from the repository, set HAYSTACK_VERIFY_REPO, or use a control plane with the operator API). The E2B account is shared — unattributed sandboxes are never killed.');
-    }
-    let targets = [];
-    if (options.killRun) {
-        targets = rows.filter(row => row.run_id === options.killRun);
-        if (targets.length === 0 && !options.json) {
-            console.log(chalk.yellow(`No live sandboxes attributed to ${options.killRun}.`));
-        }
-    }
-    else if (options.killStale) {
-        targets = rows.filter(row => row.stale);
-    }
-    const killed = [];
-    const killErrors = [];
-    for (const target of targets) {
-        const result = await kill(target.sandbox_id, false);
-        if (result.ok)
-            killed.push(target.sandbox_id);
-        else
-            killErrors.push(`${target.sandbox_id}: ${result.error}`);
-    }
-    if (options.json) {
-        process.stdout.write(`${JSON.stringify({ ...inventory, via, killed, kill_errors: killErrors }, null, 2)}\n`);
-        if (killErrors.length > 0)
-            process.exitCode = 1;
-        return;
-    }
-    if (rows.length === 0) {
-        console.log(chalk.dim('No sandboxes are running on the E2B account.'));
-        return;
-    }
-    console.log(chalk.bold(`${inventory.total} running sandboxes — ${inventory.verifier_count} verifier, ${inventory.other_count} other workstreams${inventory.stale_count ? chalk.yellow(`, ${inventory.stale_count} stale`) : ''} ${chalk.dim(`(via ${via === 'server' ? 'control plane' : 'E2B API'})`)}`));
-    if (!inventory.attribution_available) {
-        console.log(chalk.yellow('No run records available — attribution limited to template match; nothing can be killed.'));
-    }
-    console.log('');
-    for (const row of rows) {
-        const flag = killed.includes(row.sandbox_id) ? chalk.red('KILLED')
-            : row.stale ? chalk.yellow('stale')
-                : row.verifier ? chalk.green('verifier')
-                    : chalk.dim('other');
-        const who = row.run_id
-            ? `${row.run_id} ${row.role ?? ''}${row.cell ? ` · ${row.cell.slice(0, 50)}` : ''}`
-            : row.verifier ? 'verifier template, no run record' : `template ${row.template}`;
-        console.log(`  ${flag.padEnd(8)} ${row.sandbox_id}  ${chalk.dim(who)}`);
-        console.log(`           ${chalk.dim(`up ${row.age ?? '?'}${row.ends ? ` · ends ${row.ends}` : ''}${row.stale_reason ? ` · ${row.stale_reason}` : ''}`)}`);
-    }
-    if (killed.length > 0) {
-        console.log('');
-        console.log(`${chalk.green('✓')} killed ${killed.length} sandbox(es).`);
-    }
-    for (const failure of killErrors)
-        console.error(chalk.red(`kill failed — ${failure}`));
-    if (killErrors.length > 0)
-        process.exitCode = 1;
-    if (!wantKill && inventory.stale_count > 0) {
-        console.log('');
-        console.log(chalk.dim('Reclaim capacity with: haystack verify sandboxes --kill-stale (only verifier-attributed sandboxes are ever killed).'));
-    }
-}

package/dist/commands/verify.d.ts

@@ -1,28 +0,0 @@
-export declare const VERIFY_SPECIMENS: Set<string>;
-export interface VerifyOptions {
-    server?: string;
-    token?: string;
-    repo?: string;
-    base?: string;
-    head?: string;
-    intentTranscript?: string;
-    intentFile?: string;
-    idempotencyKey?: string;
-    account?: string;
-    wait?: boolean;
-    interval?: string;
-    timeout?: string;
-    json?: boolean;
-    open?: boolean;
-    /** Internal reproducibility option: execute an already-frozen plan. */
-    planSourceRunId?: string;
-}
-export interface StartRunResponse {
-    runId: string;
-    status: string;
-    resultsUrl: string;
-}
-export declare function parseStartRunResponse(raw: string): StartRunResponse;
-export declare function verifierErrorReason(raw: string, contentType: string | null): string;
-export declare function startVerificationRun(specimenArg: string | undefined, options: VerifyOptions): Promise<StartRunResponse>;
-export declare function verifyCommand(specimenArg: string | undefined, options: VerifyOptions): Promise<void>;

package/dist/commands/webhooks.d.ts

@@ -1,30 +0,0 @@
-/** currentRepo() for token-account resolution. Outside a git repo there is
- *  simply no repo context — expected for id-based commands run from anywhere,
- *  so that case stays quiet. A remote that EXISTS but isn't recognized is a
- *  different story: repo-scoped account defaults silently won't apply, so say
- *  so (classified by error type per PR007). */
-export declare function tryCurrentRepo(): string | null;
-/** Token-resolution scope for adminFetch: explicit repo wins, else the cwd's
- *  origin remote, else no scope (active account). Exported for tests. */
-export declare function resolveTokenScope(repoFullName?: string): {
-    owner: string;
-    repo: string;
-} | Record<string, never>;
-export declare function registerWebhook(opts: {
-    url: string;
-    events?: string[];
-    secretEnv?: string;
-    repo?: string;
-}): Promise<void>;
-export declare function listWebhooks(opts: {
-    repo?: string;
-    json?: boolean;
-}): Promise<void>;
-export declare function rotateWebhookSecret(id: string, repo?: string): Promise<void>;
-export declare function setWebhookEnabled(id: string, enabled: boolean, repo?: string): Promise<void>;
-export declare function listDeliveries(opts: {
-    repo?: string;
-    limit?: number;
-    json?: boolean;
-}): Promise<void>;
-export declare function replayDelivery(id: string, repo?: string): Promise<void>;

package/dist/index.d.ts

@@ -1,22 +0,0 @@
-#!/usr/bin/env node
-/**
- * Haystack CLI
- *
- * Set up your project for Haystack.
- * Automated PR review, triage, and merge queue for AI-assisted development.
- *
- * Usage:
- *   npx @haystackeditor/cli init           # Set up .haystack.json
- *   npx @haystackeditor/cli setup          # Interactive onboarding wizard
- *   npx @haystackeditor/cli status         # Check configuration
- *   npx @haystackeditor/cli login          # Authenticate with GitHub
- *   npx @haystackeditor/cli submit         # Create a PR (auto-merge or review)
- *   npx @haystackeditor/cli triage          # Check last submitted PR
- *   npx @haystackeditor/cli triage 123     # View analysis results for a PR
- *   npx @haystackeditor/cli dismiss 123    # Dismiss findings for a PR
- *   npx @haystackeditor/cli mark-reviewed 123 # Mark review as not needed
- *   npx @haystackeditor/cli request-review 123 # Tag a PR as needing human review
- *   npx @haystackeditor/cli pr-status 123  # Show PR status in Haystack pipeline
- *   npx @haystackeditor/cli config         # Manage preferences
- */
-export {};