@haystackeditor/cli 0.15.31 → 0.17.0

package/dist/commands/verify-hosted.js

@@ -76,98 +76,64 @@ export function parseHostedRunState(value, expectedRunId) {
     if (headCommit && !COMMIT_SHA.test(headCommit)) {
         throw new Error('Hosted verifier response has an invalid headCommit.');
     }
-    const outputValue = response.output;
-    const output = outputValue === undefined
-        ? undefined
-        : requireRecord(outputValue, 'Hosted verifier output');
     const resultValue = response.result;
-    const fleet = response.provider === 'haystack';
-    if (response.provider !== undefined && !fleet) {
+    if (response.provider !== 'haystack') {
         throw new Error('Hosted verifier returned an unsupported provider.');
     }
-    if (fleet && response.version !== FLEET_PROJECTION_VERSION) {
+    if (response.version !== FLEET_PROJECTION_VERSION) {
         throw new Error('Hosted verifier returned an unsupported fleet projection version.');
     }
-    const result = fleet || resultValue === undefined
-        ? undefined
-        : parseHostedRunnerResult(resultValue);
     const createdAt = optionalTimestamp(response, 'createdAt');
     const completedAt = optionalTimestamp(response, 'completedAt');
     let progress;
     let fleetResult;
-    if (fleet) {
-        if (response.publicRunId !== runId || !repository || !baseCommit || !headCommit || !createdAt || output) {
-            throw new Error('Hosted fleet projection is missing its immutable run identity.');
+    if (response.publicRunId !== runId || !repository || !baseCommit || !headCommit || !createdAt) {
+        throw new Error('Hosted fleet projection is missing its immutable run identity.');
+    }
+    if (response.progress !== undefined && response.progress !== null) {
+        progress = requireRecord(response.progress, 'Hosted fleet progress');
+        if (progress.version !== 'dv-verify-progress-v1' || progress.publicRunId !== runId) {
+            throw new Error('Hosted fleet progress does not match the requested run.');
         }
-        if (response.progress !== undefined && response.progress !== null) {
-            progress = requireRecord(response.progress, 'Hosted fleet progress');
-            if (progress.version !== 'dv-verify-progress-v1' || progress.publicRunId !== runId) {
-                throw new Error('Hosted fleet progress does not match the requested run.');
-            }
-            requireString(progress, 'stage');
-            requireString(progress, 'status');
+        requireString(progress, 'stage');
+        requireString(progress, 'status');
+    }
+    if (resultValue !== undefined && resultValue !== null) {
+        fleetResult = requireRecord(resultValue, 'Hosted fleet result');
+        const mapping = requireRecord(fleetResult.mapping, 'Hosted fleet result mapping');
+        const provenance = requireRecord(fleetResult.provenance, 'Hosted fleet provenance');
+        if (fleetResult.version !== 'dv-verify-result-v1' || fleetResult.provider !== 'haystack'
+            || mapping.publicRunId !== runId || provenance.baseSha !== baseCommit || provenance.headSha !== headCommit) {
+            throw new Error('Hosted fleet result does not match the requested run and commits.');
         }
-        if (resultValue !== undefined && resultValue !== null) {
-            fleetResult = requireRecord(resultValue, 'Hosted fleet result');
-            const mapping = requireRecord(fleetResult.mapping, 'Hosted fleet result mapping');
-            const provenance = requireRecord(fleetResult.provenance, 'Hosted fleet provenance');
-            if (fleetResult.version !== 'dv-verify-result-v1' || fleetResult.provider !== 'haystack'
-                || mapping.publicRunId !== runId || provenance.baseSha !== baseCommit || provenance.headSha !== headCommit) {
-                throw new Error('Hosted fleet result does not match the requested run and commits.');
-            }
-            // CONTRACT-GAP: P0 currently couples its canonical parsers to runner-only
-            // modules outside this published CLI. The server validates the complete
-            // P0 result; the CLI only checks the fields it presents, retaining the
-            // original document instead of defining a second P0 wire contract.
-            requireString(fleetResult, 'lifecycle', /^(complete|failed|cancelled|budget-stopped|account-action)$/);
-            requireString(fleetResult, 'runHealth', /^(healthy|degraded|infrastructure-error|not-executed)$/);
-            const cleanup = requireRecord(fleetResult.cleanup, 'Hosted fleet cleanup');
-            requireString(cleanup, 'status', /^(complete|pending)$/);
-            if (!Array.isArray(cleanup.pending) || !Array.isArray(fleetResult.findings)) {
-                throw new Error('Hosted fleet result has invalid findings or cleanup.');
-            }
-            for (const value of fleetResult.findings) {
-                const finding = requireRecord(value, 'Hosted fleet finding');
-                requireString(finding, 'findingId');
-                requireString(finding, 'caseId');
-                requireString(finding, 'judgment');
-            }
-            if (fleetResult.savedChecks !== undefined) {
-                parseHostedSavedChecks(fleetResult.savedChecks, runId, headCommit);
-            }
-            requireString(provenance, 'intent', /^(user|inferred)$/);
-            if (status === 'complete' && fleetResult.lifecycle !== 'complete') {
-                throw new Error('Hosted fleet lifecycle disagrees with its completed job.');
-            }
+        // CONTRACT-GAP: P0 currently couples its canonical parsers to runner-only
+        // modules outside this published CLI. The server validates the complete
+        // P0 result; the CLI only checks the fields it presents, retaining the
+        // original document instead of defining a second P0 wire contract.
+        requireString(fleetResult, 'lifecycle', /^(complete|failed|cancelled|budget-stopped|account-action)$/);
+        requireString(fleetResult, 'runHealth', /^(healthy|degraded|infrastructure-error|not-executed)$/);
+        const cleanup = requireRecord(fleetResult.cleanup, 'Hosted fleet cleanup');
+        requireString(cleanup, 'status', /^(complete|pending)$/);
+        if (!Array.isArray(cleanup.pending) || !Array.isArray(fleetResult.findings)) {
+            throw new Error('Hosted fleet result has invalid findings or cleanup.');
         }
-        if (status === 'complete' && !fleetResult) {
-            throw new Error('Hosted fleet run completed without a result receipt.');
+        for (const value of fleetResult.findings) {
+            const finding = requireRecord(value, 'Hosted fleet finding');
+            requireString(finding, 'findingId');
+            requireString(finding, 'caseId');
+            requireString(finding, 'judgment');
         }
-    }
-    else if (status === 'complete') {
-        // Two terminal shapes exist: the Workflow receipt envelope (`output`)
-        // and the runner-queue result envelope (`result`). Exactly one must
-        // validate.
-        if (result) {
-            if (!repository || !baseCommit || !headCommit || !createdAt) {
-                throw new Error('Hosted verifier returned a complete run without a matching terminal receipt.');
-            }
+        if (fleetResult.savedChecks !== undefined) {
+            parseHostedSavedChecks(fleetResult.savedChecks, runId, headCommit);
         }
-        else if (!repository
-            || !baseCommit
-            || !headCommit
-            || !createdAt
-            || !completedAt
-            || !output
-            || output.runId !== runId
-            || output.repository !== repository
-            || output.baseCommit !== baseCommit
-            || output.headCommit !== headCommit
-            || output.sourceOfflineReady !== true
-            || output.sandboxDeleted !== true) {
-            throw new Error('Hosted verifier returned a complete run without a matching terminal receipt.');
+        requireString(provenance, 'intent', /^(user|inferred)$/);
+        if (status === 'complete' && fleetResult.lifecycle !== 'complete') {
+            throw new Error('Hosted fleet lifecycle disagrees with its completed job.');
         }
     }
+    if (status === 'complete' && !fleetResult) {
+        throw new Error('Hosted fleet run completed without a result receipt.');
+    }
     return {
         runId,
         status,
@@ -176,37 +142,13 @@ export function parseHostedRunState(value, expectedRunId) {
         headCommit,
         createdAt,
         completedAt,
-        output,
-        result,
-        ...(fleet ? { provider: 'haystack', version: FLEET_PROJECTION_VERSION, progress, fleetResult } : {}),
+        provider: 'haystack',
+        version: FLEET_PROJECTION_VERSION,
+        progress,
+        fleetResult,
         error: optionalString(response, 'error'),
     };
 }
-function parseHostedRunnerResult(value) {
-    const record = requireRecord(value, 'Hosted verifier runner result');
-    const regressionsValue = record.regressions;
-    if (typeof record.verdict !== 'string'
-        || typeof record.summary !== 'string'
-        || !Number.isInteger(record.casesTotal)
-        || !Number.isInteger(record.casesFailed)
-        || typeof record.outputLocation !== 'string'
-        || typeof record.wallSeconds !== 'number'
-        || !Array.isArray(regressionsValue)
-        || !regressionsValue.every(item => !!item && typeof item === 'object' && !Array.isArray(item)
-            && typeof item.caseId === 'string'
-            && typeof item.title === 'string')) {
-        throw new Error('Hosted verifier runner result is malformed.');
-    }
-    return {
-        verdict: record.verdict,
-        summary: record.summary,
-        casesTotal: record.casesTotal,
-        casesFailed: record.casesFailed,
-        regressions: regressionsValue,
-        outputLocation: record.outputLocation,
-        wallSeconds: record.wallSeconds,
-    };
-}
 export function parseHostedRepository(value) {
     const parts = value.split('/');
     if (parts.length !== 2
@@ -303,15 +245,11 @@ function parseHostedSavedChecks(value, runId, headSha) {
     return saved;
 }
 function savedCheckDisplay(value) {
+    // eslint-disable-next-line no-control-regex -- rejecting/stripping control characters is the point
     return String(value).replace(/[\u0000-\u001f\u007f-\u009f]/g, '');
 }
-function requireCommit(value, flag) {
-    if (typeof value !== 'string' || !COMMIT_SHA.test(value)) {
-        throw new Error(`${flag} must be an exact 40-character lowercase commit SHA.`);
-    }
-    return value;
-}
 function requireRevision(value, flag) {
+    // eslint-disable-next-line no-control-regex -- rejecting/stripping control characters is the point
     if (typeof value !== 'string' || value.length === 0 || value.length > 1_024 || /[\u0000-\u0020\u007f]/.test(value)) {
         throw new Error(`${flag} must be a non-empty Git revision of at most 1024 characters without whitespace or control characters.`);
     }
@@ -365,13 +303,9 @@ export function readHostedIntentFile(intentFile) {
         intended_outcomes: record.intended_outcomes,
     };
 }
-export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom, fleetRequest) {
+export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, intent) {
     const digest = createHash('sha256')
-        .update(JSON.stringify(fleetRequest
-        ? [fleetRequest.provider, repository, baseCommit, headCommit, fleetRequest.intent ?? null]
-        : replayPlanFrom
-            ? [repository, baseCommit, headCommit, replayPlanFrom]
-            : [repository, baseCommit, headCommit]))
+        .update(JSON.stringify(['haystack', repository, baseCommit, headCommit, intent ?? null]))
         .digest('hex');
     return `cli:${digest}`;
 }
@@ -398,7 +332,7 @@ export function hostedPollingOptions(interval, timeout, onStatus) {
     };
 }
 export async function startHostedVerification(repositoryArg, options, token) {
-    const { repository, launchBody, idempotencyKey } = prepareHostedLaunch(repositoryArg, options);
+    const { launchBody, idempotencyKey } = prepareHostedLaunch(repositoryArg, options);
     const path = '/api/agent/cloud-verifier/runs';
     const response = await fetch(haystackApiUrl(path), {
         method: 'POST',
@@ -424,49 +358,27 @@ export async function startHostedVerification(repositoryArg, options, token) {
         throw error;
     }
     const state = parseHostedRunState(await response.json());
-    if (options.provider === 'haystack' && state.provider !== 'haystack') {
-        throw new Error('Hosted verifier did not acknowledge the fleet-pinned request.');
-    }
-    return {
-        state: {
-            ...state,
-            repository: state.repository ?? repository.fullName,
-            baseCommit: state.baseCommit ?? launchBody.baseCommit,
-            headCommit: state.headCommit ?? launchBody.headCommit,
-        },
-        idempotencyKey,
-    };
+    return { state, idempotencyKey };
 }
 function prepareHostedLaunch(repositoryArg, options) {
     const repository = parseHostedRepository(repositoryArg);
-    const fleet = options.provider === 'haystack';
-    const validateRevision = fleet ? requireRevision : requireCommit;
-    const baseCommit = validateRevision(options.base, '--base');
-    const headCommit = validateRevision(options.head, '--head');
-    const intent = fleet && options.intentFile === undefined ? undefined : readHostedIntentFile(options.intentFile);
-    if (fleet && intent && [intent.problem, intent.goal, ...intent.intended_outcomes].some(value => /[\u0000-\u001f\u007f]/.test(value))) {
+    const baseCommit = requireRevision(options.base, '--base');
+    const headCommit = requireRevision(options.head, '--head');
+    const intent = options.intentFile === undefined ? undefined : readHostedIntentFile(options.intentFile);
+    // eslint-disable-next-line no-control-regex -- rejecting/stripping control characters is the point
+    if (intent && [intent.problem, intent.goal, ...intent.intended_outcomes].some(value => /[\u0000-\u001f\u007f]/.test(value))) {
         throw new Error('Fleet --intent-file fields must be single-line text without control characters.');
     }
-    const replayPlanFrom = options.replayPlanFrom;
-    if (fleet && replayPlanFrom !== undefined) {
-        throw new Error('--replay-plan-from is available through the explicit hosted start alias.');
-    }
-    if (replayPlanFrom !== undefined && !RUN_ID.test(replayPlanFrom)) {
-        throw new Error('--replay-plan-from must match cv_ followed by 48 lowercase hex characters.');
-    }
     const idempotencyKey = requireIdempotencyKey(options.idempotencyKey
-        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom, fleet ? { provider: 'haystack', intent } : undefined));
+        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, intent));
     const launchBody = {
-        ...(fleet ? { provider: 'haystack' } : {}),
+        provider: 'haystack',
         owner: repository.owner,
         repository: repository.repository,
         baseCommit,
         headCommit,
         idempotencyKey,
         ...(intent ? { intent } : {}),
-        ...(replayPlanFrom
-            ? { replayPlanFromRunId: replayPlanFrom }
-            : {}),
     };
     return { repository, launchBody, idempotencyKey };
 }
@@ -526,9 +438,8 @@ export function buildHostedJson(operation, state, extras = {}) {
             : {}),
         ...(extras.nextCommand ? { next_command: extras.nextCommand } : {}),
         ...(extras.timedOut !== undefined ? { timed_out: extras.timedOut } : {}),
-        ...(state.output ? { output: state.output } : {}),
-        ...(state.result ? { result: state.result } : {}),
-        ...(state.provider ? { provider: state.provider, version: state.version } : {}),
+        provider: state.provider,
+        version: state.version,
         ...(state.progress ? { progress: state.progress } : {}),
         ...(state.fleetResult ? { result: state.fleetResult } : {}),
         ...(state.error ? { error: state.error } : {}),
@@ -550,13 +461,11 @@ function printHostedState(operation, state, options) {
         }), null, 2)}\n`);
         return;
     }
-    const icon = state.provider === 'haystack' && state.status === 'complete'
+    const icon = state.status === 'complete'
         ? chalk.cyan('•')
-        : state.status === 'complete'
-            ? chalk.green('✓')
-            : TERMINAL_STATUSES.has(state.status)
-                ? chalk.red('✗')
-                : chalk.cyan('•');
+        : TERMINAL_STATUSES.has(state.status)
+            ? chalk.red('✗')
+            : chalk.cyan('•');
     console.log(`${icon} Hosted verification ${chalk.bold(state.runId)}: ${state.status}`);
     if (state.repository) {
         console.log(`  ${chalk.dim('Repository:')} ${state.repository}`);
@@ -564,15 +473,6 @@ function printHostedState(operation, state, options) {
     if (state.baseCommit && state.headCommit) {
         console.log(`  ${chalk.dim('Commits:')} ${state.baseCommit.slice(0, 12)} → ${state.headCommit.slice(0, 12)}`);
     }
-    if (state.result) {
-        const passed = state.result.casesTotal - state.result.casesFailed;
-        console.log(`  ${chalk.dim('Verdict:')} ${state.result.verdict} `
-            + `(${passed}/${state.result.casesTotal} cases clean, ${Math.round(state.result.wallSeconds)}s)`);
-        for (const regression of state.result.regressions) {
-            console.log(`    ${chalk.red('✗')} ${regression.caseId}: ${regression.title}`);
-        }
-        console.log(`  ${chalk.dim('Artifacts:')} ${state.result.outputLocation}`);
-    }
     if (state.progress) {
         console.log(`  ${chalk.dim('Progress:')} ${state.progress.stage} (${state.progress.status})`);
     }
@@ -657,9 +557,7 @@ export async function verifyHostedStartCommand(repositoryArg, options) {
         repo: repository.repository,
     });
     if (!options.json) {
-        console.error(chalk.dim(options.provider === 'haystack'
-            ? 'Submitting repository revisions to the hosted fleet verifier…'
-            : 'Submitting the exact commit pair to the hosted verifier…'));
+        console.error(chalk.dim('Submitting repository revisions to the hosted fleet verifier…'));
     }
     const started = await startHostedVerification(repositoryArg, options, auth.token);
     const selectedAccount = auth.token.startsWith('hsk_live_')

package/dist/commands/verify-precompute.js

@@ -7,9 +7,11 @@ import { tmpdir } from 'node:os';
 import chalk from 'chalk';
 import { NotLoggedInError, resolveAuthContext } from '../utils/auth.js';
 import { findGitRoot, parseRemoteUrl, resolveDiffBaseRef, } from '../utils/git.js';
-import { HaystackApiError, haystackJson } from '../utils/haystack-api.js';
+import { HaystackApiError, haystackJson, REPO_NOT_ENTITLED_CODE, SUBSCRIPTION_REQUIRED_CODE, } from '../utils/haystack-api.js';
 import { trackPrecomputeEvent } from '../utils/telemetry.js';
+import { findSecretsInPatch, isSecretBearingPath } from '../utils/secret-paths.js';
 import { startPrecomputeDelivery } from './precompute-delivery.js';
+import { captureCombinationSearchHook, readCombinationSearchHookStatus } from './combination-search-hook.js';
 // --hook has five seconds to capture the exact source and publish local custody.
 // Its detached sender owns the bounded network delivery and acknowledgement.
 // An explicit invocation still waits synchronously for the server response.
@@ -48,13 +50,16 @@ function remainingMs(deadline) {
 function gitOutput(args, gitRoot, deadline, options = {}) {
     const timeout = Math.max(1, Math.min(remainingMs(deadline), options.timeoutCapMs ?? HOOK_WALL_MS));
     try {
-        return execFileSync('git', args, {
+        const output = execFileSync('git', args, {
             cwd: gitRoot,
             encoding: 'utf8',
             env: options.env ?? process.env,
             stdio: ['pipe', 'pipe', 'pipe'],
             timeout,
-        }).trim();
+            ...(options.input === undefined ? {} : { input: options.input }),
+            ...(options.maxBuffer === undefined ? {} : { maxBuffer: options.maxBuffer }),
+        });
+        return options.raw ? output : output.trim();
     }
     catch {
         throw new PrecomputeFailure('Could not derive the repository snapshot.');
@@ -110,7 +115,41 @@ function deriveBaseSha(gitRoot, deadline) {
     }
     return baseSha;
 }
-function deriveWorktreeTreeSha(gitRoot, deadline) {
+// The -U0 scan text omits binary content and context, so it stays far below
+// the uploaded patch; this only guards against git's 1 MiB default.
+const SCAN_PATCH_MAX_BYTES = 256 * 1024 * 1024;
+/**
+ * Withholds secret-bearing changes from the snapshot index before the tree is
+ * written, so the tree, work commit, uploaded patch and combination-search
+ * patches all agree. A withheld path keeps its base version (or is absent when
+ * base has none). Every withheld path is named on stderr; secret values never are.
+ */
+function withholdSecretBearingChanges(gitRoot, baseSha, indexEnv, deadline) {
+    const changed = gitOutput(['diff', '--cached', '--no-renames', '--diff-filter=d', '--name-only', '-z', baseSha, '--'], gitRoot, deadline, { env: indexEnv, maxBuffer: SCAN_PATCH_MAX_BYTES, raw: true }).split('\0').filter(path => path.length > 0);
+    const withheld = new Map();
+    for (const path of changed) {
+        if (isSecretBearingPath(path))
+            withheld.set(path, 'secret-bearing file name');
+    }
+    if (changed.length > withheld.size) {
+        const patch = gitOutput(['-c', 'core.quotePath=false', 'diff', '--cached', '--no-renames', '--diff-filter=d', '-U0',
+            '--no-color', '--no-ext-diff', '--no-textconv',
+            // pathFromDiffHeader expects `a/` and `b/`; pin them so diff.noprefix
+            // or diff.mnemonicPrefix in the user's git config cannot break parsing.
+            '--src-prefix=a/', '--dst-prefix=b/', baseSha, '--'], gitRoot, deadline, { env: indexEnv, maxBuffer: SCAN_PATCH_MAX_BYTES });
+        for (const [path, pattern] of findSecretsInPatch(patch)) {
+            if (!withheld.has(path))
+                withheld.set(path, `possible secret: ${pattern}`);
+        }
+    }
+    if (withheld.size === 0)
+        return;
+    gitOutput(['reset', '-q', baseSha, '--pathspec-from-file=-', '--pathspec-file-nul'], gitRoot, deadline, { env: { ...indexEnv, GIT_LITERAL_PATHSPECS: '1' }, input: `${[...withheld.keys()].join('\0')}\0` });
+    for (const [path, reason] of withheld) {
+        process.stderr.write(`haystack: withheld ${JSON.stringify(path)} from the precompute upload (${reason}).\n`);
+    }
+}
+function deriveWorktreeTreeSha(gitRoot, baseSha, deadline) {
     const scratchDirectory = mkdtempSync(join(tmpdir(), 'haystack-precompute-index-'));
     const temporaryIndex = join(scratchDirectory, 'index');
     try {
@@ -128,6 +167,7 @@ function deriveWorktreeTreeSha(gitRoot, deadline) {
             gitOutput(['read-tree', 'HEAD'], gitRoot, deadline, { env: indexEnv });
         }
         gitOutput(['add', '-A'], gitRoot, deadline, { env: indexEnv });
+        withholdSecretBearingChanges(gitRoot, baseSha, indexEnv, deadline);
         const treeSha = gitOutput(['write-tree'], gitRoot, deadline, { env: indexEnv });
         if (!isCommitSha(treeSha)) {
             throw new PrecomputeFailure('Could not derive the working-tree snapshot.');
@@ -221,7 +261,7 @@ export async function derivePrecomputeRequest(gitRoot, owner, repository, deadli
     // make an older stop look newer than a later one.
     const observedAt = Date.now();
     const baseSha = deriveBaseSha(gitRoot, deadline);
-    const treeSha = deriveWorktreeTreeSha(gitRoot, deadline);
+    const treeSha = deriveWorktreeTreeSha(gitRoot, baseSha, deadline);
     const workCommit = deriveWorkCommit(gitRoot, baseSha, treeSha, deadline);
     const patchGzip = await buildCompressedPatch(gitRoot, baseSha, workCommit, deadline);
     const cacheKey = [
@@ -231,6 +271,7 @@ export async function derivePrecomputeRequest(gitRoot, owner, repository, deadli
         'slim',
         slimInputHash(),
     ].join('-');
+    const combinationSearch = captureCombinationSearchHook(gitRoot, `${owner}/${repository}`, baseSha, workCommit, deadline);
     return {
         treeSha,
         request: {
@@ -242,6 +283,7 @@ export async function derivePrecomputeRequest(gitRoot, owner, repository, deadli
             cacheKey,
             patchGzBase64: patchGzip.toString('base64'),
             patchSha256: createHash('sha256').update(patchGzip).digest('hex'),
+            ...(combinationSearch ? { combinationSearch } : {}),
         },
     };
 }
@@ -249,15 +291,16 @@ function precomputeResult(response) {
     if (!response || typeof response !== 'object' || Array.isArray(response)) {
         throw new PrecomputeFailure('The precompute service returned an invalid response.');
     }
-    const { status, runId, walker: rawWalker } = response;
+    const { status, runId, walker: rawWalker, search: rawSearch } = response;
     const walker = rawWalker === undefined ? undefined : readWalkerStatus(rawWalker);
+    const search = rawSearch === undefined ? undefined : readCombinationSearchHookStatus(rawSearch);
     if (status === 'queued' && typeof runId === 'string' && isRunId(runId)) {
-        return { outcome: 'enqueued', runId, ...(walker === undefined ? {} : { walker }) };
+        return { outcome: 'enqueued', runId, ...(walker === undefined ? {} : { walker }), ...(search === undefined ? {} : { search }) };
     }
     if (status === 'cached')
-        return { outcome: 'cached', ...(walker === undefined ? {} : { walker }) };
+        return { outcome: 'cached', ...(walker === undefined ? {} : { walker }), ...(search === undefined ? {} : { search }) };
     if (status === 'existing')
-        return { outcome: 'existing', ...(walker === undefined ? {} : { walker }) };
+        return { outcome: 'existing', ...(walker === undefined ? {} : { walker }), ...(search === undefined ? {} : { search }) };
     throw new PrecomputeFailure('The precompute service returned an invalid response.');
 }
 /** One authenticated submission of the already captured request. No source reads or retries. */
@@ -325,6 +368,12 @@ function normalModeFailure(error) {
         return new PrecomputeFailure('Authentication is required. Run `haystack login` first.');
     }
     if (error instanceof HaystackApiError) {
+        // Entitlement denials are not authentication problems: classifyHttpError
+        // already turned the server body into its one-line message, so show it.
+        if (error.status === 403
+            && (error.code === REPO_NOT_ENTITLED_CODE || error.code === SUBSCRIPTION_REQUIRED_CODE)) {
+            return new PrecomputeFailure(error.message);
+        }
         if (error.status === 401 || error.status === 403) {
             return new PrecomputeFailure('Authentication was rejected. Run `haystack login` and try again.');
         }
@@ -340,7 +389,7 @@ function normalModeFailure(error) {
     }
     return new PrecomputeFailure('The precompute request failed.');
 }
-function printResult(outcome, runId, walker) {
+function printResult(outcome, runId, walker, search) {
     if (outcome === 'enqueued') {
         console.log(chalk.green(`Precompute request queued${runId ? ` (${runId})` : ''}.`));
     }
@@ -360,6 +409,10 @@ function printResult(outcome, runId, walker) {
             : 'Walker unavailable: the enqueue request failed.');
     else
         console.log('Walker status was not reported by the service.');
+    if (search?.status === 'queued' || search?.status === 'existing')
+        console.log(`Browser search ${search.status} (${search.runId}).`);
+    else if (search?.status === 'unavailable' && search.reason !== 'not-configured')
+        console.log(`Browser search unavailable: ${search.reason}.`);
 }
 export async function verifyPrecomputeCommand(options) {
     const startedAt = Date.now();
@@ -421,7 +474,7 @@ export async function verifyPrecomputeCommand(options) {
             }
         }
         if (!options.hook)
-            printResult(outcome, result.runId, result.walker);
+            printResult(outcome, result.runId, result.walker, result.search);
     }
     catch (error) {
         if (!options.hook)