@haystackeditor/cli 0.15.5 → 0.15.6

package/dist/commands/setup.js

@@ -125,7 +125,7 @@ const CONFIG_COMMIT_MSG = 'chore: configure Haystack via CLI setup wizard';
 const AUTO_MERGE_LABEL = 'haystack:auto-merge';
 const ONBOARDING_BOOTSTRAP_LABEL = 'haystack:onboarding-bootstrap';
 const BOOTSTRAP_PR_TITLE = 'Configure Haystack';
-const BOOTSTRAP_PR_BODY_INTRO = 'This PR was opened automatically by the Haystack CLI setup wizard because the default branch is protected.\n\n' +
+const BOOTSTRAP_PR_BODY_INTRO = 'This PR was opened automatically by the Haystack CLI setup wizard to configure Haystack for this repo.\n\n' +
     'It adds the Haystack onboarding config:\n' +
     '- `.haystack/pr-rules.yml` — rules Haystack enforces on every PR\n' +
     '- `.haystack/review-policy.md` — path-scoped review policies + review instructions\n' +
@@ -146,47 +146,6 @@ const BOOTSTRAP_PR_OUTRO_MANUAL = 'Auto-merge is off for this repo, so this PR i
 function encodeBranchPath(branch) {
     return branch.split('/').map(encodeURIComponent).join('/');
 }
-/**
- * Is the given branch protected such that a direct commit can't land —
- * either by legacy branch protection OR a repository ruleset?
- *
- * Decided from GitHub's *structured* signals, not error-message text:
- *   - `GET /repos/{o}/{r}/branches/{b}` → `.protected` (legacy protection)
- *   - `GET /repos/{o}/{r}/rules/branches/{b}` → a `pull_request` rule means
- *     "changes must go through a PR" (rulesets)
- *
- * Called on the write-failure path: a 409/422 from the direct commit tells
- * us *that* something rejected the write; this tells us *whether* it was
- * protection (→ open a bootstrap PR) vs. a genuine bad request (→ surface
- * the error). If the probe itself can't be completed we throw — guessing
- * from message wording is exactly the brittleness we're avoiding here.
- */
-async function isBranchProtected(owner, repo, branch, token) {
-    const headers = ghHeaders(token);
-    const enc = encodeBranchPath(branch);
-    // Legacy branch protection — the `protected` boolean is authoritative.
-    const branchRes = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/branches/${enc}`, { headers });
-    if (branchRes.ok) {
-        const data = (await branchRes.json());
-        if (data.protected === true)
-            return true;
-    }
-    else if (branchRes.status !== 404) {
-        throw new Error(`Couldn't check branch protection: ${branchRes.status} — ${await branchRes.text()}`);
-    }
-    // Repository rulesets — `rules/branches` collapses every active rule on
-    // the branch into one list. A `pull_request` rule = "must merge via PR".
-    const rulesRes = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/rules/branches/${enc}`, { headers });
-    if (rulesRes.ok) {
-        const rules = (await rulesRes.json());
-        if (rules.some((r) => r.type === 'pull_request'))
-            return true;
-    }
-    else if (rulesRes.status !== 404) {
-        throw new Error(`Couldn't check repository rulesets: ${rulesRes.status} — ${await rulesRes.text()}`);
-    }
-    return false;
-}
 function ghHeaders(token) {
     return {
         Authorization: `Bearer ${token}`,
@@ -381,56 +340,6 @@ async function addBootstrapLabels(owner, repo, prNumber, prUrl, token, autoMerge
         `Add these labels to the PR manually so Haystack picks it up: ${labels.join(', ')}. ` +
         `Don't re-run \`haystack setup\` — that opens a duplicate PR.`);
 }
-/** Wraps a contents-API write failure with its HTTP status so the caller can
- *  distinguish a protection rejection (409/422 → PR fallback) from a genuine
- *  error (→ surface it). */
-class GitHubWriteError extends Error {
-    status;
-    body;
-    constructor(status, body) {
-        super(`GitHub write failed: ${status}`);
-        this.status = status;
-        this.body = body;
-        this.name = 'GitHubWriteError';
-    }
-}
-/** Read the blob SHA of an existing file (needed to update it). Non-OK (incl.
- *  404 = file doesn't exist yet) returns null; the subsequent PUT then creates
- *  the file, and surfaces a real error if the write itself fails. */
-async function fetchFileSha(owner, repo, path, token) {
-    const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/contents/${path}`, { headers: ghHeaders(token) });
-    if (!res.ok) {
-        if (res.status !== 404) {
-            trackError('haystack_setup_fetch_file_sha_failed', {
-                owner,
-                repo,
-                path,
-                status: res.status,
-            });
-        }
-        return null;
-    }
-    const data = (await res.json());
-    return data.sha ?? null;
-}
-/** PUT a single file to the default branch via the contents API. Throws
- *  GitHubWriteError on any non-OK response so the caller can branch on status. */
-async function putFile(owner, repo, path, content, message, sha, token) {
-    const body = {
-        message,
-        content: Buffer.from(content).toString('base64'),
-    };
-    if (sha)
-        body.sha = sha;
-    const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/contents/${path}`, {
-        method: 'PUT',
-        headers: ghHeaders(token),
-        body: JSON.stringify(body),
-    });
-    if (!res.ok) {
-        throw new GitHubWriteError(res.status, await res.text().catch(() => ''));
-    }
-}
 /**
  * Protected-branch fallback: build ONE commit containing ALL the onboarding
  * files (`configFiles` + `.entire/settings.json`) via the Git Data API, CREATE
@@ -495,50 +404,17 @@ async function openBootstrapConfigPR(owner, repo, configFiles, token, defaultBra
     return { prUrl: pr.html_url, entireSettingsBundled };
 }
 /**
- * Write the onboarding config files to a repo. Tries a direct commit per file
- * to the default branch first; on a protected-branch / ruleset rejection
- * (409/422 confirmed by a structured protection probe) falls back to ONE
- * bootstrap PR containing all files. Mirrors the web wizard's
- * writeOnboardingFiles.
- *
- * Returns `{ bootstrapPR }` when the PR fallback was used (so the caller can
- * thread the branch into step 7), `{}` on clean direct commits.
+ * Write the onboarding config files to a repo by ALWAYS opening a PR
+ * (branch → one commit → PR) — never a direct commit to the default branch.
+ * Matches the web wizard (#1936): a silent push to someone's default branch is
+ * jarring and hard to undo, so onboarding always goes through a "Configure
+ * Haystack" PR. The PR is enrolled for auto-merge only when the user kept
+ * auto-merge on; otherwise it waits for them to review and merge it.
  */
 async function writeOnboardingFilesToRepo(owner, repo, files, autoMergeEnabled, token) {
-    // Look up existing SHAs once on the default branch so updates to files that
-    // already exist carry the right sha. Done before any write so a mid-loop
-    // failure doesn't leave us guessing.
-    const shaByPath = new Map();
-    for (const f of files) {
-        shaByPath.set(f.path, await fetchFileSha(owner, repo, f.path, token));
-    }
-    let successfulWrites = 0;
-    try {
-        for (const f of files) {
-            await putFile(owner, repo, f.path, f.content, f.message, shaByPath.get(f.path) ?? null, token);
-            successfulWrites++;
-        }
-        return {};
-    }
-    catch (err) {
-        // Only a 409/422 can be a protection rejection. Anything else (auth, 404,
-        // 5xx, network) is a genuine error — surface it.
-        const status = err instanceof GitHubWriteError ? err.status : 0;
-        if (status !== 409 && status !== 422)
-            throw err;
-        if (successfulWrites > 0) {
-            throw err;
-        }
-        // Probe GitHub's *structured* protection signals to decide: protection
-        // (→ PR fallback) vs. a genuine bad request / sha conflict (→ surface the
-        // error). This replaces brittle error-message substring matching.
-        const defaultBranch = await getDefaultBranch(owner, repo, token);
-        if (!(await isBranchProtected(owner, repo, defaultBranch, token))) {
-            throw err;
-        }
-        const bootstrapPR = await openBootstrapConfigPR(owner, repo, files, token, defaultBranch, autoMergeEnabled);
-        return { bootstrapPR };
-    }
+    const defaultBranch = await getDefaultBranch(owner, repo, token);
+    const bootstrapPR = await openBootstrapConfigPR(owner, repo, files, token, defaultBranch, autoMergeEnabled);
+    return { bootstrapPR };
 }
 const SCAN_POLL_INTERVAL_MS = 1500;
 // A run still marked `running` but whose KV state hasn't been touched for this
@@ -864,8 +740,6 @@ async function stepSelectRepos(token) {
 const PR_RULES_PATH = '.haystack/pr-rules.yml';
 const REVIEW_POLICY_PATH = '.haystack/review-policy.md';
 const HAYSTACK_CONFIG_PATH = '.haystack.json';
-const RULES_COMMIT_MSG = 'chore: configure Haystack rules via CLI setup wizard';
-const POLICY_COMMIT_MSG = 'chore: add review policies via CLI setup wizard';
 /**
  * Scan each selected repo with one unified scan and collect the proposed
  * rules / policies / instructions per repo. A failed scan for one repo records
@@ -1093,13 +967,13 @@ function buildOnboardingFiles(result, autoMerge) {
     const files = [];
     const prRules = buildPrRules(result.rules);
     if (prRules.length > 0) {
-        files.push({ path: PR_RULES_PATH, content: serializePrRulesYaml(prRules), message: RULES_COMMIT_MSG });
+        files.push({ path: PR_RULES_PATH, content: serializePrRulesYaml(prRules) });
     }
     const reviewPolicyMd = buildReviewPolicyMarkdown(result.policies, result.instructions);
     if (reviewPolicyMd) {
-        files.push({ path: REVIEW_POLICY_PATH, content: reviewPolicyMd, message: POLICY_COMMIT_MSG });
+        files.push({ path: REVIEW_POLICY_PATH, content: reviewPolicyMd });
     }
-    files.push({ path: HAYSTACK_CONFIG_PATH, content: buildHaystackConfigJson(autoMerge), message: CONFIG_COMMIT_MSG });
+    files.push({ path: HAYSTACK_CONFIG_PATH, content: buildHaystackConfigJson(autoMerge) });
     return files;
 }
 async function stepConfirm(byRepo, token) {
@@ -1146,24 +1020,17 @@ async function stepConfirm(byRepo, token) {
         const result = byRepo.get(repoFullName);
         const files = buildOnboardingFiles(result, autoMerge);
         try {
-            ui.progress(`Writing to ${repoFullName}...`);
+            ui.progress(`Opening Configure Haystack PR for ${repoFullName}...`);
             const writeResult = await writeOnboardingFilesToRepo(owner, repo, files, autoMerge, token);
             ui.clearProgress();
-            if (writeResult.bootstrapPR) {
-                // Default branch was protected — config landed in a bootstrap PR. With
-                // auto-merge on, Haystack merges it once its labels are processed; with
-                // auto-merge off it waits for the user. Step 7 ensures
-                // .entire/settings.json is on the same PR.
-                bootstrapPRs.set(repoFullName, writeResult.bootstrapPR);
-                const note = autoMerge
-                    ? ' (default branch protected — opened a PR)'
-                    : ' (default branch protected — opened a PR for you to review and merge)';
-                console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(note));
-                console.log(chalk.dim(`    ${writeResult.bootstrapPR.prUrl}`));
-            }
-            else {
-                console.log(chalk.green(`  ✓ ${repoFullName}`));
-            }
+            // Onboarding always opens a PR (never a direct commit). With auto-merge on,
+            // Haystack merges it once its labels are processed; with auto-merge off it
+            // waits for the user. Step 7 ensures .entire/settings.json rode along in
+            // the same commit.
+            bootstrapPRs.set(repoFullName, writeResult.bootstrapPR);
+            const note = autoMerge ? ' (opened a PR)' : ' (opened a PR for you to review and merge)';
+            console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(note));
+            console.log(chalk.dim(`    ${writeResult.bootstrapPR.prUrl}`));
         }
         catch (err) {
             ui.clearProgress();
@@ -1242,11 +1109,11 @@ async function runSetupFlow(options) {
         ui.result({ status: 'cancelled' });
         return;
     }
-    // Step 7: Install Entire CLI (session tracking). bootstrapPRs tells it
-    // which repos had a protected default branch so it can commit
-    // .entire/settings.json to the same PR instead of a doomed direct PUT.
-    // --skip-entire skips the whole step (binary install, hooks, AND the remote
-    // .entire/settings.json write) — not just the install prompt.
+    // Step 7: Install Entire CLI (session tracking). bootstrapPRs tells it which
+    // repos got a Configure Haystack PR (all of them) so it can report that
+    // .entire/settings.json rode along in that PR's commit.
+    // --skip-entire skips the whole step (binary install + hooks) — not just the
+    // install prompt.
     if (options.skipEntire) {
         console.log(chalk.dim('  Skipping session tracking (--skip-entire).\n'));
     }
@@ -1344,53 +1211,6 @@ async function installEntireBinary() {
         return false;
     }
 }
-/**
- * Write .entire/settings.json directly to the default branch.
- *
- * This is the DIRECT path only. Repos whose default branch is protected
- * never reach here — step 6's openBootstrapConfigPR already bundled
- * .entire/settings.json into the bootstrap PR's single commit (on a ~ALL
- * ruleset you can't add it as a later commit, so it must ride along in the
- * branch-creation commit). stepInstallEntire skips this call for those
- * repos. So if we're here, step 6 proved the default branch accepts a
- * direct commit.
- */
-async function configureEntireSettingsViaAPI(repoFullName, token) {
-    const [owner, repo] = repoFullName.split('/');
-    const result = await buildEntireSettingsContent(repoFullName, token);
-    // null → file already exists unchanged; nothing to write.
-    if (result === null)
-        return;
-    // buildEntireSettingsContent already fetched the file — reuse its
-    // content + existingSha. A second GET here would (a) be redundant and
-    // (b) on a transient non-404 failure fall back to existingSha=null,
-    // turning the PUT into a create that GitHub rejects 422 — masking the
-    // real read error. (Non-404 read failures already threw upstream.)
-    const { content, existingSha } = result;
-    const headers = ghHeaders(token);
-    const body = {
-        message: 'chore: configure Entire CLI settings',
-        content: Buffer.from(content).toString('base64'),
-    };
-    if (existingSha)
-        body.sha = existingSha;
-    const putResp = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/contents/.entire/settings.json`, {
-        method: 'PUT',
-        headers,
-        body: JSON.stringify(body),
-    });
-    if (!putResp.ok) {
-        const errText = await putResp.text().catch(() => '');
-        const error = new Error(`GitHub API ${putResp.status}: ${errText}`);
-        trackError('entire_settings_write_failed', {
-            error_message: error.message,
-            repo: repoFullName,
-            status: putResp.status,
-            had_existing: !!existingSha,
-        });
-        throw error;
-    }
-}
 async function stepInstallEntire(selectedRepos, token, bootstrapPRs) {
     console.log(chalk.bold('\n  Step 7: Session tracking (Entire CLI)\n'));
     const status = isEntireInstalled();
@@ -1429,48 +1249,28 @@ async function stepInstallEntire(selectedRepos, token, bootstrapPRs) {
     if (!userConsented) {
         console.log(chalk.dim('  Skipping session tracking.\n'));
     }
-    // Configure .entire/settings.json on each repo via GitHub API
-    // (works even if binary install failed — settings are remote; skip if user declined).
-    // Repos whose default branch was protected went the bootstrap-PR route in
-    // step 6, which ALREADY bundled .entire/settings.json into that PR's
-    // single commit (on a ~ALL ruleset it can't be added as a later commit).
-    // So we skip those here and only direct-write the non-protected repos.
+    // Onboarding always opens a PR, and .entire/settings.json rides along in that
+    // PR's single commit (see openBootstrapConfigPR), so there's nothing to write
+    // separately here — just report what landed.
     if (userConsented) {
-        let configured = 0;
         let bundled = 0;
         for (const repoFullName of selectedRepos) {
             const bootstrapPR = bootstrapPRs.get(repoFullName);
-            if (bootstrapPR) {
-                if (bootstrapPR.entireSettingsBundled) {
-                    // .entire/settings.json made it into the bootstrap PR's commit.
-                    console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(' (in bootstrap PR)'));
-                    bundled++;
-                }
-                else {
-                    // The bootstrap PR shipped the config files but not
-                    // .entire/settings.json — its optional read failed transiently. Don't
-                    // count it as configured; the warning was already shown when the PR
-                    // was opened.
-                    console.log(chalk.yellow(`  ⚠ ${repoFullName}`) +
-                        chalk.dim(' — bootstrap PR has config files only; re-run setup to add session tracking'));
-                }
-                continue;
+            if (bootstrapPR?.entireSettingsBundled) {
+                console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(' (in PR)'));
+                bundled++;
             }
-            try {
-                ui.progress(`Configuring ${repoFullName}...`);
-                await configureEntireSettingsViaAPI(repoFullName, token);
-                ui.clearProgress();
-                console.log(chalk.green(`  ✓ ${repoFullName}`));
-                configured++;
-            }
-            catch (err) {
-                ui.clearProgress();
-                console.log(chalk.yellow(`  ⚠ ${repoFullName}: ${err instanceof Error ? err.message : err}`));
+            else {
+                // The PR shipped the config files but not .entire/settings.json — its
+                // optional read failed transiently. The warning was already shown when
+                // the PR was opened.
+                console.log(chalk.yellow(`  ⚠ ${repoFullName}`) +
+                    chalk.dim(' — PR has config files only; re-run setup to add session tracking'));
             }
         }
-        if (configured > 0 || bundled > 0) {
-            console.log(chalk.green(`\n  ✓ Session tracking configured on ${configured + bundled} repo(s) (transcripts auto-compacted)\n`));
-            trackSetupEvent('entire_configured', { configured: configured + bundled, total: selectedRepos.length });
+        if (bundled > 0) {
+            console.log(chalk.green(`\n  ✓ Session tracking configured on ${bundled} repo(s) (transcripts auto-compacted)\n`));
+            trackSetupEvent('entire_configured', { configured: bundled, total: selectedRepos.length });
         }
         else {
             console.log(chalk.yellow('\n  ⚠ Could not configure session tracking on any repos.\n'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.5",
+  "version": "0.15.6",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {