@haystackeditor/cli 0.15.5 → 0.15.7

package/dist/commands/setup.js

@@ -56,6 +56,10 @@ function buildAnswerMap(options) {
             answers.upgrade_entire = true;
         if (!('install_hooks' in answers))
             answers.install_hooks = true;
+        // Don't auto-launch a browser in an unattended --yes run; the feed URL is
+        // still printed and returned in the result for the caller to open.
+        if (!('open_feed' in answers))
+            answers.open_feed = false;
     }
     return answers;
 }
@@ -125,7 +129,7 @@ const CONFIG_COMMIT_MSG = 'chore: configure Haystack via CLI setup wizard';
 const AUTO_MERGE_LABEL = 'haystack:auto-merge';
 const ONBOARDING_BOOTSTRAP_LABEL = 'haystack:onboarding-bootstrap';
 const BOOTSTRAP_PR_TITLE = 'Configure Haystack';
-const BOOTSTRAP_PR_BODY_INTRO = 'This PR was opened automatically by the Haystack CLI setup wizard because the default branch is protected.\n\n' +
+const BOOTSTRAP_PR_BODY_INTRO = 'This PR was opened automatically by the Haystack CLI setup wizard to configure Haystack for this repo.\n\n' +
     'It adds the Haystack onboarding config:\n' +
     '- `.haystack/pr-rules.yml` — rules Haystack enforces on every PR\n' +
     '- `.haystack/review-policy.md` — path-scoped review policies + review instructions\n' +
@@ -146,47 +150,6 @@ const BOOTSTRAP_PR_OUTRO_MANUAL = 'Auto-merge is off for this repo, so this PR i
 function encodeBranchPath(branch) {
     return branch.split('/').map(encodeURIComponent).join('/');
 }
-/**
- * Is the given branch protected such that a direct commit can't land —
- * either by legacy branch protection OR a repository ruleset?
- *
- * Decided from GitHub's *structured* signals, not error-message text:
- *   - `GET /repos/{o}/{r}/branches/{b}` → `.protected` (legacy protection)
- *   - `GET /repos/{o}/{r}/rules/branches/{b}` → a `pull_request` rule means
- *     "changes must go through a PR" (rulesets)
- *
- * Called on the write-failure path: a 409/422 from the direct commit tells
- * us *that* something rejected the write; this tells us *whether* it was
- * protection (→ open a bootstrap PR) vs. a genuine bad request (→ surface
- * the error). If the probe itself can't be completed we throw — guessing
- * from message wording is exactly the brittleness we're avoiding here.
- */
-async function isBranchProtected(owner, repo, branch, token) {
-    const headers = ghHeaders(token);
-    const enc = encodeBranchPath(branch);
-    // Legacy branch protection — the `protected` boolean is authoritative.
-    const branchRes = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/branches/${enc}`, { headers });
-    if (branchRes.ok) {
-        const data = (await branchRes.json());
-        if (data.protected === true)
-            return true;
-    }
-    else if (branchRes.status !== 404) {
-        throw new Error(`Couldn't check branch protection: ${branchRes.status} — ${await branchRes.text()}`);
-    }
-    // Repository rulesets — `rules/branches` collapses every active rule on
-    // the branch into one list. A `pull_request` rule = "must merge via PR".
-    const rulesRes = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/rules/branches/${enc}`, { headers });
-    if (rulesRes.ok) {
-        const rules = (await rulesRes.json());
-        if (rules.some((r) => r.type === 'pull_request'))
-            return true;
-    }
-    else if (rulesRes.status !== 404) {
-        throw new Error(`Couldn't check repository rulesets: ${rulesRes.status} — ${await rulesRes.text()}`);
-    }
-    return false;
-}
 function ghHeaders(token) {
     return {
         Authorization: `Bearer ${token}`,
@@ -381,56 +344,6 @@ async function addBootstrapLabels(owner, repo, prNumber, prUrl, token, autoMerge
         `Add these labels to the PR manually so Haystack picks it up: ${labels.join(', ')}. ` +
         `Don't re-run \`haystack setup\` — that opens a duplicate PR.`);
 }
-/** Wraps a contents-API write failure with its HTTP status so the caller can
- *  distinguish a protection rejection (409/422 → PR fallback) from a genuine
- *  error (→ surface it). */
-class GitHubWriteError extends Error {
-    status;
-    body;
-    constructor(status, body) {
-        super(`GitHub write failed: ${status}`);
-        this.status = status;
-        this.body = body;
-        this.name = 'GitHubWriteError';
-    }
-}
-/** Read the blob SHA of an existing file (needed to update it). Non-OK (incl.
- *  404 = file doesn't exist yet) returns null; the subsequent PUT then creates
- *  the file, and surfaces a real error if the write itself fails. */
-async function fetchFileSha(owner, repo, path, token) {
-    const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/contents/${path}`, { headers: ghHeaders(token) });
-    if (!res.ok) {
-        if (res.status !== 404) {
-            trackError('haystack_setup_fetch_file_sha_failed', {
-                owner,
-                repo,
-                path,
-                status: res.status,
-            });
-        }
-        return null;
-    }
-    const data = (await res.json());
-    return data.sha ?? null;
-}
-/** PUT a single file to the default branch via the contents API. Throws
- *  GitHubWriteError on any non-OK response so the caller can branch on status. */
-async function putFile(owner, repo, path, content, message, sha, token) {
-    const body = {
-        message,
-        content: Buffer.from(content).toString('base64'),
-    };
-    if (sha)
-        body.sha = sha;
-    const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/contents/${path}`, {
-        method: 'PUT',
-        headers: ghHeaders(token),
-        body: JSON.stringify(body),
-    });
-    if (!res.ok) {
-        throw new GitHubWriteError(res.status, await res.text().catch(() => ''));
-    }
-}
 /**
  * Protected-branch fallback: build ONE commit containing ALL the onboarding
  * files (`configFiles` + `.entire/settings.json`) via the Git Data API, CREATE
@@ -495,50 +408,17 @@ async function openBootstrapConfigPR(owner, repo, configFiles, token, defaultBra
     return { prUrl: pr.html_url, entireSettingsBundled };
 }
 /**
- * Write the onboarding config files to a repo. Tries a direct commit per file
- * to the default branch first; on a protected-branch / ruleset rejection
- * (409/422 confirmed by a structured protection probe) falls back to ONE
- * bootstrap PR containing all files. Mirrors the web wizard's
- * writeOnboardingFiles.
- *
- * Returns `{ bootstrapPR }` when the PR fallback was used (so the caller can
- * thread the branch into step 7), `{}` on clean direct commits.
+ * Write the onboarding config files to a repo by ALWAYS opening a PR
+ * (branch → one commit → PR) — never a direct commit to the default branch.
+ * Matches the web wizard (#1936): a silent push to someone's default branch is
+ * jarring and hard to undo, so onboarding always goes through a "Configure
+ * Haystack" PR. The PR is enrolled for auto-merge only when the user kept
+ * auto-merge on; otherwise it waits for them to review and merge it.
  */
 async function writeOnboardingFilesToRepo(owner, repo, files, autoMergeEnabled, token) {
-    // Look up existing SHAs once on the default branch so updates to files that
-    // already exist carry the right sha. Done before any write so a mid-loop
-    // failure doesn't leave us guessing.
-    const shaByPath = new Map();
-    for (const f of files) {
-        shaByPath.set(f.path, await fetchFileSha(owner, repo, f.path, token));
-    }
-    let successfulWrites = 0;
-    try {
-        for (const f of files) {
-            await putFile(owner, repo, f.path, f.content, f.message, shaByPath.get(f.path) ?? null, token);
-            successfulWrites++;
-        }
-        return {};
-    }
-    catch (err) {
-        // Only a 409/422 can be a protection rejection. Anything else (auth, 404,
-        // 5xx, network) is a genuine error — surface it.
-        const status = err instanceof GitHubWriteError ? err.status : 0;
-        if (status !== 409 && status !== 422)
-            throw err;
-        if (successfulWrites > 0) {
-            throw err;
-        }
-        // Probe GitHub's *structured* protection signals to decide: protection
-        // (→ PR fallback) vs. a genuine bad request / sha conflict (→ surface the
-        // error). This replaces brittle error-message substring matching.
-        const defaultBranch = await getDefaultBranch(owner, repo, token);
-        if (!(await isBranchProtected(owner, repo, defaultBranch, token))) {
-            throw err;
-        }
-        const bootstrapPR = await openBootstrapConfigPR(owner, repo, files, token, defaultBranch, autoMergeEnabled);
-        return { bootstrapPR };
-    }
+    const defaultBranch = await getDefaultBranch(owner, repo, token);
+    const bootstrapPR = await openBootstrapConfigPR(owner, repo, files, token, defaultBranch, autoMergeEnabled);
+    return { bootstrapPR };
 }
 const SCAN_POLL_INTERVAL_MS = 1500;
 // A run still marked `running` but whose KV state hasn't been touched for this
@@ -864,8 +744,6 @@ async function stepSelectRepos(token) {
 const PR_RULES_PATH = '.haystack/pr-rules.yml';
 const REVIEW_POLICY_PATH = '.haystack/review-policy.md';
 const HAYSTACK_CONFIG_PATH = '.haystack.json';
-const RULES_COMMIT_MSG = 'chore: configure Haystack rules via CLI setup wizard';
-const POLICY_COMMIT_MSG = 'chore: add review policies via CLI setup wizard';
 /**
  * Scan each selected repo with one unified scan and collect the proposed
  * rules / policies / instructions per repo. A failed scan for one repo records
@@ -1093,13 +971,13 @@ function buildOnboardingFiles(result, autoMerge) {
     const files = [];
     const prRules = buildPrRules(result.rules);
     if (prRules.length > 0) {
-        files.push({ path: PR_RULES_PATH, content: serializePrRulesYaml(prRules), message: RULES_COMMIT_MSG });
+        files.push({ path: PR_RULES_PATH, content: serializePrRulesYaml(prRules) });
     }
     const reviewPolicyMd = buildReviewPolicyMarkdown(result.policies, result.instructions);
     if (reviewPolicyMd) {
-        files.push({ path: REVIEW_POLICY_PATH, content: reviewPolicyMd, message: POLICY_COMMIT_MSG });
+        files.push({ path: REVIEW_POLICY_PATH, content: reviewPolicyMd });
     }
-    files.push({ path: HAYSTACK_CONFIG_PATH, content: buildHaystackConfigJson(autoMerge), message: CONFIG_COMMIT_MSG });
+    files.push({ path: HAYSTACK_CONFIG_PATH, content: buildHaystackConfigJson(autoMerge) });
     return files;
 }
 async function stepConfirm(byRepo, token) {
@@ -1146,24 +1024,17 @@ async function stepConfirm(byRepo, token) {
         const result = byRepo.get(repoFullName);
         const files = buildOnboardingFiles(result, autoMerge);
         try {
-            ui.progress(`Writing to ${repoFullName}...`);
+            ui.progress(`Opening Configure Haystack PR for ${repoFullName}...`);
             const writeResult = await writeOnboardingFilesToRepo(owner, repo, files, autoMerge, token);
             ui.clearProgress();
-            if (writeResult.bootstrapPR) {
-                // Default branch was protected — config landed in a bootstrap PR. With
-                // auto-merge on, Haystack merges it once its labels are processed; with
-                // auto-merge off it waits for the user. Step 7 ensures
-                // .entire/settings.json is on the same PR.
-                bootstrapPRs.set(repoFullName, writeResult.bootstrapPR);
-                const note = autoMerge
-                    ? ' (default branch protected — opened a PR)'
-                    : ' (default branch protected — opened a PR for you to review and merge)';
-                console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(note));
-                console.log(chalk.dim(`    ${writeResult.bootstrapPR.prUrl}`));
-            }
-            else {
-                console.log(chalk.green(`  ✓ ${repoFullName}`));
-            }
+            // Onboarding always opens a PR (never a direct commit). With auto-merge on,
+            // Haystack merges it once its labels are processed; with auto-merge off it
+            // waits for the user. Step 7 ensures .entire/settings.json rode along in
+            // the same commit.
+            bootstrapPRs.set(repoFullName, writeResult.bootstrapPR);
+            const note = autoMerge ? ' (opened a PR)' : ' (opened a PR for you to review and merge)';
+            console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(note));
+            console.log(chalk.dim(`    ${writeResult.bootstrapPR.prUrl}`));
         }
         catch (err) {
             ui.clearProgress();
@@ -1242,22 +1113,34 @@ async function runSetupFlow(options) {
         ui.result({ status: 'cancelled' });
         return;
     }
-    // Step 7: Install Entire CLI (session tracking). bootstrapPRs tells it
-    // which repos had a protected default branch so it can commit
-    // .entire/settings.json to the same PR instead of a doomed direct PUT.
-    // --skip-entire skips the whole step (binary install, hooks, AND the remote
-    // .entire/settings.json write) — not just the install prompt.
+    // Step 7: Install Entire CLI (session tracking). bootstrapPRs tells it which
+    // repos got a Configure Haystack PR (all of them) so it can report that
+    // .entire/settings.json rode along in that PR's commit.
+    // --skip-entire skips the whole step (binary install + hooks) — not just the
+    // install prompt.
     if (options.skipEntire) {
         console.log(chalk.dim('  Skipping session tracking (--skip-entire).\n'));
     }
     else {
         await stepInstallEntire(selectedRepos, token, bootstrapPRs);
     }
+    // Close the loop: point the user to their Haystack feed (the inbox/card stack
+    // where their PRs surface). Interactive users get offered a browser open; an
+    // agent gets the URL in the `result` event to surface/open as it sees fit.
+    const feedUrl = `${HAYSTACK_API}/inbox`;
+    console.log(chalk.bold('\n  Your Haystack feed:'));
+    console.log(`  ${chalk.cyan(feedUrl)}\n`);
+    if (ui.interactive) {
+        const openFeed = await ui.confirm({ id: 'open_feed', message: 'Open your Haystack feed now?', default: true });
+        if (openFeed)
+            tryOpenBrowser(feedUrl);
+    }
     // Final structured outcome for non-interactive/agent callers.
     ui.result({
         status: 'complete',
         repos: selectedRepos,
         pullRequests: [...bootstrapPRs.entries()].map(([repo, pr]) => ({ repo, url: pr.prUrl })),
+        feedUrl,
     });
 }
 // =============================================================================
@@ -1344,53 +1227,6 @@ async function installEntireBinary() {
         return false;
     }
 }
-/**
- * Write .entire/settings.json directly to the default branch.
- *
- * This is the DIRECT path only. Repos whose default branch is protected
- * never reach here — step 6's openBootstrapConfigPR already bundled
- * .entire/settings.json into the bootstrap PR's single commit (on a ~ALL
- * ruleset you can't add it as a later commit, so it must ride along in the
- * branch-creation commit). stepInstallEntire skips this call for those
- * repos. So if we're here, step 6 proved the default branch accepts a
- * direct commit.
- */
-async function configureEntireSettingsViaAPI(repoFullName, token) {
-    const [owner, repo] = repoFullName.split('/');
-    const result = await buildEntireSettingsContent(repoFullName, token);
-    // null → file already exists unchanged; nothing to write.
-    if (result === null)
-        return;
-    // buildEntireSettingsContent already fetched the file — reuse its
-    // content + existingSha. A second GET here would (a) be redundant and
-    // (b) on a transient non-404 failure fall back to existingSha=null,
-    // turning the PUT into a create that GitHub rejects 422 — masking the
-    // real read error. (Non-404 read failures already threw upstream.)
-    const { content, existingSha } = result;
-    const headers = ghHeaders(token);
-    const body = {
-        message: 'chore: configure Entire CLI settings',
-        content: Buffer.from(content).toString('base64'),
-    };
-    if (existingSha)
-        body.sha = existingSha;
-    const putResp = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/contents/.entire/settings.json`, {
-        method: 'PUT',
-        headers,
-        body: JSON.stringify(body),
-    });
-    if (!putResp.ok) {
-        const errText = await putResp.text().catch(() => '');
-        const error = new Error(`GitHub API ${putResp.status}: ${errText}`);
-        trackError('entire_settings_write_failed', {
-            error_message: error.message,
-            repo: repoFullName,
-            status: putResp.status,
-            had_existing: !!existingSha,
-        });
-        throw error;
-    }
-}
 async function stepInstallEntire(selectedRepos, token, bootstrapPRs) {
     console.log(chalk.bold('\n  Step 7: Session tracking (Entire CLI)\n'));
     const status = isEntireInstalled();
@@ -1429,48 +1265,28 @@ async function stepInstallEntire(selectedRepos, token, bootstrapPRs) {
     if (!userConsented) {
         console.log(chalk.dim('  Skipping session tracking.\n'));
     }
-    // Configure .entire/settings.json on each repo via GitHub API
-    // (works even if binary install failed — settings are remote; skip if user declined).
-    // Repos whose default branch was protected went the bootstrap-PR route in
-    // step 6, which ALREADY bundled .entire/settings.json into that PR's
-    // single commit (on a ~ALL ruleset it can't be added as a later commit).
-    // So we skip those here and only direct-write the non-protected repos.
+    // Onboarding always opens a PR, and .entire/settings.json rides along in that
+    // PR's single commit (see openBootstrapConfigPR), so there's nothing to write
+    // separately here — just report what landed.
     if (userConsented) {
-        let configured = 0;
         let bundled = 0;
         for (const repoFullName of selectedRepos) {
             const bootstrapPR = bootstrapPRs.get(repoFullName);
-            if (bootstrapPR) {
-                if (bootstrapPR.entireSettingsBundled) {
-                    // .entire/settings.json made it into the bootstrap PR's commit.
-                    console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(' (in bootstrap PR)'));
-                    bundled++;
-                }
-                else {
-                    // The bootstrap PR shipped the config files but not
-                    // .entire/settings.json — its optional read failed transiently. Don't
-                    // count it as configured; the warning was already shown when the PR
-                    // was opened.
-                    console.log(chalk.yellow(`  ⚠ ${repoFullName}`) +
-                        chalk.dim(' — bootstrap PR has config files only; re-run setup to add session tracking'));
-                }
-                continue;
+            if (bootstrapPR?.entireSettingsBundled) {
+                console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(' (in PR)'));
+                bundled++;
             }
-            try {
-                ui.progress(`Configuring ${repoFullName}...`);
-                await configureEntireSettingsViaAPI(repoFullName, token);
-                ui.clearProgress();
-                console.log(chalk.green(`  ✓ ${repoFullName}`));
-                configured++;
-            }
-            catch (err) {
-                ui.clearProgress();
-                console.log(chalk.yellow(`  ⚠ ${repoFullName}: ${err instanceof Error ? err.message : err}`));
+            else {
+                // The PR shipped the config files but not .entire/settings.json — its
+                // optional read failed transiently. The warning was already shown when
+                // the PR was opened.
+                console.log(chalk.yellow(`  ⚠ ${repoFullName}`) +
+                    chalk.dim(' — PR has config files only; re-run setup to add session tracking'));
             }
         }
-        if (configured > 0 || bundled > 0) {
-            console.log(chalk.green(`\n  ✓ Session tracking configured on ${configured + bundled} repo(s) (transcripts auto-compacted)\n`));
-            trackSetupEvent('entire_configured', { configured: configured + bundled, total: selectedRepos.length });
+        if (bundled > 0) {
+            console.log(chalk.green(`\n  ✓ Session tracking configured on ${bundled} repo(s) (transcripts auto-compacted)\n`));
+            trackSetupEvent('entire_configured', { configured: bundled, total: selectedRepos.length });
         }
         else {
             console.log(chalk.yellow('\n  ⚠ Could not configure session tracking on any repos.\n'));

package/dist/commands/triage.js

@@ -68,20 +68,54 @@ function parsePRIdentifier(identifier) {
 // ============================================================================
 // Output formatting
 // ============================================================================
+/**
+ * Decide whether a finding is one the auto-fixer is already handling (and thus
+ * shouldn't be re-fixed). The fixer re-derives — often paraphrases — its manifest
+ * summaries rather than copying them verbatim, so exact string matching misses
+ * them. This mirrors the normalized + fuzzy matching the backend uses in
+ * agent/cloudflare/src/auto-fix-post-synthesis.ts (normalizeText / categoriesCompatible).
+ */
+function normalizeText(value) {
+    return value.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+/** Categories match if equal, or if one's tokens are a subset of the other's. */
+function categoriesCompatible(left, right) {
+    const a = normalizeText(left);
+    const b = normalizeText(right);
+    if (a === b)
+        return true;
+    const aTokens = a.split(/[^a-z0-9]+/).filter(Boolean);
+    const bTokens = b.split(/[^a-z0-9]+/).filter(Boolean);
+    const aSet = new Set(aTokens);
+    const bSet = new Set(bTokens);
+    return ((bTokens.length > 0 && bTokens.every((t) => aSet.has(t))) ||
+        (aTokens.length > 0 && aTokens.every((t) => bSet.has(t))));
+}
+/** True if the finding matches any item the auto-fixer is handling. */
+function isAutoFixing(finding, manifest) {
+    const items = manifest?.fixedItems ?? [];
+    if (items.length === 0)
+        return false;
+    const summaryKey = normalizeText(finding.summary);
+    if (summaryKey.length === 0)
+        return false;
+    return items.some((item) => normalizeText(item.summary) === summaryKey &&
+        categoriesCompatible(finding.category, item.category));
+}
 function printRichOutput(pr, synthesis, manifest) {
     const reviewUrl = `https://haystackeditor.com/review/${pr.owner}/${pr.repo}/${pr.prNumber}`;
     console.log(`\n  ${chalk.bold(`Haystack Triage: ${pr.owner}/${pr.repo}#${pr.prNumber}`)}\n`);
     // Auto-fixer status — what's being fixed vs what it skipped
     if (manifest && (manifest.fixedItems.length > 0 || manifest.leftForReview.length > 0)) {
         if (manifest.fixedItems.length > 0) {
-            console.log(chalk.bold('  Auto-fixer is handling:\n'));
+            console.log(chalk.bold('  Auto-fixer is handling these (leave them alone):\n'));
             for (const item of manifest.fixedItems) {
                 console.log(`    - [${item.category}] ${item.summary}`);
             }
-            console.log('');
+            console.log(`  ${chalk.dim("Don't fix these. The auto-fixer is already on them and will push its own commit.")}\n`);
         }
         if (manifest.leftForReview.length > 0) {
-            console.log(chalk.bold('  Auto-fixer skipped:\n'));
+            console.log(chalk.bold('  Auto-fixer skipped these (they need you):\n'));
             for (const item of manifest.leftForReview) {
                 console.log(`    - [${item.category}] ${item.summary}`);
                 console.log(`      ${chalk.dim(item.reason)}`);
@@ -89,10 +123,13 @@ function printRichOutput(pr, synthesis, manifest) {
             console.log('');
         }
     }
-    // Findings — the actionable output for agents
-    const findings = synthesis.synthesisDisplay || [];
+    // Findings — the actionable output for agents. Exclude anything the auto-fixer
+    // is already handling so the agent doesn't duplicate (and fight) its work.
+    const allFindings = synthesis.synthesisDisplay || [];
+    const findings = allFindings.filter((f) => !isAutoFixing(f, manifest));
+    const fixingCount = manifest?.fixedItems?.length ?? 0;
     if (findings.length > 0) {
-        console.log(chalk.bold('  Findings:\n'));
+        console.log(chalk.bold('  Findings to address:\n'));
         for (let i = 0; i < findings.length; i++) {
             const finding = findings[i];
             const sourceTag = finding.source ? ` (${finding.source})` : '';
@@ -112,7 +149,11 @@ function printRichOutput(pr, synthesis, manifest) {
             console.log('');
         }
     }
-    else if (!manifest || manifest.fixedItems.length === 0) {
+    else if (fixingCount > 0 && allFindings.length > 0) {
+        // Every finding is being auto-fixed — nothing left for the agent.
+        console.log(chalk.dim('  Nothing to address. Every finding is being auto-fixed (see above).\n'));
+    }
+    else {
         console.log(chalk.dim('  No findings.\n'));
     }
     console.log(`  ${chalk.dim(reviewUrl)}\n`);
@@ -123,6 +164,7 @@ function printJsonOutput(pr, synthesis, manifest) {
         repo: pr.repo,
         prNumber: pr.prNumber,
         rating: synthesis.haystackRating,
+        // Issues the auto-fixer is already on — leave these alone, do not re-fix.
         autoFixerHandling: manifest?.fixedItems ?? [],
         autoFixerSkipped: manifest?.leftForReview ?? [],
         findings: (synthesis.synthesisDisplay || []).map((f) => ({
@@ -131,6 +173,8 @@ function printJsonOutput(pr, synthesis, manifest) {
             detail: f.detail,
             agentFixPrompt: f.agentFixPrompt || null,
             source: f.source || null,
+            // True when the auto-fixer is handling this finding — don't fix it yourself.
+            autoFixing: isAutoFixing(f, manifest),
         })),
     };
     console.log(JSON.stringify(output, null, 2));
@@ -159,16 +203,19 @@ function printHookOutput(pr, synthesis, manifest, status) {
         console.log(`[Haystack] ${label}: Analysis in progress...`);
         return;
     }
-    const findings = synthesis.synthesisDisplay || [];
     const stars = ratingStars(synthesis.haystackRating);
     const fixingCount = manifest?.fixedItems?.length ?? 0;
-    if (findings.length === 0 && fixingCount === 0) {
+    // Only count findings the auto-fixer is NOT handling \u2014 those are what need the user.
+    const actionable = (synthesis.synthesisDisplay || []).filter((f) => !isAutoFixing(f, manifest));
+    if (actionable.length === 0 && fixingCount === 0) {
         console.log(`[Haystack] \u2705 ${label} ${stars}: Good to merge`);
     }
+    else if (actionable.length === 0) {
+        // Everything is being auto-fixed \u2014 nothing for the user to do.
+        console.log(`[Haystack] \u2705 ${label} ${stars}: ${fixingCount} being auto-fixed, nothing for you to do`);
+    }
     else {
-        const parts = [];
-        if (findings.length > 0)
-            parts.push(`${findings.length} finding(s)`);
+        const parts = [`${actionable.length} finding(s)`];
         if (fixingCount > 0)
             parts.push(`${fixingCount} being auto-fixed`);
         console.log(`[Haystack] \u26A0\uFE0F  ${label} ${stars}: Needs your input (${parts.join(', ')})`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.5",
+  "version": "0.15.7",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {