@haystackeditor/cli 0.15.6 → 0.15.8

package/dist/assets/hooks/llm-rules-template.md

@@ -29,6 +29,8 @@ After submitting, use `haystack triage <pr-number>` to check analysis results (r
 - Do not add silent fallbacks.
 - Do not add backwards compatibility, unless you confirmed with the user first that it's desired.
 - Do not add TODOs and incomplete code unless they have been explicitly flagged to the user.
+- When the user asks for a general or systematic fix, do not satisfy it with a check that only catches the known example. Implement the requested class of protection, or explicitly say what remains unfinished.
+- Finish both sides of cross-boundary implementations. When adding a new keyed capability, mode, event, route, config value, feature flag, enum variant, or serialized field, verify and update every required consumer, producer, registry, allow-list, schema, persistence path, and delivery surface. If the existing system requires "also register it in X", do that wiring or explicitly report that it is intentionally out of scope.
 
 ## No Truncation Without Permission
 

package/dist/commands/setup.js

@@ -56,6 +56,10 @@ function buildAnswerMap(options) {
             answers.upgrade_entire = true;
         if (!('install_hooks' in answers))
             answers.install_hooks = true;
+        // Don't auto-launch a browser in an unattended --yes run; the feed URL is
+        // still printed and returned in the result for the caller to open.
+        if (!('open_feed' in answers))
+            answers.open_feed = false;
     }
     return answers;
 }
@@ -1120,11 +1124,51 @@ async function runSetupFlow(options) {
     else {
         await stepInstallEntire(selectedRepos, token, bootstrapPRs);
     }
-    // Final structured outcome for non-interactive/agent callers.
+    // Close the loop with ONE prominent "Next steps" block. The two things that
+    // actually matter next (merge the config PR, then open the feed) land here
+    // together, not dimmed and not scattered mid-run, so a human scanning the
+    // terminal can't miss them. In JSON mode these console writes go to stderr,
+    // so a driving agent instead gets the same content as `summary` in the
+    // `result` event to relay verbatim.
+    const feedUrl = `${HAYSTACK_API}/inbox`;
+    const prs = [...bootstrapPRs.entries()].map(([repo, pr]) => ({ repo, url: pr.prUrl }));
+    const prLabel = prs.length === 1
+        ? 'Review and merge your Configure Haystack PR:'
+        : 'Review and merge your Configure Haystack PRs:';
+    // Plain-text summary an agent can print as-is (no ANSI codes).
+    const summaryLines = [];
+    if (prs.length > 0) {
+        summaryLines.push(prLabel);
+        for (const { repo, url } of prs)
+            summaryLines.push(`  ${repo}: ${url}`);
+        summaryLines.push('');
+    }
+    summaryLines.push('Then open your Haystack feed (where your PRs surface for review):');
+    summaryLines.push(`  ${feedUrl}`);
+    const summary = summaryLines.join('\n');
+    // Styled version for the human at a TTY.
+    console.log(chalk.green.bold('\n  Next steps\n'));
+    if (prs.length > 0) {
+        console.log(`  ${prLabel}`);
+        for (const { repo, url } of prs)
+            console.log(`    ${chalk.bold(repo)}  ${chalk.cyan(url)}`);
+        console.log('');
+    }
+    console.log('  Then open your Haystack feed (where your PRs surface for review):');
+    console.log(`    ${chalk.cyan(feedUrl)}\n`);
+    if (ui.interactive) {
+        const openFeed = await ui.confirm({ id: 'open_feed', message: 'Open your Haystack feed now?', default: true });
+        if (openFeed)
+            tryOpenBrowser(feedUrl);
+    }
+    // Final structured outcome for non-interactive/agent callers. `summary` is the
+    // ready-to-print Next steps text so a driving agent can surface it verbatim.
     ui.result({
         status: 'complete',
         repos: selectedRepos,
-        pullRequests: [...bootstrapPRs.entries()].map(([repo, pr]) => ({ repo, url: pr.prUrl })),
+        pullRequests: prs,
+        feedUrl,
+        summary,
     });
 }
 // =============================================================================

package/dist/commands/triage.js

@@ -68,20 +68,32 @@ function parsePRIdentifier(identifier) {
 // ============================================================================
 // Output formatting
 // ============================================================================
+/**
+ * True if the finding is one the auto-fixer is already handling (and thus
+ * shouldn't be re-fixed). Correlation is by exact finding id — the same stable id
+ * analysis assigns and the fixer echoes back in its manifest. We never compare
+ * summary/category text.
+ */
+function isAutoFixing(finding, manifest) {
+    if (!finding.id)
+        return false;
+    const items = manifest?.fixedItems ?? [];
+    return items.some((item) => item.id === finding.id);
+}
 function printRichOutput(pr, synthesis, manifest) {
     const reviewUrl = `https://haystackeditor.com/review/${pr.owner}/${pr.repo}/${pr.prNumber}`;
     console.log(`\n  ${chalk.bold(`Haystack Triage: ${pr.owner}/${pr.repo}#${pr.prNumber}`)}\n`);
     // Auto-fixer status — what's being fixed vs what it skipped
     if (manifest && (manifest.fixedItems.length > 0 || manifest.leftForReview.length > 0)) {
         if (manifest.fixedItems.length > 0) {
-            console.log(chalk.bold('  Auto-fixer is handling:\n'));
+            console.log(chalk.bold('  Auto-fixer is handling these (leave them alone):\n'));
             for (const item of manifest.fixedItems) {
                 console.log(`    - [${item.category}] ${item.summary}`);
             }
-            console.log('');
+            console.log(`  ${chalk.dim("Don't fix these. The auto-fixer is already on them and will push its own commit.")}\n`);
         }
         if (manifest.leftForReview.length > 0) {
-            console.log(chalk.bold('  Auto-fixer skipped:\n'));
+            console.log(chalk.bold('  Auto-fixer skipped these (they need you):\n'));
             for (const item of manifest.leftForReview) {
                 console.log(`    - [${item.category}] ${item.summary}`);
                 console.log(`      ${chalk.dim(item.reason)}`);
@@ -89,10 +101,13 @@ function printRichOutput(pr, synthesis, manifest) {
             console.log('');
         }
     }
-    // Findings — the actionable output for agents
-    const findings = synthesis.synthesisDisplay || [];
+    // Findings — the actionable output for agents. Exclude anything the auto-fixer
+    // is already handling so the agent doesn't duplicate (and fight) its work.
+    const allFindings = synthesis.synthesisDisplay || [];
+    const findings = allFindings.filter((f) => !isAutoFixing(f, manifest));
+    const fixingCount = manifest?.fixedItems?.length ?? 0;
     if (findings.length > 0) {
-        console.log(chalk.bold('  Findings:\n'));
+        console.log(chalk.bold('  Findings to address:\n'));
         for (let i = 0; i < findings.length; i++) {
             const finding = findings[i];
             const sourceTag = finding.source ? ` (${finding.source})` : '';
@@ -112,7 +127,11 @@ function printRichOutput(pr, synthesis, manifest) {
             console.log('');
         }
     }
-    else if (!manifest || manifest.fixedItems.length === 0) {
+    else if (fixingCount > 0 && allFindings.length > 0) {
+        // Every finding is being auto-fixed — nothing left for the agent.
+        console.log(chalk.dim('  Nothing to address. Every finding is being auto-fixed (see above).\n'));
+    }
+    else {
         console.log(chalk.dim('  No findings.\n'));
     }
     console.log(`  ${chalk.dim(reviewUrl)}\n`);
@@ -123,6 +142,7 @@ function printJsonOutput(pr, synthesis, manifest) {
         repo: pr.repo,
         prNumber: pr.prNumber,
         rating: synthesis.haystackRating,
+        // Issues the auto-fixer is already on — leave these alone, do not re-fix.
         autoFixerHandling: manifest?.fixedItems ?? [],
         autoFixerSkipped: manifest?.leftForReview ?? [],
         findings: (synthesis.synthesisDisplay || []).map((f) => ({
@@ -131,6 +151,8 @@ function printJsonOutput(pr, synthesis, manifest) {
             detail: f.detail,
             agentFixPrompt: f.agentFixPrompt || null,
             source: f.source || null,
+            // True when the auto-fixer is handling this finding — don't fix it yourself.
+            autoFixing: isAutoFixing(f, manifest),
         })),
     };
     console.log(JSON.stringify(output, null, 2));
@@ -159,16 +181,19 @@ function printHookOutput(pr, synthesis, manifest, status) {
         console.log(`[Haystack] ${label}: Analysis in progress...`);
         return;
     }
-    const findings = synthesis.synthesisDisplay || [];
     const stars = ratingStars(synthesis.haystackRating);
     const fixingCount = manifest?.fixedItems?.length ?? 0;
-    if (findings.length === 0 && fixingCount === 0) {
+    // Only count findings the auto-fixer is NOT handling \u2014 those are what need the user.
+    const actionable = (synthesis.synthesisDisplay || []).filter((f) => !isAutoFixing(f, manifest));
+    if (actionable.length === 0 && fixingCount === 0) {
         console.log(`[Haystack] \u2705 ${label} ${stars}: Good to merge`);
     }
+    else if (actionable.length === 0) {
+        // Everything is being auto-fixed \u2014 nothing for the user to do.
+        console.log(`[Haystack] \u2705 ${label} ${stars}: ${fixingCount} being auto-fixed, nothing for you to do`);
+    }
     else {
-        const parts = [];
-        if (findings.length > 0)
-            parts.push(`${findings.length} finding(s)`);
+        const parts = [`${actionable.length} finding(s)`];
         if (fixingCount > 0)
             parts.push(`${fixingCount} being auto-fixed`);
         console.log(`[Haystack] \u26A0\uFE0F  ${label} ${stars}: Needs your input (${parts.join(', ')})`);

package/dist/triage/prompts.js

@@ -259,6 +259,7 @@ ${traceFileList}
 2. From each file, identify:
    - The user's original instruction/prompt (the first message)
    - Any follow-up instructions or corrections from the user
+   - The final effective scope after later corrections or reframes
 
 3. ${precomputedDiff ? 'Review the diff below' : `Run \`git diff ${baseBranch}...HEAD\``} to see what was actually implemented.
 
@@ -274,7 +275,11 @@ The agent implemented something DIFFERENT from what was asked:
 ### Incomplete Fulfillment
 The agent didn't finish everything that was asked:
 - User requested 3 things, agent only did 2
+- User requested a general/systematic guardrail or end-to-end behavior, but the diff only handles one known instance, one special case, or one side of the required wiring
+- User initially mentioned a known example, then clarified "not the specific case" / "the general class"; the diff still implements only the known example or category-specific check
 - Interface fields declared but never populated
+- A new keyed capability, event, route, config value, enum variant, or serialized field is referenced on one side of a boundary but the required registry, producer, consumer, schema, handler, persistence path, or delivery surface is missing
+- A change appears to work through local/dev/test defaults, mocks, or overrides, but the production wiring path needed to deliver the requested behavior was not updated
 - Functions stubbed with TODO/placeholder comments
 - Agent said "I'll skip X for now" for something the user explicitly requested
 - Tests not written when user asked for tests
@@ -297,6 +302,7 @@ Do NOT flag internal implementation choices with no observable effect (naming, f
 ### Ignored Correction
 The user gave an explicit correction or redirection and the final code does NOT honor it:
 - User said "don't use a global / use X instead / that's racy, do Y" and the agent shipped the thing it was told not to
+- User said the target is the general class rather than the specific instance, but the agent still shipped only the instance-specific implementation
 - Agent applied the correction, then quietly reverted it in a later step
 - A general later "looks good" does NOT cancel a specific earlier correction
 This is high severity by default: the user actively steered and was overridden.
@@ -322,6 +328,10 @@ Compare each concrete claim the agent made to the user against what the diff act
 - TODO, FIXME, placeholder, stub comments in new code
 - Empty function bodies or early returns
 - Interface fields that are declared but never assigned anywhere
+- Feature-specific or instance-specific checks added after the user asked for a general guardrail against a broader failure mode
+- Earlier narrow examples treated as the whole task even though later user messages broadened or generalized the requested scope
+- New string-keyed names, enum variants, serialized fields, action types, routes, events, or config keys that have no matching entry in the surrounding registry, allow-list, schema, handler, producer, consumer, or template path
+- Comments or neighboring code saying "must also register/list/wire this" where the diff updated only the reference side
 - New mechanisms (cooldowns, retries, caches, rate limits) not requested by the user
 - Decisions that drop, limit, or reshape data flowing to the output, or pick a default that changes what end-users see, with no instruction specifying it
 

package/dist/utils/analysis-api.d.ts

@@ -26,6 +26,9 @@ export interface AnalysisIssue {
     source: 'bug-detection' | 'rule-violation';
 }
 export interface SynthesisDisplayIssue {
+    /** Stable finding id (assigned at synthesis). Used to correlate with the
+     *  auto-fix manifest by exact match instead of comparing text. */
+    id?: string;
     category: string;
     summary: string;
     detail: string;
@@ -110,10 +113,12 @@ export interface AutoFixManifest {
     repo: string;
     prNumber: number;
     fixedItems: Array<{
+        id?: string;
         category: string;
         summary: string;
     }>;
     leftForReview: Array<{
+        id?: string;
         category: string;
         summary: string;
         reason: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.6",
+  "version": "0.15.8",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {