@haystackeditor/cli 0.15.7 → 0.15.9

package/dist/assets/hooks/llm-rules-template.md

@@ -29,6 +29,8 @@ After submitting, use `haystack triage <pr-number>` to check analysis results (r
 - Do not add silent fallbacks.
 - Do not add backwards compatibility, unless you confirmed with the user first that it's desired.
 - Do not add TODOs and incomplete code unless they have been explicitly flagged to the user.
+- When the user asks for a general or systematic fix, do not satisfy it with a check that only catches the known example. Implement the requested class of protection, or explicitly say what remains unfinished.
+- Finish both sides of cross-boundary implementations. When adding a new keyed capability, mode, event, route, config value, feature flag, enum variant, or serialized field, verify and update every required consumer, producer, registry, allow-list, schema, persistence path, and delivery surface. If the existing system requires "also register it in X", do that wiring or explicitly report that it is intentionally out of scope.
 
 ## No Truncation Without Permission
 

package/dist/commands/setup.js

@@ -1032,9 +1032,10 @@ async function stepConfirm(byRepo, token) {
             // waits for the user. Step 7 ensures .entire/settings.json rode along in
             // the same commit.
             bootstrapPRs.set(repoFullName, writeResult.bootstrapPR);
-            const note = autoMerge ? ' (opened a PR)' : ' (opened a PR for you to review and merge)';
-            console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(note));
-            console.log(chalk.dim(`    ${writeResult.bootstrapPR.prUrl}`));
+            // Don't print the GitHub PR URL: the user reviews and merges from their
+            // Haystack feed, not the GitHub PR page. The feed link is the single CTA
+            // in the Next steps block below.
+            console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(' (configured)'));
         }
         catch (err) {
             ui.clearProgress();
@@ -1124,23 +1125,37 @@ async function runSetupFlow(options) {
     else {
         await stepInstallEntire(selectedRepos, token, bootstrapPRs);
     }
-    // Close the loop: point the user to their Haystack feed (the inbox/card stack
-    // where their PRs surface). Interactive users get offered a browser open; an
-    // agent gets the URL in the `result` event to surface/open as it sees fit.
+    // Close the loop with ONE prominent CTA: the Haystack feed. The Configure
+    // Haystack PR (and every PR after it) is reviewed and merged from the feed,
+    // NOT the GitHub PR page, so the feed is the only link we surface. In JSON
+    // mode these console writes go to stderr, so a driving agent instead gets the
+    // same content as `summary` in the `result` event to relay verbatim.
     const feedUrl = `${HAYSTACK_API}/inbox`;
-    console.log(chalk.bold('\n  Your Haystack feed:'));
-    console.log(`  ${chalk.cyan(feedUrl)}\n`);
+    const prs = [...bootstrapPRs.entries()].map(([repo, pr]) => ({ repo, url: pr.prUrl }));
+    // Plain-text summary an agent can print as-is (no ANSI codes).
+    const summary = [
+        'Open your Haystack feed to review and merge your Configure Haystack PR:',
+        `  ${feedUrl}`,
+    ].join('\n');
+    // Styled version for the human at a TTY.
+    console.log(chalk.green.bold('\n  Next steps\n'));
+    console.log('  Open your Haystack feed to review and merge your Configure Haystack PR:');
+    console.log(`    ${chalk.cyan(feedUrl)}\n`);
     if (ui.interactive) {
         const openFeed = await ui.confirm({ id: 'open_feed', message: 'Open your Haystack feed now?', default: true });
         if (openFeed)
             tryOpenBrowser(feedUrl);
     }
-    // Final structured outcome for non-interactive/agent callers.
+    // Final structured outcome for non-interactive/agent callers. `summary` is the
+    // ready-to-print Next steps text so a driving agent can surface it verbatim.
+    // `pullRequests` stays as structured metadata (programmatic use), but the
+    // human-facing copy points only to the feed.
     ui.result({
         status: 'complete',
         repos: selectedRepos,
-        pullRequests: [...bootstrapPRs.entries()].map(([repo, pr]) => ({ repo, url: pr.prUrl })),
+        pullRequests: prs,
         feedUrl,
+        summary,
     });
 }
 // =============================================================================

package/dist/commands/triage.js

@@ -69,38 +69,16 @@ function parsePRIdentifier(identifier) {
 // Output formatting
 // ============================================================================
 /**
- * Decide whether a finding is one the auto-fixer is already handling (and thus
- * shouldn't be re-fixed). The fixer re-derives — often paraphrases — its manifest
- * summaries rather than copying them verbatim, so exact string matching misses
- * them. This mirrors the normalized + fuzzy matching the backend uses in
- * agent/cloudflare/src/auto-fix-post-synthesis.ts (normalizeText / categoriesCompatible).
+ * True if the finding is one the auto-fixer is already handling (and thus
+ * shouldn't be re-fixed). Correlation is by exact finding id — the same stable id
+ * analysis assigns and the fixer echoes back in its manifest. We never compare
+ * summary/category text.
  */
-function normalizeText(value) {
-    return value.toLowerCase().replace(/\s+/g, ' ').trim();
-}
-/** Categories match if equal, or if one's tokens are a subset of the other's. */
-function categoriesCompatible(left, right) {
-    const a = normalizeText(left);
-    const b = normalizeText(right);
-    if (a === b)
-        return true;
-    const aTokens = a.split(/[^a-z0-9]+/).filter(Boolean);
-    const bTokens = b.split(/[^a-z0-9]+/).filter(Boolean);
-    const aSet = new Set(aTokens);
-    const bSet = new Set(bTokens);
-    return ((bTokens.length > 0 && bTokens.every((t) => aSet.has(t))) ||
-        (aTokens.length > 0 && aTokens.every((t) => bSet.has(t))));
-}
-/** True if the finding matches any item the auto-fixer is handling. */
 function isAutoFixing(finding, manifest) {
-    const items = manifest?.fixedItems ?? [];
-    if (items.length === 0)
+    if (!finding.id)
         return false;
-    const summaryKey = normalizeText(finding.summary);
-    if (summaryKey.length === 0)
-        return false;
-    return items.some((item) => normalizeText(item.summary) === summaryKey &&
-        categoriesCompatible(finding.category, item.category));
+    const items = manifest?.fixedItems ?? [];
+    return items.some((item) => item.id === finding.id);
 }
 function printRichOutput(pr, synthesis, manifest) {
     const reviewUrl = `https://haystackeditor.com/review/${pr.owner}/${pr.repo}/${pr.prNumber}`;

package/dist/triage/prompts.js

@@ -259,6 +259,7 @@ ${traceFileList}
 2. From each file, identify:
    - The user's original instruction/prompt (the first message)
    - Any follow-up instructions or corrections from the user
+   - The final effective scope after later corrections or reframes
 
 3. ${precomputedDiff ? 'Review the diff below' : `Run \`git diff ${baseBranch}...HEAD\``} to see what was actually implemented.
 
@@ -274,7 +275,11 @@ The agent implemented something DIFFERENT from what was asked:
 ### Incomplete Fulfillment
 The agent didn't finish everything that was asked:
 - User requested 3 things, agent only did 2
+- User requested a general/systematic guardrail or end-to-end behavior, but the diff only handles one known instance, one special case, or one side of the required wiring
+- User initially mentioned a known example, then clarified "not the specific case" / "the general class"; the diff still implements only the known example or category-specific check
 - Interface fields declared but never populated
+- A new keyed capability, event, route, config value, enum variant, or serialized field is referenced on one side of a boundary but the required registry, producer, consumer, schema, handler, persistence path, or delivery surface is missing
+- A change appears to work through local/dev/test defaults, mocks, or overrides, but the production wiring path needed to deliver the requested behavior was not updated
 - Functions stubbed with TODO/placeholder comments
 - Agent said "I'll skip X for now" for something the user explicitly requested
 - Tests not written when user asked for tests
@@ -297,6 +302,7 @@ Do NOT flag internal implementation choices with no observable effect (naming, f
 ### Ignored Correction
 The user gave an explicit correction or redirection and the final code does NOT honor it:
 - User said "don't use a global / use X instead / that's racy, do Y" and the agent shipped the thing it was told not to
+- User said the target is the general class rather than the specific instance, but the agent still shipped only the instance-specific implementation
 - Agent applied the correction, then quietly reverted it in a later step
 - A general later "looks good" does NOT cancel a specific earlier correction
 This is high severity by default: the user actively steered and was overridden.
@@ -322,6 +328,10 @@ Compare each concrete claim the agent made to the user against what the diff act
 - TODO, FIXME, placeholder, stub comments in new code
 - Empty function bodies or early returns
 - Interface fields that are declared but never assigned anywhere
+- Feature-specific or instance-specific checks added after the user asked for a general guardrail against a broader failure mode
+- Earlier narrow examples treated as the whole task even though later user messages broadened or generalized the requested scope
+- New string-keyed names, enum variants, serialized fields, action types, routes, events, or config keys that have no matching entry in the surrounding registry, allow-list, schema, handler, producer, consumer, or template path
+- Comments or neighboring code saying "must also register/list/wire this" where the diff updated only the reference side
 - New mechanisms (cooldowns, retries, caches, rate limits) not requested by the user
 - Decisions that drop, limit, or reshape data flowing to the output, or pick a default that changes what end-users see, with no instruction specifying it
 

package/dist/utils/analysis-api.d.ts

@@ -26,6 +26,9 @@ export interface AnalysisIssue {
     source: 'bug-detection' | 'rule-violation';
 }
 export interface SynthesisDisplayIssue {
+    /** Stable finding id (assigned at synthesis). Used to correlate with the
+     *  auto-fix manifest by exact match instead of comparing text. */
+    id?: string;
     category: string;
     summary: string;
     detail: string;
@@ -110,10 +113,12 @@ export interface AutoFixManifest {
     repo: string;
     prNumber: number;
     fixedItems: Array<{
+        id?: string;
         category: string;
         summary: string;
     }>;
     leftForReview: Array<{
+        id?: string;
         category: string;
         summary: string;
         reason: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.7",
+  "version": "0.15.9",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {