@haystackeditor/cli 0.16.0 → 0.17.1

package/dist/commands/case-batch.js

@@ -16,7 +16,7 @@ import { dirname, isAbsolute, resolve, sep } from 'node:path';
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { classifyHttpError, haystackApiUrl } from '../utils/haystack-api.js';
+import { classifyHttpError, HaystackApiError, haystackApiUrl } from '../utils/haystack-api.js';
 import { boundedCaseBatchJson, buildCaseBatchRequest, CASE_BATCH_MAX_CASES, CASE_BATCH_MAX_CONCURRENT_CASES, CASE_BATCH_MAX_INPUT_BYTES, CASE_BATCH_MAX_CASE_WALL_MS, CASE_BATCH_MAX_TOTAL_BUDGET_MS, CASE_BATCH_MIN_CASE_WALL_MS, CASE_BATCH_MIN_TOTAL_BUDGET_MS, CaseBatchRequestValidationError, CaseBatchResponseError, isJsonObject, isTerminalCaseBatchStatus, parseCaseBatchCommit, parseCaseBatchIdempotencyKey, parseCaseBatchLimits, parseCaseBatchRepository, parseCaseBatchSnapshot, parseCaseBatchSource, parseCaseBatchWorld, parseProductCases, } from './case-batch-contract.js';
 /** The CLI gateway mount. The same worker handlers are `/v1/case-batches` and
  * `/api/cloud-verifier/case-batches`; CLI callers use the agent gateway, as
@@ -155,6 +155,9 @@ export function prepareCaseBatchSubmission(options) {
     const headCommit = parseCaseBatchCommit(options.head, '--head');
     const baseWorld = options.baseWorld === undefined ? undefined : parseCaseBatchWorld(options.baseWorld, '--base-world');
     const headWorld = options.headWorld === undefined ? undefined : parseCaseBatchWorld(options.headWorld, '--head-world');
+    if (options.driverBundle !== undefined && !/^[0-9a-f]{64}$/u.test(options.driverBundle))
+        throw new CaseBatchRequestValidationError('--driver-bundle must be the resident probe bundle sha256 (64 lowercase hex).');
+    const driver = options.driverBundle === undefined ? undefined : { mode: 'resident', bundleSha256: options.driverBundle };
     const cases = parseProductCases(readJsonFile(options.cases, '--cases'));
     const combinations = boundedCaseBatchJson(readJsonFile(options.combinations, '--combinations'), 'combination space');
     const limits = parseCaseBatchLimits({
@@ -165,6 +168,10 @@ export function prepareCaseBatchSubmission(options) {
         maxConcurrentCases: flagInteger(options.maxConcurrent, Math.min(cases.length, CASE_BATCH_MAX_CONCURRENT_CASES), '--max-concurrent', 1, CASE_BATCH_MAX_CONCURRENT_CASES),
         perCaseWallMs: flagInteger(options.perCaseWallMs, DEFAULT_PER_CASE_WALL_MS, '--per-case-wall-ms', CASE_BATCH_MIN_CASE_WALL_MS, CASE_BATCH_MAX_CASE_WALL_MS),
         totalBudgetMs: flagInteger(options.totalBudgetMs, DEFAULT_TOTAL_BUDGET_MS, '--total-budget-ms', CASE_BATCH_MIN_TOTAL_BUDGET_MS, CASE_BATCH_MAX_TOTAL_BUDGET_MS),
+        // Absent unless given: an absent settle is the contract's 0 and leaves the request as before.
+        ...(options.warmSettleMs === undefined ? {} : {
+            warmSettleMs: flagInteger(options.warmSettleMs, 0, '--warm-settle-ms', 0, CASE_BATCH_MAX_CASE_WALL_MS),
+        }),
     });
     const source = options.sourcePatch === undefined
         ? undefined
@@ -175,6 +182,7 @@ export function prepareCaseBatchSubmission(options) {
         headCommit,
         baseWorld: baseWorld ?? null,
         headWorld: headWorld ?? null,
+        driver: driver ?? null,
         combinations,
         cases,
         limits,
@@ -188,6 +196,7 @@ export function prepareCaseBatchSubmission(options) {
         idempotencyKey,
         baseWorld,
         headWorld,
+        driver,
         combinations: combinations,
         cases,
         limits,
@@ -195,24 +204,65 @@ export function prepareCaseBatchSubmission(options) {
     });
     return { repository, request, caseCount: cases.length, limits };
 }
-export async function caseBatchSubmitCommand(options) {
+/** A refused submission: the HTTP answer, and the gateway's stable reason when it gave one
+ * (`world-pair-locked`, `idempotency-conflict`, `runner-unavailable`, ...). Callers switch on
+ * `reason`, never on the message. */
+export class CaseBatchAdmissionRefusedError extends HaystackApiError {
+    reason;
+    constructor(refusal, reason) {
+        super(refusal.status, refusal.message, refusal.code);
+        this.name = 'CaseBatchAdmissionRefusedError';
+        this.reason = reason;
+    }
+}
+/** `case-batch submit` as a library call: the same validation, the same login bearer and the same
+ * request. A caller that submits many batches (the product-fuzz search) runs this in its own
+ * process, so every request after the first reuses one warm connection instead of paying for a
+ * new process and a new TLS session per call. */
+export async function submitCaseBatch(options) {
     // Validate every local input before touching credentials or the network.
     const prepared = prepareCaseBatchSubmission(options);
     const { auth } = await authFor(prepared.repository.fullName, options.account);
-    if (!options.json) {
-        console.error(chalk.dim(`Submitting ${prepared.caseCount} cases to the hosted coordinator…`));
+    const response = await gatewayFetch(GATEWAY, auth.token, { method: 'POST', body: JSON.stringify(prepared.request) });
+    if (!response.ok) {
+        const copy = response.clone();
+        const refusal = await classifyHttpError(response, `Haystack API ${GATEWAY}`);
+        let reason = null;
+        try {
+            const body = await copy.json();
+            if (isJsonObject(body) && typeof body.reason === 'string')
+                reason = body.reason;
+        }
+        catch {
+            // Not JSON: the refusal above already carries the status and the readable part of the body.
+        }
+        throw new CaseBatchAdmissionRefusedError(refusal, reason);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch (error) {
+        throw new CaseBatchResponseError(`Case batch service returned a body that is not JSON: ${error instanceof Error ? error.message : String(error)}`);
     }
-    const { status, body } = await gatewayJson(GATEWAY, auth.token, {
-        method: 'POST',
-        body: JSON.stringify(prepared.request),
-    });
     if (!isJsonObject(body) || typeof body.runId !== 'string' || !RUN_ID.test(body.runId)) {
         throw new CaseBatchResponseError('Case batch admission did not return a run id.');
     }
-    const runId = body.runId;
     // The search route answers 202 for a newly admitted run and 200 for an
     // identical replay of an admitted idempotency key.
-    const admitted = status === 200 ? 'existing' : 'created';
+    return { runId: body.runId, admitted: response.status === 200 ? 'existing' : 'created', prepared };
+}
+/** One bounded status read as a library call, with the bearer `case-batch status` would use. */
+export async function readCaseBatchStatus(runId, repository, account) {
+    requireRunId(runId);
+    const { repository: parsed, auth } = await authFor(repository, account);
+    return readCaseBatch(runId, parsed.fullName, auth.token);
+}
+export async function caseBatchSubmitCommand(options) {
+    if (!options.json) {
+        console.error(chalk.dim('Submitting cases to the hosted coordinator…'));
+    }
+    const { runId, admitted, prepared } = await submitCaseBatch(options);
     const nextCommand = `haystack case-batch status ${runId} --repository ${prepared.repository.fullName} --watch`;
     if (options.json) {
         process.stdout.write(`${JSON.stringify(withSchema('case-batch', {
@@ -228,6 +278,7 @@ export async function caseBatchSubmitCommand(options) {
                 max_concurrent_cases: prepared.limits.maxConcurrentCases,
                 per_case_wall_ms: prepared.limits.perCaseWallMs,
                 total_budget_ms: prepared.limits.totalBudgetMs,
+                ...(prepared.limits.warmSettleMs === undefined ? {} : { warm_settle_ms: prepared.limits.warmSettleMs }),
             },
             ...(prepared.request.baseWorld ? { base_world: prepared.request.baseWorld } : {}),
             ...(prepared.request.headWorld ? { head_world: prepared.request.headWorld } : {}),
@@ -334,6 +385,12 @@ function caseJson(record) {
         case_bundle_path: outcome ? outcome.caseBundlePath : null,
         differing_outcomes: outcome ? outcome.differingOutcomes : [],
         detail: outcome ? outcome.detail : null,
+        execution_path: outcome?.executionPath ?? null,
+        // v4: null when the outcome carries none (before v4, or a settled comparison's `failure`).
+        node_ids: outcome?.nodeIds ? { base1: outcome.nodeIds.base1, head: outcome.nodeIds.head } : null,
+        failure: outcome?.failure ? { source: outcome.failure.source, arm: outcome.failure.arm,
+            error_class: outcome.failure.errorClass, error_code: outcome.failure.errorCode,
+            node_id: outcome.failure.nodeId } : null,
         phases: outcome ? outcome.phases : null,
         vm_ids: record.vmIds,
         lease_ids: record.leaseIds,
@@ -520,6 +577,156 @@ export async function caseBatchCancelCommand(runId, options) {
     console.log('  A claimed batch stays draining until its owner proves physical cleanup and posts a terminal checkpoint.');
     console.log(`  ${chalk.dim('Watch:')} haystack case-batch status ${runId} --repository ${repository.fullName} --watch`);
 }
+/* ---------------------------------------------------------------- finalize */
+/** Mirrors CASE_BATCH_FINALIZE_STATUSES and CASE_BATCH_FINALIZE_REASON_MAX in
+ * infra/lambda/haystack-design-verifier-shared/case_batch_contracts.ts. */
+const FINALIZE_STATUSES = ['cancelled', 'incomplete'];
+const FINALIZE_REASON_MAX = 1_000;
+/** A refused finalize: the HTTP answer and the gateway's typed reason (`finalize-not-stranded`,
+ * `finalize-live-claim`, `finalize-already-terminal`, `finalize-conflict`). */
+export class CaseBatchFinalizeRefusedError extends HaystackApiError {
+    reason;
+    constructor(refusal, reason) {
+        super(refusal.status, reason ? `Case batch finalize refused (${reason}): ${refusal.message}` : refusal.message, refusal.code);
+        this.name = 'CaseBatchFinalizeRefusedError';
+        this.reason = reason;
+    }
+}
+/** Operator finalize of a stranded batch: terminal with the given status, the reason recorded as its
+ * error, and its world-pair lock freed. The gateway accepts it only when the batch was cancelled or has
+ * gone 15 minutes without an update, and no claim is live. Cleanup is reported exactly as the batch
+ * last recorded it; finalize never asserts it. */
+export async function caseBatchFinalizeCommand(runId, options) {
+    requireRunId(runId);
+    if (typeof options.repository !== 'string' || options.repository.length === 0) {
+        throw new CaseBatchRequestValidationError('--repository is required; finalize is scoped to an exact repository.');
+    }
+    const status = options.status;
+    if (typeof status !== 'string' || !FINALIZE_STATUSES.includes(status)) {
+        throw new CaseBatchRequestValidationError(`--status must be one of: ${FINALIZE_STATUSES.join(', ')}.`);
+    }
+    const reason = options.reason;
+    if (typeof reason !== 'string' || reason.trim().length === 0 || reason.length > FINALIZE_REASON_MAX || reason.includes('\0')) {
+        throw new CaseBatchRequestValidationError(`--reason is required: 1 to ${FINALIZE_REASON_MAX} characters saying why the batch is stranded.`);
+    }
+    const { repository, auth } = await authFor(options.repository, options.account);
+    const path = `${GATEWAY}/${encodeURIComponent(runId)}/finalize?${repositoryQuery(repository.fullName)}`;
+    const response = await gatewayFetch(path, auth.token, { method: 'POST', body: JSON.stringify({ status, reason }) });
+    if (!response.ok) {
+        const copy = response.clone();
+        const refusal = await classifyHttpError(response, `Haystack API ${path}`);
+        let refusalReason = null;
+        try {
+            const body = await copy.json();
+            if (isJsonObject(body) && typeof body.reason === 'string')
+                refusalReason = body.reason;
+        }
+        catch {
+            // Not JSON: the refusal above already carries the status and the readable part of the body.
+        }
+        throw new CaseBatchFinalizeRefusedError(refusal, refusalReason);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch (error) {
+        throw new CaseBatchResponseError(`Case batch service returned a body that is not JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!isJsonObject(body) || body.runId !== runId || body.terminal !== true || body.status !== status
+        || typeof body.cleanupComplete !== 'boolean' || typeof body.generation !== 'number'
+        || typeof body.previousStatus !== 'string' || typeof body.lastUpdatedAt !== 'string'
+        || (body.eligibility !== 'cancel-requested' && body.eligibility !== 'stale') || typeof body.finalizedAt !== 'string') {
+        throw new CaseBatchResponseError('Case batch finalize was not acknowledged for this run.');
+    }
+    if (options.json) {
+        process.stdout.write(`${JSON.stringify(withSchema('case-batch', {
+            operation: 'finalize',
+            run_id: runId,
+            repository: repository.fullName,
+            status,
+            terminal: true,
+            cleanup_complete: body.cleanupComplete,
+            generation: body.generation,
+            previous_status: body.previousStatus,
+            last_updated_at: body.lastUpdatedAt,
+            eligibility: body.eligibility,
+            reason,
+            finalized_at: body.finalizedAt,
+        }), null, 2)}\n`);
+        return;
+    }
+    console.log(`${chalk.cyan('•')} Case batch ${chalk.bold(runId)} finalized as ${status} (was ${body.previousStatus}; ${body.eligibility}).`);
+    console.log(body.cleanupComplete
+        ? '  Its last checkpoint recorded cleanup complete.'
+        : chalk.yellow('  Its last checkpoint did NOT record cleanup complete; its VM and lease ownership rows remain for dispatcher recovery.'));
+}
+/** Parallel artifact reads. Bounded so a large bundle does not open hundreds of sockets. */
+const BUNDLE_FETCH_CONCURRENCY = 8;
+/** The bundle route's `reason` (HTTP 409) for a PNG a page lists that the coordinator has not
+ * uploaded yet. PNGs upload after the batch is terminal, off its world-pair lock. Mirrors
+ * CASE_BATCH_ARTIFACT_PENDING_REASON in infra/lambda/haystack-design-verifier-shared/case_batch_contracts.ts. */
+const ARTIFACT_PENDING_REASON = 'artifact-pending';
+/** Exit status when every other artifact verified and only PNGs are still uploading: EX_TEMPFAIL
+ * from sysexits.h, "try again later". Rerun the command, or pass the pending paths to `--only`. */
+export const CASE_BATCH_BUNDLE_PENDING_EXIT = 75;
+/** The bundle route's `reason` (HTTP 410) for a listed PNG whose upload the coordinator gave up on and
+ * recorded. Terminal: nothing will upload it. Mirrors CASE_BATCH_ARTIFACT_FAILED_REASON in
+ * infra/lambda/haystack-design-verifier-shared/case_batch_contracts.ts. */
+const ARTIFACT_FAILED_REASON = 'artifact-failed';
+/** Exit status when nothing is pending but at least one listed PNG failed to upload: the answer is final and
+ * the bundle is incomplete, so a caller must not retry and must not treat it as complete. */
+export const CASE_BATCH_BUNDLE_FAILED_EXIT = 1;
+/** A listed PNG the service reports as failed for good (its recorded upload error). Terminal, never retried. */
+export class CaseBatchArtifactFailedError extends Error {
+    path;
+    uploadError;
+    constructor(path, uploadError) {
+        super(`Bundle artifact ${path} failed to upload (${uploadError.errorClass}${uploadError.status === null ? '' : ` HTTP ${uploadError.status}`}: ${uploadError.message}).`);
+        this.path = path;
+        this.uploadError = uploadError;
+        this.name = 'CaseBatchArtifactFailedError';
+    }
+}
+/** The recorded upload error when an error body is the failed answer, else null (the caller reports the
+ * response like any other refusal). */
+function artifactFailedBody(text) {
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!isJsonObject(body) || body.reason !== ARTIFACT_FAILED_REASON || !isJsonObject(body.uploadError))
+        return null;
+    const { errorClass, status, message } = body.uploadError;
+    if (typeof errorClass !== 'string' || typeof message !== 'string' || (status !== null && typeof status !== 'number')) {
+        throw new CaseBatchResponseError('Bundle route answered artifact-failed without a valid uploadError.');
+    }
+    return { errorClass, status, message };
+}
+/** A listed PNG the service reports as still uploading. Retryable, never a missing artifact. */
+export class CaseBatchArtifactPendingError extends Error {
+    path;
+    constructor(path) {
+        super(`Bundle artifact ${path} is still uploading; retry it.`);
+        this.path = path;
+        this.name = 'CaseBatchArtifactPendingError';
+    }
+}
+/** True when an error body carries the pending `reason`. A body that is not JSON is not that answer,
+ * and the caller reports the response like any other refusal. */
+function isArtifactPendingBody(text) {
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return false;
+    }
+    return isJsonObject(body) && body.reason === ARTIFACT_PENDING_REASON;
+}
 function safeBundlePath(path) {
     if (typeof path !== 'string' || path.length === 0 || path.length > 512) {
         throw new CaseBatchResponseError('Bundle manifest names an invalid artifact path.');
@@ -561,6 +768,16 @@ export function collectArtifactRefs(document, into) {
             }
             into.set(path, { path, sha256: value.sha256, bytes: value.bytes });
         }
+        else if (typeof value.path === 'string' && typeof value.pngSha256 === 'string'
+            && /^[0-9a-f]{64}$/.test(value.pngSha256) && Object.keys(value).length === 2) {
+            // A page's image reference: the PNG's own sha256; its size is checked against the bound only.
+            const path = safeBundlePath(value.path);
+            const existing = into.get(path);
+            if (existing && existing.sha256 !== value.pngSha256) {
+                throw new CaseBatchResponseError(`Bundle manifest lists ${path} twice with different digests.`);
+            }
+            into.set(path, { path, sha256: value.pngSha256, bytes: existing?.bytes ?? null });
+        }
         for (const item of Object.values(value))
             visit(item, depth + 1);
     };
@@ -590,6 +807,19 @@ async function fetchBundleArtifact(runId, repository, token, relative, requireSe
     const encoded = relative.split('/').map(encodeURIComponent).join('/');
     const suffix = relative === 'manifest.json' ? '' : `/${encoded}`;
     const response = await gatewayFetch(`${GATEWAY}/${encodeURIComponent(runId)}/bundle${suffix}?${repositoryQuery(repository)}`, token, { method: 'GET', accept: '*/*' });
+    if (response.status === 409) {
+        const text = await response.text();
+        if (isArtifactPendingBody(text))
+            throw new CaseBatchArtifactPendingError(relative);
+        throw await classifyHttpError(new Response(text, { status: response.status, headers: response.headers }), `Haystack API ${GATEWAY}/${runId}/bundle${suffix}`);
+    }
+    if (response.status === 410) {
+        const text = await response.text();
+        const failure = artifactFailedBody(text);
+        if (failure !== null)
+            throw new CaseBatchArtifactFailedError(relative, failure);
+        throw await classifyHttpError(new Response(text, { status: response.status, headers: response.headers }), `Haystack API ${GATEWAY}/${runId}/bundle${suffix}`);
+    }
     if (!response.ok) {
         throw await classifyHttpError(response, `Haystack API ${GATEWAY}/${runId}/bundle${suffix}`);
     }
@@ -613,7 +843,10 @@ function writeArtifact(outDir, relative, bytes) {
     writeFileSync(destination, bytes);
     return destination;
 }
-export async function caseBatchBundleCommand(runId, options) {
+/** `case-batch bundle` as a library call: the same reads and digest checks, returned instead of printed,
+ * and no process exit status. A caller in its own process (the product-fuzz page) waits on `pending` and
+ * renders `failed` without the PNG. */
+export async function downloadCaseBatchBundle(runId, options) {
     requireRunId(runId);
     if (typeof options.repository !== 'string' || options.repository.length === 0) {
         throw new CaseBatchRequestValidationError('--repository is required; every bundle read is scoped to an exact repository.');
@@ -641,21 +874,39 @@ export async function caseBatchBundleCommand(runId, options) {
     writeArtifact(outDir, 'manifest.json', manifest.bytes);
     const pending = new Map();
     collectArtifactRefs(manifestDocument, pending);
+    const only = (options.only ?? []).map(entry => {
+        if (typeof entry !== 'string' || entry.length === 0)
+            throw new CaseBatchRequestValidationError('--only names an empty path.');
+        return entry;
+    });
+    // The manifest and its pages are always read: they are what every other artifact is verified against.
+    const wanted = (path) => path.startsWith('manifest-pages/') || only.length === 0
+        || only.some(entry => entry === path || (entry.endsWith('/') && path.startsWith(entry)));
     const verified = [];
+    /** Listed PNGs the service reported as still uploading; nothing was written for them. */
+    const uploading = [];
+    /** Listed PNGs the service reported as failed for good. */
+    const failed = [];
     const done = new Set(['manifest.json']);
     let totalBytes = manifest.bytes.byteLength;
-    for (;;) {
-        const next = [...pending.values()].find(ref => !done.has(ref.path));
-        if (!next)
-            break;
-        done.add(next.path);
-        if (verified.length >= MAX_BUNDLE_ARTIFACTS) {
-            throw new CaseBatchResponseError(`Bundle lists more than ${MAX_BUNDLE_ARTIFACTS} artifacts.`);
-        }
+    const fetchOne = async (next) => {
         if (!options.json)
             console.error(chalk.dim(`Fetching ${next.path}…`));
-        const artifact = await fetchBundleArtifact(runId, repository.fullName, auth.token, next.path);
-        if (artifact.bytes.byteLength !== next.bytes) {
+        let artifact;
+        try {
+            artifact = await fetchBundleArtifact(runId, repository.fullName, auth.token, next.path);
+        }
+        catch (error) {
+            if (error instanceof CaseBatchArtifactFailedError) {
+                failed.push({ path: next.path, uploadError: error.uploadError });
+                return;
+            }
+            if (!(error instanceof CaseBatchArtifactPendingError))
+                throw error;
+            uploading.push(next.path);
+            return;
+        }
+        if (next.bytes !== null && artifact.bytes.byteLength !== next.bytes) {
             throw new CaseBatchResponseError(`Bundle artifact ${next.path} is ${artifact.bytes.byteLength} bytes; the manifest declares ${next.bytes}.`);
         }
         if (artifact.sha256 !== next.sha256) {
@@ -669,10 +920,10 @@ export async function caseBatchBundleCommand(runId, options) {
             throw new CaseBatchResponseError(`Bundle exceeded the ${MAX_BUNDLE_BYTES}-byte download bound.`);
         }
         writeArtifact(outDir, next.path, artifact.bytes);
-        // A manifest page lists its own PNGs; follow one level at a time until the
-        // closure is complete. Only verified bytes are ever parsed.
+        // A manifest page lists its cases' PNGs and records; follow pages only. Only verified bytes are
+        // ever parsed, and a case's records are data, never a list of further artifacts.
         const json = next.path.endsWith('.json');
-        if (json) {
+        if (next.path.startsWith('manifest-pages/')) {
             try {
                 collectArtifactRefs(JSON.parse(artifact.bytes.toString('utf8')), pending);
             }
@@ -682,27 +933,74 @@ export async function caseBatchBundleCommand(runId, options) {
                 throw new CaseBatchResponseError(`Bundle page ${next.path} is not JSON.`);
             }
         }
-        verified.push({ ...next, json });
-    }
+        verified.push({ path: next.path, sha256: next.sha256, bytes: artifact.bytes.byteLength, json });
+    };
+    for (;;) {
+        const wave = [...pending.values()].filter(ref => !done.has(ref.path) && wanted(ref.path));
+        if (wave.length === 0)
+            break;
+        for (const ref of wave)
+            done.add(ref.path);
+        if (verified.length + wave.length > MAX_BUNDLE_ARTIFACTS) {
+            throw new CaseBatchResponseError(`Bundle lists more than ${MAX_BUNDLE_ARTIFACTS} artifacts.`);
+        }
+        let cursor = 0;
+        await Promise.all(Array.from({ length: Math.min(BUNDLE_FETCH_CONCURRENCY, wave.length) }, async () => {
+            for (let index = cursor++; index < wave.length; index = cursor++)
+                await fetchOne(wave[index]);
+        }));
+    }
+    const missing = only.filter(entry => !entry.endsWith('/') && !done.has(entry));
+    if (missing.length > 0) {
+        throw new CaseBatchResponseError(`Bundle does not list ${missing.join(', ')}.`);
+    }
+    uploading.sort();
+    failed.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+    return { repository: repository.fullName, outDir, manifest: { sha256: manifest.sha256, bytes: manifest.bytes.byteLength },
+        verified, totalBytes, pending: uploading, failed };
+}
+export async function caseBatchBundleCommand(runId, options) {
+    const { repository, outDir, manifest, verified, totalBytes, pending: uploading, failed } = await downloadCaseBatchBundle(runId, options);
+    // Pending first: those can still arrive, so the caller retries; failed ones are final either way.
+    const exitCode = uploading.length > 0 ? CASE_BATCH_BUNDLE_PENDING_EXIT : failed.length > 0 ? CASE_BATCH_BUNDLE_FAILED_EXIT : 0;
+    if (exitCode !== 0)
+        process.exitCode = exitCode;
     if (options.json) {
         process.stdout.write(`${JSON.stringify(withSchema('case-batch', {
             operation: 'bundle',
             run_id: runId,
-            repository: repository.fullName,
+            repository,
             out_dir: outDir,
-            manifest: { path: 'manifest.json', sha256: manifest.sha256, bytes: manifest.bytes.byteLength },
+            manifest: { path: 'manifest.json', sha256: manifest.sha256, bytes: manifest.bytes },
             artifacts: verified.map(ref => ({ path: ref.path, sha256: ref.sha256, bytes: ref.bytes, verified: true })),
             artifact_count: verified.length,
             total_bytes: totalBytes,
+            pending: uploading,
+            failed: failed.map(entry => ({ path: entry.path, error_class: entry.uploadError.errorClass,
+                status: entry.uploadError.status, message: entry.uploadError.message })),
         }), null, 2)}\n`);
         return;
     }
     console.log(`${chalk.cyan('•')} Bundle for case batch ${chalk.bold(runId)} written to ${outDir}`);
-    console.log(`  ${chalk.dim('manifest.json')} ${manifest.sha256} (${manifest.bytes.byteLength} bytes)`);
+    console.log(`  ${chalk.dim('manifest.json')} ${manifest.sha256} (${manifest.bytes} bytes)`);
     for (const ref of verified) {
         console.log(`  ${chalk.dim(ref.path)} ${ref.sha256} (${ref.bytes} bytes)`);
     }
     console.log(`  ${verified.length + 1} file(s), ${totalBytes} bytes, every digest verified against the manifest.`);
+    if (uploading.length > 0) {
+        console.log(`  ${chalk.yellow(`${uploading.length} PNG(s) still uploading`)} (the batch is terminal; its PNGs publish after it):`);
+        for (const path of uploading)
+            console.log(`  ${chalk.dim(path)}`);
+        console.log(`  Retry: haystack case-batch bundle ${runId} --repository ${repository} --out ${outDir}`
+            + `${uploading.map(path => ` --only ${path}`).join('')}`);
+    }
+    if (failed.length > 0) {
+        console.log(`  ${chalk.red(`${failed.length} PNG(s) failed to upload`)} (final; the coordinator recorded why):`);
+        for (const entry of failed) {
+            console.log(`  ${chalk.dim(entry.path)} ${entry.uploadError.errorClass}`
+                + `${entry.uploadError.status === null ? '' : ` HTTP ${entry.uploadError.status}`}: ${entry.uploadError.message}`);
+        }
+    }
 }
 export const caseBatchDefaults = {
     perCaseWallMs: DEFAULT_PER_CASE_WALL_MS,

package/dist/commands/submit.js

@@ -1,7 +1,7 @@
 /**
  * Submit command - Create a PR from current changes
  *
- * Runs pre-PR triage (code review, rules, intent drift) via parallel sub-agents,
+ * Runs pre-PR triage (code review, rules) on gpt-6-astra in parallel,
  * then pushes the current branch and creates a PR.
  *
  * PRs are routed based on flags:
@@ -141,9 +141,6 @@ function checkerDisplayName(checker) {
 /**
  * Merge triage-tuning knobs from two sources, in ascending precedence:
  *   defaults (in runner.ts) < .haystack.json triage.* < CLI flags
- *
- * --max-turns <N> applies the same number to every checker. Per-checker
- * granularity stays in .haystack.json (less common, more verbose).
  */
 async function resolveTriageOptions(options) {
     let config = null;
@@ -158,30 +155,16 @@ async function resolveTriageOptions(options) {
         console.warn(chalk.dim('  Triage will use CLI flags / defaults — fix the config to apply project overrides.'));
     }
     const triageConfig = config?.triage ?? {};
-    const maxTurns = { ...(triageConfig.maxTurns ?? {}) };
-    if (typeof options.maxTurns === 'number' && options.maxTurns > 0) {
-        for (const name of ['code-review', 'rules-validator']) {
-            maxTurns[name] = options.maxTurns;
-        }
-    }
     // loadConfig does a raw `as HaystackConfig` cast (no Zod runtime parse), so
     // malformed .haystack.json values can reach us as strings/negatives/NaN.
-    // Mirror the positive-number guard we already apply to maxTurns before
-    // letting this flow into setTimeout.
+    // Guard before letting this flow into setTimeout.
     const configTimeoutMs = typeof triageConfig.timeoutMs === 'number' && triageConfig.timeoutMs > 0
         ? triageConfig.timeoutMs
         : undefined;
     const timeoutMs = typeof options.triageTimeout === 'number' && options.triageTimeout > 0
         ? options.triageTimeout * 1000
         : configTimeoutMs;
-    return {
-        maxTurns: Object.keys(maxTurns).length > 0 ? maxTurns : undefined,
-        timeoutMs,
-    };
-}
-function isCodexNetworkDisabledTriageError(err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return message.includes('CODEX_SANDBOX_NETWORK_DISABLED=1');
+    return { timeoutMs };
 }
 function printTriageSummary(result) {
     console.log(chalk.bold('\n' + '━'.repeat(50)));
@@ -200,27 +183,21 @@ function printTriageSummary(result) {
                     : issue.file;
                 const ruleTag = issue.rule ? chalk.dim(` [${issue.rule}]`) : '';
                 const patternTag = issue.pattern ? chalk.dim(` (${issue.pattern})`) : '';
-                console.log(`    ${severityIcon(issue.severity)} ${chalk.dim(location)} ${severityColor(issue.severity)(issue.message)}${ruleTag}${patternTag}`);
+                const categoryTag = issue.category ? chalk.dim(` {${issue.category}}`) : '';
+                console.log(`    ${severityIcon(issue.severity)} ${chalk.dim(location)} ${severityColor(issue.severity)(issue.message)}${ruleTag}${patternTag}${categoryTag}`);
+                if (issue.failureScenario) {
+                    console.log(chalk.dim(`        ${issue.failureScenario}`));
+                }
             }
             console.log('');
         }
     }
-    // Hard errors from sub-agent failures (auth, crashes) — these block submit.
-    if (result.errors.length > 0) {
-        console.log(chalk.red('  Checker errors:'));
-        for (const err of result.errors) {
-            console.log(chalk.red(`    ✗ ${err}`));
-        }
-        console.log('');
+    // Checkers that could not run (API error, missing key, stall). Non-blocking.
+    for (const err of result.errors) {
+        console.log(chalk.yellow(`  ! ${err}`));
     }
-    // Soft failures (max turns, timeout) — non-blocking, purely informational.
-    if (result.warnings.length > 0) {
-        console.log(chalk.yellow('  Checker warnings (non-blocking):'));
-        for (const warn of result.warnings) {
-            console.log(chalk.yellow(`    ! ${warn}`));
-        }
+    if (result.errors.length > 0)
         console.log('');
-    }
     // Total summary
     const totalIssues = result.results.reduce((sum, r) => sum + r.issues.length, 0);
     const errorCount = result.results.reduce((sum, r) => sum + r.issues.filter((i) => i.severity === 'error').length, 0);
@@ -343,49 +320,35 @@ export async function submitCommand(options) {
             const triageOptions = await resolveTriageOptions(options);
             const triageResult = await runTriage(gitRoot, baseBranch, triageOptions);
             printTriageSummary(triageResult);
-            // No valid results means we got zero signal from triage. That's
-            // "unavailable" whether the cause was a hard error (auth crash) or a
-            // soft cap (every checker hit max turns). Either way don't pretend it
-            // passed — print the warning and continue.
-            const triageInfraFailure = triageResult.results.length === 0 &&
-                (triageResult.errors.length > 0 || triageResult.warnings.length > 0);
+            // No valid results means we got zero signal from triage: every
+            // checker failed to run. Don't pretend it passed — warn and continue.
+            const triageInfraFailure = triageResult.results.length === 0 && triageResult.errors.length > 0;
             if (triageInfraFailure) {
                 console.log(chalk.yellow('\n⚠ Triage unavailable (no checkers produced results). Continuing with submit.\n'));
             }
+            // Only findings with severity "error" block; a failed checker never does.
             if (!triageResult.passed) {
-                if (triageInfraFailure) {
-                    // Infrastructure failure should not block submission.
-                    // We already warned above and continue.
-                }
-                else {
-                    fail('Triage failed. Fix the issues above or re-run with --force.', {
-                        triage: {
-                            status: 'failed',
-                            issues: triageResult.results.flatMap((r) => r.issues.map((issue) => ({
-                                checker: r.checker,
-                                severity: issue.severity,
-                                file: issue.file,
-                                line: issue.line ?? null,
-                                message: issue.message,
-                                rule: issue.rule ?? null,
-                            }))),
-                        },
-                    });
-                }
+                fail('Triage failed. Fix the issues above or re-run with --force.', {
+                    triage: {
+                        status: 'failed',
+                        issues: triageResult.results.flatMap((r) => r.issues.map((issue) => ({
+                            checker: r.checker,
+                            severity: issue.severity,
+                            file: issue.file,
+                            line: issue.line ?? null,
+                            message: issue.message,
+                            rule: issue.rule ?? null,
+                            category: issue.category ?? null,
+                            failure_scenario: issue.failureScenario ?? null,
+                        }))),
+                    },
+                });
             }
             triageStatus = triageInfraFailure ? 'unavailable' : 'passed';
         }
         catch (err) {
             // Triage failure should not block submission
-            if (isCodexNetworkDisabledTriageError(err)) {
-                console.log(chalk.yellow('\n⚠ Triage skipped in Codex app shell.'));
-                console.log(chalk.dim('  Nested Codex sub-agents cannot access model endpoints from this shell.'));
-                console.log(chalk.dim('  Submit will continue normally.'));
-                console.log(chalk.dim('  For full triage, run `haystack submit` from a regular terminal.\n'));
-            }
-            else {
-                console.log(chalk.yellow(`\n⚠ Triage skipped: ${err.message}`));
-            }
+            console.log(chalk.yellow(`\n⚠ Triage skipped: ${err.message}`));
             triageStatus = 'unavailable';
         }
     }