@haystackeditor/cli 0.16.0 → 0.17.1

package/dist/commands/verify-precompute.js

@@ -7,7 +7,7 @@ import { tmpdir } from 'node:os';
 import chalk from 'chalk';
 import { NotLoggedInError, resolveAuthContext } from '../utils/auth.js';
 import { findGitRoot, parseRemoteUrl, resolveDiffBaseRef, } from '../utils/git.js';
-import { HaystackApiError, haystackJson } from '../utils/haystack-api.js';
+import { HaystackApiError, haystackJson, REPO_NOT_ENTITLED_CODE, SUBSCRIPTION_REQUIRED_CODE, } from '../utils/haystack-api.js';
 import { trackPrecomputeEvent } from '../utils/telemetry.js';
 import { findSecretsInPatch, isSecretBearingPath } from '../utils/secret-paths.js';
 import { startPrecomputeDelivery } from './precompute-delivery.js';
@@ -368,6 +368,12 @@ function normalModeFailure(error) {
         return new PrecomputeFailure('Authentication is required. Run `haystack login` first.');
     }
     if (error instanceof HaystackApiError) {
+        // Entitlement denials are not authentication problems: classifyHttpError
+        // already turned the server body into its one-line message, so show it.
+        if (error.status === 403
+            && (error.code === REPO_NOT_ENTITLED_CODE || error.code === SUBSCRIPTION_REQUIRED_CODE)) {
+            return new PrecomputeFailure(error.message);
+        }
         if (error.status === 401 || error.status === 403) {
             return new PrecomputeFailure('Authentication was rejected. Run `haystack login` and try again.');
         }

package/dist/index.js

@@ -421,9 +421,11 @@ caseBatch
     .requiredOption('--combinations <file>', 'JSON file: the combination space each case start resolves against')
     .option('--base-world <id>', 'Existing frozen base world (frz_ plus 16 hex); omit to prepare it')
     .option('--head-world <id>', 'Existing frozen head world (frz_ plus 16 hex); omit to prepare it')
+    .option('--driver-bundle <sha256>', 'The worlds carry a resident driver running this probe bundle; sealed cases run on it')
     .option('--max-concurrent <n>', 'Concurrency ceiling, 1-500 (default: the case count, capped at 500)')
     .option('--per-case-wall-ms <ms>', 'Per-case wall budget, 1000-600000 (default 120000)')
     .option('--total-budget-ms <ms>', 'Launch budget for the batch, 10000-1800000 (default 1800000)')
+    .option('--warm-settle-ms <ms>', 'Adopt only warm clones ready at least this long, 0 to the per-case wall (default: absent = 0)')
     .option('--idempotency-key <key>', 'Stable retry key (default: deterministic from the whole submission)')
     .option('--source-patch <file>', 'JSON file with the precompute-captured { cacheKey, patchSha256, patchGzBase64 }')
     .option('--account <login>', 'Use a specific saved Haystack account')
@@ -485,6 +487,31 @@ cleanup and posts its terminal checkpoint.
     const { caseBatchCancelCommand } = await import('./commands/case-batch.js');
     return runPublicCommand(() => caseBatchCancelCommand(runId, options), options.json);
 });
+caseBatch
+    .command('finalize')
+    .description('Make a stranded owned case batch terminal (cancelled or incomplete) and free its world-pair lock')
+    .argument('<run-id>', 'Case batch run id (cv_ followed by 48 lowercase hex characters)')
+    .requiredOption('--repository <owner/repo>', 'Exact GitHub owner/repository name')
+    .requiredOption('--status <status>', 'Terminal status to record: cancelled or incomplete')
+    .requiredOption('--reason <text>', 'Why the batch is stranded; recorded as the batch error')
+    .option('--account <login>', 'Use a specific saved Haystack account')
+    .option('--json', 'Versioned machine-readable finalize receipt')
+    .addHelpText('after', `
+For a batch no owner can finish: a retired version no runner claims, a
+checkpoint the service keeps refusing, a dead runner. Accepted only when the
+batch was cancelled, or has gone 15 minutes without an update, and no runner
+holds a live claim on it; otherwise refused with a typed reason. Finalize does
+not assert cleanup: the receipt reports cleanup exactly as the batch last
+recorded it.
+
+Example:
+  haystack case-batch finalize cv_<48 hex> --repository owner/repo \\
+    --status cancelled --reason "v1 batch stranded after the v2 roll" --json
+`)
+    .action(async (runId, options) => {
+    const { caseBatchFinalizeCommand } = await import('./commands/case-batch.js');
+    return runPublicCommand(() => caseBatchFinalizeCommand(runId, options), options.json);
+});
 caseBatch
     .command('bundle')
     .description('Download a case batch replay bundle, verifying every artifact digest')
@@ -492,14 +519,22 @@ caseBatch
     .requiredOption('--repository <owner/repo>', 'Exact GitHub owner/repository name')
     .requiredOption('--out <dir>', 'Directory to write the verified bundle into')
     .option('--account <login>', 'Use a specific saved Haystack account')
+    .option('--only <path>', 'Fetch only this listed artifact, or every artifact under this directory prefix '
+    + '(ending in /); repeatable. The manifest and its pages are always fetched.', (value, previous = []) => [...previous, value])
     .option('--json', 'Versioned machine-readable list of verified artifacts')
     .addHelpText('after', `
 The manifest is fetched first and checked against the digest the service sealed
 it under; that sealed digest is required, because the manifest is the one
 artifact with no parent digest to check it against. Every artifact the manifest
-lists (and every artifact those pages list) is then fetched and checked against
-the manifest's own sha256 and byte length before it is written. Any failure
-stops the command; it never writes unverified bytes.
+lists (and every PNG and case records.json those pages list) is then fetched and
+checked against the digest (and, where declared, the byte length) its listing
+names before it is written. Any failure stops the command; it never writes
+unverified bytes.
+
+A batch's PNGs are uploaded after it is terminal. A PNG the service reports as
+still uploading is not written: it is listed as pending (\`pending\` in --json)
+and the command exits 75 once everything else is verified. Rerun it, or fetch
+just those paths with --only.
 `)
     .action(async (runId, options) => {
     const { caseBatchBundleCommand } = await import('./commands/case-batch.js');
@@ -600,37 +635,39 @@ program
     .option('--no-auto-merge', 'Do not apply the auto-merge label')
     .option('--no-wait', 'Skip waiting for analysis results')
     .option('--json', 'Machine-readable: one JSON document on stdout (see `haystack schema submit`), progress on stderr')
-    .option('--max-turns <n>', 'Max agentic turns per triage checker (overrides .haystack.json triage.maxTurns)', (v) => parseInt(v, 10))
-    .option('--triage-timeout <seconds>', 'Wall-clock timeout per triage checker in seconds (overrides .haystack.json triage.timeoutMs)', (v) => parseInt(v, 10))
+    .option('--triage-timeout <seconds>', 'Abort a triage checker after this many seconds with no data from the model (overrides .haystack.json triage.timeoutMs)', (v) => parseInt(v, 10))
     .addHelpText('after', `
 This command is designed for AI coding agents to submit PRs.
 
-  1. Runs pre-PR triage (code review and rules) via sub-agents
+  1. Runs pre-PR triage (code review and rules) on gpt-6-astra
   2. Pushes the current branch to origin
   3. Creates a pull request on GitHub
   4. Waits for Haystack analysis results (triggered via GitHub App webhook)
 
 Pre-PR Triage:
-  Before creating the PR, haystack spawns parallel sub-agents to check for:
-  • Code review bugs (logic errors, null crashes, security issues)
-  • Rule violations (from .haystack/pr-rules.yml)
+  Before creating the PR, haystack sends the diff to gpt-6-astra (OpenAI
+  Responses API, reasoning effort "xhigh", structured output) in parallel for:
+  • Code review bugs (logic errors, null crashes, security issues, secrets)
+  • Rule violations (from .haystack/pr-rules.yml and CLAUDE.md/AGENTS.md etc.)
+
+  Uses OPENAI_API_KEY if set, else the SSM parameter
+  /haystack/secrets/shared/prod/OPENAI_API_KEY (us-west-2) via the default
+  AWS credential chain. If a checker call fails, submit prints
+  "<checker> failed: <error>" and continues; only findings with severity
+  "error" block the PR.
 
   Use --force to skip triage entirely.
   Use --no-wait to skip waiting for analysis results.
 
-  Triage budgets:
-  • --max-turns <n>         Raise/lower the per-checker tool-use turn cap.
-                            Defaults: code-review 8, rules-validator 10.
-                            Applies the same N to both.
-  • --triage-timeout <sec>  Raise/lower the per-checker wall-clock timeout
-                            (default: 180s).
+  • --triage-timeout <sec>  Abort a checker when the model stream has been
+                            silent this long (default: 300s). There is no
+                            total-time cap.
 
-  Persist these in .haystack.json to apply per project:
+  Persist it in .haystack.json to apply per project:
 
     {
       "triage": {
-        "maxTurns": { "code-review": 12 },
-        "timeoutMs": 240000
+        "timeoutMs": 300000
       }
     }
 
@@ -674,8 +711,7 @@ Examples:
   haystack submit --review             # ⚠ Blocks auto-merge, needs human approval
   haystack submit --review octocat     # ⚠ Blocks auto-merge, requests review from octocat
   haystack submit --account octocat    # Use a specific saved Haystack account for this submit
-  haystack submit --max-turns 12       # Raise triage turn cap to 12 per checker
-  haystack submit --triage-timeout 300 # Raise triage wall-clock to 5 minutes
+  haystack submit --triage-timeout 600 # Allow 10 minutes of model silence per checker
 `)
     .action(async (options, command) => {
     // Resolve --auto-merge / --auto-fix defaults from .haystack.json when not

package/dist/schema.js

@@ -16,10 +16,10 @@ export const SCHEMA_VERSIONS = {
     'pr-status': '1.0.0',
     inbox: '1.0.0',
     ask: '1.0.0',
-    submit: '1.0.0',
+    submit: '1.0.1',
     action: '1.0.0',
     'cloud-verifier': '1.0.0',
-    'case-batch': '1.0.0',
+    'case-batch': '1.0.1',
     error: '1.0.0',
 };
 /** Wrap a payload with the `schema_version` envelope. */

package/dist/triage/astra.js

@@ -0,0 +1,202 @@
+/**
+ * One structured Responses API call to gpt-6-astra, the pre-PR reviewer.
+ *
+ * Streams the response so a silent connection can be told apart from a model
+ * that is still reasoning: the call is aborted only when no data has arrived
+ * for `stallMs`, never on total elapsed time. Uses node:https rather than
+ * fetch because fetch's transport imposes its own 300s body timeout, which
+ * would override a larger stall limit. Any failure throws; the runner reports
+ * it and submit continues without that checker.
+ */
+import { request as httpsRequest } from 'node:https';
+export const TRIAGE_MODEL = 'gpt-6-astra';
+/**
+ * Reasoning effort for gpt-6-astra (the API accepts none|minimal|low|medium|high|xhigh|max). xhigh, not max:
+ * max-effort reviews ran too long to wait on (owner's call, 2026-09-25).
+ */
+export const TRIAGE_REASONING_EFFORT = 'xhigh';
+const RESPONSES_URL = 'https://api.openai.com/v1/responses';
+/** SSM parameter holding the shared OpenAI key, read when OPENAI_API_KEY is unset. */
+export const OPENAI_KEY_PARAMETER = '/haystack/secrets/shared/prod/OPENAI_API_KEY';
+const OPENAI_KEY_PARAMETER_REGION = 'us-west-2';
+export const NO_OPENAI_KEY_MESSAGE = `no OpenAI key (set OPENAI_API_KEY or AWS access to ${OPENAI_KEY_PARAMETER})`;
+/**
+ * Default reader: AWS SDK v3 SSM with the default credential chain
+ * (AWS_PROFILE, env keys, SSO, instance role). Imported lazily so the SDK is
+ * off the startup path of every other command.
+ */
+const readSsmParameter = async (name, region) => {
+    const { SSMClient, GetParameterCommand } = await import('@aws-sdk/client-ssm');
+    const client = new SSMClient({ region, maxAttempts: 2 });
+    try {
+        const out = await client.send(new GetParameterCommand({ Name: name, WithDecryption: true }));
+        return out.Parameter?.Value;
+    }
+    finally {
+        client.destroy();
+    }
+};
+/**
+ * Resolve the OpenAI key: OPENAI_API_KEY if set, else the shared SSM
+ * parameter. Throws NO_OPENAI_KEY_MESSAGE (with the AWS cause appended) when
+ * neither yields a key. The key itself is never logged or put in an error.
+ */
+export async function resolveOpenAiKey(env = process.env, readParameter = readSsmParameter) {
+    const fromEnv = env.OPENAI_API_KEY?.trim();
+    if (fromEnv)
+        return fromEnv;
+    let cause;
+    try {
+        const fromSsm = (await readParameter(OPENAI_KEY_PARAMETER, OPENAI_KEY_PARAMETER_REGION))?.trim();
+        if (fromSsm)
+            return fromSsm;
+        cause = 'parameter is empty';
+    }
+    catch (err) {
+        cause = (err instanceof Error ? `${err.name}: ${err.message}` : String(err)).slice(0, 200);
+    }
+    throw new Error(`${NO_OPENAI_KEY_MESSAGE}; AWS lookup: ${cause}`);
+}
+let apiKeyPromise;
+/** One resolution per process, shared by the parallel checkers. */
+function readApiKey() {
+    apiKeyPromise ??= resolveOpenAiKey();
+    return apiKeyPromise;
+}
+/** The API's own error message from a non-2xx body, else the body's first 300 chars. */
+function apiErrorMessage(body) {
+    try {
+        const message = JSON.parse(body).error?.message;
+        if (typeof message === 'string' && message)
+            return message;
+    }
+    catch {
+        // Not JSON (proxy or gateway page); report the raw text below.
+    }
+    return body.slice(0, 300);
+}
+/** Pull the final JSON text out of a completed response. */
+function outputText(response) {
+    const parts = (response.output ?? [])
+        .filter(item => item.type === 'message')
+        .flatMap(item => item.content ?? []);
+    const refusal = parts.find(part => part.type === 'refusal');
+    if (refusal)
+        throw new Error(`${TRIAGE_MODEL} refused: ${refusal.refusal ?? '(no reason)'}`);
+    const text = parts.filter(part => part.type === 'output_text').map(part => part.text ?? '').join('');
+    if (!text)
+        throw new Error(`${TRIAGE_MODEL} returned no output text`);
+    return text;
+}
+/**
+ * Handle one SSE event block. Returns the parsed reply on response.completed,
+ * throws on a terminal failure event, and returns undefined otherwise.
+ */
+function handleEventBlock(block) {
+    const data = block
+        .split('\n')
+        .filter(line => line.startsWith('data:'))
+        .map(line => line.slice(5).trim())
+        .join('');
+    if (!data || data === '[DONE]')
+        return undefined;
+    const event = JSON.parse(data);
+    switch (event.type) {
+        case 'response.completed':
+            return { reply: JSON.parse(outputText(event.response ?? {})) };
+        case 'response.incomplete':
+            throw new Error(`${TRIAGE_MODEL} response incomplete: ${event.response?.incomplete_details?.reason ?? 'unknown reason'}`);
+        case 'response.failed':
+            throw new Error(`${TRIAGE_MODEL} response failed: ${event.response?.error?.message ?? 'unknown error'}`);
+        case 'error':
+            throw new Error(`OpenAI stream error: ${event.message ?? event.error?.message ?? data.slice(0, 300)}`);
+        default:
+            return undefined;
+    }
+}
+/** Run one structured call and return the parsed JSON object. */
+export async function callAstra(request) {
+    const apiKey = await readApiKey();
+    const body = JSON.stringify({
+        model: TRIAGE_MODEL,
+        reasoning: { effort: TRIAGE_REASONING_EFFORT },
+        store: false,
+        stream: true,
+        instructions: request.instructions,
+        input: request.input,
+        text: {
+            format: { type: 'json_schema', name: request.schemaName, strict: true, schema: request.schema },
+        },
+    });
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let stallTimer;
+        const finish = (err, reply) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(stallTimer);
+            req.destroy();
+            if (err)
+                reject(err);
+            else
+                resolve(reply);
+        };
+        const armStallTimer = () => {
+            // A chunk that lands after the call settled must not start a new timer:
+            // nothing would clear it and it would hold the process open.
+            if (settled)
+                return;
+            clearTimeout(stallTimer);
+            stallTimer = setTimeout(() => {
+                finish(new Error(`no data from ${TRIAGE_MODEL} for ${Math.round(request.stallMs / 1000)}s; aborted`));
+            }, request.stallMs);
+        };
+        const req = httpsRequest(RESPONSES_URL, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(body),
+                Accept: 'text/event-stream',
+            },
+        }, (res) => {
+            res.setEncoding('utf8');
+            const status = res.statusCode ?? 0;
+            let buffer = '';
+            res.on('data', (chunk) => {
+                armStallTimer();
+                buffer += chunk;
+                if (status < 200 || status >= 300)
+                    return;
+                // SSE allows CRLF, LF or CR line endings; normalize before splitting events.
+                buffer = buffer.replace(/\r\n?/g, '\n');
+                let boundary;
+                while ((boundary = buffer.indexOf('\n\n')) >= 0) {
+                    const block = buffer.slice(0, boundary);
+                    buffer = buffer.slice(boundary + 2);
+                    try {
+                        const outcome = handleEventBlock(block);
+                        if (outcome)
+                            return finish(null, outcome.reply);
+                    }
+                    catch (err) {
+                        return finish(err instanceof Error ? err : new Error(String(err)));
+                    }
+                }
+            });
+            res.on('end', () => {
+                if (status < 200 || status >= 300) {
+                    finish(new Error(`OpenAI ${status}: ${apiErrorMessage(buffer)}`));
+                }
+                else {
+                    finish(new Error('OpenAI stream ended without a completed response'));
+                }
+            });
+            res.on('error', err => finish(err));
+        });
+        req.on('error', err => finish(err));
+        armStallTimer();
+        req.end(body);
+    });
+}