@haystackeditor/cli 0.16.0 → 0.17.1

package/dist/triage/runner.js

@@ -1,39 +1,30 @@
 /**
- * Triage runner — orchestrates parallel sub-agent execution for pre-PR checks.
+ * Triage runner — runs the pre-PR checkers in parallel and aggregates results.
  *
- * Detects the user's agentic CLI (Claude Code, Codex, Gemini), spawns
- * parallel sub-processes for each checker, and collects structured JSON results.
+ * Each checker (code-review, rules-validator) is one structured Responses API
+ * call to gpt-6-astra at reasoning effort xhigh (see astra.ts). A checker
+ * that fails is reported as "<checker> failed: <error>" and never blocks
+ * submit; there is no second reviewer to fall back to.
  */
-import { execFileSync, spawn } from 'child_process';
+import { execFileSync } from 'child_process';
 import { existsSync, readFileSync, mkdirSync, rmSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import chalk from 'chalk';
-import { buildCodeReviewPrompt, buildRulesValidatorPrompt } from './prompts.js';
+import { buildCodeReviewPrompt, buildRulesValidatorPrompt, CODE_REVIEW_SCHEMA, RULES_VALIDATOR_SCHEMA, } from './prompts.js';
+import { callAstra, TRIAGE_MODEL, TRIAGE_REASONING_EFFORT } from './astra.js';
 import { resolveDiffBaseRef } from '../utils/git.js';
 import { trackError } from '../utils/telemetry.js';
 // ============================================================================
 // Constants
 // ============================================================================
 const TRIAGE_DIR = '.haystack/triage';
-/** Diffs up to this many characters are embedded in the prompt; larger ones are read from the diff file. */
-const MAX_INLINE_DIFF_CHARS = 100_000;
 /**
- * Read-only tool set for the Claude sub-agent. The prompt carries
- * repo-controlled text (pr-rules.yml, CLAUDE.md, the diff), so the agent must
- * not be able to run commands or write files.
+ * Abort a checker when its response stream has been silent this long.
+ * Overridable via .haystack.json triage.timeoutMs or --triage-timeout.
+ * Measured 2026-09-24: a max-effort review of a 20 KB diff streamed its
+ * longest silent gap at 14.6s.
  */
-const CLAUDE_READ_ONLY_TOOLS = 'Read,Grep,Glob';
-/** Wall-clock timeout per checker. Overridable via .haystack.json triage.timeoutMs or --triage-timeout. */
-const DEFAULT_TIMEOUT_MS = 180_000; // 3 minutes
-/**
- * Default max agentic turns per checker. Overridable via .haystack.json
- * triage.maxTurns or --max-turns. code-review tends to saturate first because
- * it reads the diff line-by-line; 8 is the breakeven we landed on empirically.
- */
-const DEFAULT_MAX_TURNS = {
-    'code-review': 8,
-    'rules-validator': 10,
-};
+const DEFAULT_STALL_MS = 300_000;
 // ============================================================================
 // Agent policy file discovery
 // ============================================================================
@@ -62,287 +53,53 @@ function discoverAgentPolicyFiles(gitRoot) {
     }
     return results;
 }
-// ============================================================================
-// CLI detection
-// ============================================================================
-/**
- * Detect which agentic CLI is installed.
- * Returns the first one found, or null if none available.
- */
-export function detectAgenticCLI() {
-    const isWindows = process.platform === 'win32';
-    const inCodexSession = Boolean(process.env.CODEX_SHELL || process.env.CODEX_THREAD_ID || process.env.CODEX_CI);
-    const inClaudeSession = Boolean(process.env.CLAUDE_CODE || process.env.CLAUDECODE);
-    const clis = inCodexSession
-        ? ['codex', 'claude', 'gemini']
-        : inClaudeSession
-            ? ['claude', 'codex', 'gemini']
-            : ['claude', 'codex', 'gemini'];
-    for (const name of clis) {
-        try {
-            execFileSync(isWindows ? 'where' : 'which', [name], { stdio: 'ignore' });
-            return name;
-        }
-        catch {
-            // Not installed
-        }
-    }
-    return null;
-}
-/**
- * Thrown when the detected CLI has no way to confine the triage sub-agent to
- * read-only tools. Triage refuses to run there rather than run unconfined.
- */
-export class UnrestrictableTriageCLIError extends Error {
-    constructor(cli) {
-        super(`Triage cannot run on ${cli}: it has no flag that denies shell and file-write tools to the sub-agent. ` +
-            'Install Claude Code (claude) or Codex CLI (codex), or pass --force to skip triage.');
-        this.name = 'UnrestrictableTriageCLIError';
-    }
-}
-/**
- * Build the CLI command + args for the detected agentic tool.
- *
- * Every runner is confined to read-only access: the prompt includes
- * repo-controlled text, so a hostile pr-rules.yml, CLAUDE.md or diff must not
- * be able to run commands or write files on the developer's machine.
- *   - claude: only the Read/Grep/Glob built-in tools exist in the session, no
- *     permission bypass, no MCP servers, and project/local settings (which can
- *     carry hooks and allow rules) are not loaded.
- *   - codex: the read-only sandbox (no writes, no network) with approvals off.
- *   - gemini: refused; its CLI cannot deny its shell tool from the command line.
- */
-export function buildCommand(cli, prompt, maxTurns) {
-    switch (cli) {
-        case 'claude':
-            return {
-                command: 'claude',
-                args: [
-                    '-p', prompt,
-                    '--max-turns', String(maxTurns),
-                    '--tools', CLAUDE_READ_ONLY_TOOLS,
-                    '--allowedTools', CLAUDE_READ_ONLY_TOOLS,
-                    '--strict-mcp-config',
-                    '--setting-sources', 'user',
-                ],
-            };
-        case 'codex':
-            return {
-                command: 'codex',
-                args: [
-                    '--sandbox', 'read-only',
-                    '--ask-for-approval', 'never',
-                    'exec',
-                    '--ephemeral',
-                    prompt,
-                ],
-            };
-        case 'gemini':
-            throw new UnrestrictableTriageCLIError(cli);
-    }
-}
+const CHECKER_LABEL = {
+    'code-review': 'code review',
+    'rules-validator': 'rules validator',
+};
 /**
- * Spawn a sub-agent process and wait for it to complete.
- * Returns the exit code.
+ * Map a schema-conformant reply onto the CheckerResult shape submit consumes.
+ * Strict mode enforces types, enums and required keys but not non-empty
+ * strings; a finding with a blank file or summary is left out and counted in
+ * `malformed` so the runner reports it, without discarding the other findings.
  */
-function spawnChecker(cli, config, cwd, timeoutMs) {
-    return new Promise((resolve) => {
-        const { command, args } = buildCommand(cli, config.prompt, config.maxTurns);
-        let stdout = '';
-        let stderr = '';
-        const proc = spawn(command, args, {
-            cwd,
-            stdio: ['ignore', 'pipe', 'pipe'],
-            env: {
-                ...process.env,
-                CLAUDECODE: undefined,
-            },
-        });
-        proc.stdout?.on('data', (data) => {
-            stdout += data.toString();
-        });
-        proc.stderr?.on('data', (data) => {
-            stderr += data.toString();
-        });
-        // Timeout
-        const timer = setTimeout(() => {
-            proc.kill('SIGTERM');
-            stderr += `\nProcess killed after ${Math.round(timeoutMs / 1000)}s timeout`;
-        }, timeoutMs);
-        proc.on('close', (code) => {
-            clearTimeout(timer);
-            resolve({ exitCode: code ?? 1, stdout, output: `${stdout}\n${stderr}`.trim() });
-        });
-        proc.on('error', (err) => {
-            clearTimeout(timer);
-            resolve({ exitCode: 1, stdout: '', output: err.message });
-        });
+function toCheckerResult(name, reply) {
+    const usable = reply.findings.filter(finding => finding.file.trim() && finding.summary.trim());
+    const malformed = reply.findings.length - usable.length;
+    const issues = usable.map((finding) => {
+        const issue = {
+            file: finding.file,
+            severity: finding.severity,
+            message: finding.summary,
+            category: finding.category,
+            failureScenario: finding.failureScenario,
+        };
+        if (typeof finding.line === 'number' && finding.line > 0)
+            issue.line = finding.line;
+        if (finding.rule)
+            issue.rule = finding.rule;
+        return issue;
     });
-}
-/**
- * Classify why a checker failed to produce a valid JSON result.
- *
- * - `max_turns`: the sub-agent exhausted its --max-turns budget. Expected when
- *   the diff is too large for the budget; should not block submit.
- * - `timeout`: we killed the process at the configured wall-clock cap. Also non-blocking.
- * - `error`: anything else (auth failure, crash, malformed output). Blocks.
- *
- * The max-turns markers come from the CLIs themselves (Claude CLI prints
- * "Reached max turns", Codex prints "turn limit"). If a new CLI is added, add
- * its marker here — unknown failures fall through to `error` (safe default).
- */
-function classifyCheckerFailure(output) {
-    const summary = summarizeCheckerFailureOutput(output) ?? '(no output)';
-    // Claude: "Reached max turns (N)". Codex/Gemini variants: "turn limit", "max iterations".
-    if (/reached max turns|max turns reached|turn limit|max iterations/i.test(output)) {
-        return { kind: 'max_turns', summary };
-    }
-    // Our own SIGTERM message from spawnChecker.
-    if (/process killed after \d+s timeout/i.test(output)) {
-        return { kind: 'timeout', summary };
-    }
-    return { kind: 'error', summary };
-}
-function summarizeCheckerFailureOutput(output) {
-    const lines = output
-        .split('\n')
-        .map(line => line.trim())
-        .filter(Boolean);
-    if (lines.length === 0)
-        return null;
-    const priorityPatterns = [
-        /not logged in/i,
-        /stream disconnected|error sending request|failed to refresh available models/i,
-        /operation not permitted|readonly database|permission denied/i,
-        /timeout|timed out/i,
-        /unauthorized|forbidden/i,
-        /^error:/i,
-        /failed/i,
-    ];
-    let summary = lines[lines.length - 1];
-    for (const pattern of priorityPatterns) {
-        const match = lines.find(line => pattern.test(line));
-        if (match) {
-            summary = match;
-            break;
-        }
-    }
-    return summary.length > 220
-        ? `${summary.slice(0, 217)}...`
-        : summary;
-}
-// ============================================================================
-// Result reading
-// ============================================================================
-/**
- * Find the last JSON object in the sub-agent's stdout whose `checker` field
- * names this checker. The sub-agent has no write tool, so its final reply is
- * the result; scanning from the end skips any schema echoes earlier on.
- */
-export function extractCheckerJson(stdout, checkerName) {
-    for (let start = stdout.lastIndexOf('{'); start >= 0; start = start > 0 ? stdout.lastIndexOf('{', start - 1) : -1) {
-        const end = findObjectEnd(stdout, start);
-        if (end < 0)
-            continue;
-        const candidate = stdout.slice(start, end + 1);
-        let parsed;
-        try {
-            parsed = JSON.parse(candidate);
-        }
-        catch {
-            // Not a complete JSON object at this brace; keep scanning backwards.
-            continue;
-        }
-        if (parsed && typeof parsed === 'object' && parsed.checker === checkerName) {
-            return candidate;
-        }
-    }
-    return null;
-}
-/** Index of the `}` closing the object that opens at `start`, or -1. Respects JSON strings. */
-function findObjectEnd(text, start) {
-    let depth = 0;
-    let inString = false;
-    for (let i = start; i < text.length; i++) {
-        const ch = text[i];
-        if (inString) {
-            if (ch === '\\')
-                i++;
-            else if (ch === '"')
-                inString = false;
-            continue;
-        }
-        if (ch === '"')
-            inString = true;
-        else if (ch === '{')
-            depth++;
-        else if (ch === '}') {
-            depth--;
-            if (depth === 0)
-                return i;
-        }
-    }
-    return -1;
-}
-/**
- * Validate a checker result JSON string.
- */
-function parseCheckerResult(content) {
-    try {
-        const result = JSON.parse(content);
-        // Basic validation
-        if (!result.checker || !Array.isArray(result.issues) || typeof result.passed !== 'boolean') {
-            return null;
-        }
-        // Ensure issues have required fields
-        result.issues = result.issues.filter((issue) => issue.file && issue.message && issue.severity);
-        // Recalculate passed based on issues
-        result.passed = !result.issues.some((i) => i.severity === 'error');
-        return result;
-    }
-    catch {
-        return null;
-    }
+    const passed = !issues.some(issue => issue.severity === 'error');
+    const result = name === 'rules-validator'
+        ? { checker: name, issues, summary: reply.summary, passed, rulesChecked: reply.rulesChecked ?? 0 }
+        : { checker: name, issues, summary: reply.summary, passed };
+    return { result, malformed };
 }
 // ============================================================================
 // Main runner
 // ============================================================================
 /**
- * Run pre-PR triage checks using parallel sub-agent processes.
+ * Run pre-PR triage checks in parallel.
  *
  * @param gitRoot - Absolute path to the git repository root
  * @param baseBranch - The base branch to diff against (e.g., "main")
  * @returns Aggregated triage results
- * @throws If no agentic CLI is detected
  */
 export async function runTriage(gitRoot, baseBranch, options = {}) {
     const startTime = Date.now();
-    // Merge defaults with caller-provided overrides. The caller (submit.ts) is
-    // responsible for layering CLI flags on top of .haystack.json values before
-    // calling us — we just see a flat override map.
-    const maxTurns = { ...DEFAULT_MAX_TURNS };
-    for (const [name, value] of Object.entries(options.maxTurns ?? {})) {
-        if (typeof value === 'number' && value > 0) {
-            maxTurns[name] = value;
-        }
-    }
-    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    // Detect CLI
-    const cli = detectAgenticCLI();
-    if (!cli) {
-        throw new Error('No agentic CLI found. Install Claude Code (claude) or Codex CLI (codex); Gemini CLI cannot be confined to read-only tools, so triage does not use it.');
-    }
-    // Refuse runners that cannot be confined to read-only tools.
-    if (cli === 'gemini') {
-        throw new UnrestrictableTriageCLIError(cli);
-    }
-    // Fast-fail in Codex app shells where outbound network is disabled.
-    // Spawning nested `codex exec` will fail after retries; skip triage immediately instead.
-    const codexNetworkDisabled = process.env.CODEX_SANDBOX_NETWORK_DISABLED === '1';
-    if (cli === 'codex' && codexNetworkDisabled) {
-        throw new Error('Codex shell has network disabled (CODEX_SANDBOX_NETWORK_DISABLED=1), so triage sub-agents cannot run. Re-run outside this sandbox or use --force.');
-    }
-    console.log(chalk.dim(`  Using: ${cli}`));
+    const stallMs = options.timeoutMs ?? DEFAULT_STALL_MS;
+    console.log(chalk.dim(`  Reviewer: ${TRIAGE_MODEL} (reasoning effort ${TRIAGE_REASONING_EFFORT})`));
     // Prepare output directory
     const triageDir = join(gitRoot, TRIAGE_DIR);
     if (existsSync(triageDir)) {
@@ -351,132 +108,93 @@ export async function runTriage(gitRoot, baseBranch, options = {}) {
     mkdirSync(triageDir, { recursive: true });
     // Resolve the ref to diff against once. Prefers origin/<base> over the bare
     // local <base> ref (which is often stale and balloons the diff with already-
-    // merged code). Every git read below — the precomputed diff, the agent diff
-    // commands in the prompts use this single resolved ref so they all see the
-    // same fork point.
+    // merged code).
     const diffBaseRef = resolveDiffBaseRef(baseBranch);
     if (diffBaseRef !== baseBranch) {
         console.log(chalk.dim(`  Diff base: ${diffBaseRef}`));
     }
-    // Compute the diff here: sub-agents have no command tool, so they cannot run
-    // git diff themselves. Includes 10 lines of context around each hunk for
-    // reviewability. argv, not a shell string: the ref comes from a branch name.
-    let diffOutput;
+    // 10 lines of context per hunk: the reviewer sees only the diff. argv, not a
+    // shell string: the ref comes from a branch name.
+    let diff;
     try {
-        diffOutput = execFileSync('git', ['diff', '-U10', '--end-of-options', `${diffBaseRef}...HEAD`], { cwd: gitRoot, encoding: 'utf-8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+        diff = execFileSync('git', ['diff', '-U10', '--end-of-options', `${diffBaseRef}...HEAD`], { cwd: gitRoot, encoding: 'utf-8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] }).trim();
     }
     catch (err) {
         const stderr = err?.stderr?.toString().trim();
         const cause = stderr || (err instanceof Error ? err.message : String(err));
         throw new Error(`Could not compute the triage diff against ${diffBaseRef}: ${cause}`);
     }
-    // Always write the diff to a file; inline it only when small enough. Larger
-    // diffs are read from the file in chunks by the agent's read tool.
-    const diffPath = join(triageDir, 'diff.patch');
-    writeFileSync(diffPath, diffOutput);
-    const diff = {
-        inline: diffOutput.length <= MAX_INLINE_DIFF_CHARS ? diffOutput : null,
-        path: diffPath,
-    };
+    writeFileSync(join(triageDir, 'diff.patch'), diff);
     // Build checker configs
     const checkers = [];
     // 1. Code review (always runs)
-    const codeReviewOutput = join(triageDir, 'code-review.json');
     checkers.push({
         name: 'code-review',
-        prompt: buildCodeReviewPrompt(diffBaseRef, diff, maxTurns['code-review'], timeoutMs),
-        outputFile: codeReviewOutput,
-        maxTurns: maxTurns['code-review'],
+        prompt: buildCodeReviewPrompt(diffBaseRef, diff),
+        schema: CODE_REVIEW_SCHEMA,
+        outputFile: join(triageDir, 'code-review.json'),
     });
     // 2. Rules validator (if pr-rules.yml or agent instruction files exist)
     const rulesPath = join(gitRoot, '.haystack', 'pr-rules.yml');
-    const hasRulesYaml = existsSync(rulesPath);
-    const rulesYaml = hasRulesYaml ? readFileSync(rulesPath, 'utf-8') : '';
-    const agentPolicyFiles = discoverAgentPolicyFiles(gitRoot);
-    if (hasRulesYaml || agentPolicyFiles.length > 0) {
-        const rulesValidatorOutput = join(triageDir, 'rules-validator.json');
-        const rulesPrompt = buildRulesValidatorPrompt(diffBaseRef, rulesYaml, diff, maxTurns['rules-validator'], timeoutMs, agentPolicyFiles);
-        if (rulesPrompt) {
-            checkers.push({
-                name: 'rules-validator',
-                prompt: rulesPrompt,
-                outputFile: rulesValidatorOutput,
-                maxTurns: maxTurns['rules-validator'],
-            });
-        }
+    const rulesYaml = existsSync(rulesPath) ? readFileSync(rulesPath, 'utf-8') : '';
+    const rulesPrompt = buildRulesValidatorPrompt(diffBaseRef, rulesYaml, diff, discoverAgentPolicyFiles(gitRoot));
+    if (rulesPrompt) {
+        checkers.push({
+            name: 'rules-validator',
+            prompt: rulesPrompt,
+            schema: RULES_VALIDATOR_SCHEMA,
+            outputFile: join(triageDir, 'rules-validator.json'),
+        });
     }
-    // Log what we're running
-    const checkerNames = checkers.map(c => c.name);
-    console.log(chalk.dim(`  Checkers: ${checkerNames.join(', ')}`));
+    console.log(chalk.dim(`  Checkers: ${checkers.map(c => c.name).join(', ')}`));
     console.log(chalk.dim(`  Running ${checkers.length} checker(s) in parallel...\n`));
-    // Spawn all checkers in parallel
-    const spawnResults = await Promise.allSettled(checkers.map(async (checker) => {
-        const startLabel = chalk.dim(`  [${checker.name}]`);
-        console.log(`${startLabel} Starting...`);
-        const result = await spawnChecker(cli, checker, gitRoot, timeoutMs);
-        if (result.exitCode === 0) {
-            console.log(`${startLabel} ${chalk.green('Done')}`);
+    const settled = await Promise.allSettled(checkers.map(async (checker) => {
+        const label = chalk.dim(`  [${checker.name}]`);
+        console.log(`${label} Starting...`);
+        try {
+            const reply = await callAstra({
+                instructions: checker.prompt.instructions,
+                input: checker.prompt.input,
+                schemaName: checker.name.replace('-', '_'),
+                schema: checker.schema,
+                stallMs,
+            });
+            const mapped = toCheckerResult(checker.name, reply);
+            writeFileSync(checker.outputFile, JSON.stringify(mapped.result, null, 2));
+            console.log(`${label} ${chalk.green('Done')}`);
+            return mapped;
         }
-        else {
-            console.log(`${startLabel} ${chalk.yellow(`Exited with code ${result.exitCode}`)}`);
+        catch (err) {
+            console.log(`${label} ${chalk.yellow('Failed')}`);
+            throw err;
         }
-        return { checker, result };
     }));
-    // Collect results
     const results = [];
     const errors = [];
-    const warnings = [];
-    for (const spawnResult of spawnResults) {
-        if (spawnResult.status === 'rejected') {
-            errors.push(`Checker failed: ${spawnResult.reason}`);
-            trackError('triage_checker_failed', {
-                checker: 'unknown',
-                kind: 'spawn_rejected',
-                cli,
-                reason: String(spawnResult.reason),
-            });
-            continue;
-        }
-        const { checker, result } = spawnResult.value;
-        const checkerJson = extractCheckerJson(result.stdout, checker.name);
-        const checkerResult = checkerJson ? parseCheckerResult(checkerJson) : null;
-        if (checkerJson && checkerResult) {
-            // Keep the on-disk result artifact the sub-agent used to write itself.
-            writeFileSync(checker.outputFile, checkerJson);
-            results.push(checkerResult);
-            continue;
-        }
-        // Sub-agent didn't produce valid output — classify as warning vs hard error.
-        const classification = classifyCheckerFailure(result.output);
-        if (classification.kind === 'max_turns') {
-            warnings.push(`${checker.name}: hit max turns (${checker.maxTurns}) — raise via --max-turns or .haystack.json triage.maxTurns, or split the PR into smaller changes`);
-        }
-        else if (classification.kind === 'timeout') {
-            warnings.push(`${checker.name}: wall-clock timeout after ${Math.round(timeoutMs / 1000)}s — consider splitting the PR`);
-        }
-        else {
-            const exitPart = result.exitCode !== 0 ? ` (exit ${result.exitCode})` : '';
-            errors.push(`${checker.name}: ${classification.summary}${exitPart}`);
+    settled.forEach((outcome, index) => {
+        const checker = checkers[index];
+        if (outcome.status === 'fulfilled') {
+            results.push(outcome.value.result);
+            if (outcome.value.malformed > 0) {
+                errors.push(`${CHECKER_LABEL[checker.name]} returned ${outcome.value.malformed} finding(s) with an empty file or summary; they were left out`);
+            }
+            return;
         }
-        // Emit telemetry for every failed checker so we can tune defaults empirically.
+        const message = outcome.reason instanceof Error ? outcome.reason.message : String(outcome.reason);
+        errors.push(`${CHECKER_LABEL[checker.name]} failed: ${message}`);
         trackError('triage_checker_failed', {
             checker: checker.name,
-            kind: classification.kind,
-            cli,
-            max_turns: checker.maxTurns,
-            timeout_ms: timeoutMs,
-            exit_code: result.exitCode,
-            summary: classification.summary,
+            model: TRIAGE_MODEL,
+            stall_ms: stallMs,
+            summary: message.slice(0, 220),
         });
-    }
-    // Warnings are non-blocking by design — they're expected outcomes of the
-    // turn/time caps, not signs of real problems.
-    const passed = results.every(r => r.passed) && errors.length === 0;
+    });
+    // A checker that failed to run gives no signal either way; only findings
+    // with severity "error" fail triage.
     return {
-        passed,
+        passed: results.every(r => r.passed),
         results,
         errors,
-        warnings,
         duration: Date.now() - startTime,
     };
 }

package/dist/triage/types.js

@@ -1,7 +1,7 @@
 /**
  * Types for the pre-PR triage system.
  *
- * Sub-agents write results as JSON files matching these schemas.
- * The runner reads and aggregates them.
+ * Each checker is one structured gpt-6-astra call (see astra.ts); the runner
+ * maps its findings onto these shapes and aggregates them.
  */
 export {};

package/dist/types.js

@@ -271,12 +271,8 @@ const SecretDeclarationSchema = z.object({
 // =============================================================================
 // TRIAGE CONFIGURATION
 // =============================================================================
-const TriageCheckerNameSchema = z.enum(['code-review', 'rules-validator']);
 const TriageConfigSchema = z.object({
-    /** Per-checker max agentic turns. Unspecified checkers use built-in defaults.
-     *  partialRecord, because zod 4's z.record() with enum keys requires every key. */
-    maxTurns: z.partialRecord(TriageCheckerNameSchema, z.number().int().positive()).optional(),
-    /** Wall-clock timeout per checker, in milliseconds. */
+    /** Abort a checker when its model stream has been silent this long, in milliseconds. */
     timeoutMs: z.number().int().positive().optional(),
 });
 // =============================================================================
@@ -322,6 +318,6 @@ export const HaystackConfigSchema = z.object({
     secrets: z.record(z.string(), SecretDeclarationSchema).optional(),
     /** Merge queue configuration for autonomous PR maintenance */
     merge_queue: MergeQueueConfigSchema.optional(),
-    /** Pre-PR triage configuration (turn budgets, timeouts) */
+    /** Pre-PR triage configuration (stall timeout) */
     triage: TriageConfigSchema.optional(),
 });

package/dist/utils/haystack-api.js

@@ -39,6 +39,12 @@ function headers(token, extra) {
  */
 export const SUBSCRIPTION_REQUIRED_CODE = 'subscription_required';
 export const SUBSCRIPTION_REQUIRED_MESSAGE = 'This account has no active Haystack subscription. See https://haystack.sh/pricing or email akshay@haystack.sh to get access.';
+/**
+ * The server returns this `error` code (HTTP 403) when the account is not
+ * entitled to the repository a request addresses (entitlement is per
+ * repository and team). Its message names the repository; print it as is.
+ */
+export const REPO_NOT_ENTITLED_CODE = 'repo_not_entitled';
 /**
  * Extract the server's own message (and its `error` code) if the body is
  * JSON; truncate raw bodies.
@@ -78,6 +84,12 @@ export async function classifyHttpError(response, context) {
     if (response.status === 403 && code === SUBSCRIPTION_REQUIRED_CODE) {
         return new HaystackApiError(403, SUBSCRIPTION_REQUIRED_MESSAGE, code);
     }
+    if (response.status === 403 && code === REPO_NOT_ENTITLED_CODE) {
+        const message = detail && detail !== code
+            ? detail.replace(/\s+/g, ' ').trim()
+            : 'This account is not entitled to use Haystack on this repository. See https://haystack.sh/pricing or email akshay@haystack.sh to get access.';
+        return new HaystackApiError(403, message, code);
+    }
     if (response.status === 401) {
         return new HaystackApiError(401, `${context}: authentication failed${suffix}. Run \`haystack login\` to re-authenticate.`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {
@@ -40,6 +40,7 @@
     "url": "https://github.com/haystackeditor/haystack-review/issues"
   },
   "dependencies": {
+    "@aws-sdk/client-ssm": "3.987.0",
     "@babel/core": "8.0.6",
     "@inquirer/prompts": "8.7.2",
     "@modelcontextprotocol/sdk": "1.26.0",