@haystackeditor/cli 0.19.0 → 0.20.0

package/dist/commands/verify-precompute.js

@@ -13,6 +13,7 @@ import { trackPrecomputeEvent } from '../utils/telemetry.js';
 import { findSecretsInPatch, isSecretBearingPath } from '../utils/secret-paths.js';
 import { startPrecomputeDelivery } from './precompute-delivery.js';
 import { CRAWL_BUDGET_MAX_MS, CRAWL_BUDGET_MIN_MS, CRAWL_TITLE_MAX_CHARS } from './crawl-contract.js';
+import { blockLines, parseOnboardingBlock } from './verify-onboarding.js';
 // --hook has five seconds to capture the exact source and publish local custody.
 // Its detached sender owns the bounded network delivery and acknowledgement.
 // An explicit invocation still waits synchronously for the server response.
@@ -66,7 +67,7 @@ function gitOutput(args, gitRoot, deadline, options = {}) {
         throw new PrecomputeFailure('Could not derive the repository snapshot.');
     }
 }
-function resolveOriginRepository(gitRoot) {
+export function resolveOriginRepository(gitRoot) {
     try {
         const remote = parseRemoteUrl('origin');
         if (!isRepositoryComponent(remote.owner)
@@ -80,8 +81,8 @@ function resolveOriginRepository(gitRoot) {
         throw new PrecomputeFailure('No supported origin repository was found.');
     }
 }
-/** The shared base rule (utils/verify-base.ts), bounded by the hook's deadline. */
-function deriveBaseSha(gitRoot, deadline) {
+/** The shared base rule (utils/verify-base.ts), bounded by the caller's deadline. */
+export function deriveBaseSha(gitRoot, deadline) {
     try {
         return resolveVerifyBaseSha('HEAD', {
             run: (args, options) => gitOutput(args, gitRoot, deadline, options?.remote
@@ -332,7 +333,8 @@ function readWalkerStatus(value) {
     }
     throw new PrecomputeFailure('The precompute service returned an invalid walker status.');
 }
-const CRAWL_UNAVAILABLE_REASONS = ['not-configured', 'runner-unavailable', 'profile-ambiguous', 'superseded', 'enqueue-failed'];
+const CRAWL_UNAVAILABLE_REASONS = ['runner-unavailable', 'superseded', 'enqueue-failed'];
+const isOnboardRunId = (value) => typeof value === 'string' && /^ob_[0-9a-f]{48}$/.test(value);
 function readCrawlHookStatus(value) {
     if (value && typeof value === 'object' && !Array.isArray(value)) {
         const record = value;
@@ -343,6 +345,18 @@ function readCrawlHookStatus(value) {
             const reason = CRAWL_UNAVAILABLE_REASONS.find(known => known === record.reason);
             if (record.status === 'unavailable' && reason !== undefined)
                 return { status: record.status, reason };
+            // Crawl amendment 8: the base has no published onboarding record yet.
+            if (record.status === 'onboarding' && isOnboardRunId(record.onboardRunId))
+                return { status: 'onboarding', onboardRunId: record.onboardRunId };
+        }
+        if (Object.keys(record).length === 3 && record.status === 'onboarding-blocked'
+            && (record.onboardRunId === null || isOnboardRunId(record.onboardRunId))) {
+            try {
+                return { status: 'onboarding-blocked', onboardRunId: record.onboardRunId, block: parseOnboardingBlock(record.block) };
+            }
+            catch (error) {
+                throw new PrecomputeFailure(`The precompute service returned an invalid onboarding block (${error instanceof Error ? error.message : String(error)}).`);
+            }
         }
     }
     throw new PrecomputeFailure('The precompute service returned an invalid crawl status.');
@@ -350,9 +364,7 @@ function readCrawlHookStatus(value) {
 /** Why the service could not start a crawl, in plain words. */
 export function crawlUnavailableText(reason) {
     switch (reason) {
-        case 'not-configured': return 'this repository is not set up for crawling yet';
         case 'runner-unavailable': return 'no machine that can crawl this repository is available right now';
-        case 'profile-ambiguous': return 'the machines that crawl this repository disagree about how to run it';
         case 'superseded': return 'a newer stop in this repository came first';
         case 'enqueue-failed': return 'the service could not queue it';
     }
@@ -449,6 +461,11 @@ function printResult(result) {
         console.log(`A matching crawl already exists (${crawl.runId}).`);
     else if (crawl?.status === 'unavailable')
         console.log(`Crawl unavailable: ${crawlUnavailableText(crawl.reason)}.`);
+    else if (crawl?.status === 'onboarding') {
+        console.log(`The app is being onboarded for this base (${crawl.onboardRunId}); the crawl runs when it is ready. Run \`haystack verify\` to follow it.`);
+    }
+    else if (crawl?.status === 'onboarding-blocked')
+        console.log(blockLines(crawl.block).join('\n'));
     else
         console.log('Crawl status was not reported by the service.');
 }

package/dist/commands/verify.js

@@ -1,5 +1,6 @@
 /**
- * `haystack verify` — the crawl of the current change (CRAWL-V1, amendment 1).
+ * `haystack verify` — the crawl of the current change (CRAWL-V1, amendments 1
+ * and 8).
  *
  * It captures the checkout (committed and uncommitted) exactly as the stop
  * hook does, finds the caller's crawl for that exact capture (its code and its
@@ -13,14 +14,23 @@
  * it; it stops at the crawl's answer at its budget, or when the crawl ends, and
  * prints where the change shows up in the running app and what the crawl found.
  * The hosted fleet run of pushed commits is `haystack verify hosted start|status`.
+ *
+ * A base the service has not onboarded yet answers the submission `onboarding`
+ * (APP-ONBOARDING-V1): the command follows the onboarding's stage list until
+ * it is ready, then submits the capture again, which finds the crawl the
+ * service admitted from the first submission (or starts it), and follows that.
+ * A blocked onboarding prints why and exactly what would unblock it.
  */
+import { execFileSync } from 'node:child_process';
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
+import { findGitRoot } from '../utils/hooks.js';
 import { resolveAuthContext } from '../utils/auth.js';
 import { classifyHttpError, HaystackApiError } from '../utils/haystack-api.js';
 import { GATEWAY_TIMEOUT_MS, gatewayFetch } from './case-batch.js';
 import { CRAWL_BUDGET_MAX_MS, CRAWL_BUDGET_MIN_MS, CRAWL_MAX_FINDINGS, CRAWL_MAX_FINDING_STEPS, CRAWL_WAIT_MAX_MS, } from './crawl-contract.js';
 import { captureCheckout, crawlUnavailableText, EXPLICIT_WALL_MS, normalModeFailure, postPrecomputeCapture, } from './verify-precompute.js';
+import { formatOnboarding, onboardingExitCode, readOnboardingStatus, reportOnboardingState, waitForOnboarding } from './verify-onboarding.js';
 const CRAWLS_PATH = '/api/agent/cloud-verifier/crawls';
 /** A held read (waitAfter): the service's hold, then the time any read gets. */
 const HELD_READ_TIMEOUT_MS = CRAWL_WAIT_MAX_MS + GATEWAY_TIMEOUT_MS;
@@ -73,7 +83,8 @@ const SPOT_WORDS = {
     pressed: 'ran when its control was pressed',
     observed: 'a difference seen',
     confirmed: 'a difference seen and confirmed',
-    judged: 'judged a bug',
+    // The stage, not the verdict: a judged difference may be judged not a bug. The findings carry the verdicts.
+    judged: 'a difference seen, confirmed and judged',
 };
 const VERDICT_WORDS = {
     bug: 'Bug',
@@ -336,7 +347,9 @@ function headline(view) {
 }
 function spotLines(spot) {
     const how = spot.furthest === null ? 'never reached' : SPOT_WORDS[spot.furthest];
-    const lines = [`  ${chalk.bold(`${safe(spot.file)}:${spot.line}`)}  ${how}`];
+    const found = spot.findingIds.length === 0 ? ''
+        : ` (${spot.findingIds.length} finding${spot.findingIds.length === 1 ? '' : 's'} below)`;
+    const lines = [`  ${chalk.bold(`${safe(spot.file)}:${spot.line}`)}  ${how}${found}`];
     if (spot.reachedBy) {
         lines.push(`      reached by: ${[spot.reachedBy.start, ...spot.reachedBy.steps].map(safe).join(' > ')}`);
         if (spot.reachedBy.page !== null)
@@ -530,7 +543,8 @@ function staleWords(found, stale) {
 }
 /** Submits the capture through the explicit precompute submission when no crawl
  * of it exists or the one found is stale. Returns the acknowledged run id (null
- * when no crawl could be started) and the line to report. */
+ * when no crawl could be started), whether the base is being onboarded or its
+ * onboarding is blocked, and the line to report. */
 async function submitCapture(capture, token, found) {
     let acknowledgment;
     // A momentary 429/5xx (a server or runner restarting) is asked again, as the stop hook's sender does: admission is
@@ -550,23 +564,55 @@ async function submitCapture(capture, token, found) {
     const crawl = acknowledgment.crawl;
     const before = found === null ? 'No crawl existed for this change' : staleWords(found.view, found.stale);
     if (crawl === undefined) {
-        return { runId: null, line: `${before}, and the service did not say whether it started ${found === null ? 'one' : 'another'}.` };
+        return { runId: null, onboarding: null,
+            line: `${before}, and the service did not say whether it started ${found === null ? 'one' : 'another'}.` };
     }
     if (crawl.status === 'unavailable') {
-        return { runId: null, line: `${before}, and ${found === null ? 'none' : 'another'} could not be started: ${crawlUnavailableText(crawl.reason)}.` };
+        return { runId: null, onboarding: null,
+            line: `${before}, and ${found === null ? 'none' : 'another'} could not be started: ${crawlUnavailableText(crawl.reason)}.` };
+    }
+    if (crawl.status === 'onboarding') {
+        return { runId: null, onboarding: 'onboarding', line: `${before}. The app is not onboarded for this base yet: `
+                + `the service is preparing it (${crawl.onboardRunId}) and runs the crawl when it is ready.` };
+    }
+    if (crawl.status === 'onboarding-blocked') {
+        return { runId: null, onboarding: 'onboarding-blocked', line: `${before}, and the app's onboarding for this base is blocked.` };
     }
     if (found === null) {
-        return { runId: crawl.runId, line: crawl.status === 'queued'
+        return { runId: crawl.runId, onboarding: null, line: crawl.status === 'queued'
                 ? `No crawl existed for this change yet; started one (${crawl.runId}).`
                 : `The service already had a crawl for this change (${crawl.runId}).` };
     }
     if (!anotherCrawl(found.stale) && crawl.runId === found.view.runId) {
-        return { runId: crawl.runId, line: `${before}; asked the service to run it again.` };
+        return { runId: crawl.runId, onboarding: null, line: `${before}; asked the service to run it again.` };
     }
-    return { runId: crawl.runId, line: crawl.status === 'queued'
+    return { runId: crawl.runId, onboarding: null, line: crawl.status === 'queued'
             ? `${before}; started one for this change (${crawl.runId}).`
             : `${before}; the service already had one for this change (${crawl.runId}).` };
 }
+function checkedChange(baseCommit, workCommit) {
+    const gitRoot = findGitRoot();
+    if (!gitRoot)
+        throw new Error('Run this command from a git repository.');
+    const files = execFileSync('git', ['diff', '--name-only', '-z', '--no-renames', baseCommit, workCommit], { cwd: gitRoot, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }).split('\0').filter(path => path !== '');
+    return { baseCommit, workCommit, files };
+}
+/** One line naming what the crawl checks, so an agent knows which edits it covers. */
+function checkedLine(change) {
+    const shown = change.files.slice(0, 5).join(', ');
+    const more = change.files.length > 5 ? ` and ${change.files.length - 5} more` : '';
+    return `Checking ${change.files.length} changed file${change.files.length === 1 ? '' : 's'} against ${change.baseCommit.slice(0, 12)}`
+        + ` (where HEAD meets origin's default branch), committed and uncommitted: ${shown}${more}.`;
+}
+/** Prints the onboarding (and nothing else) as the command's answer: `--json`
+ * carries OnboardingStatusV1. A block exits 3: its ask says what to do. */
+function finishWithOnboarding(status, json, change) {
+    if (json)
+        process.stdout.write(`${JSON.stringify(withSchema('verify', { change, onboarding: status, crawl: null }), null, 2)}\n`);
+    else
+        console.log(formatOnboarding(status));
+    process.exitCode = onboardingExitCode(status);
+}
 export async function verifyCommand(options) {
     // In --json mode stdout carries the one document; every other line goes to stderr.
     const note = (line) => { if (options.json)
@@ -575,12 +621,17 @@ export async function verifyCommand(options) {
         console.log(line); };
     const capture = await captureCheckout(Date.now() + EXPLICIT_WALL_MS, repositoryOverride(options.repo), minutesOption(options.minutes));
     const request = capture.derivation.request;
+    const change = checkedChange(request.baseCommit, request.workCommit);
     if (!request.crawl) {
         note(`Nothing to verify: this checkout has no changes against ${request.baseCommit.slice(0, 12)}.`);
         if (options.json)
-            process.stdout.write(`${JSON.stringify(withSchema('verify', { crawl: null }), null, 2)}\n`);
+            process.stdout.write(`${JSON.stringify(withSchema('verify', { change, onboarding: null, crawl: null }), null, 2)}\n`);
         return;
     }
+    note(checkedLine(change));
+    // Measured: a 3-minute crawl answered 13 minutes after the command started (building and preparing both apps).
+    note('A crawl often takes 10 to 15 minutes. If this command times out or is stopped, the crawl keeps going:'
+        + ' run `haystack verify` again to pick up the same crawl.');
     const identity = {
         repository: `${request.owner}/${request.repository}`,
         baseCommit: request.baseCommit,
@@ -591,14 +642,32 @@ export async function verifyCommand(options) {
     };
     const auth = await resolveAuthContext({ preferredLogin: options.account, owner: request.owner, repo: request.repository });
     let view = await readCrawl(identity, auth.token);
+    let onboarding = null;
     const stale = view === null ? null : staleCrawl(view, identity);
     if (view === null || stale !== null) {
         const found = view === null || stale === null ? null : { view, stale };
-        const submitted = await submitCapture(capture, auth.token, found);
+        let submitted = await submitCapture(capture, auth.token, found);
         note(submitted.line);
+        if (submitted.onboarding !== null) {
+            onboarding = await readOnboardingStatus(identity.repository, identity.baseCommit, auth.token);
+            reportOnboardingState(onboarding);
+            if (options.wait !== false && onboarding.state === 'onboarding') {
+                onboarding = await waitForOnboarding(onboarding, auth.token, progress, 'haystack verify');
+                reportOnboardingState(onboarding);
+            }
+            if (onboarding.state !== 'ready') {
+                finishWithOnboarding(onboarding, options.json, change);
+                return;
+            }
+            // Ready: the service admitted the waiting crawl when the record published; this
+            // submission of the same capture finds it (or starts it, when a newer stop replaced it).
+            note('The app is onboarded for this base.');
+            submitted = await submitCapture(capture, auth.token, found);
+            note(submitted.line);
+        }
         if (submitted.runId === null) {
             if (options.json)
-                process.stdout.write(`${JSON.stringify(withSchema('verify', { crawl: null }), null, 2)}\n`);
+                process.stdout.write(`${JSON.stringify(withSchema('verify', { change, onboarding, crawl: null }), null, 2)}\n`);
             process.exitCode = 1;
             return;
         }
@@ -611,9 +680,13 @@ export async function verifyCommand(options) {
         view = await waitForCrawl(view, identity, auth.token);
     }
     if (options.json)
-        process.stdout.write(`${JSON.stringify(withSchema('verify', { crawl: view }), null, 2)}\n`);
-    else
+        process.stdout.write(`${JSON.stringify(withSchema('verify', { change, onboarding, crawl: view }), null, 2)}\n`);
+    else {
         console.log(formatCrawl(view));
+        const notes = [...(onboarding?.dataAbsences ?? []), ...(onboarding?.versionChoices ?? [])];
+        if (notes.length)
+            console.log(['', ...notes.map(note => `Note: ${safe(note)}`)].join('\n'));
+    }
     const exitCode = crawlExitCode(view);
     if (exitCode !== 0)
         process.exitCode = exitCode;

package/dist/index.js

@@ -6,7 +6,7 @@
  * Automated PR review, triage, and merge queue for AI-assisted development.
  *
  * Usage:
- *   npx @haystackeditor/cli init           # Set up .haystack.json
+ *   npx @haystackeditor/cli init           # Set this repository up for `haystack verify`
  *   npx @haystackeditor/cli setup          # Interactive onboarding wizard
  *   npx @haystackeditor/cli status         # Check configuration
  *   npx @haystackeditor/cli login          # Authenticate with GitHub
@@ -133,7 +133,7 @@ function getVersion() {
 const program = new Command();
 program
     .name('haystack')
-    .description('Haystack CLI — automated PR review, triage, and merge queue')
+    .description('Haystack CLI — haystack verify runs your app with and without a change and shows what it broke')
     .version(getVersion())
     // commander 13 made surplus positional arguments an error; the CLI has always
     // ignored them. Every command created below inherits this setting.
@@ -144,18 +144,38 @@ program
     .action((name) => (name ? schemaCommand(name) : listSchemas()));
 program
     .command('init')
-    .description('Create .haystack.json configuration')
-    .option('-f, --force', 'Overwrite existing .haystack.json')
+    .description('Set this repository up for `haystack verify` and start onboarding the app')
+    .option('-y, --yes', 'Make the changes without asking')
+    .option('--json', 'The result as one JSON document on stdout (see `haystack schema init`)')
     .addHelpText('after', `
-This creates a .haystack.json file with auto-detected settings:
-  • Dev server command and port
-  • Services (for monorepos)
-  • Auth bypass for CI environments
+There is no setup file: Haystack works out how to run the app from what the
+repository already keeps working. init shows each change as a diff, then makes
+it with --yes (or a yes at the prompt):
+  • Claude Code's Stop hook (\`haystack verify precompute --hook\`) in the
+    per-developer .claude/settings.local.json, kept out of commits, when
+    Claude Code is in use here
+  • a short note in AGENTS.md (and CLAUDE.md when the repository keeps one)
+    telling coding agents to run \`haystack verify\` after a change
+Then it starts onboarding the app, so it is usually ready by the first
+\`haystack verify\`. Running it again changes only what is missing and shows
+where onboarding is (\`haystack verify onboarding\` shows that too).
 
-After running, use \`haystack setup\` to scan your repos for rules,
-CI signals, and review policies.
+Exit codes:
+  0  set up: onboarding is running or the app is ready
+  1  the command failed
+  2  changes were shown but not made: run \`haystack init --yes\`
+  3  onboarding is blocked: the output says what would unblock it
+  4  not logged in: run \`haystack login\`
+  5  the Haystack GitHub App is not installed on the repository's owner:
+     the output links to it
+  6  set up, but onboarding stopped before finishing: run \`haystack init\` again
+
+Examples:
+  haystack init
+  haystack init --yes
+  haystack init --yes --json
 `)
-    .action(initCommand);
+    .action(options => runPublicCommand(() => initCommand(options), options.json));
 program
     .command('setup')
     .description('Onboarding wizard — scan repos for rules/policies and write Haystack config')
@@ -233,13 +253,22 @@ changed spot, how far the crawl got with it, and the steps that reached it),
 what the crawl found (bugs first, with the steps to see each), and the changed
 code it never ran.
 
+The first verify on a base the service has not onboarded yet prepares the app
+(reads the repository, plans how to run it, builds its runtime, starts it,
+prepares its data and test accounts, proves a workflow); the command shows each
+step, and the crawl runs once the app is ready. When onboarding cannot go on it
+says why and what would unblock it, for example a question to answer with
+\`haystack verify answer <question-id> <choice>\`.
+
 Exit codes:
   0  the crawl answered or finished (the bugs it found are in the output), or
      it is still running and --no-wait was given
   1  the command failed, or no crawl could be started for this change
   2  the crawl ended without finishing: it stopped early or was cancelled
      (a newer stop in the repository replaces an older crawl), or the
-     machines it used could not be proven shut down
+     machines it used could not be proven shut down; or onboarding stopped
+     before finishing
+  3  onboarding is blocked: the output says what would unblock it
 
 The hosted fleet run of pushed commits is \`haystack verify hosted start\`.
 
@@ -273,6 +302,49 @@ function verifyCommandOptions(command) {
     }
     return options;
 }
+verify
+    .command('answer')
+    .description('Answer a question onboarding asked about your app, then run `haystack init` to continue')
+    .argument('<question-id>', 'The question id onboarding printed')
+    .argument('<choice>', 'One of the question\'s choices, exactly as printed')
+    .option('--repo <owner/repo>', 'GitHub repository (default: origin remote)')
+    .option('--account <login>', 'Use a specific saved Haystack account')
+    .option('--json', 'The repository\'s onboarding facts after the answer, as one JSON document')
+    .addHelpText('after', `
+An answer is a fact about your app (never setup); onboarding plans from it the
+next time it runs, so \`haystack init\` or a new \`haystack verify\` continues
+from there.
+
+Example:
+  haystack verify answer q_<id> "postgres 15 (terraform/db.tf)"
+`)
+    .action(async (questionId, choice, _options, cmd) => {
+    const options = verifyCommandOptions(cmd);
+    const { verifyAnswerCommand } = await import('./commands/verify-onboarding.js');
+    return runPublicCommand(() => verifyAnswerCommand(questionId, choice, options), options.json);
+});
+verify
+    .command('onboarding')
+    .description('Show where onboarding of this checkout\'s base is, without starting anything')
+    .option('--account <login>', 'Use a specific saved Haystack account')
+    .option('--wait', 'Follow onboarding until it is ready, blocked or stopped')
+    .option('--json', 'The onboarding as one JSON document (see `haystack schema verify-onboarding`)')
+    .addHelpText('after', `
+Reads the onboarding of the base \`haystack verify\` would use for this
+checkout. \`haystack init\` starts it; so does the first \`haystack verify\`.
+
+Exit codes:
+  0  the app is ready, or onboarding is running
+  1  the command failed
+  2  onboarding has not started, stopped before finishing, or was cancelled:
+     \`haystack init\` starts it again
+  3  onboarding is blocked: the output says what would unblock it
+`)
+    .action(async (_options, cmd) => {
+    const options = verifyCommandOptions(cmd);
+    const { verifyOnboardingCommand } = await import('./commands/verify-onboarding.js');
+    return runPublicCommand(() => verifyOnboardingCommand(options), options.json);
+});
 verify
     .command('history')
     .description('Read your recent finished hosted verification runs without starting a run')
@@ -570,6 +642,15 @@ program
     .option('--label <name>', '(--headless) Label to display in the dashboard for this token')
     .option('--scope <repos>', '(--headless) Comma-separated repos to scope the token to (or "all")', (val) => val.split(',').map((s) => s.trim()).filter(Boolean))
     .option('--token <hsk_live_...>', '(--headless) Skip the browser handshake — paste a token minted in the dashboard')
+    .option('--no-wait', 'Print the sign-in URL and code and return; the next `haystack login` finishes signing in')
+    .option('--json', 'The sign-in (URL and code, or the account signed in) as one JSON document (see `haystack schema login`)')
+    .addHelpText('after', `
+Signing in uses GitHub's device flow: open the URL, enter the code. A coding
+agent runs \`haystack login --no-wait\`, shows the person the URL and code, and
+then runs \`haystack login\`, which waits until the code is entered. A login
+stopped while it waits is finished the same way, with the same code, until
+GitHub expires it.
+`)
     .action(async (opts) => {
     if (opts.headless) {
         try {
@@ -581,7 +662,7 @@ program
         }
         return;
     }
-    return loginCommand();
+    return loginCommand({ wait: opts.wait, json: opts.json });
 });
 program
     .command('logout [login]')
@@ -1531,15 +1612,6 @@ fleetPolicy
     const { fleetPolicyHistoryCommand } = await import('./commands/fleet-policy.js');
     await runAdminCommand(() => fleetPolicyHistoryCommand(repository, options));
 });
-fleetPolicy
-    .command('import-kv')
-    .description('One time: import the KV policies and tenant overrides into D1')
-    .option('--dry-run', 'Report what would be imported without writing')
-    .option(workerUrlOption, workerUrlHelp)
-    .action(async (options) => {
-    const { fleetPolicyImportKvCommand } = await import('./commands/fleet-policy.js');
-    await runAdminCommand(() => fleetPolicyImportKvCommand(options));
-});
 // ─── rules ───────────────────────────────────────────────────────────────────
 const rules = program.command('rules').description('Manage .haystack/pr-rules.yml');
 rules

package/dist/schema.js

@@ -20,7 +20,11 @@ export const SCHEMA_VERSIONS = {
     action: '1.0.0',
     'cloud-verifier': '1.0.0',
     'case-batch': '1.0.1',
-    verify: '1.0.0',
+    verify: '1.0.2',
+    'verify-answer': '1.0.0',
+    'verify-onboarding': '1.0.0',
+    init: '1.0.0',
+    login: '1.0.0',
     error: '1.0.0',
 };
 /** Wrap a payload with the `schema_version` envelope. */

package/dist/utils/config.js

@@ -42,22 +42,6 @@ export async function loadConfig(configPath) {
         throw new Error(`Failed to parse ${resolvedPath}: ${err.message}`);
     }
 }
-/**
- * Save config to file
- */
-export async function saveConfig(config, configPath) {
-    const resolvedPath = configPath || path.join(process.cwd(), CONFIG_FILENAME);
-    const content = JSON.stringify(config, null, 2);
-    await fs.writeFile(resolvedPath, content, 'utf-8');
-    return resolvedPath;
-}
-/**
- * Check if config exists
- */
-export async function configExists(startDir) {
-    const configPath = await findConfigPath(startDir);
-    return configPath !== null;
-}
 /**
  * Get the project root (directory containing .haystack.json or current dir)
  */

package/dist/utils/haystack-api.js

@@ -45,6 +45,13 @@ export const SUBSCRIPTION_REQUIRED_MESSAGE = 'This account has no active Haystac
  * repository and team). Its message names the repository; print it as is.
  */
 export const REPO_NOT_ENTITLED_CODE = 'repo_not_entitled';
+/**
+ * The server returns this `code` (HTTP 403, beside a readable `error`) when the
+ * repository's owner has not installed the Haystack GitHub App, which the
+ * service needs to read the repository.
+ */
+export const INSTALLATION_REQUIRED_CODE = 'installation-required';
+export const HAYSTACK_APP_INSTALL_URL = 'https://github.com/apps/haystack-code-reviewer-pr-hook/installations/new';
 /**
  * Extract the server's own message (and its `error` code) if the body is
  * JSON; truncate raw bodies.
@@ -66,7 +73,8 @@ async function serverMessage(response) {
         const parsed = JSON.parse(text);
         return {
             detail: parsed.message ?? parsed.error ?? null,
-            code: typeof parsed.error === 'string' ? parsed.error : null,
+            // Routes that answer { error: <readable text>, code } carry the stable code in `code`.
+            code: typeof parsed.code === 'string' ? parsed.code : typeof parsed.error === 'string' ? parsed.error : null,
         };
     }
     catch {
@@ -90,6 +98,9 @@ export async function classifyHttpError(response, context) {
             : 'This account is not entitled to use Haystack on this repository. See https://haystack.sh/pricing or email akshay@haystack.sh to get access.';
         return new HaystackApiError(403, message, code);
     }
+    if (response.status === 403 && code === INSTALLATION_REQUIRED_CODE) {
+        return new HaystackApiError(403, `${detail ?? 'Install the Haystack GitHub App on the repository\'s owner'}: ${HAYSTACK_APP_INSTALL_URL}`, code);
+    }
     if (response.status === 401) {
         return new HaystackApiError(401, `${context}: authentication failed${suffix}. Run \`haystack login\` to re-authenticate.`);
     }

package/dist/utils/secrets.js

@@ -9,8 +9,6 @@
  * - detect-secrets
  * - truffleHog
  */
-import * as fs from 'fs/promises';
-import * as path from 'path';
 /**
  * Common secret patterns
  */
@@ -188,52 +186,3 @@ export function scanForSecrets(content, filename) {
     }
     return findings;
 }
-/**
- * Scan a file for secrets
- */
-export async function scanFile(filePath) {
-    try {
-        const content = await fs.readFile(filePath, 'utf-8');
-        return scanForSecrets(content, path.basename(filePath));
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Scan .haystack.json specifically for secrets
- */
-export async function scanHaystackConfig(configPath) {
-    return scanFile(configPath);
-}
-/**
- * Validate that a config doesn't contain hardcoded secrets
- * Returns true if safe, false if secrets detected
- */
-export async function validateConfigSecurity(configPath) {
-    const findings = await scanHaystackConfig(configPath);
-    const highSeverity = findings.filter((f) => f.severity === 'high');
-    return {
-        safe: highSeverity.length === 0,
-        findings,
-    };
-}
-/**
- * Get a security report string for display
- */
-export function formatSecurityReport(findings) {
-    if (findings.length === 0) {
-        return '✓ No secrets detected';
-    }
-    const lines = [
-        `⚠️  ${findings.length} potential secret(s) detected:\n`,
-    ];
-    for (const finding of findings) {
-        const severity = finding.severity === 'high' ? '🔴' : finding.severity === 'medium' ? '🟡' : '🟢';
-        lines.push(`  ${severity} ${finding.file}:${finding.line}:${finding.column}`);
-        lines.push(`     ${finding.description}`);
-        lines.push(`     Matched: ${finding.match}\n`);
-    }
-    lines.push('Use $VARIABLE syntax to reference secrets instead of hardcoding values.\n');
-    return lines.join('\n');
-}

package/dist/utils/telemetry.js

@@ -197,6 +197,38 @@ export function trackPrecomputeEvent(outcome, wallMs, timeoutMs) {
         // Telemetry must never crash or delay the CLI.
     }
 }
+/** Track one onboarding state `haystack verify` saw: started, blocked (with the block's kind) or ready. */
+export function trackOnboardingEvent(outcome, kind) {
+    try {
+        if (telemetryDisabled() || typeof globalThis.fetch !== 'function')
+            return;
+        const event = {
+            api_key: POSTHOG_API_KEY,
+            distinct_id: getDistinctId(),
+            event: 'cli_verify_onboarding',
+            properties: {
+                cli_version: getCLIVersion(),
+                os: process.platform,
+                arch: process.arch,
+                timestamp: new Date().toISOString(),
+                ...minimizeMetadata({ outcome, ...(kind === undefined ? {} : { kind }) }),
+                $ip: null,
+            },
+            timestamp: new Date().toISOString(),
+        };
+        globalThis.fetch(`${POSTHOG_HOST}/capture/`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(event),
+        }).catch(() => {
+            // Documented fire-and-forget product telemetry: delivery cannot affect
+            // the CLI command being measured.
+        });
+    }
+    catch {
+        // Telemetry must never crash the CLI
+    }
+}
 function getCLIVersion() {
     try {
         const packageJson = JSON.parse(readFileSync(PACKAGE_JSON_PATH, 'utf8'));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.19.0",
-  "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
+  "version": "0.20.0",
+  "description": "haystack verify: run your app with and without a change, and see what the change broke",
   "type": "module",
   "bin": {
     "haystack": "dist/index.js"