@haystackeditor/cli 0.19.0 → 0.21.0

package/dist/utils/haystack-api.js

@@ -45,6 +45,13 @@ export const SUBSCRIPTION_REQUIRED_MESSAGE = 'This account has no active Haystac
  * repository and team). Its message names the repository; print it as is.
  */
 export const REPO_NOT_ENTITLED_CODE = 'repo_not_entitled';
+/**
+ * The server returns this `code` (HTTP 403, beside a readable `error`) when the
+ * repository's owner has not installed the Haystack GitHub App, which the
+ * service needs to read the repository.
+ */
+export const INSTALLATION_REQUIRED_CODE = 'installation-required';
+export const HAYSTACK_APP_INSTALL_URL = 'https://github.com/apps/haystack-code-reviewer-pr-hook/installations/new';
 /**
  * Extract the server's own message (and its `error` code) if the body is
  * JSON; truncate raw bodies.
@@ -66,7 +73,8 @@ async function serverMessage(response) {
         const parsed = JSON.parse(text);
         return {
             detail: parsed.message ?? parsed.error ?? null,
-            code: typeof parsed.error === 'string' ? parsed.error : null,
+            // Routes that answer { error: <readable text>, code } carry the stable code in `code`.
+            code: typeof parsed.code === 'string' ? parsed.code : typeof parsed.error === 'string' ? parsed.error : null,
         };
     }
     catch {
@@ -90,6 +98,9 @@ export async function classifyHttpError(response, context) {
             : 'This account is not entitled to use Haystack on this repository. See https://haystack.sh/pricing or email akshay@haystack.sh to get access.';
         return new HaystackApiError(403, message, code);
     }
+    if (response.status === 403 && code === INSTALLATION_REQUIRED_CODE) {
+        return new HaystackApiError(403, `${detail ?? 'Install the Haystack GitHub App on the repository\'s owner'}: ${HAYSTACK_APP_INSTALL_URL}`, code);
+    }
     if (response.status === 401) {
         return new HaystackApiError(401, `${context}: authentication failed${suffix}. Run \`haystack login\` to re-authenticate.`);
     }

package/dist/utils/secrets.js

@@ -9,8 +9,6 @@
  * - detect-secrets
  * - truffleHog
  */
-import * as fs from 'fs/promises';
-import * as path from 'path';
 /**
  * Common secret patterns
  */
@@ -188,52 +186,3 @@ export function scanForSecrets(content, filename) {
     }
     return findings;
 }
-/**
- * Scan a file for secrets
- */
-export async function scanFile(filePath) {
-    try {
-        const content = await fs.readFile(filePath, 'utf-8');
-        return scanForSecrets(content, path.basename(filePath));
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Scan .haystack.json specifically for secrets
- */
-export async function scanHaystackConfig(configPath) {
-    return scanFile(configPath);
-}
-/**
- * Validate that a config doesn't contain hardcoded secrets
- * Returns true if safe, false if secrets detected
- */
-export async function validateConfigSecurity(configPath) {
-    const findings = await scanHaystackConfig(configPath);
-    const highSeverity = findings.filter((f) => f.severity === 'high');
-    return {
-        safe: highSeverity.length === 0,
-        findings,
-    };
-}
-/**
- * Get a security report string for display
- */
-export function formatSecurityReport(findings) {
-    if (findings.length === 0) {
-        return '✓ No secrets detected';
-    }
-    const lines = [
-        `⚠️  ${findings.length} potential secret(s) detected:\n`,
-    ];
-    for (const finding of findings) {
-        const severity = finding.severity === 'high' ? '🔴' : finding.severity === 'medium' ? '🟡' : '🟢';
-        lines.push(`  ${severity} ${finding.file}:${finding.line}:${finding.column}`);
-        lines.push(`     ${finding.description}`);
-        lines.push(`     Matched: ${finding.match}\n`);
-    }
-    lines.push('Use $VARIABLE syntax to reference secrets instead of hardcoding values.\n');
-    return lines.join('\n');
-}

package/dist/utils/telemetry.js

@@ -197,6 +197,38 @@ export function trackPrecomputeEvent(outcome, wallMs, timeoutMs) {
         // Telemetry must never crash or delay the CLI.
     }
 }
+/** Track one onboarding state `haystack verify` saw: started, blocked (with the block's kind) or ready. */
+export function trackOnboardingEvent(outcome, kind) {
+    try {
+        if (telemetryDisabled() || typeof globalThis.fetch !== 'function')
+            return;
+        const event = {
+            api_key: POSTHOG_API_KEY,
+            distinct_id: getDistinctId(),
+            event: 'cli_verify_onboarding',
+            properties: {
+                cli_version: getCLIVersion(),
+                os: process.platform,
+                arch: process.arch,
+                timestamp: new Date().toISOString(),
+                ...minimizeMetadata({ outcome, ...(kind === undefined ? {} : { kind }) }),
+                $ip: null,
+            },
+            timestamp: new Date().toISOString(),
+        };
+        globalThis.fetch(`${POSTHOG_HOST}/capture/`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(event),
+        }).catch(() => {
+            // Documented fire-and-forget product telemetry: delivery cannot affect
+            // the CLI command being measured.
+        });
+    }
+    catch {
+        // Telemetry must never crash the CLI
+    }
+}
 function getCLIVersion() {
     try {
         const packageJson = JSON.parse(readFileSync(PACKAGE_JSON_PATH, 'utf8'));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.19.0",
-  "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
+  "version": "0.21.0",
+  "description": "haystack verify: run your app with and without a change, and see what the change broke",
   "type": "module",
   "bin": {
     "haystack": "dist/index.js"

package/schemas/init.v1.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.haystackeditor.com/cli/schemas/init.v1.json",
+  "title": "Haystack init: this repository's setup for `haystack verify`",
+  "description": "Machine-readable output of `haystack init --json`. `changes` are the project-local changes init planned (made when status is done); `onboarding` is the base's OnboardingStatusV1 (onboarding_contracts.ts, APP-ONBOARDING-V1) as POST /api/agent/cloud-verifier/onboarding returns it, null unless status is done. Exit codes: 0 done (onboarding running or ready), 1 failed (the error envelope), 2 planned (nothing written; run with --yes), 3 done but onboarding blocked, 4 login-required, 5 app-required (install the Haystack GitHub App), 6 done but onboarding stopped before finishing (run init again).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "status", "repository", "changes", "notices", "onboarding"],
+  "properties": {
+    "schema_version": { "const": "1.0.0" },
+    "status": { "enum": ["done", "planned", "login-required", "app-required"] },
+    "repository": { "type": "string" },
+    "changes": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "action", "reason", "diff"],
+        "properties": {
+          "path": { "type": "string" },
+          "action": { "enum": ["create", "update"] },
+          "reason": { "type": "string" },
+          "diff": { "type": "array", "items": { "type": "string" } }
+        }
+      }
+    },
+    "notices": { "type": "array", "items": { "type": "string" } },
+    "onboarding": {
+      "oneOf": [
+        { "type": "null" },
+        { "$ref": "verify.v1.json#/$defs/onboardingStatus" }
+      ]
+    }
+  }
+}

package/schemas/login.v1.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.haystackeditor.com/cli/schemas/login.v1.json",
+  "title": "Haystack login: a GitHub device-flow sign-in",
+  "description": "Machine-readable output of `haystack login --json`. With --no-wait, status is pending and carries the URL to open and the code to enter (never the device code); the next `haystack login` finishes it. Otherwise status is logged-in with the account signed in.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "status", "verificationUri", "userCode", "expiresAt", "login"],
+  "properties": {
+    "schema_version": { "const": "1.0.0" },
+    "status": { "enum": ["pending", "logged-in"] },
+    "verificationUri": { "type": ["string", "null"] },
+    "userCode": { "type": ["string", "null"] },
+    "expiresAt": { "type": ["string", "null"], "format": "date-time" },
+    "login": { "type": ["string", "null"] }
+  }
+}

package/schemas/verify-answer.v1.json

@@ -0,0 +1,86 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.haystackeditor.com/cli/schemas/verify-answer.v1.json",
+  "title": "Haystack verify answer: the repository's onboarding facts after an answer",
+  "description": "Machine-readable output of `haystack verify answer <question-id> <choice> --json`: OnboardingFactsView (onboarding_contracts.ts, APP-ONBOARDING-V1) as POST /api/agent/cloud-verifier/onboarding/answers returns it.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "facts"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": "1.0.0"
+    },
+    "facts": {
+      "type": "object",
+      "required": [
+        "repository",
+        "facts",
+        "factsDigest",
+        "openQuestions"
+      ],
+      "properties": {
+        "repository": {
+          "type": "string"
+        },
+        "factsDigest": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "facts": {
+          "type": "object",
+          "required": [
+            "dbProfile",
+            "answers"
+          ],
+          "properties": {
+            "dbProfile": {
+              "oneOf": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "string",
+                  "pattern": "^[0-9a-f]{64}$"
+                }
+              ]
+            },
+            "answers": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "openQuestions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": [
+              "id",
+              "message",
+              "choices"
+            ],
+            "properties": {
+              "id": {
+                "type": "string"
+              },
+              "message": {
+                "type": "string"
+              },
+              "choices": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/verify-onboarding.v1.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://docs.haystackeditor.com/cli/schemas/verify-onboarding.v1.json",
+  "title": "Haystack verify onboarding: the onboarding of this checkout's base",
+  "description": "Machine-readable output of `haystack verify onboarding --json`: OnboardingStatusV1 (onboarding_contracts.ts, APP-ONBOARDING-V1) of the base `haystack verify` would use, as GET /api/agent/cloud-verifier/onboarding?repository=&baseCommit= returns it.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "onboarding"],
+  "properties": {
+    "schema_version": { "const": "1.0.0" },
+    "onboarding": { "$ref": "verify.v1.json#/$defs/onboardingStatus" }
+  }
+}

package/schemas/verify.v1.json

@@ -2,12 +2,33 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://docs.haystackeditor.com/cli/schemas/verify.v1.json",
   "title": "Haystack verify: the crawl of the current change (CRAWL-V1)",
-  "description": "Machine-readable output of `haystack verify --json`: the caller's crawl of the exact captured checkout (its code and its change title), as GET /api/agent/cloud-verifier/crawls?repository=&workCommit= or, for a crawl the command just submitted, GET /api/agent/cloud-verifier/crawls/:runId?repository= returns it, or null when no crawl of the capture could be started. The crawl shapes mirror infra/lambda/haystack-design-verifier-shared/crawl_contracts.ts (with amendments 1, 8 and 9); that file wins where they differ.",
+  "description": "Machine-readable output of `haystack verify --json`: the caller's crawl of the exact captured checkout (its code and its change title), as GET /api/agent/cloud-verifier/crawls?repository=&workCommit= or, for a crawl the command just submitted, GET /api/agent/cloud-verifier/crawls/:runId?repository= returns it, or null when no crawl of the capture could be started. The crawl shapes mirror infra/lambda/haystack-design-verifier-shared/crawl_contracts.ts (with amendments 1, 8, 9, 10 and 11); that file wins where they differ. Crawl amendment 11 (schema 1.0.1): when the capture's base is not onboarded yet, `onboarding` is the base's OnboardingStatusV1 (onboarding_contracts.ts, APP-ONBOARDING-V1) and `crawl` is null until the app is ready; it is null when onboarding was not involved.",
   "type": "object",
   "additionalProperties": false,
   "required": ["schema_version", "crawl"],
   "properties": {
-    "schema_version": { "const": "1.0.0" },
+    "onboarding": {
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/onboardingStatus"
+        }
+      ]
+    },
+    "schema_version": { "const": "1.0.2" },
+    "change": {
+      "description": "Schema 1.0.2: what this verify checked: the capture's base commit (where HEAD meets origin's default branch), its work commit (committed and uncommitted changes), and the files that differ between them.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["baseCommit", "workCommit", "files"],
+      "properties": {
+        "baseCommit": { "$ref": "#/$defs/commit" },
+        "workCommit": { "$ref": "#/$defs/commit" },
+        "files": { "type": "array", "items": { "type": "string" } }
+      }
+    },
     "crawl": {
       "oneOf": [
         { "type": "null" },
@@ -16,6 +37,253 @@
     }
   },
   "$defs": {
+    "onboardingBlock": {
+      "type": "object",
+      "required": [
+        "kind",
+        "stage",
+        "reason",
+        "evidence",
+        "ask"
+      ],
+      "properties": {
+        "kind": {
+          "enum": [
+            "not-enabled",
+            "no-web-app",
+            "unsupported",
+            "question",
+            "outside-credential",
+            "outside-dependency",
+            "evidence-too-large",
+            "budget",
+            "proof-failed"
+          ]
+        },
+        "stage": {
+          "enum": [
+            "admission",
+            "inventory",
+            "plan",
+            "runtime",
+            "boot",
+            "data",
+            "accounts",
+            "workflow",
+            "publish",
+            "cleanup"
+          ]
+        },
+        "reason": {
+          "type": "string"
+        },
+        "evidence": {
+          "$ref": "#/$defs/strings"
+        },
+        "names": {
+          "$ref": "#/$defs/strings"
+        },
+        "ask": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "object",
+              "required": [
+                "message"
+              ],
+              "properties": {
+                "message": {
+                  "type": "string"
+                },
+                "command": {
+                  "type": "string"
+                },
+                "question": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "choices"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string"
+                    },
+                    "choices": {
+                      "$ref": "#/$defs/strings"
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    "onboardingStatus": {
+      "type": "object",
+      "required": [
+        "version",
+        "repository",
+        "baseCommit",
+        "state",
+        "onboardRunId",
+        "recordDigest",
+        "checkpoint",
+        "block",
+        "dataAbsences",
+        "versionChoices"
+      ],
+      "properties": {
+        "version": {
+          "const": "app-onboarding-v1"
+        },
+        "repository": {
+          "type": "string"
+        },
+        "baseCommit": {
+          "$ref": "#/$defs/commit"
+        },
+        "state": {
+          "enum": [
+            "ready",
+            "onboarding",
+            "blocked",
+            "incomplete",
+            "cancelled",
+            "not-started"
+          ]
+        },
+        "onboardRunId": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "string",
+              "pattern": "^ob_[0-9a-f]{48}$"
+            }
+          ]
+        },
+        "recordDigest": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "string",
+              "pattern": "^[0-9a-f]{64}$"
+            }
+          ]
+        },
+        "checkpoint": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "object",
+              "required": [
+                "status",
+                "stage",
+                "execution",
+                "owned"
+              ],
+              "properties": {
+                "status": {
+                  "enum": [
+                    "queued",
+                    "running",
+                    "cleanup-pending",
+                    "published",
+                    "reused",
+                    "blocked",
+                    "incomplete",
+                    "cancelled"
+                  ]
+                },
+                "stage": {
+                  "enum": [
+                    "inventory",
+                    "plan",
+                    "runtime",
+                    "boot",
+                    "data",
+                    "accounts",
+                    "workflow",
+                    "publish",
+                    "cleanup"
+                  ]
+                },
+                "owned": {
+                  "$ref": "#/$defs/strings"
+                },
+                "execution": {
+                  "type": "object",
+                  "required": [
+                    "stages"
+                  ],
+                  "properties": {
+                    "stages": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "required": [
+                          "stage",
+                          "status"
+                        ],
+                        "properties": {
+                          "stage": {
+                            "enum": [
+                              "inventory",
+                              "plan",
+                              "runtime",
+                              "boot",
+                              "data",
+                              "accounts",
+                              "workflow",
+                              "publish",
+                              "cleanup"
+                            ]
+                          },
+                          "status": {
+                            "enum": [
+                              "pending",
+                              "running",
+                              "ok",
+                              "reused",
+                              "failed",
+                              "blocked"
+                            ]
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        },
+        "block": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/onboardingBlock"
+            }
+          ]
+        },
+        "dataAbsences": {
+          "$ref": "#/$defs/strings"
+        },
+        "versionChoices": {
+          "$ref": "#/$defs/strings"
+        }
+      }
+    },
     "runId": { "type": "string", "pattern": "^cv_[0-9a-f]{48}$" },
     "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
     "count": { "type": "integer", "minimum": 0 },