@haystackeditor/cli 0.25.0 → 0.26.0

package/dist/utils/design-verifier-api.js

@@ -1,294 +0,0 @@
-/**
- * Client for the design-verifier trigger route on the auth worker.
- *
- * The worker owns everything sensitive: it authenticates the CLI token,
- * enforces hsk_live repo scope, resolves the PR's base/head SHAs via the
- * GitHub App install token, and forwards to the AWS design-verifier API with
- * the server-side shared secret. This client just POSTs and interprets the
- * response.
- */
-import { haystackApiUrl } from './haystack-api.js';
-import { isDesignVerifierHistoryReport } from './design-verifier-history.js';
-function isDuration(value) {
-    return value === null || (typeof value === 'number' && Number.isFinite(value) && value >= 0);
-}
-function isTimestamp(value) {
-    return value === null || (typeof value === 'string' && Number.isFinite(Date.parse(value)));
-}
-function isTimingSummary(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const timing = value;
-    if (!isDuration(timing.admissionMs) || !isDuration(timing.pipelineDurationMs) ||
-        typeof timing.recordedStageMs !== 'number' || !isDuration(timing.recordedStageMs) ||
-        !isDuration(timing.unattributedMs) ||
-        !Array.isArray(timing.stages))
-        return false;
-    const expectedStages = ['prepare', 'bake', 'blast-radius', 'prefetch', 'case-design', 'verdict'];
-    return timing.stages.length === expectedStages.length && timing.stages.every((stage, index) => stage && typeof stage === 'object' && stage.stage === expectedStages[index] &&
-        typeof stage.status === 'string' && isDuration(stage.durationMs) && isTimestamp(stage.completedAt) &&
-        ['phase-artifact', 'phase-artifact-clock', 'cache-hit', 'missing'].includes(stage.source) &&
-        stage.breakdownMs && typeof stage.breakdownMs === 'object' && !Array.isArray(stage.breakdownMs) &&
-        Object.values(stage.breakdownMs).every((duration) => typeof duration === 'number' && isDuration(duration)));
-}
-function isDesignVerifierStatusResult(value, expected) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const run = value;
-    if (run.version !== 'dv-cli-status-v1' || run.runId !== expected.runId ||
-        run.owner !== expected.owner || run.repo !== expected.repo || run.pr !== expected.pr ||
-        typeof run.status !== 'string')
-        return false;
-    if (run.status !== 'succeeded')
-        return true;
-    return !!run.result && typeof run.result === 'object' &&
-        run.result.verdict && typeof run.result.verdict === 'object' &&
-        Array.isArray(run.result.cases) && Array.isArray(run.result.scenarios) &&
-        Array.isArray(run.result.changedFiles) && Array.isArray(run.result.probes) &&
-        (run.result.timings === undefined || isTimingSummary(run.result.timings)) &&
-        run.result.replay && typeof run.result.replay === 'object';
-}
-function apiHeaders(token) {
-    return {
-        'Cache-Control': 'no-cache',
-        'User-Agent': 'Haystack-CLI',
-        Authorization: `Bearer ${token}`,
-    };
-}
-function isUniverseAction(value, expected) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const action = value;
-    return action.version === 'dv-universe-action-v1' && action.runId === expected.runId &&
-        (expected.actionId === undefined || action.actionId === expected.actionId) &&
-        (expected.caseId === undefined || action.caseId === expected.caseId) &&
-        (expected.universe === undefined || action.universe === expected.universe) &&
-        /^action-[0-9a-f-]{36}$/.test(action.actionId || '') &&
-        /^universe-[0-9a-f]{24}$/.test(action.universeId || '') &&
-        ['control-before', 'before', 'after'].includes(action.universe) &&
-        ['replay', 'exec'].includes(action.action) &&
-        ['queued', 'running', 'completed', 'failed'].includes(action.status) &&
-        action.command && Array.isArray(action.command.argv) && typeof action.command.cwd === 'string';
-}
-function universeActionPath(owner, repo, prNumber, runId) {
-    return `/api/design-verifier/universe/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${prNumber}/${encodeURIComponent(runId)}`;
-}
-async function parseUniverseActionResponse(response, expected) {
-    let data = {};
-    try {
-        data = await response.json();
-    }
-    catch {
-        return { status: 'error', message: `Universe endpoint returned invalid JSON (HTTP ${response.status})` };
-    }
-    if (response.ok) {
-        if (!isUniverseAction(data, expected)) {
-            return { status: 'error', message: `Universe endpoint returned an invalid or mismatched result (HTTP ${response.status})` };
-        }
-        return { status: 'ok', action: data };
-    }
-    const message = data.message || data.error || `HTTP ${response.status}`;
-    if (response.status === 401 || response.status === 403)
-        return { status: 'denied', message };
-    if (response.status === 404 || response.status === 410)
-        return { status: 'not_found', message };
-    if (response.status === 502 || response.status === 503)
-        return { status: 'unavailable', message };
-    return { status: 'error', message };
-}
-export async function startDesignVerifierUniverseAction(owner, repo, prNumber, runId, token, request) {
-    let response;
-    try {
-        response = await fetch(haystackApiUrl(universeActionPath(owner, repo, prNumber, runId)), {
-            method: 'POST',
-            headers: { ...apiHeaders(token), 'Content-Type': 'application/json' },
-            body: JSON.stringify(request),
-        });
-    }
-    catch (err) {
-        return { status: 'error', message: err.message };
-    }
-    return parseUniverseActionResponse(response, {
-        runId,
-        caseId: request.caseId,
-        universe: request.universe,
-    });
-}
-export async function getDesignVerifierUniverseAction(owner, repo, prNumber, runId, actionId, token) {
-    const path = universeActionPath(owner, repo, prNumber, runId);
-    let response;
-    try {
-        response = await fetch(haystackApiUrl(`${path}?actionId=${encodeURIComponent(actionId)}`), {
-            method: 'GET',
-            headers: apiHeaders(token),
-        });
-    }
-    catch (err) {
-        return { status: 'error', message: err.message };
-    }
-    return parseUniverseActionResponse(response, { runId, actionId });
-}
-export async function waitForDesignVerifierUniverseAction(owner, repo, prNumber, runId, actionId, token, options = {}) {
-    const intervalMs = options.intervalMs ?? 1_000;
-    const deadline = Date.now() + (options.timeoutMs ?? 10 * 60_000);
-    let consecutiveErrors = 0;
-    for (;;) {
-        const loaded = await getDesignVerifierUniverseAction(owner, repo, prNumber, runId, actionId, token);
-        if (loaded.status === 'ok') {
-            consecutiveErrors = 0;
-            if (['completed', 'failed'].includes(loaded.action.status)) {
-                return { status: 'terminal', action: loaded.action };
-            }
-        }
-        else {
-            consecutiveErrors += 1;
-            if (loaded.status === 'denied' || loaded.status === 'not_found' || consecutiveErrors >= 3) {
-                return { status: 'error', message: loaded.message };
-            }
-        }
-        if (Date.now() >= deadline)
-            return { status: 'timeout' };
-        await new Promise((resolve) => setTimeout(resolve, intervalMs));
-    }
-}
-export async function triggerDesignVerifier(owner, repo, prNumber, token) {
-    const url = haystackApiUrl(`/api/design-verifier/trigger/${owner}/${repo}/${prNumber}`);
-    let response;
-    try {
-        response = await fetch(url, {
-            method: 'POST',
-            headers: { ...apiHeaders(token), 'Content-Type': 'application/json' },
-            body: '{}',
-        });
-    }
-    catch (err) {
-        return { status: 'error', message: err.message };
-    }
-    let data = {};
-    let parseFailed = false;
-    try {
-        data = await response.json();
-    }
-    catch {
-        // Recorded, not swallowed: non-OK statuses are classified below; a 2xx
-        // with an unparseable body becomes an explicit error rather than a
-        // silently-empty success.
-        parseFailed = true;
-    }
-    if (parseFailed && response.ok) {
-        return { status: 'error', message: `Trigger endpoint returned invalid JSON (HTTP ${response.status})` };
-    }
-    if (response.ok) {
-        const outcome = data.outcome === 'queued' || data.outcome === 'duplicate' ? data.outcome : 'started';
-        if (!data.runId) {
-            return { status: 'error', message: `Trigger succeeded but no runId was returned (HTTP ${response.status})` };
-        }
-        return { status: outcome, runId: data.runId };
-    }
-    const message = data.message || data.error || `HTTP ${response.status}`;
-    // API Gateway answers 403 "Missing Authentication Token" for routes that
-    // do not exist — which is exactly what the flag-gated backend looks like
-    // before enable_design_verifier is on. The worker's own denials carry
-    // specific error codes/messages, so this signature is unambiguous.
-    if (response.status === 403 && data.message === 'Missing Authentication Token') {
-        return { status: 'unavailable', message: 'Design verifier is not enabled in this environment yet.' };
-    }
-    if (response.status === 401 || response.status === 403)
-        return { status: 'denied', message };
-    if (response.status === 429)
-        return { status: 'rate_limited', message };
-    if (response.status === 404) {
-        // Two distinct 404s share this status: the worker's own pr_not_found
-        // (carries an error code and a specific message) versus the AWS gateway
-        // 404 for the flag-gated /v3/design-verifier route not being enabled
-        // yet. Only the latter means "feature unavailable".
-        if (data.error === 'pr_not_found') {
-            return { status: 'error', message };
-        }
-        return { status: 'unavailable', message: 'Design verifier is not enabled in this environment yet.' };
-    }
-    return { status: 'error', message };
-}
-export async function getDesignVerifierStatus(owner, repo, prNumber, runId, token) {
-    const url = haystackApiUrl(`/api/design-verifier/status/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${prNumber}/${encodeURIComponent(runId)}`);
-    let response;
-    try {
-        response = await fetch(url, { method: 'GET', headers: apiHeaders(token) });
-    }
-    catch (err) {
-        return { status: 'error', message: err.message };
-    }
-    let data = {};
-    try {
-        data = await response.json();
-    }
-    catch {
-        return { status: 'error', message: `Status endpoint returned invalid JSON (HTTP ${response.status})` };
-    }
-    if (response.ok) {
-        if (!isDesignVerifierStatusResult(data, { owner, repo, pr: prNumber, runId })) {
-            return { status: 'error', message: `Status endpoint returned an invalid or mismatched result (HTTP ${response.status})` };
-        }
-        return { status: 'ok', run: data };
-    }
-    const message = data.message || data.error || `HTTP ${response.status}`;
-    if (response.status === 401 || response.status === 403)
-        return { status: 'denied', message };
-    if (response.status === 404)
-        return { status: 'not_found', message };
-    if (response.status === 502 || response.status === 503)
-        return { status: 'unavailable', message };
-    return { status: 'error', message };
-}
-export async function getDesignVerifierHistory(owner, repo, token, limit = 20) {
-    const url = haystackApiUrl(`/api/design-verifier/history/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}?limit=${limit}`);
-    try {
-        const response = await fetch(url, { method: 'GET', headers: apiHeaders(token) });
-        const data = await response.json();
-        if (response.ok) {
-            if (!isDesignVerifierHistoryReport(data, { owner, repo, limit })) {
-                return { status: 'error', message: 'History endpoint returned an invalid or mismatched result.' };
-            }
-            return { status: 'ok', history: data };
-        }
-        const message = data?.message || data?.error || `HTTP ${response.status}`;
-        if (response.status === 401 || response.status === 403)
-            return { status: 'denied', message };
-        if ([404, 502, 503].includes(response.status))
-            return { status: 'unavailable', message };
-        return { status: 'error', message };
-    }
-    catch (error) {
-        return { status: 'error', message: error.message };
-    }
-}
-export async function waitForDesignVerifier(owner, repo, prNumber, runId, token, options = {}) {
-    const intervalMs = options.intervalMs ?? 3000;
-    const timeoutMs = options.timeoutMs ?? 2 * 60 * 60 * 1000;
-    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-    const deadline = Date.now() + timeoutMs;
-    let consecutiveErrors = 0;
-    let lastStage;
-    for (;;) {
-        const loaded = await getDesignVerifierStatus(owner, repo, prNumber, runId, token);
-        if (loaded.status !== 'ok') {
-            consecutiveErrors += 1;
-            if (loaded.status === 'denied' || loaded.status === 'not_found' || consecutiveErrors >= 3) {
-                return { status: 'error', message: loaded.message };
-            }
-        }
-        else {
-            consecutiveErrors = 0;
-            if (loaded.run.stage !== lastStage) {
-                lastStage = loaded.run.stage;
-                options.onProgress?.(loaded.run);
-            }
-            if (['succeeded', 'failed', 'failed-stale'].includes(loaded.run.status)) {
-                return { status: 'terminal', run: loaded.run };
-            }
-        }
-        if (Date.now() >= deadline)
-            return { status: 'timeout' };
-        await sleep(intervalMs);
-    }
-}

package/dist/utils/design-verifier-history.js

@@ -1,79 +0,0 @@
-const outcomes = ['healthy', 'degraded', 'invalid', 'failed', 'unknown'];
-export function isDesignVerifierHistoryReport(value, expected) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const report = value;
-    if (report.version !== 'dv-cli-history-v1' || report.owner !== expected.owner ||
-        report.repo !== expected.repo || report.limit !== expected.limit ||
-        !Number.isSafeInteger(report.retentionDays) || report.retentionDays <= 0 ||
-        !Array.isArray(report.runs) || report.runs.length > report.limit || !report.summary)
-        return false;
-    const seen = new Set();
-    const counts = { healthy: 0, degraded: 0, invalid: 0, failed: 0, unknown: 0 };
-    const blockers = new Map();
-    for (const run of report.runs) {
-        if (!run || !Number.isSafeInteger(run.pr) || run.pr < 1 || typeof run.runId !== 'string')
-            return false;
-        const prefix = `${expected.owner}--${expected.repo}--${run.pr}--`;
-        if (!run.runId.startsWith(prefix) ||
-            !/^[0-9a-f]{12}(?:--attempt-[1-9]\d*)?$/.test(run.runId.slice(prefix.length)) ||
-            seen.has(run.runId) || !outcomes.includes(run.outcome) ||
-            !['succeeded', 'failed', 'failed-stale'].includes(run.status) ||
-            (run.outcome === 'failed') !== (run.status !== 'succeeded') ||
-            typeof run.createdAt !== 'string' || !Number.isFinite(Date.parse(run.createdAt)) ||
-            (run.finishedAt !== null && (typeof run.finishedAt !== 'string' || !Number.isFinite(Date.parse(run.finishedAt)))) ||
-            (run.baseSha !== null && typeof run.baseSha !== 'string') ||
-            (run.headSha !== null && typeof run.headSha !== 'string') ||
-            (run.admitted !== null && (!Number.isSafeInteger(run.admitted) || run.admitted < 0)) ||
-            !Array.isArray(run.losses) || run.losses.some(loss => !loss || typeof loss.code !== 'string' || !loss.code || typeof loss.owner !== 'string' ||
-            !loss.owner || !['degraded', 'invalid'].includes(loss.impact) ||
-            !Number.isSafeInteger(loss.count) || loss.count < 1))
-            return false;
-        if (['healthy', 'degraded'].includes(run.outcome) && (run.admitted === null || run.admitted === 0))
-            return false;
-        seen.add(run.runId);
-        counts[run.outcome]++;
-        for (const code of new Set(run.losses.map(loss => loss.code))) {
-            blockers.set(code, (blockers.get(code) || 0) + 1);
-        }
-    }
-    const summary = report.summary;
-    const usableRate = report.runs.length ? (counts.healthy + counts.degraded) / report.runs.length : null;
-    if (summary.total !== report.runs.length || summary.usableRate !== usableRate ||
-        outcomes.some(outcome => summary[outcome] !== counts[outcome]) ||
-        !Array.isArray(summary.topBlockers) || summary.topBlockers.length !== blockers.size)
-        return false;
-    const seenBlockers = new Set();
-    return summary.topBlockers.every(blocker => {
-        if (!blocker || seenBlockers.has(blocker.code) || blockers.get(blocker.code) !== blocker.affectedRuns)
-            return false;
-        seenBlockers.add(blocker.code);
-        return true;
-    });
-}
-function terminalSafe(value) {
-    return Array.from(value).filter(character => {
-        const point = character.codePointAt(0);
-        return point >= 32 && !(point >= 127 && point <= 159);
-    }).join('');
-}
-export function formatDesignVerifierHistory(report) {
-    const { summary } = report;
-    const lines = [`Execution history for ${terminalSafe(report.owner)}/${terminalSafe(report.repo)}`,
-        `Latest ${summary.total} recorded terminal attempts within ${report.retentionDays} days (limit ${report.limit}).`];
-    if (summary.total === 0) {
-        lines.push('No recorded attempts in this window. History starts when recording is deployed.');
-        return lines.join('\n');
-    }
-    lines.push(`Usable evidence: ${Math.round(summary.usableRate * 100)}% of attempts (${summary.healthy + summary.degraded}/${summary.total}).`, `Fully healthy: ${summary.healthy}; partially degraded: ${summary.degraded}; invalid: ${summary.invalid}; failed: ${summary.failed}; unknown: ${summary.unknown}.`, 'Usable includes partial evidence from degraded attempts. This measures execution reliability, not bug-detection accuracy.', '');
-    for (const run of report.runs) {
-        lines.push(`${run.finishedAt || run.createdAt}  PR #${run.pr}  ${run.outcome}  ${run.admitted ?? '?'} admitted cases`, `  ${run.runId}`);
-    }
-    if (summary.topBlockers.length) {
-        lines.push('', 'Most frequent blockers (attempts affected):');
-        for (const blocker of summary.topBlockers.slice(0, 5)) {
-            lines.push(`  ${terminalSafe(blocker.code)}: ${blocker.affectedRuns}`);
-        }
-    }
-    return lines.join('\n');
-}