@haystackeditor/cli 0.25.0 → 0.26.0

package/dist/utils/github-api.js

@@ -1,324 +0,0 @@
-/**
- * GitHub API utilities for haystack submit command.
- *
- * Provides functions for creating PRs, managing labels, etc.
- */
-import { isHeadlessToken, resolveAuthContext } from './auth.js';
-import { trackError } from './telemetry.js';
-const GITHUB_API_BASE = 'https://api.github.com';
-// OAuth App Policy fallback. Orgs can restrict our OAuth app, which makes the
-// user's token 403 on every API call to that org — so `haystack submit` can't
-// open PRs, add labels, or request reviewers there. The auth-worker GitHub
-// proxy swaps in the GitHub App installation token server-side (the App isn't
-// subject to OAuth App Policy / SAML SSO enforcement the way the OAuth token
-// is), so on such a 403 we retry the same request through it. Direct calls are
-// tried first, so on unrestricted orgs nothing changes and PRs stay
-// user-authored; only the fallback path is performed by the App (haystack[bot]).
-const GITHUB_PROXY_BASE = 'https://haystackeditor.com/api/github';
-/**
- * A 403 that is NOT a rate-limit is almost always OAuth App Policy or SAML SSO
- * enforcement blocking our OAuth app on this org — exactly what the
- * installation-token proxy can bypass. Rate-limit 403s carry
- * `x-ratelimit-remaining: 0` and the proxy can't help with those, so we don't
- * retry them.
- */
-/**
- * REST base URL for a token. Haystack headless tokens (hsk_live_*) only work
- * through the Haystack proxy and must never reach api.github.com.
- */
-export function githubRestBaseFor(token) {
-    return isHeadlessToken(token) ? GITHUB_PROXY_BASE : GITHUB_API_BASE;
-}
-function isOAuthPolicyForbidden(response) {
-    return response.status === 403 && response.headers.get('x-ratelimit-remaining') !== '0';
-}
-// Label definitions for Haystack workflow
-export const HAYSTACK_LABELS = {
-    'haystack:auto-merge': {
-        name: 'haystack:auto-merge',
-        color: '0E8A16', // Green
-        description: 'Auto-merge after Haystack approval',
-    },
-    'haystack:needs-review': {
-        name: 'haystack:needs-review',
-        color: 'FBCA04', // Yellow
-        description: 'Requires Haystack review',
-    },
-    'haystack:ready-to-merge': {
-        name: 'haystack:ready-to-merge',
-        color: '2EA44F', // GitHub green
-        description: 'Passed Haystack analysis, ready to merge',
-    },
-};
-// ============================================================================
-// Authentication
-// ============================================================================
-/**
- * Get a GitHub token, throw if not authenticated
- */
-export async function requireGitHubAuth(options) {
-    const context = await resolveAuthContext(options);
-    return context.token;
-}
-async function resolveToken(token, options) {
-    return token ?? requireGitHubAuth(options);
-}
-// ============================================================================
-// API helpers
-// ============================================================================
-/**
- * Make an authenticated GitHub API request
- */
-async function githubApiRequest(method, path, token, body) {
-    // body is serialized to a string (not a stream), so the same init can be
-    // reused for the proxy retry below.
-    const init = {
-        method,
-        headers: {
-            Authorization: `Bearer ${token}`,
-            Accept: 'application/vnd.github.v3+json',
-            'Content-Type': 'application/json',
-            'User-Agent': 'Haystack-CLI',
-        },
-        body: body ? JSON.stringify(body) : undefined,
-    };
-    // A Haystack headless token (hsk_live_*) is not a GitHub credential: sending
-    // it to api.github.com would leak it to GitHub and fail anyway. Only the
-    // Haystack proxy understands it (it resolves an App installation token).
-    if (isHeadlessToken(token)) {
-        return fetch(`${GITHUB_PROXY_BASE}${path}`, init);
-    }
-    const direct = await fetch(`${GITHUB_API_BASE}${path}`, init);
-    if (!isOAuthPolicyForbidden(direct))
-        return direct;
-    // Org restricts our OAuth app — retry through the proxy on the App's
-    // installation token. Same `Authorization: Bearer <github-token>`; the proxy
-    // validates it, then uses its own token upstream. If the proxy can't help
-    // (e.g. the App isn't installed on this owner), fall back to the original
-    // response so handleApiError surfaces GitHub's actual "org restricted" 403.
-    const proxied = await fetch(`${GITHUB_PROXY_BASE}${path}`, init);
-    return proxied.status === 403 ? direct : proxied;
-}
-async function handleApiError(response, context, operation) {
-    if (response.status === 401) {
-        throw new Error('GitHub token expired or invalid. Run `haystack login` again.');
-    }
-    if (response.status === 403) {
-        const rateLimitRemaining = response.headers.get('x-ratelimit-remaining');
-        if (rateLimitRemaining === '0') {
-            // Log every rate-limit hit so we can watch real-world frequency and decide
-            // whether the CLI needs its own token bucket. Routes to PostHog (and on to
-            // Slack via the ops-alert pipeline). Fire-and-forget; never blocks.
-            trackError('cli_github_rate_limited', {
-                operation,
-                status: 403,
-                rate_limit_limit: response.headers.get('x-ratelimit-limit'),
-                rate_limit_reset: response.headers.get('x-ratelimit-reset'),
-                rate_limit_resource: response.headers.get('x-ratelimit-resource'),
-            });
-            throw new Error('GitHub API rate limit exceeded. Please wait and try again.');
-        }
-        throw new Error(`Permission denied: ${context}`);
-    }
-    if (response.status === 404) {
-        throw new Error(`Not found: ${context}`);
-    }
-    if (response.status === 422) {
-        const data = await response.json().catch(() => ({}));
-        const errorMsg = data.errors?.[0]?.message || data.message || 'Validation failed';
-        throw new Error(`GitHub API error: ${errorMsg}`);
-    }
-    const data = await response.json().catch(() => ({}));
-    throw new Error(data.message || `GitHub API error (${response.status}): ${context}`);
-}
-// ============================================================================
-// Pull Request operations
-// ============================================================================
-/**
- * Create a pull request
- */
-export async function createPullRequest(options) {
-    const token = await resolveToken(options.token, {
-        owner: options.owner,
-        repo: options.repo,
-    });
-    const response = await githubApiRequest('POST', `/repos/${options.owner}/${options.repo}/pulls`, token, {
-        title: options.title,
-        head: options.head,
-        base: options.base,
-        body: options.body || '',
-        draft: options.draft || false,
-    });
-    if (!response.ok) {
-        // GitHub returns 500 when creating a PR from a branch that was the head
-        // of a recently merged PR. Check for this case and give an actionable error.
-        if (response.status >= 500) {
-            const mergedPR = await findMergedPRForBranch(options.owner, options.repo, options.head, token);
-            if (mergedPR) {
-                throw new Error(`Branch "${options.head}" was already used for merged PR #${mergedPR.number}. ` +
-                    `Push to a new branch name and try again.`);
-            }
-        }
-        await handleApiError(response, `creating PR in ${options.owner}/${options.repo}`, 'create_pull_request');
-    }
-    return response.json();
-}
-/**
- * Check if a merged PR exists for a given branch (used for diagnosing 500s on PR creation).
- *
- * Only searches the exact qualified head (owner:branch). We intentionally do NOT
- * fall back to a bare branch name because that can match a different fork's branch
- * and produce a misleading "branch already used" diagnosis.
- *
- * Returns null if the lookup fails (5xx, network error) so the caller falls through
- * to the generic error handler rather than surfacing a wrong diagnosis.
- */
-async function findMergedPRForBranch(owner, repo, head, token) {
-    const headParam = head.includes(':') ? head : `${owner}:${head}`;
-    try {
-        const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/pulls?head=${encodeURIComponent(headParam)}&state=closed`, token);
-        if (!response.ok) {
-            console.error(`[github-api] Merged-PR lookup failed (head=${headParam}): HTTP ${response.status}`);
-            return null;
-        }
-        const prs = await response.json();
-        return prs.find((pr) => pr.merged_at) ?? null;
-    }
-    catch (err) {
-        console.error(`[github-api] Merged-PR lookup error (head=${headParam}): ${err}`);
-        return null;
-    }
-}
-/**
- * Check if a PR already exists for a branch
- */
-export async function findExistingPR(owner, repo, head, token) {
-    const authToken = await resolveToken(token, { owner, repo });
-    // head format should be "owner:branch" for cross-repo or just "branch" for same-repo
-    const headParam = head.includes(':') ? head : `${owner}:${head}`;
-    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/pulls?head=${encodeURIComponent(headParam)}&state=open`, authToken);
-    if (!response.ok) {
-        if (response.status === 404)
-            return null;
-        await handleApiError(response, 'checking for existing PR', 'find_existing_pull_request');
-    }
-    const prs = await response.json();
-    return prs.length > 0 ? prs[0] : null;
-}
-// ============================================================================
-// Label operations
-// ============================================================================
-/**
- * Add labels to an issue/PR
- */
-export async function addLabelsToIssue(owner, repo, issueNumber, labels, token) {
-    const authToken = await resolveToken(token, { owner, repo });
-    const response = await githubApiRequest('POST', `/repos/${owner}/${repo}/issues/${issueNumber}/labels`, authToken, { labels });
-    if (!response.ok) {
-        await handleApiError(response, `adding labels to PR #${issueNumber}`, 'add_labels');
-    }
-}
-/**
- * Get all labels from an issue/PR
- */
-export async function getLabelsFromIssue(owner, repo, issueNumber, token) {
-    const authToken = await resolveToken(token, { owner, repo });
-    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/issues/${issueNumber}/labels`, authToken);
-    if (!response.ok) {
-        await handleApiError(response, `getting labels from PR #${issueNumber}`, 'get_labels');
-    }
-    const labels = await response.json();
-    return labels.map((l) => l.name);
-}
-/**
- * Remove a label from an issue/PR
- */
-export async function removeLabelFromIssue(owner, repo, issueNumber, labelName, token) {
-    const authToken = await resolveToken(token, { owner, repo });
-    const response = await githubApiRequest('DELETE', `/repos/${owner}/${repo}/issues/${issueNumber}/labels/${encodeURIComponent(labelName)}`, authToken);
-    // 404 is fine - label wasn't on the issue
-    if (!response.ok && response.status !== 404) {
-        await handleApiError(response, `removing label '${labelName}' from PR #${issueNumber}`, 'remove_label');
-    }
-}
-/**
- * Check if a label exists in the repo
- */
-export async function labelExists(owner, repo, labelName, token) {
-    const authToken = await resolveToken(token, { owner, repo });
-    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}/labels/${encodeURIComponent(labelName)}`, authToken);
-    return response.ok;
-}
-/**
- * Create a label in the repo
- */
-export async function createLabel(owner, repo, label, token) {
-    const authToken = await resolveToken(token, { owner, repo });
-    const response = await githubApiRequest('POST', `/repos/${owner}/${repo}/labels`, authToken, {
-        name: label.name,
-        color: label.color,
-        description: label.description,
-    });
-    if (!response.ok && response.status !== 422) {
-        // 422 means label already exists, which is fine
-        await handleApiError(response, `creating label '${label.name}'`, 'create_label');
-    }
-}
-/**
- * Ensure all required Haystack labels exist in the repo
- */
-export async function ensureHaystackLabels(owner, repo, labelNames, token) {
-    for (const name of labelNames) {
-        const labelInfo = HAYSTACK_LABELS[name];
-        if (!labelInfo)
-            continue;
-        const exists = await labelExists(owner, repo, name, token);
-        if (!exists) {
-            await createLabel(owner, repo, labelInfo, token);
-        }
-    }
-}
-// ============================================================================
-// Review request operations
-// ============================================================================
-/**
- * Request reviewers on a pull request
- */
-export async function requestReviewers(owner, repo, prNumber, reviewers, token) {
-    const authToken = await resolveToken(token, { owner, repo });
-    const response = await githubApiRequest('POST', `/repos/${owner}/${repo}/pulls/${prNumber}/requested_reviewers`, authToken, { reviewers });
-    if (!response.ok) {
-        await handleApiError(response, `requesting reviewers on PR #${prNumber}`, 'request_reviewers');
-    }
-}
-// ============================================================================
-// User operations
-// ============================================================================
-/**
- * Get the authenticated user's info
- */
-export async function getCurrentUser(token) {
-    const authToken = await resolveToken(token);
-    const response = await githubApiRequest('GET', '/user', authToken);
-    if (!response.ok) {
-        await handleApiError(response, 'getting current user', 'get_current_user');
-    }
-    return response.json();
-}
-export async function getRepositoryAccess(owner, repo, token) {
-    const authToken = await resolveToken(token, { owner, repo });
-    const response = await githubApiRequest('GET', `/repos/${owner}/${repo}`, authToken);
-    if (!response.ok) {
-        await handleApiError(response, `getting repository access for ${owner}/${repo}`, 'get_repository_access');
-    }
-    return response.json();
-}
-/**
- * Check if user has push access to a repo
- */
-export async function hasPushAccess(owner, repo, token) {
-    const data = await getRepositoryAccess(owner, repo, token);
-    return data.permissions?.admin === true
-        || data.permissions?.maintain === true
-        || data.permissions?.push === true;
-}

package/dist/utils/pending-state.js

@@ -1,86 +0,0 @@
-/**
- * Pending submit state persistence.
- *
- * Manages `.haystack/pending-submit.json` in the git root directory.
- * This file persists across CLI sessions so that analysis results
- * can be retrieved after disconnection.
- */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from 'fs';
-import { join } from 'path';
-import { findGitRoot } from './git.js';
-// ============================================================================
-// Constants
-// ============================================================================
-const PENDING_FILE = 'pending-submit.json';
-const HAYSTACK_DIR = '.haystack';
-const STALE_THRESHOLD_MS = 2 * 60 * 60 * 1000; // 2 hours
-// ============================================================================
-// Functions
-// ============================================================================
-function getPendingPath(gitRoot) {
-    const root = gitRoot || findGitRoot();
-    if (!root)
-        return null;
-    return join(root, HAYSTACK_DIR, PENDING_FILE);
-}
-/**
- * Save pending submit state to disk.
- */
-export function savePendingSubmit(state, gitRoot) {
-    const root = gitRoot || findGitRoot();
-    if (!root)
-        throw new Error('Not a git repository');
-    const dir = join(root, HAYSTACK_DIR);
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true });
-    }
-    const filePath = join(dir, PENDING_FILE);
-    writeFileSync(filePath, JSON.stringify(state, null, 2));
-}
-/**
- * Load pending submit state from disk.
- * Returns null if no pending state exists or if it's stale.
- */
-export function loadPendingSubmit(gitRoot) {
-    const filePath = getPendingPath(gitRoot);
-    if (!filePath || !existsSync(filePath))
-        return null;
-    try {
-        const content = readFileSync(filePath, 'utf-8');
-        const state = JSON.parse(content);
-        // Check version
-        if (state.version !== 1)
-            return null;
-        // Auto-mark stale entries
-        if (state.status === 'polling') {
-            const age = Date.now() - new Date(state.submittedAt).getTime();
-            if (age > STALE_THRESHOLD_MS) {
-                state.status = 'stale';
-                savePendingSubmit(state, gitRoot);
-            }
-        }
-        return state;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Clear pending submit state (delete the file).
- */
-export function clearPendingSubmit(gitRoot) {
-    const filePath = getPendingPath(gitRoot);
-    if (filePath && existsSync(filePath)) {
-        unlinkSync(filePath);
-    }
-}
-/**
- * Update the status and optionally the analysis result of a pending submit.
- */
-export function updatePendingSubmit(updates, gitRoot) {
-    const state = loadPendingSubmit(gitRoot);
-    if (!state)
-        return;
-    Object.assign(state, updates);
-    savePendingSubmit(state, gitRoot);
-}

package/dist/utils/pr-ref.js

@@ -1,56 +0,0 @@
-/**
- * Shared PR-identifier parsing for every command that takes a PR ref.
- *
- * One grammar, one error message, one repo-inference path. This used to be
- * duplicated per command, and the copies drifted: different "accepted formats"
- * lists (none mentioned the `#123` form the regex accepted), and one copy let
- * a raw git error escape where the others gave a friendly hint. Commands must
- * import from here rather than reimplementing the grammar.
- *
- * Accepted formats, in the order they are tried:
- *   https://github.com/owner/repo/pull/123   GitHub URL
- *   owner/repo#123                           Fully qualified
- *   123 or #123                              PR number (repo inferred from the `origin` remote)
- */
-import { parseRemoteUrl } from './git.js';
-/** The accepted-formats block used in parse errors and help text. */
-export function acceptedPrRefFormats(commandName) {
-    return (`  haystack ${commandName} 123\n` +
-        `  haystack ${commandName} #123\n` +
-        `  haystack ${commandName} owner/repo#123\n` +
-        `  haystack ${commandName} https://github.com/owner/repo/pull/123`);
-}
-/**
- * Parse a PR identifier. `commandName` is interpolated into error messages so
- * the agent can copy a corrected invocation verbatim (e.g. "triage",
- * "pr get", "traces list").
- */
-export function parsePrRef(identifier, commandName) {
-    const urlMatch = identifier.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/);
-    if (urlMatch) {
-        return { owner: urlMatch[1], repo: urlMatch[2], prNumber: parseInt(urlMatch[3], 10) };
-    }
-    // owner/repo#123 — repo segment may not contain `/` (a stray extra segment
-    // used to silently become part of the repo name and 404 downstream).
-    const qualifiedMatch = identifier.match(/^([^/#\s]+)\/([^/#\s]+)#(\d+)$/);
-    if (qualifiedMatch) {
-        return { owner: qualifiedMatch[1], repo: qualifiedMatch[2], prNumber: parseInt(qualifiedMatch[3], 10) };
-    }
-    const numberMatch = identifier.match(/^#?(\d+)$/);
-    if (numberMatch) {
-        const prNumber = parseInt(numberMatch[1], 10);
-        try {
-            const remote = parseRemoteUrl('origin');
-            return { owner: remote.owner, repo: remote.repo, prNumber };
-        }
-        catch (err) {
-            throw new Error(`Cannot determine the repository for PR #${prNumber} ` +
-                `(${err instanceof Error ? err.message : String(err)}).\n` +
-                `Run from inside a checkout with an "origin" remote, or use the full format:\n` +
-                `  haystack ${commandName} owner/repo#${prNumber}`);
-        }
-    }
-    throw new Error(`Invalid PR identifier: "${identifier}"\n\n` +
-        `Accepted formats:\n${acceptedPrRefFormats(commandName)}\n\n` +
-        `See \`haystack ${commandName.split(' ')[0]} --help\` for details.`);
-}