@haystackeditor/cli 0.25.1 → 0.26.0

package/dist/commands/setup.js

@@ -1,1170 +0,0 @@
-/**
- * haystack setup - Interactive onboarding wizard
- *
- * CLI equivalent of the web onboarding wizard. Walks through:
- * 1. Login check
- * 2. Repository selection
- * 3. Scan for coding rules
- * 4. Scan for wait-for signals (CI checks, bot reviews)
- * 5. Scan for review policies
- * 6. Review discovered items (toggle on/off)
- * 7. Confirm & write .haystack.json to selected repos
- * 8. Offer to install local Haystack hooks
- */
-import chalk from 'chalk';
-import { execFileSync, execSync } from 'child_process';
-import { basename } from 'path';
-import { resolveAuthContext } from '../utils/auth.js';
-import { githubRestBaseFor } from '../utils/github-api.js';
-import { HAYSTACK_APP_INSTALL_URL } from '../utils/haystack-api.js';
-import { describeHookOverwrites, hooksInstall } from './hooks.js';
-import { installSessionHooks } from './install-session-hooks.js';
-import { findGitRoot } from '../utils/hooks.js';
-import { trackError } from '../utils/telemetry.js';
-import { createPrompter, loadAnswersFile, PromptCancelledError } from '../utils/prompter.js';
-/** The active prompter for this `setup` invocation (TTY or JSON). */
-let ui;
-/**
- * Translate CLI flags into a pre-supplied answer map keyed by question id.
- * Explicit flags win; `--answers` fills the rest. Anything still missing is
- * asked at runtime (TTY prompt or JSON `question` event).
- */
-function buildAnswerMap(options) {
-    const answers = options.answersFile ? loadAnswersFile(options.answersFile) : {};
-    if (options.repos && options.repos.length > 0)
-        answers.select_repos = options.repos;
-    if (typeof options.autoMerge === 'boolean')
-        answers.auto_merge = options.autoMerge;
-    if (options.yes) {
-        // Accept the interactive wizard's defaults non-interactively: keep every
-        // discovered item (skip the toggle UI), confirm the write, and say yes to
-        // the same things the prompts default to (auto-merge and hooks). Use
-        // --no-auto-merge to opt out. Only fill ids not
-        // already set by an explicit flag or --answers.
-        if (!('want_to_toggle' in answers))
-            answers.want_to_toggle = false;
-        if (!('confirm_write' in answers))
-            answers.confirm_write = true;
-        if (!('auto_merge' in answers)) {
-            answers.auto_merge = true;
-            // Consequential default applied without an interactive prompt — say so.
-            console.error('--yes: enabling auto-merge (the wizard default). Pass --no-auto-merge to opt out.');
-        }
-        if (!('install_hooks' in answers))
-            answers.install_hooks = true;
-        // Don't auto-launch a browser in an unattended --yes run; the feed URL is
-        // still printed and returned in the result for the caller to open.
-        if (!('open_feed' in answers))
-            answers.open_feed = false;
-    }
-    return answers;
-}
-// =============================================================================
-// Constants
-// =============================================================================
-const HAYSTACK_API = 'https://haystackeditor.com';
-// The token verification call below uses githubRestBaseFor: direct to GitHub
-// for an OAuth token (user-scoped, so OAuth App Policy does not apply), the
-// Haystack proxy for an hsk_live token, which must never reach GitHub.
-// Per-repo reads + writes go through the auth-worker proxy, which swaps in the
-// GitHub App installation token server-side. That's what lets the config write
-// and the bootstrap PR succeed on orgs that restrict the OAuth app — the same
-// path the web onboarding wizard uses. Authenticated with the CLI's GitHub
-// token via `Authorization: Bearer` (the proxy validates it against GitHub
-// /user, then uses its own installation/OAuth token upstream). Commits + PRs
-// created this way are authored by haystack[bot], which is the intended
-// behavior for onboarding config and matches the web wizard.
-const GITHUB_PROXY = `${HAYSTACK_API}/api/github`;
-const CATEGORY_LABELS = {
-    testing: 'Testing',
-    style: 'Style',
-    security: 'Security',
-    performance: 'Performance',
-    docs: 'Documentation',
-    other: 'Other',
-};
-const SEVERITY_LABELS = {
-    critical: 'Critical',
-    high: 'High',
-    medium: 'Medium',
-    low: 'Low',
-};
-// =============================================================================
-// GitHub API helpers
-// =============================================================================
-/**
- * Source the onboarding repo list from the user's Haystack GitHub App
- * installations (resolved server-side with the App JWT via
- * /api/github/user-installations) instead of `GET /user/repos` with the user's
- * OAuth token. Every repo here is covered by an installation, so the picker can
- * only ever offer repos Haystack can actually access — no OAuth GitHub-data call,
- * and no "access denied" downstream when a chosen repo turns out not to be
- * install-covered. Sorted most-recently-pushed first.
- */
-async function fetchInstallCoveredRepos(token) {
-    const installations = await fetchHaystackInstallations(token);
-    const pushedByName = new Map();
-    for (const inst of installations) {
-        for (const repo of inst.repositories ?? []) {
-            if (repo?.full_name && !pushedByName.has(repo.full_name)) {
-                pushedByName.set(repo.full_name, repo.pushed_at ?? '');
-            }
-        }
-    }
-    return [...pushedByName.entries()]
-        .sort((a, b) => b[1].localeCompare(a[1])) // ISO pushed_at desc → recent first
-        .map(([fullName]) => fullName);
-}
-// Bootstrap PR constants — kept in sync with the web wizard
-// (src/features/onboarding/services/onboardingApi.ts). The branch prefix and
-// the two labels are load-bearing: the worker's bootstrap merge path
-// (agent/cloudflare/src/merge-queue-cron.ts) keys off them.
-const CONFIG_COMMIT_MSG = 'chore: configure Haystack via CLI setup wizard';
-const AUTO_MERGE_LABEL = 'haystack:auto-merge';
-const ONBOARDING_BOOTSTRAP_LABEL = 'haystack:onboarding-bootstrap';
-const BOOTSTRAP_PR_TITLE = 'Configure Haystack';
-const BOOTSTRAP_PR_BODY_INTRO = 'This PR was opened automatically by the Haystack CLI setup wizard to configure Haystack for this repo.\n\n' +
-    'It adds the Haystack onboarding config:\n' +
-    '- `.haystack/pr-rules.yml` — rules Haystack enforces on every PR\n' +
-    '- `.haystack/review-policy.md` — path-scoped review policies + review instructions\n' +
-    '- `.haystack.json` — your Haystack merge-queue settings\n\n';
-// Auto-merge ON: Haystack bootstrap-merges the PR itself once labeled.
-const BOOTSTRAP_PR_OUTRO_AUTOMERGE = 'Haystack will bootstrap-merge this PR automatically once the labels are applied. ' +
-    'You can tweak the files from GitHub or re-run `haystack setup` anytime.';
-// Auto-merge OFF: the repo opted out of auto-merge, so this PR is NOT enrolled
-// (no labels). It waits for the user to review and merge it themselves.
-const BOOTSTRAP_PR_OUTRO_MANUAL = 'Auto-merge is off for this repo, so this PR is yours to review: check the files and merge it ' +
-    'whenever you\'re ready. You can tweak them from GitHub or re-run `haystack setup` anytime.';
-/**
- * Encode a branch name for use in a URL path while preserving `/`
- * separators (e.g. `release/stable`). encodeURIComponent on the whole
- * string would turn `/` into `%2F`, which several GitHub endpoints reject.
- */
-function encodeBranchPath(branch) {
-    return branch.split('/').map(encodeURIComponent).join('/');
-}
-function ghHeaders(token) {
-    return {
-        Authorization: `Bearer ${token}`,
-        Accept: 'application/vnd.github.v3+json',
-        'Content-Type': 'application/json',
-        'User-Agent': 'Haystack-CLI',
-    };
-}
-async function getDefaultBranch(owner, repo, token) {
-    const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}`, { headers: ghHeaders(token) });
-    if (!res.ok) {
-        throw new Error(`Failed to read repo metadata: ${res.status} — ${await res.text()}`);
-    }
-    return (await res.json()).default_branch;
-}
-async function getBranchSha(owner, repo, branch, token) {
-    // GitHub's git/ref/heads/{ref} endpoint expects literal slashes in the ref
-    // path — encodeURIComponent would turn `release/stable` into
-    // `release%2Fstable` and 404. encodeBranchPath escapes each segment but
-    // keeps the `/` separators.
-    const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/git/ref/heads/${encodeBranchPath(branch)}`, { headers: ghHeaders(token) });
-    if (!res.ok) {
-        throw new Error(`Failed to read branch ref: ${res.status} — ${await res.text()}`);
-    }
-    return (await res.json()).object.sha;
-}
-async function createBranch(owner, repo, branch, sha, token) {
-    const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/git/refs`, {
-        method: 'POST',
-        headers: ghHeaders(token),
-        body: JSON.stringify({ ref: `refs/heads/${branch}`, sha }),
-    });
-    if (!res.ok) {
-        throw new Error(`Failed to create branch: ${res.status} — ${await res.text()}`);
-    }
-}
-async function createBootstrapPR(owner, repo, head, base, token, autoMergeEnabled) {
-    const body = BOOTSTRAP_PR_BODY_INTRO +
-        (autoMergeEnabled ? BOOTSTRAP_PR_OUTRO_AUTOMERGE : BOOTSTRAP_PR_OUTRO_MANUAL);
-    const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/pulls`, {
-        method: 'POST',
-        headers: ghHeaders(token),
-        body: JSON.stringify({ title: BOOTSTRAP_PR_TITLE, head, base, body }),
-    });
-    if (!res.ok) {
-        throw new Error(`Failed to open PR: ${res.status} — ${await res.text()}`);
-    }
-    return (await res.json());
-}
-/**
- * Build a single commit containing `files` on top of `baseSha` via the Git
- * Data API (blobs → tree → commit). Returns the new commit sha.
- *
- * Why not `PUT /contents/`: that updates a ref, and a ruleset whose
- * `pull_request` rule targets `~ALL` branches blocks ref *updates* on
- * EVERY branch — including a fresh onboarding branch. So
- * createBranch-then-commitFileToBranch fails at the commit step. Building
- * the commit as a standalone object and then *creating* a ref at it only
- * ever creates a ref, never updates one (and there is no `creation`
- * restriction in those rulesets), so it gets through. Also works fine for
- * normally-protected repos. Critically: on a `~ALL` repo you cannot add a
- * second commit afterward either, so BOTH onboarding files must land in
- * this one commit.
- */
-async function createCommitWithFiles(owner, repo, baseSha, files, message, token) {
-    const headers = ghHeaders(token);
-    // The new tree extends the base commit's tree.
-    const baseCommitRes = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/git/commits/${baseSha}`, { headers });
-    if (!baseCommitRes.ok) {
-        throw new Error(`Failed to read base commit: ${baseCommitRes.status} — ${await baseCommitRes.text()}`);
-    }
-    const baseTreeSha = (await baseCommitRes.json()).tree.sha;
-    // One blob per file.
-    const treeEntries = await Promise.all(files.map(async (f) => {
-        const blobRes = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/git/blobs`, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({ content: f.content, encoding: 'utf-8' }),
-        });
-        if (!blobRes.ok) {
-            throw new Error(`Failed to create blob for ${f.path}: ${blobRes.status} — ${await blobRes.text()}`);
-        }
-        const blob = (await blobRes.json());
-        return { path: f.path, mode: '100644', type: 'blob', sha: blob.sha };
-    }));
-    const treeRes = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/git/trees`, {
-        method: 'POST',
-        headers,
-        body: JSON.stringify({ base_tree: baseTreeSha, tree: treeEntries }),
-    });
-    if (!treeRes.ok) {
-        throw new Error(`Failed to create tree: ${treeRes.status} — ${await treeRes.text()}`);
-    }
-    const tree = (await treeRes.json());
-    const commitRes = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/git/commits`, {
-        method: 'POST',
-        headers,
-        body: JSON.stringify({ message, tree: tree.sha, parents: [baseSha] }),
-    });
-    if (!commitRes.ok) {
-        throw new Error(`Failed to create commit: ${commitRes.status} — ${await commitRes.text()}`);
-    }
-    return (await commitRes.json()).sha;
-}
-async function addBootstrapLabels(owner, repo, prNumber, prUrl, token, autoMerge) {
-    // CRITICAL, not best-effort. ONBOARDING_BOOTSTRAP_LABEL is the identity marker
-    // that keeps the PR recognized in the user's Analyzing / Good to Merge tabs
-    // (isOnboardingBootstrapPR) and lets the worker's bootstrap path discover it —
-    // so it's ALWAYS applied. AUTO_MERGE_LABEL enrolls the PR for auto-merge, so add
-    // it only when auto-merge is on. The label API failing is almost always
-    // transient, so retry a few times before giving up.
-    const labels = autoMerge
-        ? [ONBOARDING_BOOTSTRAP_LABEL, AUTO_MERGE_LABEL]
-        : [ONBOARDING_BOOTSTRAP_LABEL];
-    let lastErr = '';
-    for (let attempt = 1; attempt <= 3; attempt++) {
-        const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/issues/${prNumber}/labels`, {
-            method: 'POST',
-            headers: ghHeaders(token),
-            body: JSON.stringify({ labels }),
-        });
-        if (res.ok)
-            return;
-        lastErr = `${res.status} — ${await res.text()}`;
-        if (attempt < 3) {
-            await new Promise((resolve) => setTimeout(resolve, attempt * 500));
-        }
-    }
-    // Retries exhausted. The PR exists with the config committed — it just
-    // won't auto-merge without the labels. Throw an actionable error: name
-    // the PR, name the exact labels, and warn against re-running (which would
-    // open a duplicate PR on a fresh timestamped branch).
-    throw new Error(`opened PR ${prUrl} but couldn't apply the auto-merge labels after 3 tries (${lastErr}). ` +
-        `Add these labels to the PR manually so Haystack picks it up: ${labels.join(', ')}. ` +
-        `Don't re-run \`haystack setup\` — that opens a duplicate PR.`);
-}
-/**
- * Assign the onboarding actor (the human running `haystack setup`) to the
- * bootstrap PR.
- *
- * Load-bearing for backfill parity with the web wizard
- * (src/features/onboarding/services/onboardingApi.ts → assignAuthorToPr): when
- * the bootstrap PR merges, the webhook handler's
- * `_extract_onboarding_backfill_actor` figures out whose existing open PRs to
- * analyze by reading the merged PR's assignees. The PR is authored by
- * haystack[bot] (excluded as a bot) and carries no actor marker, so WITHOUT an
- * assignee the actor can't be determined and the backfill is silently skipped
- * (`[ONBOARDING_BACKFILL] Could not determine onboarding actor`) — leaving a
- * freshly-onboarded user's pre-existing PRs un-analyzed. The web wizard assigns
- * the user; the CLI must do the same.
- *
- * Best-effort: the PR is already open + labeled (which is what gates onboarding
- * completion), so a failed assignment must not fail setup. Tracked so we notice
- * if it starts failing systemically (e.g. after a GitHub App permission
- * narrowing).
- */
-async function assignActorToPr(owner, repo, prNumber, login, token) {
-    if (!login) {
-        trackError('haystack_setup_assign_actor_no_login', { repo: `${owner}/${repo}`, pr_number: prNumber });
-        return;
-    }
-    try {
-        const res = await fetch(`${GITHUB_PROXY}/repos/${owner}/${repo}/issues/${prNumber}/assignees`, {
-            method: 'POST',
-            headers: ghHeaders(token),
-            body: JSON.stringify({ assignees: [login] }),
-        });
-        if (!res.ok) {
-            trackError('haystack_setup_assign_actor_failed', {
-                repo: `${owner}/${repo}`,
-                pr_number: prNumber,
-                status: res.status,
-            });
-        }
-    }
-    catch (err) {
-        trackError('haystack_setup_assign_actor_failed', {
-            repo: `${owner}/${repo}`,
-            pr_number: prNumber,
-            error_message: err instanceof Error ? err.message : String(err),
-        });
-    }
-}
-/**
- * Protected-branch fallback: build ONE commit containing ALL the onboarding
- * config files via the Git Data API, CREATE
- * a branch ref at it, open a PR, and apply the auto-merge + bootstrap labels.
- *
- * Why every file in one commit: a ruleset whose `pull_request` rule targets
- * `~ALL` branches blocks ref *updates* on every branch — so you can neither
- * commit to the default branch NOR add a second commit to the onboarding
- * branch afterward. The only thing allowed is *creating* a ref. So all the
- * bootstrap-critical files (`.haystack/pr-rules.yml`, `.haystack/review-policy.md`,
- * and `.haystack.json`) must land in the single commit the
- * branch is created at. Mirrors the web wizard's PR-fallback path.
- */
-async function openBootstrapConfigPR(owner, repo, configFiles, token, defaultBranch, autoMergeEnabled, assigneeLogin) {
-    const baseSha = await getBranchSha(owner, repo, defaultBranch, token);
-    // Branch prefix MUST stay `haystack/onboarding-` — the worker keys off it.
-    // The timestamp avoids collisions when setup is re-run.
-    const branchName = `haystack/onboarding-${Date.now()}`;
-    const files = configFiles.map((f) => ({
-        path: f.path,
-        content: f.content,
-    }));
-    const commitSha = await createCommitWithFiles(owner, repo, baseSha, files, CONFIG_COMMIT_MSG, token);
-    await createBranch(owner, repo, branchName, commitSha, token);
-    const pr = await createBootstrapPR(owner, repo, branchName, defaultBranch, token, autoMergeEnabled);
-    // Assign the actor BEFORE labeling. The onboarding-bootstrap backfill keys off
-    // the merged PR's assignees, and the auto-merge label can let the merge-queue
-    // cron merge this PR promptly — so the assignee must be in place first, else
-    // the merge webhook fires without it and the backfill can't attribute the run.
-    await assignActorToPr(owner, repo, pr.number, assigneeLogin, token);
-    // Always apply the onboarding-bootstrap marker so the PR stays recognized in
-    // the user's tabs (isOnboardingBootstrapPR); enroll for auto-merge only when
-    // the repo hasn't opted out. With auto-merge off the PR is still opened, marked,
-    // and analyzed — it just waits for the user to merge it.
-    await addBootstrapLabels(owner, repo, pr.number, pr.html_url, token, autoMergeEnabled);
-    return { prUrl: pr.html_url };
-}
-/**
- * Write the onboarding config files to a repo by ALWAYS opening a PR
- * (branch → one commit → PR) — never a direct commit to the default branch.
- * Matches the web wizard (#1936): a silent push to someone's default branch is
- * jarring and hard to undo, so onboarding always goes through a "Configure
- * Haystack" PR. The PR is enrolled for auto-merge only when the user kept
- * auto-merge on; otherwise it waits for them to review and merge it.
- */
-async function writeOnboardingFilesToRepo(owner, repo, files, autoMergeEnabled, token, assigneeLogin) {
-    const defaultBranch = await getDefaultBranch(owner, repo, token);
-    const bootstrapPR = await openBootstrapConfigPR(owner, repo, files, token, defaultBranch, autoMergeEnabled, assigneeLogin);
-    return { bootstrapPR };
-}
-const SCAN_POLL_INTERVAL_MS = 1500;
-// A run still marked `running` but whose KV state hasn't been touched for this
-// long is treated as dead (CF isolate killed mid-scan). Mirrors the web's
-// RESUME_FRESHNESS window so we surface a retryable error instead of hanging.
-const SCAN_STALE_MS = 90_000;
-/**
- * Run one unified onboarding scan for a single repo, returning the proposed
- * rules / policies / instructions. Authenticated with the CLI's GitHub token
- * (the scan endpoint validates it against GitHub /user, the same trust model as
- * the cookie session the web uses).
- */
-async function runUnifiedScan(repo, token) {
-    const startResp = await fetch(`${HAYSTACK_API}/api/onboarding/scan`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${token}`,
-        },
-        body: JSON.stringify({ repo, scanType: 'unified' }),
-    });
-    if (!startResp.ok) {
-        const text = await startResp.text().catch(() => '');
-        throw new Error(`Scan kickoff failed: ${startResp.status}${text ? ` ${text}` : ''}`.trim());
-    }
-    const { runId } = (await startResp.json());
-    if (!runId)
-        throw new Error('Scan kickoff returned no runId');
-    let lastProgressKey = '';
-    let loggedPollFetchError = false;
-    let loggedPollStatusError = false;
-    // eslint-disable-next-line no-constant-condition
-    while (true) {
-        await new Promise((resolve) => setTimeout(resolve, SCAN_POLL_INTERVAL_MS));
-        let statusResp;
-        try {
-            statusResp = await fetch(`${HAYSTACK_API}/api/onboarding/scan/status?runId=${encodeURIComponent(runId)}`, { headers: { Authorization: `Bearer ${token}` } });
-        }
-        catch (err) {
-            // Transient network blip — the KV state is authoritative and won't vanish
-            // from one failed poll, so keep going.
-            if (!loggedPollFetchError) {
-                loggedPollFetchError = true;
-                trackError('haystack_setup_scan_status_poll_fetch_error', {
-                    repo,
-                    error: err instanceof Error ? err.message : String(err),
-                });
-            }
-            continue;
-        }
-        if (statusResp.status === 404) {
-            // State expired (TTL) or runId never registered — surface, don't hang.
-            ui.clearProgress();
-            throw new Error('Scan state expired — please retry.');
-        }
-        if (!statusResp.ok) {
-            // Transient (5xx etc.) — back off and retry on the next tick.
-            if (!loggedPollStatusError) {
-                loggedPollStatusError = true;
-                trackError('haystack_setup_scan_status_poll_non_ok', {
-                    repo,
-                    status: statusResp.status,
-                });
-            }
-            continue;
-        }
-        const state = (await statusResp.json());
-        if (state.progress) {
-            const key = `${state.progress.message}|${state.progress.detail ?? ''}`;
-            if (key !== lastProgressKey) {
-                lastProgressKey = key;
-                ui.progress(state.progress.message, state.progress.detail);
-            }
-        }
-        if (state.status === 'done') {
-            ui.clearProgress();
-            if (!state.result)
-                throw new Error('Scan completed but returned no result.');
-            return {
-                rules: state.result.rules ?? [],
-                policies: state.result.policies ?? [],
-                instructions: state.result.instructions ?? [],
-            };
-        }
-        if (state.status === 'error') {
-            ui.clearProgress();
-            throw new Error(state.error || 'Scan failed');
-        }
-        if (state.status === 'running' && Date.now() - state.updatedAt > SCAN_STALE_MS) {
-            ui.clearProgress();
-            throw new Error('Scan stalled (no progress) — please retry.');
-        }
-    }
-}
-// =============================================================================
-// Display helpers
-// =============================================================================
-function printSectionHeader(title, count, total) {
-    console.log(`\n  ${chalk.bold(title)}  ${chalk.dim(`${count}/${total} enabled`)}`);
-    console.log(chalk.dim('  ' + '─'.repeat(50)));
-}
-function printRule(rule, index) {
-    const status = rule.enabled ? chalk.green('ON ') : chalk.dim('OFF');
-    const cat = chalk.dim(`[${CATEGORY_LABELS[rule.category] || rule.category}]`);
-    console.log(`  ${chalk.dim(`${index + 1}.`)} ${status} ${rule.name} ${cat}`);
-    console.log(`     ${chalk.dim(rule.description)}`);
-}
-function printPolicy(policy, index) {
-    const status = policy.enabled ? chalk.green('ON ') : chalk.dim('OFF');
-    const sev = chalk.dim(`[${SEVERITY_LABELS[policy.severity] || policy.severity}]`);
-    console.log(`  ${chalk.dim(`${index + 1}.`)} ${status} ${policy.name} ${sev}`);
-    if (policy.paths.length > 0) {
-        console.log(`     ${chalk.dim(`Paths: ${policy.paths.join(', ')}`)}`);
-    }
-    console.log(`     ${chalk.dim(policy.reason)}`);
-}
-function printInstruction(instruction, index) {
-    const status = instruction.enabled ? chalk.green('ON ') : chalk.dim('OFF');
-    console.log(`  ${chalk.dim(`${index + 1}.`)} ${status} ${instruction.text}`);
-}
-// =============================================================================
-// Wizard steps
-// =============================================================================
-// =============================================================================
-// Step 0.5: Ensure the Haystack GitHub App is installed
-// =============================================================================
-const APP_INSTALL_POLL_INTERVAL_MS = 3000;
-const APP_INSTALL_TIMEOUT_MS = 10 * 60 * 1000;
-class InstallationsAuthError extends Error {
-    status;
-    constructor(status, message) {
-        super(message);
-        this.status = status;
-        this.name = 'InstallationsAuthError';
-    }
-}
-async function fetchHaystackInstallations(token) {
-    // Detect the Haystack App via the auth-worker, NOT GitHub's
-    // `GET /user/installations`. That GitHub endpoint requires a GitHub App
-    // user-to-server token; the CLI's `haystack login` token is a classic OAuth
-    // token, so GitHub answers 403 ("must authenticate with an access token
-    // authorized to a GitHub App") — which made step 0 falsely report the App as
-    // uninstalled and exit. The auth-worker resolves installations server-side
-    // with the App's own JWT, so it works with the CLI's token. Every entry it
-    // returns IS a Haystack installation (the worker only knows about this App),
-    // so there's no app_slug to filter on.
-    const res = await fetch(`${HAYSTACK_API}/api/github/user-installations`, {
-        headers: {
-            Authorization: `Bearer ${token}`,
-            Accept: 'application/json',
-            'User-Agent': 'Haystack-CLI',
-        },
-    });
-    if (!res.ok) {
-        // 401/403 here are genuine auth failures (the token the worker validates is
-        // bad), unlike the GitHub endpoint's spurious 403. Retrying won't recover;
-        // bail with a distinct error type so the poll loop can prompt re-auth.
-        if (res.status === 401 || res.status === 403) {
-            throw new InstallationsAuthError(res.status, `${res.status} ${await res.text()}`);
-        }
-        throw new Error(`failed to fetch installations: ${res.status} ${await res.text()}`);
-    }
-    const data = (await res.json());
-    return data.installations ?? [];
-}
-function tryOpenBrowser(url) {
-    // Best-effort browser open. Never blocks setup — the URL is also printed.
-    // Windows: `start` is a cmd.exe builtin, not a standalone executable, so we
-    // can't invoke it via execFileSync directly. Route through cmd /c.
-    try {
-        if (process.platform === 'win32') {
-            // The empty quoted string is `start`'s "window title" arg — required
-            // when the first arg might be quoted, prevents start from misparsing
-            // the URL as a title. /c terminates cmd after the command runs.
-            execSync(`cmd /c start "" "${url.replace(/"/g, '%22')}"`, { stdio: 'ignore' });
-        }
-        else {
-            const opener = process.platform === 'darwin' ? 'open' : 'xdg-open';
-            execFileSync(opener, [url], { stdio: 'ignore' });
-        }
-        return true;
-    }
-    catch (err) {
-        // Log so operators see systemic browser-open failures (corporate Linux
-        // without xdg-open, weird PATH, etc.). The user-visible UX is unchanged
-        // since the URL was already printed for manual copy.
-        console.log(chalk.dim(`  (Couldn't auto-open browser: ${err.message})`));
-        return false;
-    }
-}
-/** True if the App is installed; tolerates transient errors (returns false so
- *  the poll keeps waiting) but rethrows a genuine auth failure so the caller can
- *  bail and prompt re-auth. */
-async function isAppInstalled(token) {
-    try {
-        return (await fetchHaystackInstallations(token)).length > 0;
-    }
-    catch (err) {
-        // Auth failures are permanent — surface them. Anything else (5xx, network
-        // blip) is transient during the install poll: return false so the poll
-        // keeps waiting instead of crashing the wizard.
-        if (err instanceof InstallationsAuthError)
-            throw err;
-        // Transient (5xx / network / rate limit): log so it isn't a silent fallback
-        // (PR001), then return false so the install poll keeps waiting. Re-throwing
-        // here — a literal reading of "no silent fallback" — would reintroduce the
-        // poll-crash this function exists to prevent, so we log instead.
-        trackError('haystack_setup_app_check_transient_error', {
-            error_message: err instanceof Error ? err.message : String(err),
-        });
-        return false;
-    }
-}
-async function stepEnsureAppInstalled(token) {
-    console.log(chalk.bold('  Step 0: Verify GitHub App'));
-    // Initial check — use the raw fetch (not isAppInstalled, which swallows
-    // transient errors) so we can distinguish three outcomes: installed (done),
-    // genuine auth failure (bail + prompt re-auth), or a transient probe error
-    // (refuse-to-fail and proceed rather than brick setup over a blip).
-    try {
-        if ((await fetchHaystackInstallations(token)).length > 0) {
-            console.log(chalk.green('  ✓ Haystack App installed\n'));
-            return;
-        }
-    }
-    catch (err) {
-        if (err instanceof InstallationsAuthError) {
-            console.log(chalk.yellow(`\n  Your GitHub token is no longer valid (${err.status}).`));
-            console.log(chalk.dim('  Run `haystack login` to re-authenticate, then re-run `haystack setup`.\n'));
-            trackError('haystack_setup_installations_auth_failure', { status: err.status });
-            process.exit(1);
-        }
-        console.log(chalk.yellow(`  Could not check App installations: ${err.message}`));
-        console.log(chalk.dim(`  Continuing — install manually at ${HAYSTACK_APP_INSTALL_URL} if not yet installed.\n`));
-        trackError('haystack_setup_installations_probe_failed', { error_message: err.message });
-        return;
-    }
-    console.log(chalk.yellow('  The Haystack GitHub App is not installed yet.'));
-    console.log(chalk.dim("  Without it, Haystack can't analyze, triage, or merge your PRs."));
-    // Only auto-open a browser for a local interactive user. Under a coding agent
-    // (JSON mode) the `action` event carries the URL for the agent to relay.
-    if (ui.interactive) {
-        const opened = tryOpenBrowser(HAYSTACK_APP_INSTALL_URL);
-        if (opened)
-            console.log(chalk.dim('  (Opened in your browser. Pick the repos to grant access.)'));
-    }
-    // ui.action emits an `action` event (JSON) or prints + spins (TTY), then polls
-    // until the App is detected or it times out. A mid-poll auth failure surfaces
-    // as a thrown InstallationsAuthError.
-    let result;
-    try {
-        result = await ui.action({
-            id: 'install_app',
-            message: 'Install the Haystack GitHub App, then it is detected automatically.',
-            url: HAYSTACK_APP_INSTALL_URL,
-            check: () => isAppInstalled(token),
-            pollIntervalMs: APP_INSTALL_POLL_INTERVAL_MS,
-            timeoutMs: APP_INSTALL_TIMEOUT_MS,
-        });
-    }
-    catch (err) {
-        if (err instanceof InstallationsAuthError) {
-            console.log(chalk.yellow(`\n  Your GitHub token became invalid (${err.status}) while waiting.`));
-            console.log(chalk.dim('  Run `haystack login` to re-authenticate, then re-run `haystack setup`.\n'));
-            trackError('haystack_setup_installations_auth_failure', { status: err.status, during: 'poll' });
-            process.exit(1);
-        }
-        throw err;
-    }
-    if (result === 'ok') {
-        console.log(chalk.green('\n  ✓ App installed\n'));
-        return;
-    }
-    if (result === 'skip') {
-        // Caller intentionally skipped — proceed (refuse-to-fail), but warn that the
-        // App is needed for Haystack to actually act on the configured repos.
-        console.log(chalk.yellow('\n  Skipping GitHub App verification.'));
-        console.log(chalk.dim('  Haystack needs the App installed to analyze, triage, or merge your PRs.\n'));
-        return;
-    }
-    // result === 'timeout'
-    trackError('haystack_setup_app_install_timeout', { timeout_ms: APP_INSTALL_TIMEOUT_MS });
-    console.log(chalk.yellow('\n  Timed out waiting for App install.'));
-    console.log(chalk.dim(`  Install at ${HAYSTACK_APP_INSTALL_URL}, then re-run \`haystack setup\`.\n`));
-    process.exit(1);
-}
-async function stepSelectRepos(token) {
-    console.log(chalk.bold('\n  Step 1: Select repositories\n'));
-    console.log(chalk.dim('  Fetching your repositories...'));
-    const repos = await fetchInstallCoveredRepos(token);
-    if (repos.length === 0) {
-        console.log(chalk.yellow('\n  No repositories found on your Haystack App installation(s).'));
-        console.log(chalk.dim(`  Add repositories to the install at ${HAYSTACK_APP_INSTALL_URL}, then re-run \`haystack setup\`.\n`));
-        process.exit(1);
-    }
-    let selectedRepos = [];
-    for (;;) {
-        selectedRepos = await ui.multiselect({
-            id: 'select_repos',
-            message: 'Select repositories to configure:',
-            choices: repos.map((r) => ({ name: r, value: r })),
-        });
-        if (selectedRepos.length > 0)
-            break;
-        // Interactive live pick: keep the picker open so the user can correct an
-        // empty selection (restores the old inquirer `validate`). But a PRE-SUPPLIED
-        // empty selection (--answers select_repos:[]) would be returned unchanged
-        // every iteration — re-prompting can't fix it, so fail instead of looping.
-        // Non-interactive likewise can't be corrected.
-        if (!ui.interactive || ui.hasPreset('select_repos')) {
-            console.log(chalk.yellow('\n  No repositories selected. Pass --repo <owner/name>.\n'));
-            process.exit(1);
-        }
-        console.log(chalk.yellow('  Select at least one repository.'));
-    }
-    console.log(chalk.green(`  ${selectedRepos.length} repo(s) selected\n`));
-    return selectedRepos;
-}
-// File paths written during onboarding (must match the web wizard + worker:
-// src/features/onboarding/services/onboardingApi.ts + the merge-queue cron's
-// ONBOARDING_ALLOWED_PATHS).
-const PR_RULES_PATH = '.haystack/pr-rules.yml';
-const REVIEW_POLICY_PATH = '.haystack/review-policy.md';
-const HAYSTACK_CONFIG_PATH = '.haystack.json';
-/**
- * Scan each selected repo with one unified scan and collect the proposed
- * rules / policies / instructions per repo. A failed scan for one repo records
- * an empty result (and a warning) rather than aborting the whole wizard.
- */
-async function stepScanRepos(repos, token) {
-    console.log(chalk.bold('\n  Step 2: Scanning your repositories\n'));
-    console.log(chalk.dim("  Haystack reads each repo's PR history to learn its review conventions.\n"));
-    const byRepo = new Map();
-    for (const repo of repos) {
-        console.log(chalk.dim(`  Scanning ${repo}...`));
-        try {
-            const result = await runUnifiedScan(repo, token);
-            byRepo.set(repo, result);
-            const counts = [];
-            if (result.rules.length)
-                counts.push(`${result.rules.length} rule(s)`);
-            if (result.policies.length)
-                counts.push(`${result.policies.length} policy/policies`);
-            if (result.instructions.length)
-                counts.push(`${result.instructions.length} instruction(s)`);
-            console.log(counts.length
-                ? chalk.green(`  ✓ ${repo}: ${counts.join(', ')}`)
-                : chalk.dim(`  ${repo}: nothing discovered`));
-        }
-        catch (err) {
-            console.log(chalk.yellow(`  ⚠ ${repo}: scan failed (${err.message})`));
-            console.log(chalk.dim('     Continuing — this repo will get a baseline config you can tune later.'));
-            byRepo.set(repo, { rules: [], policies: [], instructions: [] });
-        }
-    }
-    return byRepo;
-}
-/**
- * Show the discovered rules / policies / instructions per repo and let the user
- * toggle any off. Mutates the `enabled` flags on the items in `byRepo` in place.
- */
-async function stepReview(byRepo) {
-    const total = [...byRepo.values()].reduce((n, r) => n + r.rules.length + r.policies.length + r.instructions.length, 0);
-    if (total === 0) {
-        console.log(chalk.dim('\n  No items discovered — skipping review.\n'));
-        return;
-    }
-    console.log(chalk.bold('\n  Step 3: Review discovered configuration\n'));
-    console.log(chalk.dim('  Toggle items on/off. Only enabled items will be written.\n'));
-    for (const [repo, result] of byRepo) {
-        if (result.rules.length + result.policies.length + result.instructions.length === 0)
-            continue;
-        console.log(`\n  ${chalk.bold.cyan(repo)}`);
-        if (result.rules.length > 0) {
-            printSectionHeader('Coding Rules', result.rules.filter((r) => r.enabled).length, result.rules.length);
-            result.rules.forEach((r, i) => printRule(r, i));
-        }
-        if (result.policies.length > 0) {
-            printSectionHeader('Review Policies', result.policies.filter((p) => p.enabled).length, result.policies.length);
-            result.policies.forEach((p, i) => printPolicy(p, i));
-        }
-        if (result.instructions.length > 0) {
-            printSectionHeader('Review Instructions', result.instructions.filter((ins) => ins.enabled).length, result.instructions.length);
-            result.instructions.forEach((ins, i) => printInstruction(ins, i));
-        }
-    }
-    const wantToToggle = await ui.confirm({
-        id: 'want_to_toggle',
-        message: 'Would you like to toggle any items?',
-        default: false,
-    });
-    if (!wantToToggle)
-        return;
-    // NUL separates repo / kind / id in the checkbox value so it can't collide
-    // with any character in a repo slug or an item id.
-    const SEP = '\u0000';
-    const allItems = [];
-    for (const [repo, result] of byRepo) {
-        if (result.rules.length + result.policies.length + result.instructions.length === 0)
-            continue;
-        allItems.push({ separator: `── ${repo} ──` });
-        result.rules.forEach((r) => {
-            allItems.push({
-                name: `${r.name} ${chalk.dim(`[rule · ${CATEGORY_LABELS[r.category] || r.category}]`)}`,
-                value: `${repo}${SEP}rule${SEP}${r.id}`,
-                checked: r.enabled,
-            });
-        });
-        result.policies.forEach((p) => {
-            allItems.push({
-                name: `${p.name} ${chalk.dim(`[policy · ${SEVERITY_LABELS[p.severity] || p.severity}]`)}`,
-                value: `${repo}${SEP}policy${SEP}${p.id}`,
-                checked: p.enabled,
-            });
-        });
-        result.instructions.forEach((ins) => {
-            allItems.push({
-                name: `${ins.text} ${chalk.dim('[instruction]')}`,
-                value: `${repo}${SEP}instruction${SEP}${ins.id}`,
-                checked: ins.enabled,
-            });
-        });
-    }
-    const enabled = await ui.multiselect({
-        id: 'review_enabled_items',
-        message: 'Select items to enable:',
-        choices: allItems,
-    });
-    const enabledSet = new Set(enabled);
-    for (const [repo, result] of byRepo) {
-        result.rules.forEach((r) => { r.enabled = enabledSet.has(`${repo}${SEP}rule${SEP}${r.id}`); });
-        result.policies.forEach((p) => { p.enabled = enabledSet.has(`${repo}${SEP}policy${SEP}${p.id}`); });
-        result.instructions.forEach((ins) => { ins.enabled = enabledSet.has(`${repo}${SEP}instruction${SEP}${ins.id}`); });
-    }
-}
-// ── Config builders ──────────────────────────────────────────────────────
-// Mirror src/features/onboarding/components/ConfirmStep.tsx (buildPrRules,
-// buildReviewPolicyMarkdown) + services/onboardingApi.ts (serializePrRulesYaml,
-// buildHaystackConfigJson) so the CLI and web wizard emit byte-identical files.
-/** Build pr-rules.yml entries from the proposed rules. Everything onboarding
- *  surfaces is LLM-evaluated (natural-language rules extracted from review
- *  comments), so type:'llm' and the description doubles as the prompt. */
-function buildPrRules(rules) {
-    const PROPOSED_TO_YML_CATEGORY = {
-        testing: 'patterns',
-        style: 'style',
-        security: 'security',
-        performance: 'performance',
-        docs: 'patterns',
-        other: 'patterns',
-    };
-    return rules
-        .filter((r) => r.enabled)
-        .map((r) => ({
-        id: r.id,
-        name: r.name,
-        type: 'llm',
-        severity: 'warning',
-        message: r.description,
-        category: PROPOSED_TO_YML_CATEGORY[r.category],
-        llm: { prompt: r.description },
-    }));
-}
-/** Render review-policy.md from path-scoped policies + universal instructions.
- *  Returns null when nothing is enabled (caller skips the file). */
-function buildReviewPolicyMarkdown(policies, instructions) {
-    const enabledPolicies = policies.filter((p) => p.enabled);
-    const enabledInstructions = instructions.filter((i) => i.enabled);
-    if (enabledPolicies.length === 0 && enabledInstructions.length === 0)
-        return null;
-    const lines = ['# Review Policies', ''];
-    for (const policy of enabledPolicies) {
-        lines.push(`## ${policy.name}`);
-        lines.push(`- **Paths**: ${policy.paths.map((p) => '`' + p + '`').join(', ')}`);
-        lines.push(`- **Severity**: ${policy.severity}`);
-        lines.push(`- **Reason**: ${policy.reason}`);
-        lines.push('');
-    }
-    if (enabledInstructions.length > 0) {
-        lines.push('## Instructions');
-        for (const instr of enabledInstructions) {
-            lines.push(`- ${instr.text}`);
-        }
-        lines.push('');
-    }
-    return lines.join('\n');
-}
-/** `.haystack.json` enabling the merge queue, reflecting the user's auto-merge
- *  choice. Mirrors the web wizard's buildHaystackConfigJson shape. Auto-merge is
- *  the master switch: when off, nothing lands in the queue, so the two sub-flags
- *  follow it. */
-function buildHaystackConfigJson(autoMerge) {
-    const config = {
-        preferences: { auto_merge: autoMerge },
-        merge_queue: {
-            merge_queue: autoMerge,
-            auto_resolve_conflicts: autoMerge,
-            auto_fix_ci_failures: autoMerge,
-        },
-    };
-    return JSON.stringify(config, null, 2) + '\n';
-}
-// Minimal YAML serializer for the pr-rules.yml shape (keeps us off a yaml dep;
-// mirrors onboardingApi.ts serializePrRulesYaml).
-function yamlScalar(s) {
-    return `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
-}
-function yamlBlockOrScalar(s, indentCols) {
-    if (!s.includes('\n'))
-        return yamlScalar(s);
-    const pad = ' '.repeat(indentCols);
-    const body = s.split('\n').map((line) => `${pad}${line}`).join('\n');
-    return `|\n${body}`;
-}
-function serializePrRulesYaml(rules) {
-    if (rules.length === 0) {
-        return '# No rules configured yet. Add entries under `rules:` below.\nrules: []\n';
-    }
-    const lines = ['rules:'];
-    for (const rule of rules) {
-        lines.push(`  - id: ${yamlScalar(rule.id)}`);
-        lines.push(`    name: ${yamlScalar(rule.name)}`);
-        lines.push(`    type: ${rule.type}`);
-        lines.push(`    severity: ${rule.severity}`);
-        if (rule.category)
-            lines.push(`    category: ${yamlScalar(rule.category)}`);
-        lines.push(`    message: ${yamlScalar(rule.message)}`);
-        if (rule.llm) {
-            lines.push(`    llm:`);
-            lines.push(`      prompt: ${yamlBlockOrScalar(rule.llm.prompt, 8)}`);
-            if (rule.llm.files)
-                lines.push(`      files: ${yamlScalar(rule.llm.files)}`);
-        }
-        if (rule.pattern) {
-            lines.push(`    pattern:`);
-            lines.push(`      regex: ${yamlScalar(rule.pattern.regex)}`);
-            if (rule.pattern.files)
-                lines.push(`      files: ${yamlScalar(rule.pattern.files)}`);
-            if (rule.pattern.exclude)
-                lines.push(`      exclude: ${yamlScalar(rule.pattern.exclude)}`);
-        }
-    }
-    return lines.join('\n') + '\n';
-}
-/** Build the onboarding files to write for one repo from its (toggled) scan
- *  result. `.haystack.json` is always written (it enables the merge queue); the
- *  rules + policy files only when there's enabled content for them. */
-function buildOnboardingFiles(result, autoMerge) {
-    const files = [];
-    const prRules = buildPrRules(result.rules);
-    if (prRules.length > 0) {
-        files.push({ path: PR_RULES_PATH, content: serializePrRulesYaml(prRules) });
-    }
-    const reviewPolicyMd = buildReviewPolicyMarkdown(result.policies, result.instructions);
-    if (reviewPolicyMd) {
-        files.push({ path: REVIEW_POLICY_PATH, content: reviewPolicyMd });
-    }
-    files.push({ path: HAYSTACK_CONFIG_PATH, content: buildHaystackConfigJson(autoMerge) });
-    return files;
-}
-async function stepConfirm(byRepo, token, assigneeLogin) {
-    const selectedRepos = [...byRepo.keys()];
-    console.log(chalk.bold('\n  Step 4: Confirm & write configuration\n'));
-    // Per-repo summary of what will be written.
-    for (const [repo, result] of byRepo) {
-        const enabledRules = result.rules.filter((r) => r.enabled).length;
-        const enabledPolicies = result.policies.filter((p) => p.enabled).length;
-        const enabledInstructions = result.instructions.filter((i) => i.enabled).length;
-        const parts = [];
-        if (enabledRules > 0)
-            parts.push(`${enabledRules} rule(s) → ${PR_RULES_PATH}`);
-        if (enabledPolicies + enabledInstructions > 0) {
-            parts.push(`${enabledPolicies + enabledInstructions} policy/instruction(s) → ${REVIEW_POLICY_PATH}`);
-        }
-        parts.push(`merge queue → ${HAYSTACK_CONFIG_PATH}`);
-        console.log(`  ${chalk.bold(repo)}`);
-        parts.forEach((p) => console.log(`    ${chalk.dim('•')} ${chalk.dim(p)}`));
-    }
-    console.log('');
-    // Auto-merge is the master switch. Default ON (matches the web wizard default
-    // + the repo-level preferences.auto_merge opt-in model). When off, the
-    // bootstrap PR is opened but NOT labeled, so the user merges it manually and
-    // no PRs auto-merge.
-    const autoMerge = await ui.confirm({
-        id: 'auto_merge',
-        message: 'Enable auto-merge? (Haystack merges PRs automatically once they pass review)',
-        default: true,
-    });
-    const confirmed = await ui.confirm({
-        id: 'confirm_write',
-        message: `Write Haystack config to ${selectedRepos.length} repo(s)?`,
-        default: true,
-    });
-    if (!confirmed) {
-        console.log(chalk.yellow('\n  Setup cancelled.\n'));
-        return { confirmed: false, bootstrapPRs: new Map() };
-    }
-    const failedRepos = [];
-    const bootstrapPRs = new Map();
-    for (const repoFullName of selectedRepos) {
-        const [owner, repo] = repoFullName.split('/');
-        const result = byRepo.get(repoFullName);
-        const files = buildOnboardingFiles(result, autoMerge);
-        try {
-            ui.progress(`Opening Configure Haystack PR for ${repoFullName}...`);
-            const writeResult = await writeOnboardingFilesToRepo(owner, repo, files, autoMerge, token, assigneeLogin);
-            ui.clearProgress();
-            // Onboarding always opens a PR (never a direct commit). With auto-merge on,
-            // Haystack merges it once its labels are processed; with auto-merge off it
-            // waits for the user.
-            bootstrapPRs.set(repoFullName, writeResult.bootstrapPR);
-            // Don't print the GitHub PR URL: the user reviews and merges from their
-            // Haystack feed, not the GitHub PR page. The feed link is the single CTA
-            // in the Next steps block below.
-            console.log(chalk.green(`  ✓ ${repoFullName}`) + chalk.dim(' (configured)'));
-        }
-        catch (err) {
-            ui.clearProgress();
-            console.log(chalk.red(`  ✗ ${repoFullName}: ${err.message}`));
-            failedRepos.push(repoFullName);
-        }
-    }
-    if (failedRepos.length > 0) {
-        console.log(chalk.red(`\n  Setup failed for ${failedRepos.length} repo(s).\n`));
-        process.exit(1);
-    }
-    console.log(chalk.green('\n  Setup complete!\n'));
-    return { confirmed: true, bootstrapPRs };
-}
-// =============================================================================
-// Main command
-// =============================================================================
-export async function setupCommand(options = {}) {
-    // Create the prompter FIRST: in JSON mode it redirects console.* to stderr so
-    // stdout carries only NDJSON, which the steps below rely on.
-    ui = createPrompter({ json: options.json, answers: buildAnswerMap(options) });
-    try {
-        await runSetupFlow(options);
-    }
-    catch (err) {
-        // An agent cancelling a prompt is a clean exit, not a crash.
-        if (err instanceof PromptCancelledError) {
-            console.log(chalk.yellow('\n  Setup cancelled.\n'));
-            ui.result({ status: 'cancelled' });
-            return;
-        }
-        throw err;
-    }
-    finally {
-        ui.close();
-    }
-}
-async function runSetupFlow(options) {
-    console.log(chalk.cyan('\n  Haystack Setup Wizard\n'));
-    // Step 0: Check login
-    let authContext;
-    try {
-        authContext = await resolveAuthContext();
-    }
-    catch (err) {
-        console.log(chalk.yellow(`  ${err.message}\n`));
-        process.exit(1);
-    }
-    const token = authContext.token;
-    // Verify token
-    const userResponse = await fetch(`${githubRestBaseFor(token)}/user`, {
-        headers: {
-            Authorization: `Bearer ${token}`,
-            'User-Agent': 'Haystack-CLI',
-        },
-    });
-    if (!userResponse.ok) {
-        console.log(chalk.yellow('  Token expired. Run `haystack login` again.\n'));
-        process.exit(1);
-    }
-    const user = (await userResponse.json());
-    console.log(chalk.dim(`  Logged in as ${chalk.bold(user.login)}\n`));
-    // Step 0.5: Ensure the Haystack GitHub App is installed. Without it, all
-    // the server-side machinery (merge queue, analysis, fixer, review chat) is
-    // dark — the user would write .haystack.json and then nothing would happen.
-    await stepEnsureAppInstalled(token);
-    // Step 1: Select repos
-    const selectedRepos = await stepSelectRepos(token);
-    // Step 2: Unified scan per repo (rules + policies + instructions)
-    const byRepo = await stepScanRepos(selectedRepos, token);
-    // Step 3: Review (toggle items off)
-    await stepReview(byRepo);
-    // Step 4: Confirm & write the config files. Pass the authenticated user's
-    // login so each bootstrap PR is assigned to them — the onboarding-bootstrap
-    // backfill keys off the merged PR's assignees to decide whose existing open
-    // PRs to analyze (parity with the web wizard).
-    const { confirmed, bootstrapPRs } = await stepConfirm(byRepo, token, user.login);
-    if (!confirmed) {
-        ui.result({ status: 'cancelled' });
-        return;
-    }
-    // Step 7: Offer Haystack's local quality hooks when setup runs in a selected repo.
-    await stepInstallHooks(selectedRepos, options.json === true);
-    // Close the loop with ONE prominent CTA: the Haystack feed. The Configure
-    // Haystack PR (and every PR after it) is reviewed and merged from the feed,
-    // NOT the GitHub PR page, so the feed is the only link we surface. In JSON
-    // mode these console writes go to stderr, so a driving agent instead gets the
-    // same content as `summary` in the `result` event to relay verbatim.
-    const feedUrl = `${HAYSTACK_API}/inbox`;
-    const prs = [...bootstrapPRs.entries()].map(([repo, pr]) => ({ repo, url: pr.prUrl }));
-    // Plain-text summary an agent can print as-is (no ANSI codes).
-    const summary = [
-        'Open your Haystack feed to review and merge your Configure Haystack PR:',
-        `  ${feedUrl}`,
-    ].join('\n');
-    // Styled version for the human at a TTY.
-    console.log(chalk.green.bold('\n  Next steps\n'));
-    console.log('  Open your Haystack feed to review and merge your Configure Haystack PR:');
-    console.log(`    ${chalk.cyan(feedUrl)}\n`);
-    if (ui.interactive) {
-        const openFeed = await ui.confirm({ id: 'open_feed', message: 'Open your Haystack feed now?', default: true });
-        if (openFeed)
-            tryOpenBrowser(feedUrl);
-    }
-    // Final structured outcome for non-interactive/agent callers. `summary` is the
-    // ready-to-print Next steps text so a driving agent can surface it verbatim.
-    // `pullRequests` stays as structured metadata (programmatic use), but the
-    // human-facing copy points only to the feed.
-    ui.result({
-        status: 'complete',
-        repos: selectedRepos,
-        pullRequests: prs,
-        feedUrl,
-        summary,
-    });
-}
-// =============================================================================
-// Step 7: Install Haystack git hooks
-// =============================================================================
-async function stepInstallHooks(selectedRepos, json) {
-    // Offer to install local git hooks if cwd is inside one of the selected repos
-    const gitRoot = findGitRoot();
-    if (gitRoot) {
-        const gitDirName = basename(gitRoot).toLowerCase();
-        const repoName = selectedRepos.find((r) => {
-            const name = r.split('/')[1]?.replace(/\.git$/, '');
-            return name && gitDirName === name.toLowerCase();
-        });
-        if (repoName) {
-            try {
-                const installHooks = await ui.confirm({
-                    id: 'install_hooks',
-                    message: `Install local hooks for ${repoName}? (git hooks in hooks/ via core.hooksPath; Claude Code session and verification-precompute hooks in your .claude/settings.local.json)`,
-                    default: true,
-                });
-                if (installHooks) {
-                    console.log('');
-                    const overwrites = await describeHookOverwrites(gitRoot);
-                    let installGitHooks = true;
-                    if (overwrites.length > 0) {
-                        console.log(chalk.yellow('  Installing Haystack hooks would:'));
-                        for (const change of overwrites)
-                            console.log(chalk.yellow(`    - ${change}`));
-                        if (json || !process.stdin.isTTY) {
-                            console.log('  Existing git hooks were left alone; to replace them, run `haystack hooks install --force` yourself.');
-                            installGitHooks = false;
-                        }
-                        else {
-                            installGitHooks = await ui.confirm({
-                                id: 'overwrite_hooks',
-                                message: 'Overwrite these existing hooks?',
-                                default: false,
-                            });
-                            if (!installGitHooks) {
-                                console.log(chalk.dim('  Existing git hooks were left alone. To replace them later: haystack hooks install --force'));
-                            }
-                        }
-                    }
-                    if (installGitHooks)
-                        await hooksInstall({ force: overwrites.length > 0 });
-                    await installSessionHooks({ cli: 'claude' });
-                }
-            }
-            catch (err) {
-                console.log(chalk.yellow(`  ⚠ Hook installation failed: ${err instanceof Error ? err.message : err}`));
-                console.log(chalk.dim('  You can install hooks later with: haystack hooks install'));
-            }
-        }
-        else {
-            console.log(chalk.dim('  To install git hooks in a repo, cd into it and run:'));
-            console.log(chalk.dim('    haystack hooks install\n'));
-        }
-    }
-    else {
-        console.log(chalk.dim('  To install git hooks in a repo, cd into it and run:'));
-        console.log(chalk.dim('    haystack hooks install\n'));
-    }
-}