@haystackeditor/cli 0.25.1 → 0.26.0

package/dist/commands/submit.js

@@ -1,745 +0,0 @@
-/**
- * Submit command - Create a PR from current changes
- *
- * Runs pre-PR triage (code review, rules) on gpt-6-astra in parallel,
- * then pushes the current branch and creates a PR.
- *
- * PRs are routed based on flags:
- *   - Default: auto-merge queue (analysis runs, auto-merged if approved)
- *   - --review: human review required
- *   - --force: skip triage checks
- */
-import chalk from 'chalk';
-import fs from 'fs';
-import { findGitRoot, getCurrentBranch, getDefaultBranch, hasUncommittedChanges, parseRemoteUrl, pushBranch, getLastCommitMessage, getCommitMessagesSinceBase, HEADLESS_PUSH_ERROR, } from '../utils/git.js';
-import { createPullRequest, findExistingPR, getRepositoryAccess, requestReviewers, } from '../utils/github-api.js';
-import { runTriage } from '../triage/runner.js';
-import { loadConfig } from '../utils/config.js';
-import { checkAnalysisReady, fetchAnalysisResults } from '../utils/analysis-api.js';
-import { savePendingSubmit, updatePendingSubmit } from '../utils/pending-state.js';
-import { ensureHaystackLabels, addLabelsToIssue, } from '../utils/github-api.js';
-import { isHeadlessToken, listStoredAccounts, resolveAuthContext, setRepoDefaultAccount, } from '../utils/auth.js';
-import { HaystackApiError } from '../utils/haystack-api.js';
-import { withSchema } from '../schema.js';
-// ============================================================================
-// Helpers
-// ============================================================================
-function buildPRBody(commitMessages) {
-    const body = commitMessages || 'Submitted via `haystack submit`.';
-    return `${body}
-
----
-*Created via [Haystack CLI](https://haystackeditor.com)*`;
-}
-function canCreateSameRepoPullRequest(permissions) {
-    return permissions?.admin === true
-        || permissions?.maintain === true
-        || permissions?.push === true;
-}
-function buildSubmitPermissionMessage(activeLogin, owner, repo, detail) {
-    const repoName = `${owner}/${repo}`;
-    const lines = [
-        `Haystack is authenticated as ${activeLogin}, but that account cannot create a same-repo pull request in ${repoName}.`,
-        'Use `haystack submit --account <login>` or `haystack auth use <login>` to select a different saved account.',
-    ];
-    if (detail) {
-        lines.push(detail);
-    }
-    lines.push(`If the correct account is not saved yet, run \`haystack login\` with a GitHub account that has collaborator access to ${repoName}, then retry \`haystack submit\`.`);
-    return lines.join('\n');
-}
-function formatSubmitPermissionError(error, activeLogin, owner, repo) {
-    const message = error instanceof Error ? error.message : String(error);
-    const lowerMessage = message.toLowerCase();
-    const shouldWrap = lowerMessage.includes('must be a collaborator')
-        || lowerMessage.includes('permission denied')
-        || message.startsWith('Not found: getting repository access');
-    if (!shouldWrap) {
-        return message;
-    }
-    return buildSubmitPermissionMessage(activeLogin, owner, repo, `GitHub said: ${message}`);
-}
-async function checkSubmitAccess(owner, repo, authContext) {
-    try {
-        const repoAccess = await getRepositoryAccess(owner, repo, authContext.token);
-        return { repoAccess };
-    }
-    catch (error) {
-        return { error };
-    }
-}
-function ambiguousAccountMessage(owner, repo, logins) {
-    return [
-        `Multiple saved Haystack accounts can create a same-repo pull request in ${owner}/${repo}: ${logins.join(', ')}.`,
-        'Re-run `haystack submit --account <login>` or `haystack auth use <login>` to choose one.',
-    ].join('\n');
-}
-async function resolveSubmitAuthContext(owner, repo, preferredLogin) {
-    const primaryContext = await resolveAuthContext({ preferredLogin, owner, repo });
-    const primaryResult = await checkSubmitAccess(owner, repo, primaryContext);
-    if (primaryResult.repoAccess && canCreateSameRepoPullRequest(primaryResult.repoAccess.permissions)) {
-        return {
-            authContext: primaryContext,
-            repoAccess: primaryResult.repoAccess,
-            autoSelected: false,
-        };
-    }
-    if (!preferredLogin) {
-        const alternatives = [];
-        const accounts = await listStoredAccounts();
-        for (const account of accounts) {
-            if (account.login === primaryContext.login)
-                continue;
-            const candidateContext = await resolveAuthContext({ preferredLogin: account.login });
-            const candidateResult = await checkSubmitAccess(owner, repo, candidateContext);
-            if (candidateResult.repoAccess && canCreateSameRepoPullRequest(candidateResult.repoAccess.permissions)) {
-                alternatives.push({
-                    authContext: candidateContext,
-                    repoAccess: candidateResult.repoAccess,
-                    autoSelected: true,
-                });
-            }
-        }
-        if (alternatives.length === 1) {
-            return alternatives[0];
-        }
-        if (alternatives.length > 1) {
-            throw new Error(ambiguousAccountMessage(owner, repo, alternatives.map((candidate) => candidate.authContext.login)));
-        }
-    }
-    if (primaryResult.error) {
-        throw new Error(formatSubmitPermissionError(primaryResult.error, primaryContext.login, owner, repo));
-    }
-    throw new Error(buildSubmitPermissionMessage(primaryContext.login, owner, repo, 'The selected Haystack account does not have the collaborator access required for same-repo PR creation.'));
-}
-// ============================================================================
-// Triage output
-// ============================================================================
-function severityIcon(severity) {
-    switch (severity) {
-        case 'error': return chalk.red('✗');
-        case 'warning': return chalk.yellow('!');
-        case 'info': return chalk.blue('i');
-        default: return chalk.dim('-');
-    }
-}
-function severityColor(severity) {
-    switch (severity) {
-        case 'error': return chalk.red;
-        case 'warning': return chalk.yellow;
-        case 'info': return chalk.blue;
-        default: return chalk.dim;
-    }
-}
-function checkerDisplayName(checker) {
-    switch (checker) {
-        case 'code-review': return 'Code Review';
-        case 'rules-validator': return 'Rules Validator';
-        default: return checker;
-    }
-}
-/**
- * Merge triage-tuning knobs from two sources, in ascending precedence:
- *   defaults (in runner.ts) < .haystack.json triage.* < CLI flags
- */
-async function resolveTriageOptions(options) {
-    let config = null;
-    try {
-        config = await loadConfig();
-    }
-    catch (err) {
-        // loadConfig returns null when the file doesn't exist — it only throws on
-        // read/parse failures, which we must surface so a malformed config doesn't
-        // silently lose the user's project-level triage overrides.
-        console.warn(chalk.yellow(`⚠ Could not load .haystack.json: ${err.message}`));
-        console.warn(chalk.dim('  Triage will use CLI flags / defaults — fix the config to apply project overrides.'));
-    }
-    const triageConfig = config?.triage ?? {};
-    // loadConfig does a raw `as HaystackConfig` cast (no Zod runtime parse), so
-    // malformed .haystack.json values can reach us as strings/negatives/NaN.
-    // Guard before letting this flow into setTimeout.
-    const configTimeoutMs = typeof triageConfig.timeoutMs === 'number' && triageConfig.timeoutMs > 0
-        ? triageConfig.timeoutMs
-        : undefined;
-    const timeoutMs = typeof options.triageTimeout === 'number' && options.triageTimeout > 0
-        ? options.triageTimeout * 1000
-        : configTimeoutMs;
-    return { timeoutMs };
-}
-function printTriageSummary(result) {
-    console.log(chalk.bold('\n' + '━'.repeat(50)));
-    console.log(chalk.bold('  Pre-PR Triage Results'));
-    console.log(chalk.bold('━'.repeat(50) + '\n'));
-    // Per-checker summaries
-    for (const checkerResult of result.results) {
-        const icon = checkerResult.passed ? chalk.green('✓') : chalk.red('✗');
-        const name = checkerDisplayName(checkerResult.checker);
-        console.log(`  ${icon} ${chalk.bold(name)}: ${checkerResult.summary}`);
-        // List issues
-        if (checkerResult.issues.length > 0) {
-            for (const issue of checkerResult.issues) {
-                const location = issue.line
-                    ? `${issue.file}:${issue.line}`
-                    : issue.file;
-                const ruleTag = issue.rule ? chalk.dim(` [${issue.rule}]`) : '';
-                const patternTag = issue.pattern ? chalk.dim(` (${issue.pattern})`) : '';
-                const categoryTag = issue.category ? chalk.dim(` {${issue.category}}`) : '';
-                console.log(`    ${severityIcon(issue.severity)} ${chalk.dim(location)} ${severityColor(issue.severity)(issue.message)}${ruleTag}${patternTag}${categoryTag}`);
-                if (issue.failureScenario) {
-                    console.log(chalk.dim(`        ${issue.failureScenario}`));
-                }
-            }
-            console.log('');
-        }
-    }
-    // Checkers that could not run (API error, missing key, stall). Non-blocking.
-    for (const err of result.errors) {
-        console.log(chalk.yellow(`  ! ${err}`));
-    }
-    if (result.errors.length > 0)
-        console.log('');
-    // Total summary
-    const totalIssues = result.results.reduce((sum, r) => sum + r.issues.length, 0);
-    const errorCount = result.results.reduce((sum, r) => sum + r.issues.filter((i) => i.severity === 'error').length, 0);
-    const warningCount = result.results.reduce((sum, r) => sum + r.issues.filter((i) => i.severity === 'warning').length, 0);
-    const duration = (result.duration / 1000).toFixed(1);
-    if (result.passed && result.results.length > 0) {
-        console.log(chalk.green(`  All checks passed (${duration}s)\n`));
-    }
-    else if (result.passed) {
-        // No blocking issues, but nothing actually completed either — the
-        // triage-unavailable warning will print separately.
-        console.log(chalk.yellow(`  No checkers produced results (${duration}s)\n`));
-    }
-    else {
-        const parts = [];
-        if (errorCount > 0)
-            parts.push(chalk.red(`${errorCount} error(s)`));
-        if (warningCount > 0)
-            parts.push(chalk.yellow(`${warningCount} warning(s)`));
-        console.log(`  ${parts.join(', ')} found across ${totalIssues} issue(s) (${duration}s)\n`);
-    }
-    // Results saved location
-    console.log(chalk.dim('  Results saved to .haystack/triage/\n'));
-}
-// ============================================================================
-// Main command
-// ============================================================================
-export async function submitCommand(options) {
-    // --json contract: stdout carries exactly one JSON document (the submit
-    // payload or an error envelope); every progress/status line goes to stderr.
-    // Redirecting console.log wholesale keeps the existing progress output
-    // intact for humans watching stderr. (console.error/warn already hit stderr.)
-    if (options.json) {
-        console.log = (...args) => {
-            process.stderr.write(args.map((a) => (typeof a === 'string' ? a : String(a))).join(' ') + '\n');
-        };
-    }
-    /** Print a classified failure (JSON envelope on stdout when --json) and exit 1. */
-    const fail = (message, extra) => {
-        if (options.json) {
-            process.stdout.write(JSON.stringify(withSchema('submit', { status: 'error', error: message, ...extra }), null, 2) + '\n');
-            console.error(chalk.red(`\n${message}\n`));
-        }
-        else {
-            console.error(chalk.red(`\n${message}\n`));
-        }
-        process.exit(1);
-    };
-    console.log(chalk.bold.cyan('\nHaystack Submit\n'));
-    // -------------------------------------------------------------------------
-    // Step 1: Validate environment
-    // -------------------------------------------------------------------------
-    console.log(chalk.dim('Checking environment...'));
-    // Validate mutually exclusive options
-    if (options.body && options.bodyFile) {
-        fail('Cannot use both --body and --body-file. Pick one.');
-    }
-    // Check git repo
-    const gitRoot = findGitRoot();
-    if (!gitRoot) {
-        fail('Not a git repository. Run `haystack submit` from inside a repository checkout.');
-        return; // unreachable — satisfies TS narrowing
-    }
-    // Get remote info
-    let remoteInfo;
-    try {
-        remoteInfo = parseRemoteUrl('origin');
-        console.log(chalk.green(`✓ Repository: ${remoteInfo.owner}/${remoteInfo.repo}`));
-    }
-    catch (err) {
-        fail(err.message);
-        return; // unreachable — satisfies TS narrowing
-    }
-    let githubToken;
-    let activeGitHubLogin;
-    let autoSelectedAccount = false;
-    try {
-        const authResolution = await resolveSubmitAuthContext(remoteInfo.owner, remoteInfo.repo, options.account);
-        githubToken = authResolution.authContext.token;
-        activeGitHubLogin = authResolution.authContext.login;
-        autoSelectedAccount = authResolution.autoSelected;
-        try {
-            await setRepoDefaultAccount(remoteInfo.owner, remoteInfo.repo, activeGitHubLogin);
-        }
-        catch (err) {
-            console.log(chalk.yellow(`⚠ Could not save ${activeGitHubLogin} as the default Haystack account for ${remoteInfo.owner}/${remoteInfo.repo}: ${err.message}`));
-        }
-        console.log(chalk.green(`✓ Authenticated as ${activeGitHubLogin}`));
-        if (autoSelectedAccount) {
-            console.log(chalk.dim(`  Auto-selected saved account ${activeGitHubLogin} for ${remoteInfo.owner}/${remoteInfo.repo}`));
-        }
-    }
-    catch (err) {
-        fail(err.message);
-    }
-    // A headless (hsk_live_) token cannot authenticate a git push, and must not
-    // be sent to github.com as a password. Stop before triage and the push.
-    if (githubToken && isHeadlessToken(githubToken)) {
-        fail(HEADLESS_PUSH_ERROR);
-    }
-    // Check for uncommitted changes
-    if (hasUncommittedChanges()) {
-        console.log(chalk.yellow('⚠ You have uncommitted changes. They will not be included in the PR.'));
-    }
-    // Get current branch info
-    const currentBranch = getCurrentBranch();
-    const baseBranch = options.base || getDefaultBranch();
-    console.log(chalk.dim(`  Current branch: ${currentBranch}`));
-    console.log(chalk.dim(`  Base branch: ${baseBranch}${options.base ? '' : ' (detected from origin)'}`));
-    // -------------------------------------------------------------------------
-    // Step 2: Pre-PR Triage
-    // -------------------------------------------------------------------------
-    // Recorded for the --json payload: what triage concluded before the PR
-    // was created. 'unavailable' = infrastructure gave zero signal (never
-    // reported as 'passed').
-    let triageStatus = 'skipped';
-    if (!options.force) {
-        console.log(chalk.dim('\nRunning pre-PR triage checks...'));
-        try {
-            const triageOptions = await resolveTriageOptions(options);
-            const triageResult = await runTriage(gitRoot, baseBranch, triageOptions);
-            printTriageSummary(triageResult);
-            // No valid results means we got zero signal from triage: every
-            // checker failed to run. Don't pretend it passed — warn and continue.
-            const triageInfraFailure = triageResult.results.length === 0 && triageResult.errors.length > 0;
-            if (triageInfraFailure) {
-                console.log(chalk.yellow('\n⚠ Triage unavailable (no checkers produced results). Continuing with submit.\n'));
-            }
-            // Only findings with severity "error" block; a failed checker never does.
-            if (!triageResult.passed) {
-                fail('Triage failed. Fix the issues above or re-run with --force.', {
-                    triage: {
-                        status: 'failed',
-                        issues: triageResult.results.flatMap((r) => r.issues.map((issue) => ({
-                            checker: r.checker,
-                            severity: issue.severity,
-                            file: issue.file,
-                            line: issue.line ?? null,
-                            message: issue.message,
-                            rule: issue.rule ?? null,
-                            category: issue.category ?? null,
-                            failure_scenario: issue.failureScenario ?? null,
-                        }))),
-                    },
-                });
-            }
-            triageStatus = triageInfraFailure ? 'unavailable' : 'passed';
-        }
-        catch (err) {
-            // Triage failure should not block submission
-            console.log(chalk.yellow(`\n⚠ Triage skipped: ${err.message}`));
-            triageStatus = 'unavailable';
-        }
-    }
-    else {
-        console.log(chalk.dim('\nSkipping triage (--force)'));
-    }
-    // -------------------------------------------------------------------------
-    // Step 3: Check if on main/master
-    // -------------------------------------------------------------------------
-    if (currentBranch === 'main' || currentBranch === 'master') {
-        fail(`Refusing to submit from ${currentBranch}. Create a feature branch first (e.g. \`git checkout -b my-change\`), then re-run \`haystack submit\`.`);
-    }
-    // -------------------------------------------------------------------------
-    // Step 4: Push to remote
-    // -------------------------------------------------------------------------
-    console.log(chalk.dim('\nPushing to origin...'));
-    if (!githubToken) {
-        fail('No Haystack account token was resolved before push (internal error). Run `haystack login`, then retry.');
-        return; // unreachable — satisfies TS narrowing
-    }
-    try {
-        pushBranch('origin', currentBranch, { token: githubToken });
-        console.log(chalk.green('✓ Branch pushed'));
-    }
-    catch (err) {
-        fail(err.message);
-    }
-    // -------------------------------------------------------------------------
-    // Step 5: Create or find PR
-    // -------------------------------------------------------------------------
-    console.log(chalk.dim('\nCreating pull request...'));
-    // Check if PR already exists
-    const existingPR = await findExistingPR(remoteInfo.owner, remoteInfo.repo, currentBranch, githubToken);
-    let prNumber;
-    let prUrl;
-    let prTitle;
-    // Where the posted title/body came from — echoed to the user and recorded
-    // in the --json payload so the derived values are never silent.
-    let titleSource;
-    let bodySource;
-    let prBody = null;
-    if (existingPR) {
-        console.log(chalk.yellow(`PR already exists: #${existingPR.number}`));
-        prNumber = existingPR.number;
-        prUrl = existingPR.html_url;
-        prTitle = existingPR.title;
-        titleSource = 'existing-pr';
-        bodySource = 'existing-pr';
-    }
-    else {
-        // Generate PR title and body
-        try {
-            prTitle = options.title || getLastCommitMessage();
-        }
-        catch (err) {
-            fail(err.message);
-            return; // unreachable — satisfies TS narrowing
-        }
-        titleSource = options.title ? 'flag' : 'last-commit';
-        let bodyContent = '';
-        if (options.bodyFile) {
-            bodySource = options.bodyFile === '-' ? 'stdin' : 'body-file';
-            try {
-                bodyContent = options.bodyFile === '-'
-                    ? fs.readFileSync(0, 'utf-8')
-                    : fs.readFileSync(options.bodyFile, 'utf-8');
-            }
-            catch (err) {
-                fail(`Failed to read body file: ${err.message}`);
-            }
-        }
-        else if (options.body) {
-            bodySource = 'flag';
-            bodyContent = options.body;
-        }
-        else {
-            bodySource = 'commit-messages';
-            bodyContent = getCommitMessagesSinceBase(baseBranch);
-        }
-        prBody = buildPRBody(bodyContent);
-        console.log(chalk.dim(`  Title: ${prTitle} (from ${titleSource === 'flag' ? '--title' : 'last commit message'})`));
-        console.log(chalk.dim(`  Body: from ${bodySource === 'commit-messages' ? 'commit messages since base' : bodySource}`));
-        try {
-            const pr = await createPullRequest({
-                owner: remoteInfo.owner,
-                repo: remoteInfo.repo,
-                title: prTitle,
-                head: currentBranch,
-                base: baseBranch,
-                body: prBody,
-                draft: options.draft,
-                token: githubToken,
-            });
-            prNumber = pr.number;
-            prUrl = pr.html_url;
-            console.log(chalk.green(`✓ Pull request created: #${prNumber}`));
-        }
-        catch (err) {
-            fail(formatSubmitPermissionError(err, activeGitHubLogin, remoteInfo.owner, remoteInfo.repo));
-            return; // unreachable — satisfies TS narrowing
-        }
-    }
-    // -------------------------------------------------------------------------
-    // Step 6: Apply auto-merge label if enabled
-    // -------------------------------------------------------------------------
-    // Applied-state tracking: the --json payload must report what actually
-    // happened on GitHub, not what was requested — label application can fail
-    // (403/422) and only warn.
-    let autoMergeApplied = false;
-    let autoFixApplied = false;
-    let reviewLabelApplied = false;
-    let reviewerRequestedOk = null;
-    // Announce the resolved value AND its source in both directions — a silent
-    // config-driven default is invisible to the caller otherwise.
-    const autoMergeSourceLabel = options.autoMergeSource === 'flag' ? '--auto-merge flag' : '.haystack.json';
-    if (options.autoMerge) {
-        try {
-            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-merge'], githubToken);
-            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-merge'], githubToken);
-            autoMergeApplied = true;
-            // With --review, the PR still enters the auto-merge queue but the
-            // merge queue's needs-review gate holds it until a human approves
-            // (removes haystack:needs-review or marks it reviewed). Don't print a
-            // bare "Auto-merge enabled" that reads as if it'll merge unreviewed.
-            if (options.review) {
-                console.log(chalk.green(`✓ Auto-merge enabled via ${autoMergeSourceLabel} (held until a human approves this PR)`));
-            }
-            else {
-                console.log(chalk.green(`✓ Auto-merge enabled for this PR (via ${autoMergeSourceLabel})`));
-            }
-        }
-        catch (err) {
-            console.log(chalk.yellow(`⚠ Could not set auto-merge label: ${err.message}`));
-        }
-    }
-    else {
-        console.log(chalk.dim(`  Auto-merge: disabled (via ${autoMergeSourceLabel})`));
-    }
-    // -------------------------------------------------------------------------
-    // Step 6b: Apply auto-fix label if --auto-fix
-    // -------------------------------------------------------------------------
-    if (options.autoFix) {
-        try {
-            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-fix'], githubToken);
-            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-fix'], githubToken);
-            autoFixApplied = true;
-            console.log(chalk.green(`✓ Auto-fix (alpha) enabled for this PR (via ${options.autoFixSource === 'flag' ? '--auto-fix flag' : '.haystack.json'})`));
-        }
-        catch (err) {
-            console.log(chalk.yellow(`⚠ Could not set auto-fix label: ${err.message}`));
-        }
-    }
-    // -------------------------------------------------------------------------
-    // Step 7: Request review if --review
-    // -------------------------------------------------------------------------
-    if (options.review) {
-        try {
-            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:needs-review'], githubToken);
-            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:needs-review'], githubToken);
-            reviewLabelApplied = true;
-            if (typeof options.review === 'string') {
-                // Specific reviewer requested
-                await requestReviewers(remoteInfo.owner, remoteInfo.repo, prNumber, [options.review], githubToken);
-                reviewerRequestedOk = options.review;
-                console.log(chalk.green(`✓ Review requested from ${options.review}`));
-            }
-            else {
-                // No reviewer specified — goes to needs-assignment queue
-                console.log(chalk.green('✓ Marked for review (needs assignment)'));
-            }
-        }
-        catch (err) {
-            console.log(chalk.yellow(`⚠ Could not request review: ${err.message}`));
-        }
-    }
-    // -------------------------------------------------------------------------
-    // Step 8: Success!
-    // -------------------------------------------------------------------------
-    console.log(chalk.green('\n' + '━'.repeat(50)));
-    console.log(chalk.bold.green(existingPR ? '\nPull Request Updated!\n' : '\nPull Request Created!\n'));
-    console.log(`  ${chalk.dim('URL:')}    ${chalk.cyan(prUrl)}`);
-    console.log(`  ${chalk.dim('Title:')}  ${prTitle}`);
-    console.log(`  ${chalk.dim('Branch:')} ${currentBranch} → ${baseBranch}`);
-    if (options.autoMerge) {
-        // --review and auto-merge are not contradictory: the PR is queued but the
-        // merge queue's needs-review gate blocks the merge until a human approves.
-        // Report it that way instead of a flat "Auto-merge if safe".
-        if (options.review) {
-            console.log(`  ${chalk.dim('Merge:')}  ${chalk.yellow('Held for human review, then auto-merge')}`);
-        }
-        else {
-            console.log(`  ${chalk.dim('Merge:')}  ${chalk.green('Auto-merge if safe')}`);
-        }
-    }
-    if (options.autoFix) {
-        console.log(`  ${chalk.dim('Fix:')}    ${chalk.cyan('Auto-fix alpha enabled')}`);
-    }
-    if (options.review) {
-        const reviewer = typeof options.review === 'string' ? options.review : 'needs assignment';
-        console.log(`  ${chalk.dim('Review:')} ${chalk.yellow(reviewer)}`);
-    }
-    console.log('');
-    // -------------------------------------------------------------------------
-    // Step 9: Wait for Haystack analysis (triggered via GitHub App webhook)
-    // -------------------------------------------------------------------------
-    console.log(chalk.dim('Haystack analysis triggered via GitHub App webhook.'));
-    // Save pending state (so `haystack triage` works even if we disconnect)
-    const pendingState = {
-        version: 1,
-        prNumber,
-        prUrl,
-        owner: remoteInfo.owner,
-        repo: remoteInfo.repo,
-        branch: currentBranch,
-        baseBranch,
-        submittedAt: new Date().toISOString(),
-        status: 'polling',
-    };
-    savePendingSubmit(pendingState, gitRoot);
-    const ref = `${remoteInfo.owner}/${remoteInfo.repo}#${prNumber}`;
-    /** Emit the final --json payload (stdout) — the single machine-readable
-     *  document of the run. `next` always tells the agent the follow-up command. */
-    const emitPayload = (analysis) => {
-        if (!options.json)
-            return;
-        process.stdout.write(JSON.stringify(withSchema('submit', {
-            status: existingPR ? 'already_exists' : 'created',
-            ref,
-            pr_number: prNumber,
-            url: prUrl,
-            title: prTitle,
-            title_source: titleSource,
-            body: prBody,
-            body_source: bodySource,
-            branch: currentBranch,
-            base: baseBranch,
-            draft: options.draft ?? false,
-            account: activeGitHubLogin ?? null,
-            // Applied state, not requested state: if a label failed to apply, the
-            // payload says so (enabled: false) even though it was asked for.
-            auto_merge: { enabled: autoMergeApplied, source: options.autoMergeSource ?? 'config' },
-            auto_fix: { enabled: autoFixApplied, source: options.autoFixSource ?? 'config' },
-            review_requested: reviewLabelApplied
-                ? { reviewer: reviewerRequestedOk }
-                : null,
-            triage: { status: triageStatus },
-            analysis,
-            next: analysis.status === 'pending' ? `haystack triage ${ref} --json` : null,
-        }), null, 2) + '\n');
-    };
-    // If --no-wait or non-interactive, exit here
-    if (options.wait === false || !process.stdin.isTTY) {
-        console.log(chalk.dim(`\nAnalysis running in background${options.wait === false ? '' : ' (no TTY — not waiting inline)'}.`));
-        console.log(chalk.dim('Check results later with: ') + chalk.cyan(`haystack triage ${ref}\n`));
-        emitPayload({ status: 'pending', verdict: null, merged: false, summary: null });
-        return;
-    }
-    // Wait for analysis inline by polling the result endpoint
-    console.log(chalk.dim('\nWaiting for analysis...\n'));
-    // Handle Ctrl+C gracefully
-    let interrupted = false;
-    const sigintHandler = () => {
-        interrupted = true;
-        console.log(chalk.dim('\n\nAnalysis still running. Check later with:'));
-        console.log(chalk.cyan(`  haystack triage ${ref}\n`));
-        emitPayload({ status: 'pending', verdict: null, merged: false, summary: null });
-        process.exit(0);
-    };
-    process.on('SIGINT', sigintHandler);
-    const POLL_INTERVAL = 5_000;
-    const POLL_TIMEOUT = 10 * 60 * 1000; // 10 minutes
-    const deadline = Date.now() + POLL_TIMEOUT;
-    let consecutiveErrors = 0;
-    const MAX_CONSECUTIVE_ERRORS = 5;
-    let emitted = false;
-    while (Date.now() < deadline && !interrupted) {
-        const result = await checkAnalysisReady(remoteInfo.owner, remoteInfo.repo, prNumber, githubToken);
-        if (result.status === 'ready') {
-            consecutiveErrors = 0;
-            // Fetch results
-            try {
-                const verdict = await fetchAnalysisResults(remoteInfo.owner, remoteInfo.repo, prNumber, githubToken);
-                updatePendingSubmit({
-                    status: 'completed',
-                    analysisResult: verdict,
-                    resolvedAt: new Date().toISOString(),
-                }, gitRoot);
-                // Print verdict
-                console.log(chalk.bold('\n' + '━'.repeat(50)));
-                console.log(chalk.bold('  Haystack Analysis Results'));
-                console.log(chalk.bold('━'.repeat(50) + '\n'));
-                if (verdict.state === 'good-to-merge') {
-                    // autoMerged here is the GH "merged: true" bit (not the
-                    // analysis's canAutoMerge eligibility). Only claim the PR was
-                    // merged when GitHub confirms it.
-                    if (verdict.autoMerged) {
-                        console.log(chalk.green.bold('  ✓ Merged\n'));
-                        console.log(chalk.dim('  No blocking issues. PR is merged on GitHub.'));
-                    }
-                    else {
-                        console.log(chalk.green.bold('  ✓ Good to merge\n'));
-                        console.log(chalk.dim(`  ${verdict.summary}`));
-                    }
-                }
-                else if (verdict.needsHumanReview) {
-                    // Distinct from generic needs-input: analysis is clean but
-                    // policy/sensitivity demands a human. Don't lump this in with
-                    // "issues found" — the user's action is "request a reviewer",
-                    // not "fix bugs".
-                    console.log(chalk.cyan.bold('  👤 Human review required\n'));
-                    console.log(chalk.dim(`  ${verdict.summary}`));
-                }
-                else if (options.autoFix) {
-                    // Auto-fix flow: agent fixes straightforward issues in the background.
-                    // Issues appear in Feed immediately — user can review while agent works.
-                    console.log(chalk.cyan.bold('  ⚙ Auto-fix triggered (alpha)\n'));
-                    console.log(chalk.dim(`  ${verdict.summary}\n`));
-                    console.log(chalk.dim('  Coding agent is fixing straightforward mechanical issues in the background.'));
-                    console.log(chalk.dim('  Auto-fix is currently alpha.'));
-                    console.log(chalk.dim('  Issues that need your judgment are in the Feed now.\n'));
-                    const reviewUrl = `https://haystackeditor.com/review/${remoteInfo.owner}/${remoteInfo.repo}/${prNumber}`;
-                    console.log(`  ${chalk.dim('Feed:')} ${chalk.cyan(reviewUrl)}\n`);
-                }
-                else {
-                    console.log(chalk.yellow.bold('  ⚠ Needs your input\n'));
-                    console.log(chalk.dim(`  ${verdict.summary}\n`));
-                    for (const issue of verdict.issues) {
-                        const icon = issue.severity === 'error' ? chalk.red('✗') : chalk.yellow('!');
-                        const loc = issue.line ? `${issue.file}:${issue.line}` : issue.file;
-                        console.log(`  ${icon} ${chalk.dim(loc)} ${issue.message}`);
-                    }
-                }
-                if (!options.autoFix || verdict.state === 'good-to-merge') {
-                    console.log(`\n  ${chalk.dim('Review:')} ${chalk.cyan(verdict.reviewUrl)}\n`);
-                }
-                emitPayload({
-                    status: 'complete',
-                    // Same public vocabulary as `triage --json` / `pr get --json`.
-                    verdict: verdict.state === 'good-to-merge'
-                        ? 'good_to_merge'
-                        : verdict.needsHumanReview ? 'needs_review' : 'needs_input',
-                    merged: verdict.autoMerged ?? false,
-                    summary: verdict.summary,
-                });
-                emitted = true;
-            }
-            catch (err) {
-                const message = err.message;
-                if (err instanceof HaystackApiError && err.isAuthError) {
-                    // Auth failure is not transient — retrying `haystack triage` with the
-                    // same credential would fail identically. Report failed + exit 1.
-                    console.error(chalk.red(`\n  ${message}`));
-                    emitPayload({ status: 'failed', verdict: null, merged: false, summary: message });
-                    process.exitCode = 1;
-                }
-                else {
-                    // The PR exists and analysis completed — only the result fetch failed.
-                    console.log(chalk.yellow(`⚠ Analysis complete but could not fetch results: ${message}`));
-                    console.log(chalk.dim('  Check results with: ') + chalk.cyan(`haystack triage ${ref}\n`));
-                    emitPayload({ status: 'pending', verdict: null, merged: false, summary: message });
-                }
-                emitted = true;
-            }
-            break;
-        }
-        if (result.status === 'error') {
-            consecutiveErrors++;
-            if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
-                console.log(chalk.red(`\n  Analysis check failed: ${result.message}`));
-                updatePendingSubmit({ status: 'failed', resolvedAt: new Date().toISOString() }, gitRoot);
-                emitPayload({ status: 'failed', verdict: null, merged: false, summary: result.message ?? null });
-                emitted = true;
-                // The PR was created, but the caller asked us to wait for a verdict
-                // and we could not deliver one — that is a failure, not a success.
-                process.exitCode = 1;
-                break;
-            }
-        }
-        else {
-            consecutiveErrors = 0;
-        }
-        process.stderr.write(`\r  ${chalk.dim('Status:')} Waiting for analysis...${'  '.repeat(10)}`);
-        await new Promise(r => setTimeout(r, POLL_INTERVAL));
-    }
-    // Clean up SIGINT handler
-    process.removeListener('SIGINT', sigintHandler);
-    if (Date.now() >= deadline && !interrupted) {
-        console.log(chalk.yellow('\n\n  Timed out waiting for analysis.'));
-        console.log(chalk.dim('  Check results later with: ') + chalk.cyan(`haystack triage ${ref}\n`));
-        if (!emitted) {
-            emitPayload({ status: 'pending', verdict: null, merged: false, summary: 'Timed out waiting for analysis; it continues server-side.' });
-        }
-    }
-}