@haystackeditor/cli 0.25.1 → 0.26.0

package/dist/commands/webhooks.js

@@ -1,241 +0,0 @@
-/**
- * `haystack webhooks ...` — register and inspect outbound webhooks.
- *
- * Two responsibilities split intentionally:
- *
- *   Local edits to .haystack.json (`register`)
- *     The .haystack.json file IS the source of truth for which URLs a repo
- *     wants to receive events on. The wizard writes it; humans edit it;
- *     `haystack webhooks register` is a typed UI over the same edit. After
- *     writing the file, this command POSTs to the haystack-webhooks worker
- *     to create the registration row and obtain the HMAC secret.
- *
- *   Remote queries (`list`, `deliveries`, `rotate-secret`, `replay`, etc.)
- *     Hit the worker's /admin endpoints with the user's Bearer token
- *     (introspected server-side; push access to the target repo required).
- *     Account resolution is repo-scoped so `haystack login` repoDefaults
- *     apply; id-based commands accept --repo when run outside the repo's
- *     checkout.
- *
- * Secret handling:
- *   The worker returns the freshly-minted HMAC secret ONCE, on register or
- *   rotate-secret. We print it to the operator and do not persist it. They
- *   are expected to stash it in their CI's secret store and reference it
- *   from .haystack.json via "secret_ref": "env:HAYSTACK_WEBHOOK_SECRET".
- */
-import { readFileSync, writeFileSync, existsSync } from 'node:fs';
-import { resolve } from 'node:path';
-import chalk from 'chalk';
-import { parseRemoteUrl, UnsupportedRemoteUrlError } from '../utils/git.js';
-import { loadToken } from '../utils/auth.js';
-const DEFAULT_WORKER_URL = process.env.HAYSTACK_WEBHOOKS_URL ??
-    'https://haystack-webhooks.akshaysg.workers.dev';
-// Public events accepted by the CLI. The backend may support additional
-// gated events, but alpha-only features should not appear in normal CLI help.
-const ALLOWED_EVENTS = [
-    'triage.completed',
-    'triage.failed',
-    'merge_queue.state_changed',
-    // 'review_chat.response_ready' deferred — chat CLI was cut, no producer.
-    'pr.classified',
-];
-function configPath() {
-    return resolve(process.cwd(), '.haystack.json');
-}
-function readConfig() {
-    const p = configPath();
-    if (!existsSync(p)) {
-        throw new Error(`.haystack.json not found in ${process.cwd()}. Run \`haystack init\` first.`);
-    }
-    return JSON.parse(readFileSync(p, 'utf8'));
-}
-function writeConfig(cfg) {
-    writeFileSync(configPath(), JSON.stringify(cfg, null, 2) + '\n', 'utf8');
-}
-function currentRepo() {
-    const r = parseRemoteUrl('origin');
-    return `${r.owner}/${r.repo}`;
-}
-/** currentRepo() for token-account resolution. Outside a git repo there is
- *  simply no repo context — expected for id-based commands run from anywhere,
- *  so that case stays quiet. A remote that EXISTS but isn't recognized is a
- *  different story: repo-scoped account defaults silently won't apply, so say
- *  so (classified by error type per PR007). */
-export function tryCurrentRepo() {
-    try {
-        return currentRepo();
-    }
-    catch (err) {
-        if (err instanceof UnsupportedRemoteUrlError) {
-            process.stderr.write(chalk.dim(`  [origin remote not recognized (${err.message}); using the active account, not repo defaults]\n`));
-        }
-        return null;
-    }
-}
-/** Token-resolution scope for adminFetch: explicit repo wins, else the cwd's
- *  origin remote, else no scope (active account). Exported for tests. */
-export function resolveTokenScope(repoFullName) {
-    const target = repoFullName ?? tryCurrentRepo();
-    if (!target || !target.includes('/'))
-        return {};
-    const [owner, repo] = target.split('/');
-    if (!owner || !repo)
-        return {};
-    return { owner, repo };
-}
-async function adminFetch(path, init = {}, repoFullName) {
-    // Resolve the token FOR THE TARGET REPO so `haystack login`'s repoDefaults
-    // apply, matching every other repo-scoped command (triage, submit). A bare
-    // loadToken() used the active account regardless of repo — with multiple
-    // saved accounts, register/list could 403 with "no push access" even
-    // though the repo's default account had admin (found 2026-07-06).
-    const token = await loadToken(resolveTokenScope(repoFullName));
-    const headers = {
-        'Content-Type': 'application/json',
-        ...(init.headers ?? {}),
-    };
-    if (token)
-        headers['Authorization'] = `Bearer ${token}`;
-    return fetch(`${DEFAULT_WORKER_URL}${path}`, {
-        method: init.method,
-        headers,
-        body: init.body == null
-            ? undefined
-            : typeof init.body === 'string'
-                ? init.body
-                : JSON.stringify(init.body),
-    });
-}
-async function readJsonOrFail(res) {
-    const body = await res.text();
-    if (!res.ok) {
-        throw new Error(`worker ${res.status}: ${body.slice(0, 512)}`);
-    }
-    try {
-        return JSON.parse(body);
-    }
-    catch {
-        throw new Error(`worker returned non-JSON: ${body.slice(0, 200)}`);
-    }
-}
-// ─── register ────────────────────────────────────────────────────────────────
-export async function registerWebhook(opts) {
-    const repo = opts.repo ?? currentRepo();
-    const events = opts.events ?? ['triage.completed', 'triage.failed'];
-    for (const e of events) {
-        if (!ALLOWED_EVENTS.includes(e)) {
-            throw new Error(`Unknown event "${e}". Allowed: ${ALLOWED_EVENTS.join(', ')}`);
-        }
-    }
-    const res = await adminFetch('/admin/registrations', {
-        method: 'POST',
-        body: { repo, url: opts.url, events },
-    }, repo);
-    const data = (await readJsonOrFail(res));
-    // Update .haystack.json. Append; do not overwrite an existing entry — the
-    // operator may want multiple webhooks pointing at different endpoints.
-    const cfg = readConfig();
-    cfg.webhooks = cfg.webhooks ?? [];
-    cfg.webhooks.push({
-        url: opts.url,
-        events,
-        secret_ref: opts.secretEnv ? `env:${opts.secretEnv}` : undefined,
-    });
-    writeConfig(cfg);
-    console.log(chalk.green('✓ Webhook registered'));
-    console.log(`  ${chalk.dim('repo:')}        ${repo}`);
-    console.log(`  ${chalk.dim('url:')}         ${opts.url}`);
-    console.log(`  ${chalk.dim('events:')}      ${events.join(', ')}`);
-    console.log(`  ${chalk.dim('id:')}          ${data.id}`);
-    console.log('');
-    console.log(chalk.yellow.bold('HMAC secret (save this now — it cannot be retrieved again):'));
-    console.log('');
-    console.log(`  ${chalk.bold(data.secret)}`);
-    console.log('');
-    if (opts.secretEnv) {
-        console.log(chalk.dim(`Stash it in your secret store and expose it as $${opts.secretEnv}.`));
-    }
-    else {
-        console.log(chalk.dim('Tip: pass --secret-env NAME to record where the secret will live.'));
-    }
-    console.log(chalk.dim('Lost the secret? Run: haystack webhooks rotate-secret ' + data.id));
-}
-// ─── list ────────────────────────────────────────────────────────────────────
-export async function listWebhooks(opts) {
-    const repo = opts.repo ?? currentRepo();
-    const res = await adminFetch(`/admin/registrations?repo=${encodeURIComponent(repo)}`, {}, repo);
-    const data = (await readJsonOrFail(res));
-    if (opts.json) {
-        console.log(JSON.stringify(data, null, 2));
-        return;
-    }
-    if (data.registrations.length === 0) {
-        console.log(chalk.dim(`No webhooks registered for ${repo}.`));
-        return;
-    }
-    for (const r of data.registrations) {
-        const state = r.disabled ? chalk.red(`disabled (${r.disabled_reason ?? 'unknown'})`) : chalk.green('active');
-        console.log(`${chalk.bold(r.url)} ${state}`);
-        console.log(`  ${chalk.dim('id:')}      ${r.id}`);
-        console.log(`  ${chalk.dim('events:')}  ${r.events.join(', ')}`);
-        if (r.consecutive_5xx > 0) {
-            console.log(`  ${chalk.dim('5xx:')}     ${r.consecutive_5xx} consecutive`);
-        }
-        console.log('');
-    }
-}
-// ─── rotate-secret ───────────────────────────────────────────────────────────
-export async function rotateWebhookSecret(id, repo) {
-    const res = await adminFetch(`/admin/registrations/${encodeURIComponent(id)}/rotate-secret`, {
-        method: 'POST',
-    }, repo);
-    const data = (await readJsonOrFail(res));
-    console.log(chalk.green('✓ Secret rotated'));
-    console.log('');
-    console.log(chalk.yellow.bold('New HMAC secret:'));
-    console.log(`  ${chalk.bold(data.secret)}`);
-    console.log('');
-    console.log(chalk.red.bold('The previous secret is now invalid. Update your receiver before the next event fires.'));
-}
-// ─── enable / disable ────────────────────────────────────────────────────────
-export async function setWebhookEnabled(id, enabled, repo) {
-    const action = enabled ? 'enable' : 'disable';
-    const res = await adminFetch(`/admin/registrations/${encodeURIComponent(id)}/${action}`, {
-        method: 'POST',
-    }, repo);
-    await readJsonOrFail(res);
-    console.log(chalk.green(`✓ Webhook ${id} ${action}d`));
-}
-// ─── deliveries / replay ─────────────────────────────────────────────────────
-export async function listDeliveries(opts) {
-    const repo = opts.repo ?? currentRepo();
-    const limit = opts.limit ?? 20;
-    const res = await adminFetch(`/admin/deliveries?repo=${encodeURIComponent(repo)}&limit=${limit}`, {}, repo);
-    const data = (await readJsonOrFail(res));
-    if (opts.json) {
-        console.log(JSON.stringify(data, null, 2));
-        return;
-    }
-    if (data.deliveries.length === 0) {
-        console.log(chalk.dim(`No deliveries for ${repo}.`));
-        return;
-    }
-    for (const d of data.deliveries) {
-        const color = d.status === 'delivered' ? chalk.green
-            : d.status === 'dead' ? chalk.red
-                : d.status === 'failed' ? chalk.yellow
-                    : chalk.dim;
-        const code = d.last_status_code != null ? ` ${d.last_status_code}` : '';
-        console.log(`${color(d.status.padEnd(10))} ${chalk.bold(d.event.padEnd(28))} ` +
-            `attempts=${d.attempts}${code} ${chalk.dim(d.id)}`);
-        if (d.last_error)
-            console.log(`  ${chalk.dim('error:')} ${d.last_error}`);
-    }
-}
-export async function replayDelivery(id, repo) {
-    const res = await adminFetch(`/admin/deliveries/${encodeURIComponent(id)}/replay`, {
-        method: 'POST',
-    }, repo);
-    await readJsonOrFail(res);
-    console.log(chalk.green(`✓ Replay queued for ${id}`));
-}

package/dist/states.js

@@ -1,46 +0,0 @@
-/**
- * Canonical machine-readable PR-state vocabulary for every CLI JSON surface.
- *
- * One concept, one spelling: all `--json` output uses snake_case state tokens.
- * Before this module existed the same state appeared as `good_to_merge`
- * (triage/pr get/inbox) and `good-to-merge` (pr-status, raw server buckets),
- * so no single parser worked across commands. Server responses that use
- * kebab-case are normalized at the edge via `normalizeFeedBucket`.
- */
-/** Public triage verdict — emitted by `triage`, `pr get`, `submit`, `pr-status`. */
-export const TRIAGE_VERDICTS = ['good_to_merge', 'needs_review', 'needs_input'];
-/**
- * Map the server's internal analysis verdict ('clean' | 'has-issues' |
- * 'needs-review', with a rating-based fallback for pre-verdict analyses) to
- * the public triage verdict. This mapping used to be duplicated inline in
- * triage.ts and pr.ts.
- */
-export function toPublicVerdict(analysisVerdict, haystackRating) {
-    const verdict = analysisVerdict ?? ((haystackRating ?? 0) >= 5 ? 'clean' : 'has-issues');
-    if (verdict === 'clean')
-        return 'good_to_merge';
-    if (verdict === 'needs-review')
-        return 'needs_review';
-    return 'needs_input';
-}
-/**
- * Known feed buckets in canonical snake_case form. The server may introduce
- * new buckets; `normalizeFeedBucket` converts mechanically so unknown buckets
- * pass through in the same convention instead of crashing or leaking kebab-case.
- */
-export const FEED_BUCKETS = [
-    'analyzing',
-    'auto_fixing',
-    'good_to_merge',
-    'failed_when_merging',
-    'issues',
-    'needs_assignment',
-    'needs_shepherding',
-    'needs_fixing',
-    'awaiting_review',
-    'review_requested',
-    'snoozed',
-];
-export function normalizeFeedBucket(bucket) {
-    return bucket == null ? null : bucket.replace(/-/g, '_');
-}