@haystackeditor/cli 0.25.1 → 0.26.0

package/dist/index.js

@@ -37,56 +37,11 @@ const authUseCommand = lazy(() => import('./commands/login.js'), 'authUseCommand
 const loginCommand = lazy(() => import('./commands/login.js'), 'loginCommand');
 const logoutCommand = lazy(() => import('./commands/login.js'), 'logoutCommand');
 const whoamiCommand = lazy(() => import('./commands/login.js'), 'whoamiCommand');
-const handleAgenticTool = lazy(() => import('./commands/config.js'), 'handleAgenticTool');
-const handleAutoMerge = lazy(() => import('./commands/config.js'), 'handleAutoMerge');
-const handleAutoFix = lazy(() => import('./commands/config.js'), 'handleAutoFix');
-const handleWaitForReviewers = lazy(() => import('./commands/config.js'), 'handleWaitForReviewers');
-const isAutoMergeEnabled = lazy(() => import('./commands/config.js'), 'isAutoMergeEnabled');
-const isAutoFixEnabled = lazy(() => import('./commands/config.js'), 'isAutoFixEnabled');
-const installSkills = lazy(() => import('./commands/skills.js'), 'installSkills');
-const listSkills = lazy(() => import('./commands/skills.js'), 'listSkills');
-const cloudVerifierUniverseValidateCommand = lazy(() => import('./commands/cloud-verifier-universe.js'), 'cloudVerifierUniverseValidateCommand');
-const cloudVerifierIdentityCensusCommand = lazy(() => import('./commands/cloud-verifier-identity-census.js'), 'cloudVerifierIdentityCensusCommand');
-const cloudVerifierDataStoreDriftCommand = lazy(() => import('./commands/cloud-verifier-data-store-drift.js'), 'cloudVerifierDataStoreDriftCommand');
-const cloudVerifierBehaviorsValidateCommand = lazy(() => import('./commands/cloud-verifier-behaviors.js'), 'cloudVerifierBehaviorsValidateCommand');
-const prepareUniverseReviewCommand = lazy(() => import('./commands/prepare-universe-review.js'), 'prepareUniverseReviewCommand');
-const scaffoldProvisionalUniverseCommand = lazy(() => import('./commands/scaffold-provisional-universe.js'), 'scaffoldProvisionalUniverseCommand');
-const hooksInstall = lazy(() => import('./commands/hooks.js'), 'hooksInstall');
-const hooksStatus = lazy(() => import('./commands/hooks.js'), 'hooksStatus');
-const submitCommand = lazy(() => import('./commands/submit.js'), 'submitCommand');
-const installSessionHooks = lazy(() => import('./commands/install-session-hooks.js'), 'installSessionHooks');
-const sessionHooksStatus = lazy(() => import('./commands/install-session-hooks.js'), 'sessionHooksStatus');
-const listPolicies = lazy(() => import('./commands/policy.js'), 'listPolicies');
-const addPolicy = lazy(() => import('./commands/policy.js'), 'addPolicy');
-const removePolicy = lazy(() => import('./commands/policy.js'), 'removePolicy');
-const initPolicies = lazy(() => import('./commands/policy.js'), 'initPolicies');
-const addInstruction = lazy(() => import('./commands/policy.js'), 'addInstruction');
-const triageCommand = lazy(() => import('./commands/triage.js'), 'triageCommand');
-const designVerifyCommand = lazy(() => import('./commands/design-verify.js'), 'designVerifyCommand');
-const dismissCommand = lazy(() => import('./commands/dismiss.js'), 'dismissCommand');
-const markReviewedCommand = lazy(() => import('./commands/dismiss.js'), 'markReviewedCommand');
-const undismissCommand = lazy(() => import('./commands/dismiss.js'), 'undismissCommand');
-const requestReviewCommand = lazy(() => import('./commands/request-review.js'), 'requestReviewCommand');
-const reviewCommand = lazy(() => import('./commands/review.js'), 'reviewCommand');
-const prStatusCommand = lazy(() => import('./commands/pr-status.js'), 'prStatusCommand');
-const prReadCommand = lazy(() => import('./commands/pr.js'), 'prReadCommand');
-const inboxListCommand = lazy(() => import('./commands/inbox.js'), 'inboxListCommand');
-const askHaystackCommand = lazy(() => import('./commands/ask.js'), 'askHaystackCommand');
 const telemetryInstrumentCommand = lazy(() => import('./commands/telemetry.js'), 'telemetryInstrumentCommand');
 const telemetrySettingsCommand = lazy(() => import('./commands/telemetry.js'), 'telemetrySettingsCommand');
 const telemetryTokenCommand = lazy(() => import('./commands/telemetry-token.js'), 'telemetryTokenCommand');
-const setupCommand = lazy(() => import('./commands/setup.js'), 'setupCommand');
 const schemaCommand = lazy(() => import('./commands/schema-cmd.js'), 'schemaCommand');
 const listSchemas = lazy(() => import('./commands/schema-cmd.js'), 'listSchemas');
-const registerWebhook = lazy(() => import('./commands/webhooks.js'), 'registerWebhook');
-const listWebhooks = lazy(() => import('./commands/webhooks.js'), 'listWebhooks');
-const rotateWebhookSecret = lazy(() => import('./commands/webhooks.js'), 'rotateWebhookSecret');
-const setWebhookEnabled = lazy(() => import('./commands/webhooks.js'), 'setWebhookEnabled');
-const listDeliveries = lazy(() => import('./commands/webhooks.js'), 'listDeliveries');
-const replayDelivery = lazy(() => import('./commands/webhooks.js'), 'replayDelivery');
-const editRulesCommand = lazy(() => import('./commands/rules.js'), 'editRulesCommand');
-const validateRulesCommand = lazy(() => import('./commands/rules.js'), 'validateRulesCommand');
-const systemMapValidateCommand = lazy(() => import('./commands/system-map.js'), 'systemMapValidateCommand');
 const verifyCommand = lazy(() => import('./commands/verify.js'), 'verifyCommand');
 const preVerifyCommand = lazy(() => import('./commands/verify.js'), 'preVerifyCommand');
 const headlessLoginCommand = lazy(() => import('./commands/tokens.js'), 'headlessLoginCommand');
@@ -96,12 +51,7 @@ const revokeTokenCommand = lazy(() => import('./commands/tokens.js'), 'revokeTok
 const databaseProfileCommand = lazy(() => import('./commands/db-profile.js'), 'databaseProfileCommand');
 const databaseProfileShowCommand = lazy(() => import('./commands/db-profile-show.js'), 'databaseProfileShowCommand');
 const databaseProfileUploadCommand = lazy(() => import('./commands/db-profile-upload.js'), 'databaseProfileUploadCommand');
-// `mcp` is imported lazily inside its command action (below), NOT at the top level.
-// It is the only module that pulls in `@modelcontextprotocol/sdk`; keeping it out of
-// the startup import graph means a missing/broken SDK can never crash core commands
-// like `triage`/`submit`. (0.15.12 shipped `mcp.js` but published its package.json
-// WITHOUT `@modelcontextprotocol/sdk`, so the eager import here hard-crashed every
-// command at startup with ERR_MODULE_NOT_FOUND.)
+const feedbackCommand = lazy(() => import('./commands/feedback.js'), 'feedbackCommand');
 async function runPublicCommand(action, json) {
     try {
         await action();
@@ -220,48 +170,6 @@ Examples:
   haystack init --yes --json --notes haystack-notes.json
 `)
     .action(options => runPublicCommand(() => initCommand(options), options.json));
-program
-    .command('setup')
-    .description('Onboarding wizard — scan repos for rules/policies and write Haystack config')
-    .option('--json', 'Agent mode: emit NDJSON events on stdout, read answers on stdin (no TTY prompts)')
-    .option('--repo <repo...>', 'Repo(s) to configure (owner/name); skips the repo picker')
-    .option('-y, --yes', 'Accept defaults non-interactively (keep all discovered items, confirm write, ENABLE auto-merge — pass --no-auto-merge to opt out)')
-    // Only the negative form exists; there is no --auto-merge. Without the flag the
-    // wizard asks (detected via getOptionValueSource below).
-    .option('--no-auto-merge', 'Turn auto-merge off in the written config (omit to be asked)')
-    .option('--answers <file>', 'JSON file of {questionId: value} pre-supplied answers')
-    .addHelpText('after', `
-Steps: verify GitHub App → select repos → scan (rules/policies/instructions) →
-review → write .haystack/pr-rules.yml + review-policy.md + .haystack.json.
-
-Three ways to run:
-  • Interactive (default): prompts in your terminal.
-  • Autonomous/CI: supply every decision via flags, e.g.
-      haystack setup --repo owner/name --yes --no-auto-merge
-  • Coding agent: --json speaks NDJSON on stdout and reads answers on stdin, so an
-    agent can auto-answer or relay questions to the user. Pre-supplied answers
-    (flags / --answers) skip the matching question.
-
-Requires authentication — run \`haystack login\` first.
-
-Examples:
-  haystack setup
-  haystack setup --repo owner/name --yes
-  haystack setup --json --repo owner/name
-`)
-    .action((options, command) => {
-    // auto-merge: false when --no-auto-merge was passed, otherwise undefined (ask).
-    // commander defaults autoMerge to true because of the --no- form, so check
-    // the value source rather than the value.
-    const autoMergeExplicit = command.getOptionValueSource('autoMerge') === 'cli';
-    return setupCommand({
-        json: options.json,
-        repos: options.repo,
-        yes: options.yes,
-        autoMerge: autoMergeExplicit ? options.autoMerge : undefined,
-        answersFile: options.answers,
-    });
-});
 program
     .command('status')
     .description('Check if .haystack.json exists and is valid')
@@ -277,7 +185,8 @@ const verify = program
     .option('--intent <sentence>', 'What you were asked to do, in the user\'s words (the task, not what your code does): the judge checks the app against it')
     .option('--idea <text>', 'Something to try in the app, said as you would to a tester (repeat for more); each is explored first', (value, previous = []) => [...previous, value])
     .option('--ideas-file <path>', 'A JSON array of more ideas')
-    .option('--json', 'The crawl as one JSON document on stdout (see `haystack schema verify`)')
+    .option('--json', 'The report as one JSON document on stdout (see `haystack schema verify`)')
+    .option('--raw', 'The service\'s whole crawl record as one JSON document, for scripts (large; see `haystack schema verify-raw`)')
     .addHelpText('after', `
 Run inside a git checkout; nothing needs to be committed or pushed. It captures
 the checkout (committed and uncommitted changes) exactly as the stop hook does,
@@ -333,7 +242,7 @@ Examples:
   haystack verify history owner/repo --limit 20
   haystack verify hosted status cv_<48 lowercase hex characters> --wait
 `)
-    .action(options => runPublicCommand(() => verifyCommand(options), options.json));
+    .action(options => runPublicCommand(() => verifyCommand(options), options.json || options.raw));
 program
     .command('pre-verify')
     .description('Before a check: what your change touches, and what could break in it')
@@ -347,9 +256,10 @@ same way, builds and prepares the change when nothing has yet (the turn-end
 hook usually has), and prints its brief: the functions the change touches, the
 changed ones and those one step away first (every one is in --json), and
 Haystack's own ideas of what could break, each with what to set up, what to do
-and what to watch. With capture set up (.haystack/capture.json), it also shows
-the routes the change touches with their share of real users' sessions. It
-never starts a crawl.
+and what to watch. With capture set up (an app's .haystack/capture.json, such
+as apps/web/.haystack/capture.json), it also shows, per app, the routes the
+change touches with their share of real users' sessions. It never starts a
+crawl.
 
 Then hand back what you were asked to do and what to try:
   haystack verify --intent "<what you were asked to do, in the user's words>" --idea "<something to try>"
@@ -455,7 +365,7 @@ verify
         process.exitCode = 0;
 });
 const hostedVerify = verify
-    .command('hosted')
+    .command('hosted', { hidden: true })
     .description('Run the production Cloud Verifier against exact GitHub commits');
 hostedVerify
     .command('start')
@@ -581,7 +491,7 @@ verify
     return runPublicCommand(() => verifyExploreCommand(run, caseId, { ...options, repo: options.repo }), options.json);
 });
 const caseBatch = program
-    .command('case-batch')
+    .command('case-batch', { hidden: true })
     .description('Submit and poll product-fuzzing case batches on the hosted coordinator (CASE-BATCH-V1)');
 caseBatch
     .command('submit')
@@ -712,6 +622,22 @@ just those paths with --only.
     const { caseBatchBundleCommand } = await import('./commands/case-batch.js');
     return runPublicCommand(() => caseBatchBundleCommand(runId, options), options.json);
 });
+program
+    .command('feedback <message...>')
+    .description('Tell the Haystack team something went wrong or got in your way (- reads the message from stdin)')
+    .option('--run <id>', 'The verification run it is about, when there is one')
+    .option('--account <login>', 'Use a specific saved Haystack account')
+    .option('--json', 'The result as one JSON document on stdout (see `haystack schema feedback`)')
+    .addHelpText('after', `
+For coding agents as much as people: when Haystack fails, confuses you or is
+missing something, say so in a sentence and keep going. The team sees it at
+once, with the CLI version, the platform and this checkout's repository.
+
+Examples:
+  haystack feedback "verify said the app never started, but it was up on :3000"
+  haystack feedback --run cv_<id> "the bug it reported is the intended change"
+`)
+    .action((words, options) => runPublicCommand(() => feedbackCommand(words, options), options.json));
 program
     .command('login')
     .description('Add or refresh a saved GitHub account (use --headless for CI tokens)')
@@ -800,171 +726,6 @@ authProgram
     .command('use <login>')
     .description('Set the active Haystack GitHub account')
     .action(authUseCommand);
-program
-    .command('submit')
-    .description('Create a PR from current changes')
-    .option('--account <login>', 'Saved Haystack account login to use for GitHub API calls')
-    .option('--title <title>', 'PR title (default: last commit message)')
-    .option('--body <body>', 'PR body (default: commit messages since base)')
-    .option('--body-file <path>', 'Read PR body from file (use "-" for stdin)')
-    .option('--base <branch>', 'Base branch (default: main or master)')
-    .option('--draft', 'Create as draft PR')
-    .option('--review [reviewer]', 'Request human review (BLOCKS auto-merge — only use when explicitly asked)')
-    .option('--force', 'Skip pre-PR triage checks')
-    .addOption(new Option('--auto-fix', 'Alpha auto-fix for entitled repositories').hideHelp())
-    .option('--auto-merge', 'Apply auto-merge label (default: from .haystack.json, --no-auto-merge to disable)')
-    .option('--no-auto-merge', 'Do not apply the auto-merge label')
-    .option('--no-wait', 'Skip waiting for analysis results')
-    .option('--json', 'Machine-readable: one JSON document on stdout (see `haystack schema submit`), progress on stderr')
-    .option('--triage-timeout <seconds>', 'Abort a triage checker after this many seconds with no data from the model (overrides .haystack.json triage.timeoutMs)', (v) => parseInt(v, 10))
-    .addHelpText('after', `
-This command is designed for AI coding agents to submit PRs.
-
-  1. Runs pre-PR triage (code review and rules) on gpt-6-astra
-  2. Pushes the current branch to origin
-  3. Creates a pull request on GitHub
-  4. Waits for Haystack analysis results (triggered via GitHub App webhook)
-
-Pre-PR Triage:
-  Before creating the PR, haystack sends the diff to gpt-6-astra (OpenAI
-  Responses API, reasoning effort "xhigh", structured output) in parallel for:
-  • Code review bugs (logic errors, null crashes, security issues, secrets)
-  • Rule violations (from .haystack/pr-rules.yml and CLAUDE.md/AGENTS.md etc.)
-
-  Uses OPENAI_API_KEY if set, else the SSM parameter
-  /haystack/secrets/shared/prod/OPENAI_API_KEY (us-west-2) via the default
-  AWS credential chain. If a checker call fails, submit prints
-  "<checker> failed: <error>" and continues; only findings with severity
-  "error" block the PR.
-
-  Use --force to skip triage entirely.
-  Use --no-wait to skip waiting for analysis results.
-
-  • --triage-timeout <sec>  Abort a checker when the model stream has been
-                            silent this long (default: 300s). There is no
-                            total-time cap.
-
-  Persist it in .haystack.json to apply per project:
-
-    {
-      "triage": {
-        "timeoutMs": 300000
-      }
-    }
-
-Review Routing:
-  If repo auto-merge is enabled in .haystack.json, plain \`haystack submit\`
-  enters the auto-merge queue after submission. Otherwise it still runs the
-  same Haystack analysis workflow without enabling auto-merge.
-
-  ⚠ Only use --review when the user EXPLICITLY asks for human review.
-  --review BLOCKS auto-merge — the PR will NOT merge until a human approves,
-  which delays merging. Do not add --review "just to be safe".
-
-  • --review             Labels the PR "haystack:needs-review" for the
-                         needs-assignment queue (a teammate will pick it up)
-  • --review <username>  Same label, plus requests review from that GitHub user
-
-Machine-readable output (--json):
-  stdout carries exactly one JSON document (schema: \`haystack schema submit\`);
-  all progress goes to stderr. On success the payload includes the PR ref,
-  the resolved title/body and their sources, auto-merge/auto-fix state with
-  source, and the analysis outcome. On failure it is an error envelope
-  { status: "error", error: "..." }.
-
-Exit codes:
-  0  PR created/updated (including verdict "needs_input" — the PR exists;
-     read the verdict from the JSON or from \`haystack triage\`)
-  1  Hard failure (bad flags, auth, push, PR creation, blocking triage
-     findings, or the analysis status check itself failing)
-
-Examples:
-  haystack submit                      # Recommended: triage, create PR, auto-merge queue
-  haystack submit --json               # Agent mode: JSON on stdout, progress on stderr
-  haystack submit --force              # Skip triage
-  haystack submit --no-wait            # Don't wait for analysis
-  haystack submit --title "Fix auth"   # Custom PR title
-  haystack submit --body "## Summary"  # Custom PR body (inline)
-  haystack submit --body-file body.md  # Read body from file (supports markdown)
-  echo "## Summary" | haystack submit --body-file -  # Read body from stdin
-  haystack submit --base develop       # Target a different base branch
-  haystack submit --draft              # Create as draft PR
-  haystack submit --review             # ⚠ Blocks auto-merge, needs human approval
-  haystack submit --review octocat     # ⚠ Blocks auto-merge, requests review from octocat
-  haystack submit --account octocat    # Use a specific saved Haystack account for this submit
-  haystack submit --triage-timeout 600 # Allow 10 minutes of model silence per checker
-`)
-    .action(async (options, command) => {
-    // Resolve --auto-merge / --auto-fix defaults from .haystack.json when not
-    // explicitly set, and record WHERE each value came from so submit can
-    // announce the source (silent config-driven defaults are invisible to
-    // the caller otherwise).
-    const autoMergeFromCli = command.getOptionValueSource('autoMerge') === 'cli';
-    const autoFixFromCli = command.getOptionValueSource('autoFix') === 'cli';
-    if (!autoMergeFromCli) {
-        options.autoMerge = await isAutoMergeEnabled();
-    }
-    // Auto-fix remains alpha — the explicit --auto-fix flag still surfaces
-    // discouragement warnings; opting in via repo config is the supported path.
-    if (!autoFixFromCli) {
-        options.autoFix = await isAutoFixEnabled();
-    }
-    options.autoMergeSource = autoMergeFromCli ? 'flag' : 'config';
-    options.autoFixSource = autoFixFromCli ? 'flag' : 'config';
-    return submitCommand(options);
-});
-program
-    .command('triage [pr]')
-    .description('View Haystack analysis results for a PR')
-    .option('--json', 'Output as JSON')
-    .option('--hook', 'Minimal single-line output for session-start hooks')
-    .option('--clear', 'Clear pending submit state')
-    .option('--no-wait', 'Exit immediately if analysis is still pending')
-    .addHelpText('after', `
-Look up triage results (bugs, rule violations, verdict) for any PR.
-When called without a PR identifier, checks the last submitted PR.
-
-Runs automatically on CLI session start if session hooks are installed.
-
-PR identifier formats:
-  (none)                                  Last submitted PR
-  123                                     PR number (uses current repo)
-  #123                                    PR number with hash
-  owner/repo#123                          Fully qualified
-  https://github.com/owner/repo/pull/123  GitHub URL
-
-By default, if analysis is still in progress, the command will poll
-for up to 5 minutes. Use --no-wait to exit immediately instead.
-
-Examples:
-  haystack triage                             # Last submitted PR
-  haystack triage 42                          # Current repo, PR #42
-  haystack triage acme/widgets#99             # Specific repo
-  haystack triage https://github.com/o/r/pull/1  # From URL
-  haystack triage 42 --json                   # Machine-readable output
-  haystack triage 42 --no-wait                # Don't wait if pending
-  haystack triage --hook                      # Session-start hook output
-  haystack triage --clear                     # Clear pending state
-`)
-    .action(triageCommand);
-const inbox = program.command('inbox').description('List Haystack work needing your attention');
-inbox
-    .command('list')
-    .description('List PRs in your Haystack inbox')
-    .option('--json', 'Output as JSON')
-    .action((options) => runPublicCommand(() => inboxListCommand(options), options.json));
-const prProgram = program.command('pr').description('Inspect one pull request');
-prProgram
-    .command('get <ref>')
-    .description('Get triage and merge blockers')
-    .option('--json', 'Output as JSON')
-    .action((ref, options) => runPublicCommand(() => prReadCommand(ref, options), options.json));
-program
-    .command('ask <ref> <question>')
-    .description('Ask Haystack about a pull request')
-    .option('--json', 'Output the answer and every consulted customer-facing source as JSON')
-    .option('--session <id>', 'Continue a previous Ask Haystack session')
-    .action((ref, question, options) => runPublicCommand(() => askHaystackCommand(ref, question, options), options.json));
 const telemetry = program.command('telemetry').description('Add privacy-safe production telemetry without an application SDK')
     .addHelpText('after', `
 Next.js bundles its server code, so instead of \`instrument\` add the CLI as a
@@ -1098,583 +859,6 @@ start prints why no stand-in was used and names the declared ids; upload again w
 that dependency; when both apply, the newer upload is used.
 `)
     .action((file, options) => runPublicCommand(() => databaseProfileUploadCommand(file, options)));
-program
-    .command('dismiss <pr>')
-    .description('Dismiss analysis findings for a PR')
-    .option('--json', 'Machine-readable output (see `haystack schema action`)')
-    .addHelpText('after', `
-Dismiss analysis findings for a PR, moving it from "Issues Found" to
-"Good to Merge" in the Haystack feed.
-
-The override is tied to the PR's current HEAD commit. If a new commit is
-pushed, the override is invalidated and you'll need to dismiss again.
-
-PR identifier formats:
-  123                                     PR number (uses current repo)
-  #123                                    PR number with hash
-  owner/repo#123                          Fully qualified
-  https://github.com/owner/repo/pull/123  GitHub URL
-
-Examples:
-  haystack dismiss 42                  # Dismiss findings for PR #42
-  haystack dismiss acme/widgets#99     # Dismiss for specific repo
-`)
-    .action(dismissCommand);
-program
-    .command('design-verify <pr>')
-    // "verification" is a banned word in top-level help (public-contract test
-    // keeps retired auto-fix/verification wording out of the CLI surface).
-    .description('Run a blind design-by-execution review of a PR')
-    .option('--json', 'Machine-readable output')
-    .option('--history', 'Show recent execution reliability for this repository without starting a run')
-    .option('--limit <attempts>', 'Maximum recorded terminal attempts to show with --history (1–100, default 20)')
-    .option('--no-wait', 'Return after the run is admitted instead of waiting for its verdict')
-    .option('--run <run-id>', 'Resume and wait for an existing exact run id')
-    .option('--poll-interval <seconds>', 'Status polling interval', '3')
-    .option('--timeout <seconds>', 'Maximum time to wait; the server run continues after timeout', '7200')
-    .option('--case <case-id>', 'Select one exact generated case for universe exploration')
-    .option('--universe <role>', 'Select control-before, before, or after')
-    .option('--replay', 'Replay the registered case command in the selected universe')
-    .option('--exec-json <argv>', 'Run a JSON argv array in the selected universe')
-    .option('--cwd <path>', 'Repository-relative working directory for --exec-json')
-    .option('--command-timeout <seconds>', 'Maximum selected-universe command runtime')
-    .option('--action <action-id>', 'Resume one exact universe action')
-    .addHelpText('after', `
-Executes the change instead of reading it: infers intent from the diff
-alone, designs pre-registered behavioral test cases, runs control-before,
-before, and after in isolated sandboxes, and reports anomaly candidates
-outside the registered intent.
-
-The command waits for a behavioral verdict by default. Use --no-wait to
-return the run id immediately, or --run <run-id> to resume waiting.
-
-Read recent execution reliability across this repository's PRs:
-  haystack design-verify owner/repo#123 --history --limit 20
-History covers recorded terminal attempts, including partial or failed runs;
-it does not measure bug-detection accuracy or whether changes are bug-free.
-
-After a completed run, inspect or replay one retained case universe without
-receiving provider credentials:
-  haystack design-verify owner/repo#123 --run RUN --case case-00001 --universe before --replay
-  haystack design-verify owner/repo#123 --run RUN --case case-00001 --universe after --exec-json '["rg","TODO"]'
-
-PR identifier formats:
-  123                                     PR number (uses current repo)
-  owner/repo#123                          Fully qualified
-  https://github.com/owner/repo/pull/123  GitHub URL
-`)
-    .action(designVerifyCommand);
-program
-    .command('mark-reviewed <pr>')
-    .description('Mark human review as not needed for a PR')
-    .option('--json', 'Machine-readable output (see `haystack schema action`)')
-    .addHelpText('after', `
-Mark human review as not needed for a PR, moving it from "Needs Review"
-to "Good to Merge" in the Haystack feed.
-
-The override is tied to the PR's current HEAD commit. If a new commit is
-pushed, the override is invalidated and you'll need to mark it again.
-
-PR identifier formats:
-  123                                     PR number (uses current repo)
-  #123                                    PR number with hash
-  owner/repo#123                          Fully qualified
-  https://github.com/owner/repo/pull/123  GitHub URL
-
-Examples:
-  haystack mark-reviewed 42                  # Mark review not needed for PR #42
-  haystack mark-reviewed acme/widgets#99     # Mark for specific repo
-`)
-    .action(markReviewedCommand);
-program
-    .command('undismiss <pr>')
-    .description('Undo a dismiss or mark-reviewed override for a PR')
-    .option('--json', 'Machine-readable output (see `haystack schema action`)')
-    .addHelpText('after', `
-Clear all overrides (dismissed findings and/or review-not-needed) for a PR,
-returning it to its original feed bucket.
-
-PR identifier formats:
-  123                                     PR number (uses current repo)
-  #123                                    PR number with hash
-  owner/repo#123                          Fully qualified
-  https://github.com/owner/repo/pull/123  GitHub URL
-
-Examples:
-  haystack undismiss 42                  # Undo overrides for PR #42
-  haystack undismiss acme/widgets#99     # Undo for specific repo
-`)
-    .action(undismissCommand);
-program
-    .command('review [pr]')
-    .description('Trigger a fresh Haystack analysis for a PR (machine analysis — for HUMAN review use request-review)')
-    .option('--no-wait', 'Exit after triggering instead of waiting for results')
-    .option('--json', 'Machine-readable output (see `haystack schema action`)')
-    .addHelpText('after', `
-Re-run full Haystack analysis on a PR's current head.
-
-Haystack analyzes a PR once when it's opened (or marked ready); later
-pushes only get a resolution check against the existing findings. Use
-this command when new commits deserve fresh detection, or any time you
-want a second opinion.
-
-When called without a PR identifier, uses the last submitted PR.
-
-PR identifier formats:
-  (none)                                  Last submitted PR
-  123                                     PR number (uses current repo)
-  #123                                    PR number with hash
-  owner/repo#123                          Fully qualified
-  https://github.com/owner/repo/pull/123  GitHub URL
-
-Examples:
-  haystack review                             # Last submitted PR
-  haystack review 42                          # Current repo, PR #42
-  haystack review acme/widgets#99             # Specific repo
-  haystack review 42 --no-wait                # Trigger and exit
-`)
-    .action(reviewCommand);
-program
-    .command('request-review <pr> [reviewer]')
-    .description('Tag a PR as needing human review')
-    .option('--json', 'Machine-readable output (see `haystack schema action`)')
-    .addHelpText('after', `
-Tag any PR with "needs human review", even after it was created.
-Adds the haystack:needs-review label to the PR, moving it from
-"Good to Merge" to the "Needs Assignment" queue in the feed.
-
-Optionally specify a reviewer to request review from a specific
-GitHub user.
-
-PR identifier formats:
-  123                                     PR number (uses current repo)
-  #123                                    PR number with hash
-  owner/repo#123                          Fully qualified
-  https://github.com/owner/repo/pull/123  GitHub URL
-
-Examples:
-  haystack request-review 42                  # Tag PR #42 for human review
-  haystack request-review 42 octocat          # Tag and request review from octocat
-  haystack request-review acme/widgets#99     # Specific repo
-`)
-    .action(requestReviewCommand);
-program
-    .command('pr-status <pr>')
-    .description('Show the current Haystack status of a PR')
-    .option('--json', 'Output as JSON')
-    .addHelpText('after', `
-Show what bucket a PR is in within the Haystack pipeline:
-  analyzing, good-to-merge, issues, needs-assignment, etc.
-
-PR identifier formats:
-  123                                     PR number (uses current repo)
-  #123                                    PR number with hash
-  owner/repo#123                          Fully qualified
-  https://github.com/owner/repo/pull/123  GitHub URL
-
-Examples:
-  haystack pr-status 42                          # Current repo, PR #42
-  haystack pr-status acme/widgets#99             # Specific repo
-  haystack pr-status https://github.com/o/r/pull/1  # From URL
-  haystack pr-status 42 --json                   # Machine-readable output
-`)
-    .action(prStatusCommand);
-// Config subcommands
-const config = program
-    .command('config')
-    .description('Manage user preferences');
-config
-    .command('agentic-tool [tool]')
-    .description('Set agentic tool (opencode|claude-code|codex|status)')
-    .addHelpText('after', `
-Tools:
-  opencode      OpenCode (Haystack billing) - default
-  claude-code   Claude Code (your Claude Max subscription)
-  codex         Codex CLI (your ChatGPT subscription)
-  status        Show current setting (default)
-
-This sets your account-level default. Projects can override
-this in .haystack.json under agentic.tool.
-
-Examples:
-  haystack config agentic-tool              # Show current setting
-  haystack config agentic-tool opencode     # Use Haystack billing
-  haystack config agentic-tool claude-code  # Use your Claude Max
-  haystack config agentic-tool codex        # Use your ChatGPT
-`)
-    .action(handleAgenticTool);
-config
-    .command('auto-merge [action]')
-    .description('Auto-merge safe PRs submitted via haystack submit (on|off|status)')
-    .addHelpText('after', `
-Actions:
-  on, enable, true     Enable auto-merge for safe PRs
-  off, disable, false  Disable auto-merge
-  status               Show current status (default)
-
-When enabled, PRs submitted via \`haystack submit\` will be
-automatically merged if Haystack analysis finds no issues
-(safe to merge). PRs with bugs or rule violations still
-require manual review.
-
-Examples:
-  haystack config auto-merge         # Show current status
-  haystack config auto-merge on      # Enable auto-merge
-  haystack config auto-merge off     # Disable auto-merge
-`)
-    .action(handleAutoMerge);
-config
-    .command('auto-fix [action]', { hidden: true })
-    .description('(Alpha) Auto-fix mechanical issues on PRs submitted via haystack submit (on|off|status)')
-    .addHelpText('after', `
-Actions:
-  on, enable, true     Enable auto-fix for mechanical issues
-  off, disable, false  Disable auto-fix
-  status               Show current status (default)
-
-⚠ Auto-fix is alpha. When enabled, PRs submitted via \`haystack submit\`
-are labeled haystack:auto-fix. The Haystack analysis pipeline then
-dispatches the sandbox fixer for issues classified as straightforward
-and mechanical. Judgment calls, policy violations, and weak coverage
-findings still surface in the Feed for human review.
-
-Examples:
-  haystack config auto-fix           # Show current status
-  haystack config auto-fix on        # Enable auto-fix (alpha)
-  haystack config auto-fix off       # Disable auto-fix
-`)
-    .action(handleAutoFix);
-config
-    .command('wait-for-reviewers [action] [reviewers...]')
-    .description('Configure which AI reviewers the merge queue waits for')
-    .addHelpText('after', `
-Actions:
-  list          Show configured reviewer bots (default)
-  add <names>   Add one or more reviewer bots
-  remove <names> Remove one or more reviewer bots
-  clear         Remove all reviewer bots
-
-Accepts friendly names (cursor, coderabbit) or exact
-GitHub bot usernames (cursor-bugbot[bot]).
-
-Stored in .haystack.json under merge_queue.wait_for_reviewer.bots.
-The merge queue will block merging until ALL configured
-bots have posted a review or comment on the PR.
-
-Examples:
-  haystack config wait-for-reviewers                          # Show status
-  haystack config wait-for-reviewers add cursor               # Wait for Cursor BugBot
-  haystack config wait-for-reviewers add cursor coderabbit    # Add multiple
-  haystack config wait-for-reviewers add cursor-bugbot[bot]   # Raw bot username
-  haystack config wait-for-reviewers remove cursor            # Stop waiting
-  haystack config wait-for-reviewers clear                    # Wait for none
-`)
-    .action(handleWaitForReviewers);
-// Skills subcommands
-const skills = program
-    .command('skills')
-    .description('Manage AI skills for coding agents');
-skills
-    .command('install')
-    .description('Install portable Haystack skills and optional coding-CLI shims')
-    .option('--cli <name>', 'Target CLI: claude, codex, cursor, or manual')
-    .addHelpText('after', `
-This installs portable skills in the Git repository's .agents/skills directory:
-  /submit                 - Submit a PR via Haystack
-  /map-your-system        - Map how Haystack QA can run this system
-  /map-cloud-verifier-universe - Map a production-derived hermetic universe
-Supported CLIs:
-  claude    Also install Claude Code command shims
-  codex     Use portable .agents/skills discovery only
-  cursor    Use portable .agents/skills discovery only
-  manual    Install portable skills and show their location
-
-Examples:
-  haystack skills install              # Install portable skills only
-  haystack skills install --cli codex  # Install for Codex only
-  haystack skills install --cli claude # Also install Claude command shims
-`)
-    .action(async (opts) => {
-    try {
-        await installSkills(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('skills install failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-skills
-    .command('list')
-    .description('List available Haystack skills')
-    .action(listSkills);
-skills
-    .command('census-universe')
-    .description('Deterministically census Cloud Verifier source identities before mapping')
-    .option('--json', 'Machine-readable result')
-    .option('--root <path>', 'Repository root (default: current Git worktree)')
-    .action((opts) => runPublicCommand(async () => cloudVerifierIdentityCensusCommand(opts), opts.json));
-skills
-    .command('data-store-drift')
-    .description('Check whether the detected data stores still match the checked-in map (per-PR drift gate)')
-    .option('--json', 'Machine-readable result')
-    .option('--root <path>', 'Repository root (default: current Git worktree)')
-    .option('--baseline <path>', 'Baseline map path (default: .haystack/cloud-verifier/data-stores.json)')
-    .option('--base-ref <ref>', 'Only run when the diff against this ref touches a store-relevant file')
-    .option('--update', 'Write the current detected stores as the new baseline')
-    .action((opts) => runPublicCommand(async () => cloudVerifierDataStoreDriftCommand(opts), opts.json));
-skills
-    .command('validate-universe')
-    .description('Validate Cloud Verifier universe artifacts and stable-ID references')
-    .option('--json', 'Machine-readable result')
-    .action(async (opts) => {
-    try {
-        await cloudVerifierUniverseValidateCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('validate-universe failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-skills
-    .command('validate-behaviors')
-    .description('Validate customer actions and their exact runtime identities')
-    .option('--json', 'Machine-readable result')
-    .action(async (opts) => {
-    try {
-        await cloudVerifierBehaviorsValidateCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('validate-behaviors failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-skills
-    .command('scaffold-provisional-universe')
-    .description('Create a compact missing-authority receipt from strict JSON facts')
-    .requiredOption('--input <path>', 'Strict provisional-universe JSON input file')
-    .action((opts) => runPublicCommand(async () => scaffoldProvisionalUniverseCommand(opts), true));
-skills
-    .command('prepare-universe-review')
-    .description('Create a tracked-source snapshot with conventional test paths removed')
-    .option('--json', 'Machine-readable isolation result and snapshot manifest')
-    .option('--exclude-inactive-submodule <path...>', 'Omit exact tracked gitlink paths explicitly known to be inactive')
-    .option('--omit-unscannable-files', 'Omit files whose test content cannot be ruled out, instead of blocking the review. '
-    + 'The reviewer still never sees a test; the omissions are recorded as uncovered scope')
-    .option('--full-receipt', 'Include complete non-blocking path receipts in JSON output')
-    .action((opts) => runPublicCommand(() => prepareUniverseReviewCommand(opts), opts.json));
-const hooks = program
-    .command('hooks')
-    .description('Manage git hooks for AI agent quality checks');
-hooks
-    .command('install')
-    .description('Install Haystack git hooks')
-    .option('-f, --force', 'Overwrite existing hooks')
-    .addHelpText('after', `
-This installs:
-  • Git hooks for AI agent quality checks (pre-commit, commit-msg, etc.)
-  • Agent context detector (identifies AI agent sessions)
-  • Truncation checker (prevents code truncation by LLMs)
-
-Hooks are installed to <repo>/hooks/ and git is configured to use them.
-
-Examples:
-  haystack hooks install --force      # Overwrite existing hooks
-`)
-    .action(hooksInstall);
-hooks
-    .command('status')
-    .description('Check hooks installation status')
-    .action(hooksStatus);
-hooks
-    .command('install-session')
-    .description('Install session-start and Stop hooks for coding CLIs')
-    .option('--cli <name>', 'Target CLI: claude, codex, gemini, or all')
-    .option('--shared', 'Write Claude Code hooks to the committed .claude/settings.json instead of settings.local.json')
-    .addHelpText('after', `
-Configures your coding CLI to run \`haystack triage --hook\` on session start.
-This shows pending PR analysis results when you open a new terminal session.
-Claude Code also runs \`haystack verify precompute --hook\` when a session stops,
-which builds and freezes the changed app in the background so that
-\`haystack verify\` starts from there. It never crawls; \`haystack verify\` does.
-
-  Claude Code:  Native SessionStart and Stop hooks (.claude/settings.local.json;
-                --shared writes the committed .claude/settings.json)
-  Codex CLI:    AGENTS.md instructions
-  Gemini CLI:   GEMINI.md instructions
-
-Examples:
-  haystack hooks install-session              # Auto-detect CLIs
-  haystack hooks install-session --cli claude # Claude Code only
-  haystack hooks install-session --cli all    # All detected CLIs
-`)
-    .action(installSessionHooks);
-hooks
-    .command('session-status')
-    .description('Check session hook installation status')
-    .action(sessionHooksStatus);
-// Policy subcommands
-const policy = program
-    .command('policy')
-    .description('Manage review policies (.haystack/review-policy.md)');
-policy
-    .command('list')
-    .description('List all review policies')
-    .action(listPolicies);
-policy
-    .command('add [name]')
-    .description('Add a new review policy interactively')
-    .addHelpText('after', `
-This command prompts for:
-  • Policy name (e.g., "Infrastructure changes")
-  • File patterns (comma-separated globs, e.g., "terraform/**,*.tf")
-  • Severity (critical, high, medium, low)
-  • Reason (why this requires human review)
-
-Examples:
-  haystack policy add                    # Interactive add
-  haystack policy add "Database changes" # Start with name
-`)
-    .action(addPolicy);
-policy
-    .command('remove <name>')
-    .description('Remove a review policy by name')
-    .action(removePolicy);
-policy
-    .command('add-instruction [text]')
-    .description('Add a semantic review instruction')
-    .addHelpText('after', `
-Instructions are natural language directives that override default review behavior.
-They apply to all PRs (not file-pattern-gated).
-
-Examples:
-  haystack policy add-instruction "Never flag weak test coverage as needing review"
-  haystack policy add-instruction   # Interactive prompt
-`)
-    .action(addInstruction);
-policy
-    .command('init')
-    .description('Create initial review-policy.md with example policies')
-    .option('-f, --force', 'Overwrite existing file')
-    .addHelpText('after', `
-Creates .haystack/review-policy.md with sensible defaults:
-  • Infrastructure changes (terraform, pulumi, cdk)
-  • Secret files (*.secret*, *.env*, credentials)
-  • CI/CD pipelines (GitHub Actions, GitLab CI, etc.)
-
-The generated policies appear in Haystack's "Human Review Needed"
-section when a PR touches matching files.
-`)
-    .action(initPolicies);
-// ─── webhooks ────────────────────────────────────────────────────────────────
-//
-// `haystack webhooks ...` — register outbound webhook subscriptions and inspect
-// delivery status. Talks to the haystack-webhooks worker.
-//
-// See docs/SPEC-CLI-FIRST-CLASS.md §1 for the wire protocol (HMAC, retries,
-// idempotency).
-const webhooks = program
-    .command('webhooks')
-    .description('Manage outbound webhooks');
-webhooks
-    .command('register')
-    .description('Register a webhook URL for the current repo and mint a fresh HMAC secret')
-    .requiredOption('-u, --url <url>', 'Receiver URL (https only)')
-    .option('-e, --events <events>', 'Comma-separated event list', (val) => val.split(',').map((s) => s.trim()).filter(Boolean))
-    .option('--secret-env <name>', 'Environment-variable name where you\'ll stash the secret (recorded in .haystack.json)')
-    .option('--repo <owner/name>', 'Override the inferred repo')
-    .action(async (opts) => {
-    try {
-        await registerWebhook(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('register failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-webhooks
-    .command('list')
-    .description('List active webhook registrations for the current repo')
-    .option('--repo <owner/name>', 'Override the inferred repo')
-    .option('--json', 'Machine-readable JSON output')
-    .action(async (opts) => {
-    try {
-        await listWebhooks(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('list failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-webhooks
-    .command('rotate-secret <id>')
-    .description('Rotate the HMAC secret for a registration (prints the new secret once)')
-    .option('--repo <owner/name>', 'Repo the registration belongs to (for account resolution outside its checkout)')
-    .action(async (id, opts) => {
-    try {
-        await rotateWebhookSecret(id, opts.repo);
-    }
-    catch (err) {
-        console.error(chalk.red('rotate-secret failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-webhooks
-    .command('disable <id>')
-    .description('Disable a registration (stops delivery; existing in-flight retries continue)')
-    .option('--repo <owner/name>', 'Repo the registration belongs to (for account resolution outside its checkout)')
-    .action(async (id, opts) => {
-    try {
-        await setWebhookEnabled(id, false, opts.repo);
-    }
-    catch (err) {
-        console.error(chalk.red('disable failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-webhooks
-    .command('enable <id>')
-    .description('Re-enable a previously disabled registration')
-    .option('--repo <owner/name>', 'Repo the registration belongs to (for account resolution outside its checkout)')
-    .action(async (id, opts) => {
-    try {
-        await setWebhookEnabled(id, true, opts.repo);
-    }
-    catch (err) {
-        console.error(chalk.red('enable failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-webhooks
-    .command('deliveries')
-    .description('Show recent webhook delivery attempts for the current repo')
-    .option('--repo <owner/name>', 'Override the inferred repo')
-    .option('--limit <n>', 'Number of deliveries (default 20)', (v) => parseInt(v, 10))
-    .option('--json', 'Machine-readable JSON output')
-    .action(async (opts) => {
-    try {
-        await listDeliveries(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('deliveries failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-webhooks
-    .command('replay <id>')
-    .description('Replay a previous delivery (idempotent via X-Haystack-Delivery)')
-    .option('--repo <owner/name>', 'Repo the delivery belongs to (for account resolution outside its checkout)')
-    .action(async (id, opts) => {
-    try {
-        await replayDelivery(id, opts.repo);
-    }
-    catch (err) {
-        console.error(chalk.red('replay failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-// ─── admin ───────────────────────────────────────────────────────────────────
-// Operator commands. The only credential is the operator's Cloudflare Access
-// token (`cloudflared access token`); exit 3 means an epoch conflict (409).
 async function runAdminCommand(action) {
     try {
         process.exitCode = await action();
@@ -1684,7 +868,7 @@ async function runAdminCommand(action) {
         process.exitCode = 1;
     }
 }
-const admin = program.command('admin').description('Haystack operator commands (Cloudflare Access)');
+const admin = program.command('admin', { hidden: true }).description('Haystack operator commands (Cloudflare Access)');
 const fleetPolicy = admin
     .command('fleet-policy')
     .description('Fleet policy authority in D1: approved policies per tenant and repository')
@@ -1748,86 +932,6 @@ fleetPolicy
     const { fleetPolicyHistoryCommand } = await import('./commands/fleet-policy.js');
     await runAdminCommand(() => fleetPolicyHistoryCommand(repository, options));
 });
-// ─── rules ───────────────────────────────────────────────────────────────────
-const rules = program.command('rules').description('Manage .haystack/pr-rules.yml');
-rules
-    .command('edit')
-    .description('Open .haystack/pr-rules.yml in $EDITOR (creates a starter if missing)')
-    .action(async () => {
-    try {
-        await editRulesCommand();
-    }
-    catch (err) {
-        console.error(chalk.red('edit failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-rules
-    .command('validate')
-    .description('Parse pr-rules.yml with the same parser the server uses')
-    .action(async () => {
-    try {
-        await validateRulesCommand();
-    }
-    catch (err) {
-        console.error(chalk.red('validate failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-// ─── system-map ──────────────────────────────────────────────────────────────
-const systemMap = program
-    .command('system-map')
-    .description('Manage .haystack/system.yml — runtime facts that help Haystack QA run your system');
-systemMap
-    .command('validate')
-    .description('Check .haystack/system.yml against the rules Haystack QA will apply')
-    .option('--json', 'Machine-readable result')
-    .addHelpText('after', `
-The system map holds VERIFIED facts about how your system works — install/
-build commands, how services boot and signal readiness, seed/reset commands,
-dev-only test logins, external services that must never be touched live, and
-prebuilt CI artifacts. Haystack QA uses these facts to run more of what it
-already wants to test; the file never selects tests.
-
-Author it with the /map-your-system skill (haystack skills install), then run
-this before committing. Checks: valid YAML + version, no test-selection keys,
-no secret values, non-empty boot/login/run commands, artifact declarations.
-
-Examples:
-  haystack system-map validate
-  haystack system-map validate --json
-`)
-    .action(async (opts) => {
-    try {
-        await systemMapValidateCommand(opts);
-    }
-    catch (err) {
-        console.error(chalk.red('validate failed:'), err instanceof Error ? err.message : err);
-        process.exit(1);
-    }
-});
-// ─── mcp ─────────────────────────────────────────────────────────────────────
-program
-    .command('mcp')
-    .description('Run a stdio MCP server exposing Haystack tools to Claude Code, Cursor, etc.')
-    .action(async () => {
-    try {
-        // Lazy import: only this command needs @modelcontextprotocol/sdk, so we keep it
-        // out of the startup graph (see the note where the eager import used to be).
-        const { runMcpServer } = await import('./commands/mcp.js');
-        await runMcpServer();
-    }
-    catch (err) {
-        const code = err?.code;
-        if (code === 'ERR_MODULE_NOT_FOUND') {
-            console.error(chalk.red('mcp server failed:'), 'the @modelcontextprotocol/sdk package is missing. Reinstall the CLI to pull it in (e.g. `npm i -g @haystackeditor/cli@latest`).');
-        }
-        else {
-            console.error(chalk.red('mcp server failed:'), err instanceof Error ? err.message : err);
-        }
-        process.exit(1);
-    }
-});
 // Show help if no command provided
 if (process.argv.length === 2) {
     program.help();