@haystackeditor/cli 0.25.1 → 0.26.0

package/dist/utils/analysis-api.js

@@ -1,416 +0,0 @@
-/**
- * Haystack Analysis API client.
- *
- * Polls the result endpoint by PR identifier to check if analysis is ready,
- * then fetches detailed results (bug detection + rule violations).
- *
- * Analysis is triggered automatically by the GitHub App webhook when a PR
- * is created or updated — the CLI does not need to trigger it directly.
- */
-import { classifyHttpError } from './haystack-api.js';
-// ============================================================================
-// Constants
-// ============================================================================
-/**
- * Analysis API base.
- *
- * IMPORTANT: this used to point directly at AWS API Gateway. That worked
- * when the CLI carried a GitHub token (X-GitHub-Token header to the
- * Lambda), but BROKE for `haystack login --headless` users — an
- * hsk_live_* token would land on AWS as if it were a GH token, the
- * Lambda would 401, and triage / pr / chat / MCP would silently return
- * nothing. The right move is to route reads through the auth-worker,
- * which:
- *
- *   1. Knows how to introspect hsk_live tokens (and GH tokens, agent JWTs,
- *      session cookies) — single normalized auth path.
- *   2. Applies the hsk_live scope gate (denyForCliScope) before forwarding
- *      to AWS, so a repo-scoped CI token can't read other repos' synthesis.
- *   3. Adds the right backend token (install token for org-installed reads,
- *      fallback otherwise) — so private-repo reads work without the CLI
- *      ever holding a GH token.
- *
- * Override with HAYSTACK_API_BASE for local dev (e.g., http://localhost:8788
- * pointing at a local auth-worker).
- */
-const ANALYSIS_API_BASE = process.env.HAYSTACK_API_BASE ?? 'https://haystackeditor.com';
-/** Build the auth-worker URL for a v3 result file (rating_synthesis.json, etc). */
-function v3ResultUrl(owner, repo, prNumber, file) {
-    // The auth-worker exposes `/api/analysis/{prIdentifier}/{file}` (see
-    // V3_API_PATTERNS in infra/auth-worker/index.js). prIdentifier format:
-    // owner/repo#prnum, URL-encoded as %2F + %23.
-    const prId = encodeURIComponent(`${owner}/${repo}#${prNumber}`);
-    return `${ANALYSIS_API_BASE}/api/analysis/${prId}${file ? `/${file}` : ''}`;
-}
-// ============================================================================
-// API helpers
-// ============================================================================
-/**
- * Build headers for an auth-worker-proxied analysis request.
- *
- * Auth-worker accepts hsk_live_*, GH tokens, agent JWTs, and session
- * cookies on `Authorization: Bearer`. The legacy `X-GitHub-Token` header
- * targeted AWS directly and is no longer used.
- */
-function apiHeaders(token) {
-    const headers = {
-        'Cache-Control': 'no-cache',
-        'User-Agent': 'Haystack-CLI',
-    };
-    if (token) {
-        headers['Authorization'] = `Bearer ${token}`;
-    }
-    return headers;
-}
-/**
- * Trigger a fresh full analysis for a PR via the auth-worker
- * (`/api/analysis-trigger/{owner}/{repo}/{pr}`). Requires auth — triggers
- * start a real analysis run. Returns the request id to wait on.
- */
-export async function triggerAnalysis(owner, repo, prNumber, token, headSha) {
-    const url = `${ANALYSIS_API_BASE}/api/analysis-trigger/${owner}/${repo}/${prNumber}`;
-    let response;
-    try {
-        // Force semantics ride on a server-set header at the trigger route.
-        // commitSha matters for dedup: without it, ingestion matches this
-        // request onto any in-flight run for an OLDER head and the CLI would
-        // wait on (and render) stale results.
-        response = await fetch(url, {
-            method: 'POST',
-            headers: { ...apiHeaders(token), 'Content-Type': 'application/json' },
-            body: JSON.stringify(headSha ? { commitSha: headSha } : {}),
-        });
-    }
-    catch (err) {
-        return { status: 'error', message: err.message };
-    }
-    let data = {};
-    let parseFailed = false;
-    try {
-        data = await response.json();
-    }
-    catch {
-        // Recorded, not swallowed: for non-OK responses the status-code handling
-        // below surfaces the failure; a 2xx with an unparseable body is its own
-        // explicit error (never "empty data") so callers can't mistake a
-        // malformed response for a normal one.
-        parseFailed = true;
-    }
-    if (parseFailed && response.ok) {
-        return { status: 'error', message: `Trigger endpoint returned invalid JSON (HTTP ${response.status})` };
-    }
-    if (response.status === 429) {
-        return {
-            status: 'rate_limited',
-            message: data.message || 'Too many analysis requests. Please wait before trying again.',
-            retryAfterSeconds: data.retryAfter,
-        };
-    }
-    if (response.status === 401 || response.status === 403) {
-        return {
-            status: 'denied',
-            message: data.message || data.error || `HTTP ${response.status}`,
-        };
-    }
-    if (!response.ok) {
-        return { status: 'error', message: data.message || data.error || `HTTP ${response.status}` };
-    }
-    if (!data.request_id) {
-        return { status: 'error', message: 'Trigger response did not include a request id' };
-    }
-    if (data.status === 'already_processing') {
-        return { status: 'already_processing', requestId: data.request_id };
-    }
-    return { status: 'started', requestId: data.request_id };
-}
-// Terminal states of the v3 status vocabulary (map_status_for_frontend in
-// haystack-v3-request-status). Everything else — QUEUED, PROCESSING,
-// CLONING, PREPARING, ANALYZING, not_found (row lag), and any state a newer
-// backend introduces — reads as pending: misclassifying a healthy
-// in-progress state as an error would abort the wait.
-const TERMINAL_STATUSES = {
-    COMPLETED: 'COMPLETED',
-    FAILED: 'FAILED',
-    TIMED_OUT: 'FAILED',
-    SUPERSEDED: 'SUPERSEDED',
-};
-/**
- * Poll the status of a triggered run by request id. The PR-level result
- * endpoint can't distinguish a fresh re-run on the same head from the
- * previous completed analysis — the request id can.
- */
-export async function fetchTriggerStatus(requestId, token) {
-    const url = `${ANALYSIS_API_BASE}/api/analysis-trigger/status/${requestId}`;
-    try {
-        const response = await fetch(url, { headers: apiHeaders(token) });
-        // The status Lambda returns not_found as a 404 WITH a JSON body — parse
-        // before rejecting on status code so "not yet written" is distinguishable
-        // from a real transport failure.
-        let data = {};
-        try {
-            data = await response.json();
-        }
-        catch {
-            return { status: 'error', message: `HTTP ${response.status}` };
-        }
-        const status = typeof data.status === 'string' ? data.status : '';
-        const terminal = TERMINAL_STATUSES[status];
-        if (terminal) {
-            return { status: terminal, message: data.message };
-        }
-        // Only successful responses (plus the documented 404 not_found row-lag
-        // case) read as pending — a 5xx carrying {"status":"error"} must count
-        // toward the error budget, not spin the wait for the full timeout.
-        if (response.ok || (response.status === 404 && status === 'not_found')) {
-            return { status: 'pending', message: data.message };
-        }
-        return { status: 'error', message: data.message || `HTTP ${response.status}` };
-    }
-    catch (err) {
-        return { status: 'error', message: err.message };
-    }
-}
-/**
- * Check if analysis results are available for a PR by polling the result endpoint.
- * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.
- */
-export async function checkAnalysisReady(owner, repo, prNumber, token) {
-    const url = v3ResultUrl(owner, repo, prNumber);
-    let response;
-    try {
-        response = await fetch(url, {
-            headers: apiHeaders(token),
-        });
-    }
-    catch (err) {
-        return { status: 'error', message: err.message };
-    }
-    if (response.status === 404)
-        return { status: 'pending' };
-    if (!response.ok) {
-        // Classified, actionable message — a bare "HTTP 403" used to send agents
-        // into a retry loop when the fix was `haystack login`.
-        return { status: 'error', message: (await classifyHttpError(response, 'Analysis status check')).message };
-    }
-    let data;
-    try {
-        data = await response.json();
-    }
-    catch {
-        return { status: 'error', message: 'Invalid JSON response' };
-    }
-    return data.status === 'COMPLETED' ? { status: 'ready' } : { status: 'pending' };
-}
-/**
- * Fetch analysis results once complete. Used by `haystack submit`'s
- * wait-for-triage loop to render a verdict block.
- *
- * Verdict semantics — three distinct signals, never conflated:
- *
- *   state                 = is the analysis itself clean?
- *                           → 'good-to-merge' iff analysisVerdict === 'clean'
- *                              AND !needsHumanReview. canAutoMerge is NOT
- *                              the source of truth (it only means "analysis
- *                              would let this through" — review policy,
- *                              grace period, or a missing auto-merge label
- *                              can still block).
- *                              Falls back to haystackRating ≥ 5 only when
- *                              analysisVerdict is absent (legacy payloads).
- *   needsHumanReview      = preserved on the return shape so callers can
- *                           distinguish "clean + needs human" from clean.
- *   autoMerged            = was the PR ACTUALLY merged? Read from the
- *                           GitHub REST endpoint, not from anything in
- *                           the synthesis. canAutoMerge is eligibility,
- *                           not outcome — never claim "auto-merged" from
- *                           the analysis side.
- *
- * Sources from the v3 rating-synthesis path (auth-worker-proxied — so
- * hsk_live tokens, GH tokens, agent JWTs, and cookies all work, and the
- * scope gate runs). The legacy v2 bug-detection / rule-violation /
- * merge-decision JSONs are no longer queried (no auth-worker proxy).
- */
-async function isPrMerged(owner, repo, prNumber, token) {
-    // Authoritative merge check. We hit the same auth-worker proxy as the
-    // rest of the CLI so hsk_live / OAuth / install tokens all work, AND
-    // scope enforcement happens here too (a token not scoped to this repo
-    // would 403; we treat that as "unknown → not merged" rather than
-    // crashing the submit flow).
-    if (!token)
-        return false;
-    try {
-        const base = process.env.HAYSTACK_API_BASE ?? 'https://haystackeditor.com';
-        const res = await fetch(`${base}/api/github/repos/${owner}/${repo}/pulls/${prNumber}`, {
-            headers: {
-                Accept: 'application/vnd.github+json',
-                Authorization: `Bearer ${token}`,
-                'User-Agent': 'Haystack-CLI',
-            },
-        });
-        if (!res.ok)
-            return false;
-        const data = (await res.json());
-        return data.merged === true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function fetchAnalysisResults(owner, repo, prNumber, token) {
-    const reviewUrl = `https://haystackeditor.com/review/${owner}/${repo}/${prNumber}`;
-    const [synthesis, autoMerged] = await Promise.all([
-        fetchRatingSynthesis(owner, repo, prNumber, token),
-        isPrMerged(owner, repo, prNumber, token),
-    ]);
-    if (!synthesis) {
-        return {
-            state: 'needs-input',
-            bugCount: 0,
-            warningCount: 0,
-            ruleViolationCount: 0,
-            summary: 'Analysis is ready but synthesis could not be loaded.',
-            issues: [],
-            reviewUrl,
-            autoMerged,
-        };
-    }
-    const display = synthesis.synthesisDisplay ?? [];
-    const issues = display.map((d) => ({
-        file: 'unknown', // synthesis findings don't always carry a path; the rich data lives on the feed
-        message: d.summary || d.detail || `Finding (${d.category})`,
-        severity: 'warning',
-        // Map the synthesis source onto the verdict's two-bucket model.
-        // Anything other than an explicit rule violation lands on bug-detection.
-        source: d.source === 'rule-violation' ? 'rule-violation' : 'bug-detection',
-    }));
-    const bugCount = issues.filter((i) => i.source === 'bug-detection').length;
-    const ruleViolationCount = issues.filter((i) => i.source === 'rule-violation').length;
-    const warningCount = issues.length;
-    // Three discrete signals, NEVER conflated:
-    //   verdictKind     : 'clean' | 'has-issues' | 'needs-review'
-    //                     (legacy payloads without analysisVerdict fall back
-    //                     to haystackRating ≥ 5 → 'clean')
-    //   needsHumanReview: true if review policy demands a human, OR if the
-    //                     orchestrator escalated verdict to 'needs-review'
-    //                     (which carries the same semantic).
-    //   analysisIsClean : true iff verdict is 'clean' OR 'needs-review'
-    //                     (both mean: no bugs/violations were found; the
-    //                     review-policy gate is the separate axis).
-    //
-    // good-to-merge = analysis clean AND no human required.
-    // 'has-issues'   → state 'needs-input'.
-    // 'needs-review' → state 'needs-input' + needsHumanReview true.
-    // 'clean' + needsHumanReview → same as 'needs-review' (defensive — the
-    //  orchestrator should already have escalated, but we handle the case
-    //  where it didn't).
-    const verdictKind = synthesis.analysisVerdict
-        ?? (synthesis.haystackRating >= 5 ? 'clean' : 'has-issues');
-    const analysisIsClean = verdictKind === 'clean' || verdictKind === 'needs-review';
-    const needsHumanReview = synthesis.needsHumanReview === true || verdictKind === 'needs-review';
-    const isGoodToMerge = analysisIsClean && !needsHumanReview;
-    const state = isGoodToMerge ? 'good-to-merge' : 'needs-input';
-    let summary;
-    if (state === 'good-to-merge') {
-        summary = autoMerged
-            ? 'No blocking issues. PR was merged.'
-            : 'No blocking issues. Safe to merge.';
-    }
-    else if (analysisIsClean && needsHumanReview) {
-        summary = 'Analysis is clean, but review policy requires a human reviewer.';
-    }
-    else {
-        const parts = [];
-        if (bugCount > 0)
-            parts.push(`${bugCount} finding(s)`);
-        if (ruleViolationCount > 0)
-            parts.push(`${ruleViolationCount} rule violation(s)`);
-        summary = parts.length > 0
-            ? parts.join(', ') + ' found.'
-            : `Rating ${synthesis.haystackRating}/5 — see the feed for details.`;
-    }
-    return {
-        state,
-        bugCount,
-        warningCount,
-        ruleViolationCount,
-        summary,
-        issues,
-        reviewUrl,
-        autoMerged,
-        needsHumanReview,
-    };
-}
-/**
- * Null means "artifact does not exist (yet)" — 404s and transient
- * network/parse failures. Auth failures (401/403) THROW a classified
- * HaystackApiError instead: collapsing them into null used to make an
- * expired token read as "not available yet — try again in a moment",
- * sending agents into a retry loop when the fix was `haystack login`.
- */
-export async function fetchAutoFixManifest(owner, repo, prNumber, token) {
-    const url = v3ResultUrl(owner, repo, prNumber, 'auto-fix-manifest.json');
-    try {
-        const response = await fetch(url, {
-            headers: apiHeaders(token),
-        });
-        if (response.status === 401 || response.status === 403) {
-            throw await classifyHttpError(response, 'Auto-fix manifest fetch');
-        }
-        if (!response.ok)
-            return null;
-        const data = await response.json();
-        if (data.download_url) {
-            const s3Resp = await fetch(data.download_url, {
-                headers: { 'User-Agent': 'Haystack-CLI' },
-            });
-            if (!s3Resp.ok)
-                return null;
-            return await s3Resp.json();
-        }
-        return data;
-    }
-    catch (err) {
-        if (err instanceof Error && err.name === 'HaystackApiError')
-            throw err;
-        // Transient network/parse failure — same "not available" semantics as 404.
-        return null;
-    }
-}
-/**
- * Null means "synthesis does not exist (yet)". Auth failures (401/403) THROW
- * a classified HaystackApiError — see fetchAutoFixManifest for why.
- */
-export async function fetchRatingSynthesis(owner, repo, prNumber, token) {
-    // Route through the auth-worker (/api/analysis/{prId}/rating_synthesis.json)
-    // so hsk_live tokens are introspected and the scope gate applies — see
-    // ANALYSIS_API_BASE comment above.
-    const url = v3ResultUrl(owner, repo, prNumber, 'rating_synthesis.json');
-    try {
-        const response = await fetch(url, {
-            headers: apiHeaders(token),
-        });
-        if (response.status === 401 || response.status === 403) {
-            throw await classifyHttpError(response, 'Rating synthesis fetch');
-        }
-        if (!response.ok)
-            return null;
-        const data = await response.json();
-        // Handle presigned URL redirect (Lambda returns { download_url } for large files)
-        // Presigned S3 URLs include auth in query params — do NOT forward the GitHub token
-        // (S3 rejects requests with both presigned auth and an Authorization/custom header)
-        if (data.download_url) {
-            const s3Resp = await fetch(data.download_url, {
-                headers: { 'User-Agent': 'Haystack-CLI' },
-            });
-            if (!s3Resp.ok)
-                return null;
-            return await s3Resp.json();
-        }
-        return data;
-    }
-    catch (err) {
-        if (err instanceof Error && err.name === 'HaystackApiError')
-            throw err;
-        // Transient network/parse failure — same "not available" semantics as 404.
-        return null;
-    }
-}