@haystackeditor/cli 0.25.1 → 0.27.0

package/dist/commands/lockfile-pin.js

@@ -0,0 +1,307 @@
+/**
+ * Adding one dependency to an app's lockfile without moving anything else (rule 13: init must never change what a build
+ * resolves beyond what it adds). Measured on real lockfiles (Rallly's pnpm workspace, and scratch workspaces whose app
+ * locks older versions of packages the CLI also uses):
+ *   - yarn 1, yarn 4 and bun add only the new descriptors and entries; nothing else moves.
+ *   - npm hoists the new tree and replaces hoisted packages the app already locks (ws, yaml, zod moved to the CLI's
+ *     versions); with `--install-strategy=nested` it places the new tree under the dependency and moves nothing.
+ *   - pnpm re-resolves the dependencies of every package the new tree shares with the old one to the newest version in the
+ *     graph (47 entries in Rallly, from @smithy/* to express), and no flag stops it. So init lets pnpm resolve the new
+ *     dependency (`--lockfile-only`), keeps every entry the lockfile had, adds the entries only the new dependency
+ *     reaches (mergePnpmLockfile), and installs exactly that (`pnpm install --frozen-lockfile`, which also proves it).
+ * lockfileDrift checks the result for every format init can read, so a package manager that moves anything else fails the
+ * change (and init restores every file).
+ */
+function unquote(text) {
+    if (text.startsWith('\'') && text.endsWith('\''))
+        return text.slice(1, -1).replace(/''/g, '\'');
+    if (text.startsWith('"') && text.endsWith('"'))
+        return JSON.parse(text);
+    return text;
+}
+/** An entry's key line (`  'name@1.0.0(peer@2)':`, `  name@1.0.0: {}`) as its name. */
+function keyOf(line) {
+    return unquote(line.trim().replace(/: \{\}$/, '').replace(/:$/, ''));
+}
+const ENTRY_SECTIONS = new Set(['importers', 'packages', 'snapshots']);
+/** pnpm-lock.yaml as its top-level sections, the importers, packages and snapshots split into entries kept as written. */
+function parseLock(text) {
+    const sections = [];
+    for (const line of text.replace(/\n$/, '').split('\n')) {
+        if (/^\S/.test(line))
+            sections.push({ header: line, entries: null, raw: [] });
+        else if (sections.length === 0)
+            throw new Error('pnpm-lock.yaml does not start with a section');
+        else
+            sections[sections.length - 1].raw.push(line);
+    }
+    for (const section of sections) {
+        if (!ENTRY_SECTIONS.has(section.header.replace(/:$/, '')))
+            continue;
+        const entries = [];
+        for (const line of section.raw) {
+            if (/^ {2}\S/.test(line))
+                entries.push({ name: keyOf(line), lines: [line] });
+            else if (line.trim() !== '') {
+                if (entries.length === 0)
+                    throw new Error(`pnpm-lock.yaml's ${section.header} has a line outside any entry`);
+                entries[entries.length - 1].lines.push(line);
+            }
+        }
+        section.entries = entries;
+    }
+    return sections;
+}
+function formatLock(sections) {
+    const blocks = sections.map(section => {
+        if (section.entries === null)
+            return [section.header, ...section.raw].join('\n');
+        return [section.header, '', section.entries.map(entry => entry.lines.join('\n')).join('\n\n'), ''].join('\n');
+    });
+    return `${blocks.join('\n').replace(/\n+$/, '')}\n`;
+}
+function section(sections, name) {
+    const found = sections.find(item => item.header === `${name}:`);
+    if (!found?.entries)
+        throw new Error(`pnpm-lock.yaml has no ${name} section`);
+    return found.entries;
+}
+/** A snapshot's edges: `dependencies` (required) and `optionalDependencies`, as snapshot keys. */
+function edges(entry) {
+    const out = [];
+    let field = null;
+    for (const line of entry.lines.slice(1)) {
+        const header = /^ {4}(\w+):$/.exec(line);
+        if (header) {
+            field = header[1];
+            continue;
+        }
+        if (/^ {4}\S/.test(line)) {
+            field = null;
+            continue;
+        }
+        const dependency = /^ {6}(.+?): (.+)$/.exec(line);
+        if (!dependency || (field !== 'dependencies' && field !== 'optionalDependencies'))
+            continue;
+        const name = unquote(dependency[1]);
+        const version = unquote(dependency[2]);
+        if (version.startsWith('link:'))
+            continue;
+        // An alias resolves to another package: its value is that package's own key.
+        const key = /^(@[^/@]+\/)?[^@(]+@/.test(version) && !/^\d/.test(version) ? version : `${name}@${version}`;
+        out.push({ key, optional: field === 'optionalDependencies' });
+    }
+    return out;
+}
+/** The snapshot key's package (`name@1.0.0(peer@2)` → `name@1.0.0`). */
+function packageKey(key) {
+    const at = key.indexOf('@', 1);
+    const peers = key.indexOf('(', at);
+    return peers === -1 ? key : key.slice(0, peers);
+}
+/** An importer's dependencies by field (`dependencies:`, `devDependencies:`, …), each entry's lines as written. */
+function importerFields(entry) {
+    const fields = [];
+    for (const line of entry.lines.slice(1)) {
+        const header = /^ {4}(\w+):$/.exec(line);
+        if (header) {
+            fields.push({ field: header[1], dependencies: [] });
+            continue;
+        }
+        const current = fields[fields.length - 1];
+        if (!current)
+            throw new Error(`pnpm-lock.yaml's importer ${entry.name} has a line outside any field`);
+        if (/^ {6}\S/.test(line))
+            current.dependencies.push({ field: current.field, name: keyOf(line.slice(4)), lines: [line] });
+        else if (current.dependencies.length > 0)
+            current.dependencies[current.dependencies.length - 1].lines.push(line);
+        else
+            throw new Error(`pnpm-lock.yaml's importer ${entry.name} has an unexpected ${current.field} line`);
+    }
+    return fields;
+}
+const byName = (a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+function versionOf(dependency) {
+    const line = dependency.lines.find(item => /^ {8}version: /.test(item));
+    if (!line)
+        throw new Error(`pnpm-lock.yaml lists ${dependency.name} with no version`);
+    return unquote(line.trim().slice('version: '.length));
+}
+/** Every snapshot key reachable from `roots` (required edges first: `required` holds those reached without an optional edge). */
+function reach(snapshots, roots) {
+    const all = new Set();
+    const required = new Set();
+    const queue = roots.map(root => ({ ...root }));
+    while (queue.length > 0) {
+        const { key, optional } = queue.shift();
+        if (optional ? all.has(key) : required.has(key))
+            continue;
+        const entry = snapshots.get(key);
+        if (!entry)
+            throw new Error(`pnpm-lock.yaml references ${key}, which it does not list`);
+        all.add(key);
+        if (!optional)
+            required.add(key);
+        for (const edge of edges(entry))
+            queue.push({ key: edge.key, optional: optional || edge.optional });
+    }
+    return { all, required };
+}
+function withOptional(entry, optional) {
+    const body = entry.lines.slice(1).filter(line => line !== '    optional: true');
+    const key = entry.lines[0].replace(/: \{\}$/, ':');
+    if (optional)
+        return { name: entry.name, lines: [key, ...body, '    optional: true'] };
+    return { name: entry.name, lines: body.length === 0 ? [`${key.replace(/:$/, '')}: {}`] : [key, ...body] };
+}
+/**
+ * The lockfile `before` plus exactly what pnpm's own resolution (`after`, from `pnpm add --lockfile-only`) adds for
+ * `dependency` in `importer`: its importer entry, the snapshots and packages only it reaches, and the optional flag
+ * removed from snapshots it now requires; an earlier version of it and what only that reached go. Everything else stays as
+ * `before` had it, so shared packages keep their resolutions (each one satisfies its own ranges already).
+ */
+export function mergePnpmLockfile(before, after, importer, dependency) {
+    const old = parseLock(before);
+    const resolved = parseLock(after);
+    if (formatLock(old) !== before)
+        throw new Error('init cannot rewrite this pnpm-lock.yaml exactly as pnpm wrote it');
+    for (const lock of [old, resolved]) {
+        if (lock[0]?.header !== 'lockfileVersion: \'9.0\'')
+            throw new Error(`init merges pnpm lockfile version 9.0, and this one is ${lock[0]?.header ?? 'empty'}`);
+    }
+    const header = (lock) => lock.filter(item => item.entries === null).map(item => [item.header, ...item.raw].join('\n')).join('\n');
+    if (header(old) !== header(resolved))
+        throw new Error('pnpm changed the lockfile\'s settings while adding the dependency');
+    const oldImporter = section(old, 'importers').find(entry => entry.name === importer);
+    const newImporter = section(resolved, 'importers').find(entry => entry.name === importer);
+    if (!oldImporter || !newImporter)
+        throw new Error(`pnpm-lock.yaml has no importer ${importer}`);
+    const added = importerFields(newImporter).flatMap(item => item.dependencies).find(item => item.name === dependency);
+    if (!added)
+        throw new Error(`pnpm did not add ${dependency} to ${importer}`);
+    const earlier = importerFields(oldImporter).flatMap(item => item.dependencies).find(item => item.name === dependency) ?? null;
+    // The importer: as before, with the dependency in the field pnpm put it in (fields in pnpm's order).
+    const oldFields = importerFields(oldImporter);
+    const order = importerFields(newImporter).map(item => item.field);
+    const fields = [...new Set([...order, ...oldFields.map(item => item.field)])].map(field => {
+        const kept = (oldFields.find(item => item.field === field)?.dependencies ?? []).filter(item => item.name !== dependency);
+        return { field, dependencies: field === added.field ? [...kept, added].sort(byName) : kept };
+    }).filter(item => item.dependencies.length > 0);
+    const importerEntry = { name: importer, lines: [oldImporter.lines[0].replace(/: \{\}$/, ':'), ...fields.flatMap(item => [`    ${item.field}:`, ...item.dependencies.flatMap(dep => dep.lines)])] };
+    // The graph: before's snapshots, then pnpm's for keys before did not have.
+    const oldSnapshots = new Map(section(old, 'snapshots').map(entry => [entry.name, entry]));
+    const newSnapshots = new Map(section(resolved, 'snapshots').map(entry => [entry.name, entry]));
+    const merged = new Map(oldSnapshots);
+    const root = `${dependency}@${versionOf(added)}`;
+    // Walk the new dependency's tree through the merged graph, taking pnpm's entries only where before had none.
+    const queue = [root];
+    const seen = new Set();
+    while (queue.length > 0) {
+        const key = queue.shift();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (!merged.has(key)) {
+            const entry = newSnapshots.get(key);
+            if (!entry)
+                throw new Error(`pnpm's resolution references ${key}, which it does not list`);
+            merged.set(key, entry);
+        }
+        for (const edge of edges(merged.get(key)))
+            queue.push(edge.key);
+    }
+    const fieldOf = { dependencies: false, devDependencies: false, optionalDependencies: true };
+    const ours = reach(merged, [{ key: root, optional: fieldOf[added.field] ?? false }]);
+    for (const key of ours.all) {
+        const entry = merged.get(key);
+        const optional = !ours.required.has(key) && (oldSnapshots.has(key) ? entry.lines.includes('    optional: true') : true);
+        merged.set(key, withOptional(entry, optional));
+    }
+    // An earlier version of the dependency: what only it reached goes, as pnpm would prune it.
+    if (earlier && `${dependency}@${versionOf(earlier)}` !== root) {
+        const importers = section(old, 'importers').map(entry => (entry.name === importer ? importerEntry : entry));
+        const roots = importers.flatMap(entry => importerFields(entry).flatMap(item => item.dependencies
+            .map(dep => ({ dep, version: versionOf(dep) })).filter(({ version }) => !version.startsWith('link:'))
+            .map(({ dep, version }) => ({ key: /^(@[^/@]+\/)?[^@(]+@/.test(version) && !/^\d/.test(version) ? version : `${dep.name}@${version}`,
+            optional: fieldOf[dep.field] ?? false }))));
+        const live = reach(merged, roots).all;
+        for (const key of reach(oldSnapshots, [{ key: `${dependency}@${versionOf(earlier)}`, optional: false }]).all)
+            if (!live.has(key))
+                merged.delete(key);
+    }
+    // Packages: before's, less those only the earlier version's snapshots used, plus pnpm's for the new ones.
+    const used = new Set([...merged.keys()].map(packageKey));
+    const dropped = new Set([...oldSnapshots.keys()].filter(key => !merged.has(key)).map(packageKey).filter(name => !used.has(name)));
+    const oldPackages = section(old, 'packages');
+    const listed = new Set(oldPackages.map(entry => entry.name));
+    const newPackages = new Map(section(resolved, 'packages').map(entry => [entry.name, entry]));
+    const packages = oldPackages.filter(entry => !dropped.has(entry.name));
+    for (const name of used) {
+        if (listed.has(name))
+            continue;
+        const entry = newPackages.get(name);
+        if (!entry)
+            throw new Error(`pnpm's resolution lists no package ${name}`);
+        packages.push(entry);
+    }
+    return formatLock(old.map(item => {
+        if (item.header === 'importers:')
+            return { ...item, entries: section(old, 'importers').map(entry => (entry.name === importer ? importerEntry : entry)) };
+        if (item.header === 'packages:')
+            return { ...item, entries: packages.sort(byName) };
+        if (item.header === 'snapshots:')
+            return { ...item, entries: [...merged.values()].sort(byName) };
+        return item;
+    }));
+}
+/** Entries as keys and their content, per format; the importer's own entry under IMPORTER. */
+const IMPORTER = '\u0000importer';
+function entriesOf(format, text, importer) {
+    const out = new Map();
+    if (format === 'pnpm') {
+        for (const item of parseLock(text)) {
+            if (item.entries === null) {
+                out.set(`header ${item.header}`, item.raw.join('\n'));
+                continue;
+            }
+            for (const entry of item.entries) {
+                const name = item.header === 'importers:' && entry.name === importer ? IMPORTER : `${item.header} ${entry.name}`;
+                // The optional flag is the dependency's to clear (it now requires the package): compared without it.
+                out.set(name, entry.lines.filter(line => line !== '    optional: true').join('\n').replace(/: \{\}$/, ':'));
+            }
+        }
+    }
+    else if (format === 'npm') {
+        const packages = JSON.parse(text).packages ?? {};
+        for (const [key, value] of Object.entries(packages))
+            out.set(key === (importer === '.' ? '' : importer) ? IMPORTER : key, JSON.stringify(value));
+    }
+    else if (format === 'yarn') {
+        for (const block of text.split(/\n\s*\n/)) {
+            const lines = block.split('\n').filter(line => line.trim() !== '' && !line.startsWith('#'));
+            if (lines.length === 0 || /^\s/.test(lines[0]))
+                continue;
+            for (const descriptor of lines[0].replace(/:$/, '').split(/,\s*/)) {
+                const name = unquote(descriptor);
+                out.set(/@workspace:/.test(name) && name.endsWith(`@workspace:${importer}`) ? IMPORTER : name, lines.slice(1).join('\n'));
+            }
+        }
+    }
+    else {
+        const parsed = JSON.parse(text.replace(/,(\s*[}\]])/g, '$1'));
+        for (const [key, value] of Object.entries(parsed.workspaces ?? {}))
+            out.set(key === (importer === '.' ? '' : importer) ? IMPORTER : `workspace ${key}`, JSON.stringify(value));
+        for (const [key, value] of Object.entries(parsed.packages ?? {}))
+            out.set(`package ${key}`, JSON.stringify(value));
+    }
+    return out;
+}
+/** The entries both lockfiles list whose content adding `dependency` to `importer` changed, other than the importer's own
+ * and the dependency's own: what that must never touch. (An entry only an earlier version of the dependency used may go;
+ * a moved resolution always shows in the entries that reference it.) */
+export function lockfileDrift(format, before, after, importer, dependency) {
+    const a = entriesOf(format, before, importer);
+    const b = entriesOf(format, after, importer);
+    return [...a.entries()].filter(([key, value]) => key !== IMPORTER && !key.includes(dependency) && b.has(key) && b.get(key) !== value)
+        .map(([key]) => key);
+}

package/dist/commands/telemetry-token.js

@@ -22,7 +22,7 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import chalk from 'chalk';
 import { resolveAuthContext } from '../utils/auth.js';
-import { classifyHttpError, HaystackApiError } from '../utils/haystack-api.js';
+import { classifyHttpError, HaystackApiError, repoApiPath } from '../utils/haystack-api.js';
 import { gatewayFetch } from './case-batch.js';
 import { TELEMETRY_ENVIRONMENT, TELEMETRY_SERVER_STATUS_PATH, TELEMETRY_TOKEN_PATH, TELEMETRY_TOKEN_SHA256, TELEMETRY_TOKEN_VERSION, } from './capture-contract.js';
 /** GitHub's owner and repository name alphabets. */
@@ -51,7 +51,7 @@ async function confirmed(question) {
 }
 /** GET the repository's server-telemetry status: its active token's hash, the endpoint, the newest flush. */
 export async function readTelemetryServerStatus(repository, token) {
-    const path = `${TELEMETRY_SERVER_STATUS_PATH}?repository=${encodeURIComponent(repository)}`;
+    const path = repoApiPath(repository, TELEMETRY_SERVER_STATUS_PATH);
     const response = await gatewayFetch(path, token);
     if (!response.ok)
         throw await classifyHttpError(response, `Haystack API ${TELEMETRY_SERVER_STATUS_PATH}`);
@@ -199,7 +199,7 @@ async function mintUnderLock(repository, file, authToken, options) {
     let answer;
     try {
         const request = { repository, tokenSha256, rotate: options.rotate === true };
-        const response = await gatewayFetch(`${TELEMETRY_TOKEN_PATH}?repository=${encodeURIComponent(repository)}`, authToken, {
+        const response = await gatewayFetch(repoApiPath(repository, TELEMETRY_TOKEN_PATH), authToken, {
             method: 'POST', body: JSON.stringify(request),
         });
         if (!response.ok)

package/dist/commands/tokens.js

@@ -5,10 +5,10 @@
  *   - `haystack login --headless [--label NAME] [--scope repo:owner/name,...]`
  *       Opens the browser to mint a token via the auth-worker, then writes it
  *       locally so subsequent CLI calls auth via Bearer.
- *   - `haystack tokens list`
+ *   - `haystack auth tokens`
  *       Lists tokens on the server side (the local file only stores ONE
  *       active token at a time; the server may have many tied to your user).
- *   - `haystack tokens revoke <id>`
+ *   - `haystack auth revoke <id>`
  *       Revokes a server-side token. If the revoked token is the one
  *       currently on disk, the local file is wiped so the next CLI call
  *       doesn't keep using a dead token.
@@ -123,12 +123,12 @@ export async function headlessLoginCommand(opts) {
     console.log(`  ${chalk.dim('path:')} ${path}`);
     console.log(`  ${chalk.dim('id:')}   ${result.id}`);
     console.log(chalk.dim('  Subsequent `haystack` calls will use this token.'));
-    console.log(chalk.dim('  Revoke server-side with: haystack tokens revoke ' + result.id));
+    console.log(chalk.dim('  Revoke server-side with: haystack auth revoke ' + result.id));
 }
 export async function headlessLogoutCommand() {
     await clearHeadlessToken();
     console.log(chalk.green('✓ Headless token removed from disk.'));
-    console.log(chalk.dim('  Server-side token is still active. Revoke it with `haystack tokens revoke <id>`.'));
+    console.log(chalk.dim('  Server-side token is still active. Revoke it with `haystack auth revoke <id>`.'));
 }
 export async function listTokensCommand(opts) {
     const token = await loadToken();

package/dist/commands/verify-explore.js

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { resolveAuthContext } from '../utils/auth.js';
-import { haystackJson } from '../utils/haystack-api.js';
+import { haystackJson, repoApiPath } from '../utils/haystack-api.js';
 const RUN_ID = /^cv_[0-9a-f]{48}$/;
 const CASE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 const ACTION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
@@ -27,8 +27,8 @@ async function context(runId, repository) {
     const { token } = await resolveAuthContext({ owner, repo });
     return {
         token,
-        path: `/api/agent/cloud-verifier/runs/${runId}/cases`,
-        query: `?repository=${encodeURIComponent(repository)}`,
+        path: repoApiPath(repository, `/runs/${runId}/cases`),
+        query: '',
     };
 }
 export async function verifyCasesCommand(runId, options) {

package/dist/commands/verify-history.js

@@ -1,5 +1,5 @@
 import { resolveAuthContext } from '../utils/auth.js';
-import { haystackJson, HaystackApiError } from '../utils/haystack-api.js';
+import { haystackJson, HaystackApiError, repoApiPath } from '../utils/haystack-api.js';
 const HEALTH = ['healthy', 'degraded', 'infrastructure-error', 'not-executed', 'unknown'];
 const LIFECYCLES = ['complete', 'failed', 'cancelled', 'budget-stopped', 'account-action'];
 const RUN_ID = /^cv_[0-9a-f]{48}$/;
@@ -139,7 +139,7 @@ export async function verifyHistoryCommand(repository, options) {
     const auth = await resolveAuthContext({ preferredLogin: options.account, owner, repo: name });
     let response;
     try {
-        response = await haystackJson(`/api/agent/cloud-verifier/history/${encodeURIComponent(owner)}/${encodeURIComponent(name)}?limit=${limit}`, auth.token, { method: 'GET' });
+        response = await haystackJson(repoApiPath(`${owner}/${name}`, `/runs?limit=${limit}`), auth.token, { method: 'GET' });
     }
     catch (error) {
         if (error instanceof HaystackApiError && error.status === 404) {

package/dist/commands/verify-onboarding.js

@@ -10,17 +10,14 @@
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { classifyHttpError, readWithRetries, SERVICE_SILENCE_LIMIT_MS, ServiceSilentError, transientReadFailure, } from '../utils/haystack-api.js';
+import { classifyHttpError, readWithRetries, SERVICE_SILENCE_LIMIT_MS, ServiceSilentError, transientReadFailure, repoApiPath, } from '../utils/haystack-api.js';
 import { trackOnboardingEvent } from '../utils/telemetry.js';
 import { gatewayFetch } from './case-batch.js';
 import { ONBOARDING_STAGES, ONBOARDING_VERSION, } from './onboarding-contract.js';
 import { sameNotes } from './onboarding-notes.js';
 import { deriveBaseSha, EXPLICIT_WALL_MS, resolveOriginRepository } from './verify-precompute.js';
 import { findGitRoot } from '../utils/hooks.js';
-const ONBOARDING_PATH = '/api/agent/cloud-verifier/onboarding';
-const FACTS_PATH = `${ONBOARDING_PATH}/facts`;
-const ANSWERS_PATH = `${ONBOARDING_PATH}/answers`;
-const NOTES_PATH = `${ONBOARDING_PATH}/notes`;
+const onboardingPath = (repository, rest = '') => repoApiPath(repository, `/onboarding${rest}`);
 const ONBOARD_RUN_ID = /^ob_[0-9a-f]{48}$/;
 const SHA256 = /^[0-9a-f]{64}$/;
 const COMMIT = /^[0-9a-f]{40}$/;
@@ -155,11 +152,11 @@ async function body(response, what) {
 export async function readOnboardingStatus(repository, baseCommit, token, onboardRunId = null) {
     if (!COMMIT.test(baseCommit))
         throw new Error(`Invalid base commit ${baseCommit}.`);
-    const path = `${ONBOARDING_PATH}?repository=${encodeURIComponent(repository)}&baseCommit=${baseCommit}`
-        + (onboardRunId === null ? '' : `&onboardRunId=${encodeURIComponent(onboardRunId)}`);
+    const path = onboardingPath(repository, `?base=${baseCommit}`)
+        + (onboardRunId === null ? '' : `&run=${encodeURIComponent(onboardRunId)}`);
     const response = await gatewayFetch(path, token);
     if (!response.ok)
-        throw await classifyHttpError(response, `Haystack API ${ONBOARDING_PATH}`);
+        throw await classifyHttpError(response, `Haystack API ${path}`);
     return parseOnboardingStatus(await body(response, 'a status'), { repository, baseCommit });
 }
 /** Rule 12's start POST: onboard this base now, before any change exists. Idempotent: a
@@ -167,11 +164,11 @@ export async function readOnboardingStatus(repository, baseCommit, token, onboar
 export async function startOnboarding(repository, baseCommit, token) {
     if (!COMMIT.test(baseCommit))
         throw new Error(`Invalid base commit ${baseCommit}.`);
-    const response = await gatewayFetch(`${ONBOARDING_PATH}?repository=${encodeURIComponent(repository)}`, token, {
+    const response = await gatewayFetch(onboardingPath(repository), token, {
         method: 'POST', body: JSON.stringify({ repository, baseCommit }),
     });
     if (!response.ok)
-        throw await classifyHttpError(response, `Haystack API ${ONBOARDING_PATH}`);
+        throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository)}`);
     return parseOnboardingStatus(await body(response, 'a status'), { repository, baseCommit });
 }
 /** How often a command reads onboarding status while it runs. The status route holds no read (a crawl's reads wait for a
@@ -357,9 +354,9 @@ function repositoryOf(value) {
     return `${origin.owner}/${origin.repository}`;
 }
 export async function readFacts(repository, token) {
-    const response = await gatewayFetch(`${FACTS_PATH}?repository=${encodeURIComponent(repository)}`, token);
+    const response = await gatewayFetch(onboardingPath(repository, '/facts'), token);
     if (!response.ok)
-        throw await classifyHttpError(response, `Haystack API ${FACTS_PATH}`);
+        throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository, '/facts')}`);
     return parseFactsView(await body(response, 'facts'), repository);
 }
 /** `haystack verify answer <question-id> <choice>`: files the answer to an open
@@ -379,7 +376,7 @@ export async function verifyAnswerCommand(questionId, choice, options) {
         if (!question.choices.includes(choice)) {
             throw new Error(`"${choice}" is not one of the question's choices: ${question.choices.map(item => JSON.stringify(item)).join(', ')}.`);
         }
-        const response = await gatewayFetch(`${ANSWERS_PATH}?repository=${encodeURIComponent(repository)}`, auth.token, {
+        const response = await gatewayFetch(onboardingPath(repository, '/answers'), auth.token, {
             method: 'POST', body: JSON.stringify({ repository, expectedFactsDigest: facts.factsDigest, questionId, answer: choice }),
         });
         if (response.status === 409 && attempt < 3) {
@@ -387,7 +384,7 @@ export async function verifyAnswerCommand(questionId, choice, options) {
             continue;
         }
         if (!response.ok)
-            throw await classifyHttpError(response, `Haystack API ${ANSWERS_PATH}`);
+            throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository, '/answers')}`);
         const view = parseFactsView(await body(response, 'facts'), repository);
         if (options.json) {
             process.stdout.write(`${JSON.stringify(withSchema('verify-answer', { facts: view }), null, 2)}\n`);
@@ -407,7 +404,7 @@ export async function writeOnboardingNotes(repository, notes, token) {
         if (sameNotes(facts.facts.notes, notes))
             return 'unchanged';
         const request = { repository, expectedFactsDigest: facts.factsDigest, notes };
-        const response = await gatewayFetch(`${NOTES_PATH}?repository=${encodeURIComponent(repository)}`, token, {
+        const response = await gatewayFetch(onboardingPath(repository, '/notes'), token, {
             method: 'POST', body: JSON.stringify(request),
         });
         if (response.status === 409 && attempt < 3) {
@@ -415,7 +412,7 @@ export async function writeOnboardingNotes(repository, notes, token) {
             continue;
         }
         if (!response.ok)
-            throw await classifyHttpError(response, `Haystack API ${NOTES_PATH}`);
+            throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository, '/notes')}`);
         if (!sameNotes(parseFactsView(await body(response, 'facts'), repository).facts.notes, notes))
             invalid('the notes it answered with');
         return 'written';

package/dist/commands/verify-precompute.js

@@ -8,7 +8,7 @@ import chalk from 'chalk';
 import { NotLoggedInError, resolveAuthContext } from '../utils/auth.js';
 import { findGitRoot, parseRemoteUrl, } from '../utils/git.js';
 import { resolveVerifyBaseSha } from '../utils/verify-base.js';
-import { HaystackApiError, haystackFetch, haystackJson, REPO_NOT_ENTITLED_CODE, SUBSCRIPTION_REQUIRED_CODE, } from '../utils/haystack-api.js';
+import { HaystackApiError, haystackFetch, haystackJson, REPO_NOT_ENTITLED_CODE, SUBSCRIPTION_REQUIRED_CODE, repoApiPath, } from '../utils/haystack-api.js';
 import { trackPrecomputeEvent } from '../utils/telemetry.js';
 import { findSecretsInPatch, isSecretBearingPath } from '../utils/secret-paths.js';
 import { startPrecomputeDelivery } from './precompute-delivery.js';
@@ -325,8 +325,7 @@ function precomputeResult(response) {
  * service no longer has it). */
 async function uploadSourcePatch(request, token, signal, force = false) {
     const gzipped = Buffer.from(request.patchGzBase64, 'base64');
-    const path = `/api/agent/cloud-verifier/source-patches/${request.patchSha256}`
-        + `?owner=${encodeURIComponent(request.owner)}&repository=${encodeURIComponent(request.repository)}`;
+    const path = repoApiPath(`${request.owner}/${request.repository}`, `/patches/${request.patchSha256}`);
     const found = force ? null : await haystackFetch(path, token, { method: 'HEAD', signal }, [404]);
     if (found === null || found.status === 404) {
         await haystackFetch(path, token, { method: 'PUT', headers: { 'Content-Type': 'application/gzip' }, body: gzipped, signal });
@@ -339,7 +338,7 @@ async function submitCapture(request, token, signal) {
     const { patchGzBase64: _inline, ...named } = request;
     const submit = async (force) => {
         const patchBytes = await uploadSourcePatch(request, token, signal, force);
-        return haystackJson('/api/agent/cloud-verifier/front-half', token, { method: 'POST',
+        return haystackJson(repoApiPath(`${request.owner}/${request.repository}`, '/checks'), token, { method: 'POST',
             headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ ...named, patchBytes }), signal });
     };
     try {