@haystackeditor/cli 0.26.0 → 0.27.0

package/README.md

@@ -151,14 +151,6 @@ Exit codes: 0 set up, 1 failed, 2 changes shown but not made, 3 onboarding
 blocked, 4 not logged in, 5 the Haystack GitHub App is not installed, 6 set up
 but onboarding stopped before finishing (run it again).
 
-### `haystack status`
-
-Check if your project is configured:
-
-```bash
-haystack status
-```
-
 ### `haystack login`
 
 Authenticate with GitHub (required for setup and secrets):

package/dist/capture/app-config.js

@@ -16,7 +16,7 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join, posix } from 'node:path';
 import { CAPTURE_KEY_PATTERN, CAPTURE_STATUS_PATH, CAPTURE_VERSION } from '../commands/capture-contract.js';
-import { haystackFetch, haystackJson } from '../utils/haystack-api.js';
+import { haystackFetch, haystackJson, repoApiPath } from '../utils/haystack-api.js';
 export const CAPTURE_CONFIG_PATH = '.haystack/capture.json';
 export function captureConfigFile(appDir) {
     return join(appDir, CAPTURE_CONFIG_PATH);
@@ -100,8 +100,8 @@ export function parseOrigins(given) {
 /** Registers the application and its production origins (rule 8b): POST /api/agent/cloud-verifier/capture/key, a
  * repository member's call, idempotent (the same application gets the same key; new origins replace the old). */
 export async function registerCaptureApp(token, repository, app, origins) {
-    const query = new URLSearchParams({ repository, app });
-    const response = await haystackJson(`/api/agent/cloud-verifier/capture/key?${query}`, token, {
+    const query = new URLSearchParams({ app });
+    const response = await haystackJson(repoApiPath(repository, `/capture/key?${query}`), token, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ origins }),
@@ -116,8 +116,8 @@ export async function registerCaptureApp(token, repository, app, origins) {
 /** The application's registration as Haystack holds it now (GET /api/agent/cloud-verifier/capture/status, lane A): its key
  * and production origins, or null when the application is not registered (404). */
 export async function readCaptureRegistration(token, repository, app) {
-    const query = new URLSearchParams({ repository, app });
-    const response = await haystackFetch(`${CAPTURE_STATUS_PATH}?${query}`, token, {}, [404]);
+    const query = new URLSearchParams({ app });
+    const response = await haystackFetch(repoApiPath(repository, `${CAPTURE_STATUS_PATH}?${query}`), token, {}, [404]);
     if (response.status === 404) {
         await response.body?.cancel();
         return null;

package/dist/commands/capture-brief.js

@@ -7,7 +7,7 @@
 import { join, posix } from 'node:path';
 import chalk from 'chalk';
 import { CAPTURE_CONFIG_PATH, captureConfigDirs, readCaptureConfig } from '../capture/app-config.js';
-import { classifyHttpError } from '../utils/haystack-api.js';
+import { classifyHttpError, repoApiPath } from '../utils/haystack-api.js';
 import { gatewayFetch } from './case-batch.js';
 import { CAPTURE_APPLICATION_ID, CAPTURE_WINDOW_PATH, captureChangedRoutes, } from './capture-contract.js';
 /** An app's application id from its record, or why the record cannot give one. */
@@ -34,9 +34,10 @@ async function readApp(gitRoot, app, repository, token, files, now) {
         return { app, applicationId: null, state: 'unavailable', reason: application.unreadable };
     const { applicationId } = application;
     try {
-        const response = await gatewayFetch(`${CAPTURE_WINDOW_PATH}?repository=${encodeURIComponent(repository)}&app=${encodeURIComponent(applicationId)}`, token);
+        const path = repoApiPath(repository, `${CAPTURE_WINDOW_PATH}?app=${encodeURIComponent(applicationId)}`);
+        const response = await gatewayFetch(path, token);
         if (!response.ok)
-            throw await classifyHttpError(response, `Haystack API ${CAPTURE_WINDOW_PATH}`);
+            throw await classifyHttpError(response, `Haystack API ${path}`);
         const answer = await response.json();
         if (answer.version !== 'capture-v1' || answer.applicationId !== applicationId)
             throw new Error('the capture window answer names another application');

package/dist/commands/capture-contract.js

@@ -10,7 +10,7 @@ export const CAPTURE_SCRIPT_MAX_BYTES = 8 * 1024;
 export const CAPTURE_ROUTE_ID_MAX = 200;
 /** Rule 4 Publishing: the largest route manifest (current.json and <release>.json), in bytes. */
 export const CAPTURE_MANIFEST_MAX_BYTES = 256 * 1024;
-export const CAPTURE_WINDOW_PATH = '/api/agent/cloud-verifier/capture/window';
+export const CAPTURE_WINDOW_PATH = '/capture/window';
 /** Rule 8(e): telemetry older than this is reported stale; rule 7b: a capture window older than this is stale. */
 export const CAPTURE_EVIDENCE_FRESH_HOURS = 24;
 export const CAPTURE_ROUTE_UNKNOWN = 'unknown';
@@ -39,8 +39,8 @@ export function captureChangedRoutes(window, files, now) {
 }
 export const TELEMETRY_TOKEN_VERSION = 'telemetry-token-v1';
 export const TELEMETRY_ENVIRONMENT = 'production';
-export const TELEMETRY_TOKEN_PATH = '/api/agent/cloud-verifier/telemetry/token';
-export const TELEMETRY_SERVER_STATUS_PATH = '/api/agent/cloud-verifier/telemetry/server';
+export const TELEMETRY_TOKEN_PATH = '/telemetry/token';
+export const TELEMETRY_SERVER_STATUS_PATH = '/telemetry/server';
 export const TELEMETRY_TOKEN_SHA256 = /^[0-9a-f]{64}$/;
 /** Lane A's capture status: GET /api/agent/cloud-verifier/capture/status?repository=&app= (rule 8b's key registration). */
-export const CAPTURE_STATUS_PATH = '/api/agent/cloud-verifier/capture/status';
+export const CAPTURE_STATUS_PATH = '/capture/status';

package/dist/commands/crawl-report.js

@@ -0,0 +1,196 @@
+export const TERMINAL = new Set(['completed', 'prepared', 'incomplete', 'cancelled']);
+export const VERDICTS = ['bug', 'cant-tell', 'being-judged', 'not-a-bug'];
+export const STATUS_WORDS = {
+    queued: 'waiting for a machine',
+    preparing: 'getting ready',
+    crawling: 'exploring the app',
+    draining: 'finishing the last checks',
+    completed: 'finished',
+    prepared: 'built and ready to check',
+    incomplete: 'stopped before finishing',
+    cancelled: 'cancelled',
+};
+export const STAGE_WORDS = {
+    reconcile: 'cleaning up after an earlier try',
+    source: 'rebuilding your change',
+    worlds: 'building and starting the app with and without your change',
+    blast: 'waiting for the analysis of what your change touches',
+    knobs: "reading the app's settings",
+    prepare: 'setting up starting points next to your change',
+    crawl: 'exploring the app',
+    publish: 'saving the results',
+    cleanup: 'shutting down the machines it used',
+};
+export const ERROR_WORDS = {
+    'source-mismatch': 'your change could not be rebuilt exactly as it was captured',
+    'blast-unavailable': 'the analysis of what your change touches was not available',
+    'world-build-failed': 'the app did not build or start, with or without your change',
+    'prepare-failed': 'setting up starting points next to your change failed',
+    'crawl-failed': 'exploring the app failed',
+    'no-capacity': 'there was no room on the machines for it',
+    stalled: 'it stopped making progress',
+    'lease-lost': 'the machine running it stopped responding',
+    cancelled: 'it was cancelled',
+};
+export const SPOT_WORDS = {
+    resolved: 'never reached',
+    loaded: 'loaded but never ran',
+    exposed: 'shown on screen',
+    activated: 'ran',
+    pressed: 'ran when its control was pressed',
+    observed: 'a difference seen',
+    confirmed: 'a difference seen and confirmed',
+    // The stage, not the verdict: a judged difference may be judged not a bug. The findings carry the verdicts.
+    judged: 'a difference seen, confirmed and judged',
+};
+export const VERDICT_WORDS = {
+    bug: 'Bug',
+    'cant-tell': "Can't tell",
+    'being-judged': 'Still being judged',
+    'not-a-bug': 'Not a bug',
+};
+export function plural(count, noun) {
+    return `${count} ${noun}${count === 1 ? '' : 's'}`;
+}
+export function errorWords(error) {
+    return error.code === 'stalled'
+        ? `${ERROR_WORDS.stalled} while ${STAGE_WORDS[error.stage]}`
+        : ERROR_WORDS[error.code];
+}
+/** What a running crawl is doing now: its stage, except while it waits for a
+ * machine or finishes its last checks, which its status says better. */
+export function currentStep(view) {
+    return view.status === 'queued' || view.status === 'draining' ? STATUS_WORDS[view.status] : STAGE_WORDS[view.stage];
+}
+/** The crawl's results: its sealed manifest, else (amendment 9) its answer at the budget, which has the same findings and reach. */
+export function results(view) {
+    return view.manifest ?? (view.answer?.status === 'answered' ? view.answer : null);
+}
+/** The status the command reports: a running crawl that has answered (amendment 9: its budget is up and its work is
+ * done; only its shutdown remains) reads as completed. */
+export function reportedStatus(view) {
+    return !TERMINAL.has(view.status) && view.answer?.status === 'answered' ? 'completed' : view.status;
+}
+export function headline(view) {
+    const bugs = results(view)?.bugs ?? view.totals.bugs;
+    const found = bugs > 0 ? ` It found ${plural(bugs, 'bug')} before it stopped.` : '';
+    switch (reportedStatus(view)) {
+        case 'completed':
+            return bugs > 0 ? `Found ${plural(bugs, 'bug')} in your change.` : 'No bugs found in your change.';
+        case 'incomplete': {
+            const error = results(view)?.error ?? view.error;
+            return `The crawl could not finish: ${error ? errorWords(error) : 'no reason was recorded'}.${found}`;
+        }
+        case 'prepared':
+            // Amendment 12: the turn-end hook built and froze this change; `haystack verify` asks for the crawl itself.
+            return 'Your change is built and ready to check, but was not crawled yet. Run `haystack verify` to check it.';
+        case 'cancelled':
+            return `The crawl was cancelled.${found}`;
+        default: {
+            const so = bugs > 0 ? ` ${plural(bugs, 'bug')} found so far.` : '';
+            if (view.cancelRequested) {
+                return `Being cancelled: ${currentStep(view)}.${so}`;
+            }
+            return `Still running: ${currentStep(view)}.${so}`;
+        }
+    }
+}
+export function verifyReport(view) {
+    const status = reportedStatus(view);
+    const published = results(view);
+    const error = published?.error ?? view.error;
+    const explored = published !== null && view.clocks.crawlStartedAt !== null;
+    const findings = explored ? VERDICTS.flatMap(verdict => published.findings.filter(finding => finding.verdict === verdict)) : [];
+    const ideaWords = { covered: 'tried', blocked: 'could not try', unfinished: 'not finished' };
+    return {
+        runId: view.runId,
+        repository: view.repository,
+        title: view.changeTitle,
+        baseCommit: view.baseCommit,
+        workCommit: view.workCommit,
+        status,
+        headline: headline(view),
+        bugs: published?.bugs ?? view.totals.bugs,
+        findings: findings.map(finding => ({
+            id: finding.id,
+            verdict: finding.verdict,
+            why: finding.why,
+            start: finding.start,
+            steps: finding.steps,
+            outsideServices: finding.standIns && (finding.standIns.old.length > 0 || finding.standIns.new.length > 0)
+                ? { withoutChange: finding.standIns.old, withChange: finding.standIns.new }
+                : null,
+        })),
+        spots: explored ? published.reach.spots.map(spot => ({
+            file: spot.file,
+            line: spot.line,
+            reached: spot.furthest === null ? 'never reached' : SPOT_WORDS[spot.furthest],
+            reachedBy: spot.reachedBy && { start: spot.reachedBy.start, steps: spot.reachedBy.steps, page: spot.reachedBy.page },
+            findingIds: spot.findingIds,
+        })) : [],
+        ideas: explored && published.ideas !== undefined
+            ? published.ideas.map(idea => ({ text: idea.text, result: ideaWords[idea.state], reason: idea.reason, findingIds: idea.findingIds }))
+            : null,
+        neverRan: explored ? {
+            files: published.reach.unreachedChangedFiles,
+            functions: published.reach.blast === null ? null : { ran: published.reach.blast.ran, total: published.reach.blast.functions },
+        } : null,
+        notFinishedInTime: explored ? published.notFinishedInTime : 0,
+        outsideServiceGaps: explored ? published.standIns?.gaps ?? [] : [],
+        error: error ? { code: error.code, message: error.message } : null,
+        machinesNotProvenShutDown: TERMINAL.has(view.status) ? view.totals.cleanupUnproven : 0,
+    };
+}
+/** The report as markdown: headings an agent can navigate, bugs first, each with the steps to see it. */
+export function reportMarkdown(report) {
+    const lines = [`# ${report.headline}`, '',
+        `Change: ${report.title}`, `Check ${report.runId} of ${report.repository}: base ${report.baseCommit.slice(0, 12)}, change ${report.workCommit.slice(0, 12)}.`];
+    if (report.error && report.status !== 'completed')
+        lines.push(`Details: ${report.error.message}`);
+    if (report.neverRan === null) {
+        lines.push('', TERMINAL.has(report.status)
+            ? 'Nothing about the change was measured: the crawl did not explore the app.'
+            : 'Where the change shows up, and what the crawl found, appear when it finishes.');
+        return lines.join('\n') + '\n';
+    }
+    lines.push('', '## Where the change shows up in the app');
+    if (report.spots.length === 0)
+        lines.push('No changed spots were recorded.');
+    for (const spot of report.spots) {
+        lines.push(`- \`${spot.file}:${spot.line}\`: ${spot.reached}${spot.findingIds.length ? ` (${plural(spot.findingIds.length, 'finding')})` : ''}`);
+        if (spot.reachedBy)
+            lines.push(`  - reached by: ${[spot.reachedBy.start, ...spot.reachedBy.steps].join(' > ')}${spot.reachedBy.page ? ` (page ${spot.reachedBy.page})` : ''}`);
+    }
+    lines.push('', '## What the crawl found');
+    if (report.findings.length === 0)
+        lines.push('No confirmed differences between the app with and without the change.');
+    report.findings.forEach((finding, index) => {
+        lines.push(`${index + 1}. **${VERDICT_WORDS[finding.verdict]}** (\`${finding.id}\`): ${finding.why ?? 'no reason was recorded.'}`, `   Starting from ${finding.start}:`, ...finding.steps.map((step, n) => `   ${n + 1}. ${step}`));
+        if (finding.outsideServices) {
+            lines.push(`   Outside services on this path, answered by stand-ins: without the change ${finding.outsideServices.withoutChange.join('; ') || 'none'};`
+                + ` with it ${finding.outsideServices.withChange.join('; ') || 'none'}.`);
+        }
+    });
+    if (report.notFinishedInTime > 0) {
+        lines.push(`${plural(report.notFinishedInTime, 'difference')} ${report.notFinishedInTime === 1 ? 'was' : 'were'} still being checked when its time ran out.`);
+    }
+    if (report.ideas !== null) {
+        lines.push('', '## Your ideas');
+        for (const idea of report.ideas)
+            lines.push(`- ${idea.result}: ${idea.text}. ${idea.reason}`);
+    }
+    lines.push('', '## What the crawl never ran');
+    if (report.neverRan.files.length === 0)
+        lines.push('Every changed file ran at least once.');
+    else
+        lines.push('Changed files no path ran:', ...report.neverRan.files.map(file => `- \`${file}\``));
+    if (report.neverRan.functions)
+        lines.push(`${report.neverRan.functions.ran} of ${plural(report.neverRan.functions.total, 'affected function')} ran.`);
+    if (report.outsideServiceGaps.length > 0) {
+        lines.push('', '## Outside services the copy could not imitate', 'Missing coverage of the environment, not bugs in the change:', ...report.outsideServiceGaps.map(gap => `- ${gap}`));
+    }
+    if (report.machinesNotProvenShutDown > 0) {
+        lines.push('', `${plural(report.machinesNotProvenShutDown, 'machine')} it used could not be proven shut down.`);
+    }
+    return lines.join('\n') + '\n';
+}

package/dist/commands/db-profile-upload.js

@@ -14,8 +14,8 @@ import chalk from 'chalk';
 import { DATABASE_PROFILE_UPLOAD_REQUEST_VERSION, parseDatabaseProfileUpload, } from './db-profile-contract.js';
 import { readDatabaseProfileFile } from './db-profile-show.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { classifyHttpError, haystackApiUrl, readWithRetries, transientReadFailure } from '../utils/haystack-api.js';
-export const DATABASE_PROFILES_PATH = '/api/agent/cloud-verifier/database-profiles';
+import { classifyHttpError, haystackApiUrl, readWithRetries, transientReadFailure, repoApiPath } from '../utils/haystack-api.js';
+export const DATABASE_PROFILES_PATH = '/database-profiles';
 /** GitHub's owner and repository name alphabets. */
 const REPOSITORY = /^([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))\/([A-Za-z0-9_.-]{1,100})$/u;
 /** Run-map dependency ids are stable kebab-case ids (the same check as
@@ -60,7 +60,7 @@ export async function uploadDatabaseProfile(request, token) {
     }
 }
 async function uploadDatabaseProfileOnce(request, token) {
-    const response = await fetch(haystackApiUrl(DATABASE_PROFILES_PATH), {
+    const response = await fetch(haystackApiUrl(repoApiPath(request.repository, DATABASE_PROFILES_PATH)), {
         method: 'POST',
         headers: {
             Authorization: `Bearer ${token}`,

package/dist/commands/feedback.js

@@ -53,7 +53,7 @@ export async function feedbackCommand(words, options) {
     const message = words.length === 1 && words[0] === '-' ? readFileSync(0, 'utf8') : words.join(' ');
     const request = buildFeedbackRequest(message, options, currentRepository());
     const { token } = await resolveAuthContext({ preferredLogin: options.account });
-    await haystackJson('/api/cli/feedback', token, {
+    await haystackJson('/v1/feedback', token, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(request),

package/dist/commands/init-telemetry.js

@@ -26,7 +26,7 @@ import { createRequire } from 'node:module';
 import { dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import chalk from 'chalk';
-import { classifyHttpError } from '../utils/haystack-api.js';
+import { classifyHttpError, repoApiPath } from '../utils/haystack-api.js';
 import { gatewayFetch } from './case-batch.js';
 import { CAPTURE_EVIDENCE_FRESH_HOURS, CAPTURE_STATUS_PATH, } from './capture-contract.js';
 import { captureAnswers, planCapture } from './init-capture.js';
@@ -961,7 +961,7 @@ async function readJson(path, token) {
 }
 /** Lane A's registration of the application: its newest capture event, or null when it is not registered (404) or has none. */
 async function captureReceived(repository, app, token) {
-    const status = await readJson(`${CAPTURE_STATUS_PATH}?repository=${encodeURIComponent(repository)}&app=${encodeURIComponent(app)}`, token);
+    const status = await readJson(repoApiPath(repository, `${CAPTURE_STATUS_PATH}?app=${encodeURIComponent(app)}`), token);
     return status === null ? null : received(status.lastSeenAt, status.release);
 }
 function withReceived(part, evidence) {

package/dist/commands/init.js

@@ -56,7 +56,7 @@ export const AGENT_NOTE = [
     '  `haystack verify answer <question-id> <choice>`.',
     '- Read its short report. `--json` prints the same report as data; `--raw` prints the crawl\'s whole record (large), for scripts;',
     '  `haystack verify --help` explains the output and exit codes.',
-    '- If `haystack` is not installed, run each command as `npx -y @haystackeditor/cli@latest <command>`.',
+    '- If `haystack` is not installed, run each command as `npx -y -p @haystackeditor/cli@latest haystack <command>`.',
     '- If Haystack fails, confuses you or gets in your way, say so in a sentence with',
     '  `haystack feedback "<what happened>"` and keep going: the Haystack team sees it at once.',
     NOTE_END,

package/dist/commands/telemetry-token.js

@@ -22,7 +22,7 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import chalk from 'chalk';
 import { resolveAuthContext } from '../utils/auth.js';
-import { classifyHttpError, HaystackApiError } from '../utils/haystack-api.js';
+import { classifyHttpError, HaystackApiError, repoApiPath } from '../utils/haystack-api.js';
 import { gatewayFetch } from './case-batch.js';
 import { TELEMETRY_ENVIRONMENT, TELEMETRY_SERVER_STATUS_PATH, TELEMETRY_TOKEN_PATH, TELEMETRY_TOKEN_SHA256, TELEMETRY_TOKEN_VERSION, } from './capture-contract.js';
 /** GitHub's owner and repository name alphabets. */
@@ -51,7 +51,7 @@ async function confirmed(question) {
 }
 /** GET the repository's server-telemetry status: its active token's hash, the endpoint, the newest flush. */
 export async function readTelemetryServerStatus(repository, token) {
-    const path = `${TELEMETRY_SERVER_STATUS_PATH}?repository=${encodeURIComponent(repository)}`;
+    const path = repoApiPath(repository, TELEMETRY_SERVER_STATUS_PATH);
     const response = await gatewayFetch(path, token);
     if (!response.ok)
         throw await classifyHttpError(response, `Haystack API ${TELEMETRY_SERVER_STATUS_PATH}`);
@@ -199,7 +199,7 @@ async function mintUnderLock(repository, file, authToken, options) {
     let answer;
     try {
         const request = { repository, tokenSha256, rotate: options.rotate === true };
-        const response = await gatewayFetch(`${TELEMETRY_TOKEN_PATH}?repository=${encodeURIComponent(repository)}`, authToken, {
+        const response = await gatewayFetch(repoApiPath(repository, TELEMETRY_TOKEN_PATH), authToken, {
             method: 'POST', body: JSON.stringify(request),
         });
         if (!response.ok)

package/dist/commands/tokens.js

@@ -5,10 +5,10 @@
  *   - `haystack login --headless [--label NAME] [--scope repo:owner/name,...]`
  *       Opens the browser to mint a token via the auth-worker, then writes it
  *       locally so subsequent CLI calls auth via Bearer.
- *   - `haystack tokens list`
+ *   - `haystack auth tokens`
  *       Lists tokens on the server side (the local file only stores ONE
  *       active token at a time; the server may have many tied to your user).
- *   - `haystack tokens revoke <id>`
+ *   - `haystack auth revoke <id>`
  *       Revokes a server-side token. If the revoked token is the one
  *       currently on disk, the local file is wiped so the next CLI call
  *       doesn't keep using a dead token.
@@ -123,12 +123,12 @@ export async function headlessLoginCommand(opts) {
     console.log(`  ${chalk.dim('path:')} ${path}`);
     console.log(`  ${chalk.dim('id:')}   ${result.id}`);
     console.log(chalk.dim('  Subsequent `haystack` calls will use this token.'));
-    console.log(chalk.dim('  Revoke server-side with: haystack tokens revoke ' + result.id));
+    console.log(chalk.dim('  Revoke server-side with: haystack auth revoke ' + result.id));
 }
 export async function headlessLogoutCommand() {
     await clearHeadlessToken();
     console.log(chalk.green('✓ Headless token removed from disk.'));
-    console.log(chalk.dim('  Server-side token is still active. Revoke it with `haystack tokens revoke <id>`.'));
+    console.log(chalk.dim('  Server-side token is still active. Revoke it with `haystack auth revoke <id>`.'));
 }
 export async function listTokensCommand(opts) {
     const token = await loadToken();

package/dist/commands/verify-explore.js

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { resolveAuthContext } from '../utils/auth.js';
-import { haystackJson } from '../utils/haystack-api.js';
+import { haystackJson, repoApiPath } from '../utils/haystack-api.js';
 const RUN_ID = /^cv_[0-9a-f]{48}$/;
 const CASE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 const ACTION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
@@ -27,8 +27,8 @@ async function context(runId, repository) {
     const { token } = await resolveAuthContext({ owner, repo });
     return {
         token,
-        path: `/api/agent/cloud-verifier/runs/${runId}/cases`,
-        query: `?repository=${encodeURIComponent(repository)}`,
+        path: repoApiPath(repository, `/runs/${runId}/cases`),
+        query: '',
     };
 }
 export async function verifyCasesCommand(runId, options) {

package/dist/commands/verify-history.js

@@ -1,5 +1,5 @@
 import { resolveAuthContext } from '../utils/auth.js';
-import { haystackJson, HaystackApiError } from '../utils/haystack-api.js';
+import { haystackJson, HaystackApiError, repoApiPath } from '../utils/haystack-api.js';
 const HEALTH = ['healthy', 'degraded', 'infrastructure-error', 'not-executed', 'unknown'];
 const LIFECYCLES = ['complete', 'failed', 'cancelled', 'budget-stopped', 'account-action'];
 const RUN_ID = /^cv_[0-9a-f]{48}$/;
@@ -139,7 +139,7 @@ export async function verifyHistoryCommand(repository, options) {
     const auth = await resolveAuthContext({ preferredLogin: options.account, owner, repo: name });
     let response;
     try {
-        response = await haystackJson(`/api/agent/cloud-verifier/history/${encodeURIComponent(owner)}/${encodeURIComponent(name)}?limit=${limit}`, auth.token, { method: 'GET' });
+        response = await haystackJson(repoApiPath(`${owner}/${name}`, `/runs?limit=${limit}`), auth.token, { method: 'GET' });
     }
     catch (error) {
         if (error instanceof HaystackApiError && error.status === 404) {

package/dist/commands/verify-onboarding.js

@@ -10,17 +10,14 @@
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { classifyHttpError, readWithRetries, SERVICE_SILENCE_LIMIT_MS, ServiceSilentError, transientReadFailure, } from '../utils/haystack-api.js';
+import { classifyHttpError, readWithRetries, SERVICE_SILENCE_LIMIT_MS, ServiceSilentError, transientReadFailure, repoApiPath, } from '../utils/haystack-api.js';
 import { trackOnboardingEvent } from '../utils/telemetry.js';
 import { gatewayFetch } from './case-batch.js';
 import { ONBOARDING_STAGES, ONBOARDING_VERSION, } from './onboarding-contract.js';
 import { sameNotes } from './onboarding-notes.js';
 import { deriveBaseSha, EXPLICIT_WALL_MS, resolveOriginRepository } from './verify-precompute.js';
 import { findGitRoot } from '../utils/hooks.js';
-const ONBOARDING_PATH = '/api/agent/cloud-verifier/onboarding';
-const FACTS_PATH = `${ONBOARDING_PATH}/facts`;
-const ANSWERS_PATH = `${ONBOARDING_PATH}/answers`;
-const NOTES_PATH = `${ONBOARDING_PATH}/notes`;
+const onboardingPath = (repository, rest = '') => repoApiPath(repository, `/onboarding${rest}`);
 const ONBOARD_RUN_ID = /^ob_[0-9a-f]{48}$/;
 const SHA256 = /^[0-9a-f]{64}$/;
 const COMMIT = /^[0-9a-f]{40}$/;
@@ -155,11 +152,11 @@ async function body(response, what) {
 export async function readOnboardingStatus(repository, baseCommit, token, onboardRunId = null) {
     if (!COMMIT.test(baseCommit))
         throw new Error(`Invalid base commit ${baseCommit}.`);
-    const path = `${ONBOARDING_PATH}?repository=${encodeURIComponent(repository)}&baseCommit=${baseCommit}`
-        + (onboardRunId === null ? '' : `&onboardRunId=${encodeURIComponent(onboardRunId)}`);
+    const path = onboardingPath(repository, `?base=${baseCommit}`)
+        + (onboardRunId === null ? '' : `&run=${encodeURIComponent(onboardRunId)}`);
     const response = await gatewayFetch(path, token);
     if (!response.ok)
-        throw await classifyHttpError(response, `Haystack API ${ONBOARDING_PATH}`);
+        throw await classifyHttpError(response, `Haystack API ${path}`);
     return parseOnboardingStatus(await body(response, 'a status'), { repository, baseCommit });
 }
 /** Rule 12's start POST: onboard this base now, before any change exists. Idempotent: a
@@ -167,11 +164,11 @@ export async function readOnboardingStatus(repository, baseCommit, token, onboar
 export async function startOnboarding(repository, baseCommit, token) {
     if (!COMMIT.test(baseCommit))
         throw new Error(`Invalid base commit ${baseCommit}.`);
-    const response = await gatewayFetch(`${ONBOARDING_PATH}?repository=${encodeURIComponent(repository)}`, token, {
+    const response = await gatewayFetch(onboardingPath(repository), token, {
         method: 'POST', body: JSON.stringify({ repository, baseCommit }),
     });
     if (!response.ok)
-        throw await classifyHttpError(response, `Haystack API ${ONBOARDING_PATH}`);
+        throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository)}`);
     return parseOnboardingStatus(await body(response, 'a status'), { repository, baseCommit });
 }
 /** How often a command reads onboarding status while it runs. The status route holds no read (a crawl's reads wait for a
@@ -357,9 +354,9 @@ function repositoryOf(value) {
     return `${origin.owner}/${origin.repository}`;
 }
 export async function readFacts(repository, token) {
-    const response = await gatewayFetch(`${FACTS_PATH}?repository=${encodeURIComponent(repository)}`, token);
+    const response = await gatewayFetch(onboardingPath(repository, '/facts'), token);
     if (!response.ok)
-        throw await classifyHttpError(response, `Haystack API ${FACTS_PATH}`);
+        throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository, '/facts')}`);
     return parseFactsView(await body(response, 'facts'), repository);
 }
 /** `haystack verify answer <question-id> <choice>`: files the answer to an open
@@ -379,7 +376,7 @@ export async function verifyAnswerCommand(questionId, choice, options) {
         if (!question.choices.includes(choice)) {
             throw new Error(`"${choice}" is not one of the question's choices: ${question.choices.map(item => JSON.stringify(item)).join(', ')}.`);
         }
-        const response = await gatewayFetch(`${ANSWERS_PATH}?repository=${encodeURIComponent(repository)}`, auth.token, {
+        const response = await gatewayFetch(onboardingPath(repository, '/answers'), auth.token, {
             method: 'POST', body: JSON.stringify({ repository, expectedFactsDigest: facts.factsDigest, questionId, answer: choice }),
         });
         if (response.status === 409 && attempt < 3) {
@@ -387,7 +384,7 @@ export async function verifyAnswerCommand(questionId, choice, options) {
             continue;
         }
         if (!response.ok)
-            throw await classifyHttpError(response, `Haystack API ${ANSWERS_PATH}`);
+            throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository, '/answers')}`);
         const view = parseFactsView(await body(response, 'facts'), repository);
         if (options.json) {
             process.stdout.write(`${JSON.stringify(withSchema('verify-answer', { facts: view }), null, 2)}\n`);
@@ -407,7 +404,7 @@ export async function writeOnboardingNotes(repository, notes, token) {
         if (sameNotes(facts.facts.notes, notes))
             return 'unchanged';
         const request = { repository, expectedFactsDigest: facts.factsDigest, notes };
-        const response = await gatewayFetch(`${NOTES_PATH}?repository=${encodeURIComponent(repository)}`, token, {
+        const response = await gatewayFetch(onboardingPath(repository, '/notes'), token, {
             method: 'POST', body: JSON.stringify(request),
         });
         if (response.status === 409 && attempt < 3) {
@@ -415,7 +412,7 @@ export async function writeOnboardingNotes(repository, notes, token) {
             continue;
         }
         if (!response.ok)
-            throw await classifyHttpError(response, `Haystack API ${NOTES_PATH}`);
+            throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository, '/notes')}`);
         if (!sameNotes(parseFactsView(await body(response, 'facts'), repository).facts.notes, notes))
             invalid('the notes it answered with');
         return 'written';

package/dist/commands/verify-precompute.js

@@ -8,7 +8,7 @@ import chalk from 'chalk';
 import { NotLoggedInError, resolveAuthContext } from '../utils/auth.js';
 import { findGitRoot, parseRemoteUrl, } from '../utils/git.js';
 import { resolveVerifyBaseSha } from '../utils/verify-base.js';
-import { HaystackApiError, haystackFetch, haystackJson, REPO_NOT_ENTITLED_CODE, SUBSCRIPTION_REQUIRED_CODE, } from '../utils/haystack-api.js';
+import { HaystackApiError, haystackFetch, haystackJson, REPO_NOT_ENTITLED_CODE, SUBSCRIPTION_REQUIRED_CODE, repoApiPath, } from '../utils/haystack-api.js';
 import { trackPrecomputeEvent } from '../utils/telemetry.js';
 import { findSecretsInPatch, isSecretBearingPath } from '../utils/secret-paths.js';
 import { startPrecomputeDelivery } from './precompute-delivery.js';
@@ -325,8 +325,7 @@ function precomputeResult(response) {
  * service no longer has it). */
 async function uploadSourcePatch(request, token, signal, force = false) {
     const gzipped = Buffer.from(request.patchGzBase64, 'base64');
-    const path = `/api/agent/cloud-verifier/source-patches/${request.patchSha256}`
-        + `?owner=${encodeURIComponent(request.owner)}&repository=${encodeURIComponent(request.repository)}`;
+    const path = repoApiPath(`${request.owner}/${request.repository}`, `/patches/${request.patchSha256}`);
     const found = force ? null : await haystackFetch(path, token, { method: 'HEAD', signal }, [404]);
     if (found === null || found.status === 404) {
         await haystackFetch(path, token, { method: 'PUT', headers: { 'Content-Type': 'application/gzip' }, body: gzipped, signal });
@@ -339,7 +338,7 @@ async function submitCapture(request, token, signal) {
     const { patchGzBase64: _inline, ...named } = request;
     const submit = async (force) => {
         const patchBytes = await uploadSourcePatch(request, token, signal, force);
-        return haystackJson('/api/agent/cloud-verifier/front-half', token, { method: 'POST',
+        return haystackJson(repoApiPath(`${request.owner}/${request.repository}`, '/checks'), token, { method: 'POST',
             headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ ...named, patchBytes }), signal });
     };
     try {