@haystackeditor/cli 0.26.0 → 0.27.1

package/README.md

@@ -151,14 +151,6 @@ Exit codes: 0 set up, 1 failed, 2 changes shown but not made, 3 onboarding
 blocked, 4 not logged in, 5 the Haystack GitHub App is not installed, 6 set up
 but onboarding stopped before finishing (run it again).
 
-### `haystack status`
-
-Check if your project is configured:
-
-```bash
-haystack status
-```
-
 ### `haystack login`
 
 Authenticate with GitHub (required for setup and secrets):

package/dist/capture/app-config.js

@@ -16,7 +16,7 @@ import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join, posix } from 'node:path';
 import { CAPTURE_KEY_PATTERN, CAPTURE_STATUS_PATH, CAPTURE_VERSION } from '../commands/capture-contract.js';
-import { haystackFetch, haystackJson } from '../utils/haystack-api.js';
+import { haystackFetch, haystackJson, repoApiPath } from '../utils/haystack-api.js';
 export const CAPTURE_CONFIG_PATH = '.haystack/capture.json';
 export function captureConfigFile(appDir) {
     return join(appDir, CAPTURE_CONFIG_PATH);
@@ -62,7 +62,8 @@ export function recordedApps(gitRoot, candidates) {
             return readCaptureConfig(join(gitRoot, dir))?.app === dir;
         }
         catch (error) {
-            throw new Error(`${posix.join(dir, CAPTURE_CONFIG_PATH)}: ${error instanceof Error ? error.message : String(error)}`);
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(dir === '.' ? message : message.replace(CAPTURE_CONFIG_PATH, posix.join(dir, CAPTURE_CONFIG_PATH)));
         }
     });
 }
@@ -100,8 +101,8 @@ export function parseOrigins(given) {
 /** Registers the application and its production origins (rule 8b): POST /api/agent/cloud-verifier/capture/key, a
  * repository member's call, idempotent (the same application gets the same key; new origins replace the old). */
 export async function registerCaptureApp(token, repository, app, origins) {
-    const query = new URLSearchParams({ repository, app });
-    const response = await haystackJson(`/api/agent/cloud-verifier/capture/key?${query}`, token, {
+    const query = new URLSearchParams({ app });
+    const response = await haystackJson(repoApiPath(repository, `/capture/key?${query}`), token, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ origins }),
@@ -116,8 +117,8 @@ export async function registerCaptureApp(token, repository, app, origins) {
 /** The application's registration as Haystack holds it now (GET /api/agent/cloud-verifier/capture/status, lane A): its key
  * and production origins, or null when the application is not registered (404). */
 export async function readCaptureRegistration(token, repository, app) {
-    const query = new URLSearchParams({ repository, app });
-    const response = await haystackFetch(`${CAPTURE_STATUS_PATH}?${query}`, token, {}, [404]);
+    const query = new URLSearchParams({ app });
+    const response = await haystackFetch(repoApiPath(repository, `${CAPTURE_STATUS_PATH}?${query}`), token, {}, [404]);
     if (response.status === 404) {
         await response.body?.cancel();
         return null;

package/dist/commands/capture-brief.js

@@ -7,7 +7,7 @@
 import { join, posix } from 'node:path';
 import chalk from 'chalk';
 import { CAPTURE_CONFIG_PATH, captureConfigDirs, readCaptureConfig } from '../capture/app-config.js';
-import { classifyHttpError } from '../utils/haystack-api.js';
+import { classifyHttpError, repoApiPath } from '../utils/haystack-api.js';
 import { gatewayFetch } from './case-batch.js';
 import { CAPTURE_APPLICATION_ID, CAPTURE_WINDOW_PATH, captureChangedRoutes, } from './capture-contract.js';
 /** An app's application id from its record, or why the record cannot give one. */
@@ -34,9 +34,10 @@ async function readApp(gitRoot, app, repository, token, files, now) {
         return { app, applicationId: null, state: 'unavailable', reason: application.unreadable };
     const { applicationId } = application;
     try {
-        const response = await gatewayFetch(`${CAPTURE_WINDOW_PATH}?repository=${encodeURIComponent(repository)}&app=${encodeURIComponent(applicationId)}`, token);
+        const path = repoApiPath(repository, `${CAPTURE_WINDOW_PATH}?app=${encodeURIComponent(applicationId)}`);
+        const response = await gatewayFetch(path, token);
         if (!response.ok)
-            throw await classifyHttpError(response, `Haystack API ${CAPTURE_WINDOW_PATH}`);
+            throw await classifyHttpError(response, `Haystack API ${path}`);
         const answer = await response.json();
         if (answer.version !== 'capture-v1' || answer.applicationId !== applicationId)
             throw new Error('the capture window answer names another application');

package/dist/commands/capture-contract.js

@@ -10,7 +10,7 @@ export const CAPTURE_SCRIPT_MAX_BYTES = 8 * 1024;
 export const CAPTURE_ROUTE_ID_MAX = 200;
 /** Rule 4 Publishing: the largest route manifest (current.json and <release>.json), in bytes. */
 export const CAPTURE_MANIFEST_MAX_BYTES = 256 * 1024;
-export const CAPTURE_WINDOW_PATH = '/api/agent/cloud-verifier/capture/window';
+export const CAPTURE_WINDOW_PATH = '/capture/window';
 /** Rule 8(e): telemetry older than this is reported stale; rule 7b: a capture window older than this is stale. */
 export const CAPTURE_EVIDENCE_FRESH_HOURS = 24;
 export const CAPTURE_ROUTE_UNKNOWN = 'unknown';
@@ -39,8 +39,8 @@ export function captureChangedRoutes(window, files, now) {
 }
 export const TELEMETRY_TOKEN_VERSION = 'telemetry-token-v1';
 export const TELEMETRY_ENVIRONMENT = 'production';
-export const TELEMETRY_TOKEN_PATH = '/api/agent/cloud-verifier/telemetry/token';
-export const TELEMETRY_SERVER_STATUS_PATH = '/api/agent/cloud-verifier/telemetry/server';
+export const TELEMETRY_TOKEN_PATH = '/telemetry/token';
+export const TELEMETRY_SERVER_STATUS_PATH = '/telemetry/server';
 export const TELEMETRY_TOKEN_SHA256 = /^[0-9a-f]{64}$/;
 /** Lane A's capture status: GET /api/agent/cloud-verifier/capture/status?repository=&app= (rule 8b's key registration). */
-export const CAPTURE_STATUS_PATH = '/api/agent/cloud-verifier/capture/status';
+export const CAPTURE_STATUS_PATH = '/capture/status';

package/dist/commands/crawl-report.js

@@ -0,0 +1,196 @@
+export const TERMINAL = new Set(['completed', 'prepared', 'incomplete', 'cancelled']);
+export const VERDICTS = ['bug', 'cant-tell', 'being-judged', 'not-a-bug'];
+export const STATUS_WORDS = {
+    queued: 'waiting for a machine',
+    preparing: 'getting ready',
+    crawling: 'exploring the app',
+    draining: 'finishing the last checks',
+    completed: 'finished',
+    prepared: 'built and ready to check',
+    incomplete: 'stopped before finishing',
+    cancelled: 'cancelled',
+};
+export const STAGE_WORDS = {
+    reconcile: 'cleaning up after an earlier try',
+    source: 'rebuilding your change',
+    worlds: 'building and starting the app with and without your change',
+    blast: 'waiting for the analysis of what your change touches',
+    knobs: "reading the app's settings",
+    prepare: 'setting up starting points next to your change',
+    crawl: 'exploring the app',
+    publish: 'saving the results',
+    cleanup: 'shutting down the machines it used',
+};
+export const ERROR_WORDS = {
+    'source-mismatch': 'your change could not be rebuilt exactly as it was captured',
+    'blast-unavailable': 'the analysis of what your change touches was not available',
+    'world-build-failed': 'the app did not build or start, with or without your change',
+    'prepare-failed': 'setting up starting points next to your change failed',
+    'crawl-failed': 'exploring the app failed',
+    'no-capacity': 'there was no room on the machines for it',
+    stalled: 'it stopped making progress',
+    'lease-lost': 'the machine running it stopped responding',
+    cancelled: 'it was cancelled',
+};
+export const SPOT_WORDS = {
+    resolved: 'never reached',
+    loaded: 'loaded but never ran',
+    exposed: 'shown on screen',
+    activated: 'ran',
+    pressed: 'ran when its control was pressed',
+    observed: 'a difference seen',
+    confirmed: 'a difference seen and confirmed',
+    // The stage, not the verdict: a judged difference may be judged not a bug. The findings carry the verdicts.
+    judged: 'a difference seen, confirmed and judged',
+};
+export const VERDICT_WORDS = {
+    bug: 'Bug',
+    'cant-tell': "Can't tell",
+    'being-judged': 'Still being judged',
+    'not-a-bug': 'Not a bug',
+};
+export function plural(count, noun) {
+    return `${count} ${noun}${count === 1 ? '' : 's'}`;
+}
+export function errorWords(error) {
+    return error.code === 'stalled'
+        ? `${ERROR_WORDS.stalled} while ${STAGE_WORDS[error.stage]}`
+        : ERROR_WORDS[error.code];
+}
+/** What a running crawl is doing now: its stage, except while it waits for a
+ * machine or finishes its last checks, which its status says better. */
+export function currentStep(view) {
+    return view.status === 'queued' || view.status === 'draining' ? STATUS_WORDS[view.status] : STAGE_WORDS[view.stage];
+}
+/** The crawl's results: its sealed manifest, else (amendment 9) its answer at the budget, which has the same findings and reach. */
+export function results(view) {
+    return view.manifest ?? (view.answer?.status === 'answered' ? view.answer : null);
+}
+/** The status the command reports: a running crawl that has answered (amendment 9: its budget is up and its work is
+ * done; only its shutdown remains) reads as completed. */
+export function reportedStatus(view) {
+    return !TERMINAL.has(view.status) && view.answer?.status === 'answered' ? 'completed' : view.status;
+}
+export function headline(view) {
+    const bugs = results(view)?.bugs ?? view.totals.bugs;
+    const found = bugs > 0 ? ` It found ${plural(bugs, 'bug')} before it stopped.` : '';
+    switch (reportedStatus(view)) {
+        case 'completed':
+            return bugs > 0 ? `Found ${plural(bugs, 'bug')} in your change.` : 'No bugs found in your change.';
+        case 'incomplete': {
+            const error = results(view)?.error ?? view.error;
+            return `The crawl could not finish: ${error ? errorWords(error) : 'no reason was recorded'}.${found}`;
+        }
+        case 'prepared':
+            // Amendment 12: the turn-end hook built and froze this change; `haystack verify` asks for the crawl itself.
+            return 'Your change is built and ready to check, but was not crawled yet. Run `haystack verify` to check it.';
+        case 'cancelled':
+            return `The crawl was cancelled.${found}`;
+        default: {
+            const so = bugs > 0 ? ` ${plural(bugs, 'bug')} found so far.` : '';
+            if (view.cancelRequested) {
+                return `Being cancelled: ${currentStep(view)}.${so}`;
+            }
+            return `Still running: ${currentStep(view)}.${so}`;
+        }
+    }
+}
+export function verifyReport(view) {
+    const status = reportedStatus(view);
+    const published = results(view);
+    const error = published?.error ?? view.error;
+    const explored = published !== null && view.clocks.crawlStartedAt !== null;
+    const findings = explored ? VERDICTS.flatMap(verdict => published.findings.filter(finding => finding.verdict === verdict)) : [];
+    const ideaWords = { covered: 'tried', blocked: 'could not try', unfinished: 'not finished' };
+    return {
+        runId: view.runId,
+        repository: view.repository,
+        title: view.changeTitle,
+        baseCommit: view.baseCommit,
+        workCommit: view.workCommit,
+        status,
+        headline: headline(view),
+        bugs: published?.bugs ?? view.totals.bugs,
+        findings: findings.map(finding => ({
+            id: finding.id,
+            verdict: finding.verdict,
+            why: finding.why,
+            start: finding.start,
+            steps: finding.steps,
+            outsideServices: finding.standIns && (finding.standIns.old.length > 0 || finding.standIns.new.length > 0)
+                ? { withoutChange: finding.standIns.old, withChange: finding.standIns.new }
+                : null,
+        })),
+        spots: explored ? published.reach.spots.map(spot => ({
+            file: spot.file,
+            line: spot.line,
+            reached: spot.furthest === null ? 'never reached' : SPOT_WORDS[spot.furthest],
+            reachedBy: spot.reachedBy && { start: spot.reachedBy.start, steps: spot.reachedBy.steps, page: spot.reachedBy.page },
+            findingIds: spot.findingIds,
+        })) : [],
+        ideas: explored && published.ideas !== undefined
+            ? published.ideas.map(idea => ({ text: idea.text, result: ideaWords[idea.state], reason: idea.reason, findingIds: idea.findingIds }))
+            : null,
+        neverRan: explored ? {
+            files: published.reach.unreachedChangedFiles,
+            functions: published.reach.blast === null ? null : { ran: published.reach.blast.ran, total: published.reach.blast.functions },
+        } : null,
+        notFinishedInTime: explored ? published.notFinishedInTime : 0,
+        outsideServiceGaps: explored ? published.standIns?.gaps ?? [] : [],
+        error: error ? { code: error.code, message: error.message } : null,
+        machinesNotProvenShutDown: TERMINAL.has(view.status) ? view.totals.cleanupUnproven : 0,
+    };
+}
+/** The report as markdown: headings an agent can navigate, bugs first, each with the steps to see it. */
+export function reportMarkdown(report) {
+    const lines = [`# ${report.headline}`, '',
+        `Change: ${report.title}`, `Check ${report.runId} of ${report.repository}: base ${report.baseCommit.slice(0, 12)}, change ${report.workCommit.slice(0, 12)}.`];
+    if (report.error && report.status !== 'completed')
+        lines.push(`Details: ${report.error.message}`);
+    if (report.neverRan === null) {
+        lines.push('', TERMINAL.has(report.status)
+            ? 'Nothing about the change was measured: the crawl did not explore the app.'
+            : 'Where the change shows up, and what the crawl found, appear when it finishes.');
+        return lines.join('\n') + '\n';
+    }
+    lines.push('', '## Where the change shows up in the app');
+    if (report.spots.length === 0)
+        lines.push('No changed spots were recorded.');
+    for (const spot of report.spots) {
+        lines.push(`- \`${spot.file}:${spot.line}\`: ${spot.reached}${spot.findingIds.length ? ` (${plural(spot.findingIds.length, 'finding')})` : ''}`);
+        if (spot.reachedBy)
+            lines.push(`  - reached by: ${[spot.reachedBy.start, ...spot.reachedBy.steps].join(' > ')}${spot.reachedBy.page ? ` (page ${spot.reachedBy.page})` : ''}`);
+    }
+    lines.push('', '## What the crawl found');
+    if (report.findings.length === 0)
+        lines.push('No confirmed differences between the app with and without the change.');
+    report.findings.forEach((finding, index) => {
+        lines.push(`${index + 1}. **${VERDICT_WORDS[finding.verdict]}** (\`${finding.id}\`): ${finding.why ?? 'no reason was recorded.'}`, `   Starting from ${finding.start}:`, ...finding.steps.map((step, n) => `   ${n + 1}. ${step}`));
+        if (finding.outsideServices) {
+            lines.push(`   Outside services on this path, answered by stand-ins: without the change ${finding.outsideServices.withoutChange.join('; ') || 'none'};`
+                + ` with it ${finding.outsideServices.withChange.join('; ') || 'none'}.`);
+        }
+    });
+    if (report.notFinishedInTime > 0) {
+        lines.push(`${plural(report.notFinishedInTime, 'difference')} ${report.notFinishedInTime === 1 ? 'was' : 'were'} still being checked when its time ran out.`);
+    }
+    if (report.ideas !== null) {
+        lines.push('', '## Your ideas');
+        for (const idea of report.ideas)
+            lines.push(`- ${idea.result}: ${idea.text}. ${idea.reason}`);
+    }
+    lines.push('', '## What the crawl never ran');
+    if (report.neverRan.files.length === 0)
+        lines.push('Every changed file ran at least once.');
+    else
+        lines.push('Changed files no path ran:', ...report.neverRan.files.map(file => `- \`${file}\``));
+    if (report.neverRan.functions)
+        lines.push(`${report.neverRan.functions.ran} of ${plural(report.neverRan.functions.total, 'affected function')} ran.`);
+    if (report.outsideServiceGaps.length > 0) {
+        lines.push('', '## Outside services the copy could not imitate', 'Missing coverage of the environment, not bugs in the change:', ...report.outsideServiceGaps.map(gap => `- ${gap}`));
+    }
+    if (report.machinesNotProvenShutDown > 0) {
+        lines.push('', `${plural(report.machinesNotProvenShutDown, 'machine')} it used could not be proven shut down.`);
+    }
+    return lines.join('\n') + '\n';
+}

package/dist/commands/db-profile-upload.js

@@ -14,8 +14,8 @@ import chalk from 'chalk';
 import { DATABASE_PROFILE_UPLOAD_REQUEST_VERSION, parseDatabaseProfileUpload, } from './db-profile-contract.js';
 import { readDatabaseProfileFile } from './db-profile-show.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { classifyHttpError, haystackApiUrl, readWithRetries, transientReadFailure } from '../utils/haystack-api.js';
-export const DATABASE_PROFILES_PATH = '/api/agent/cloud-verifier/database-profiles';
+import { classifyHttpError, haystackApiUrl, readWithRetries, transientReadFailure, repoApiPath } from '../utils/haystack-api.js';
+export const DATABASE_PROFILES_PATH = '/database-profiles';
 /** GitHub's owner and repository name alphabets. */
 const REPOSITORY = /^([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))\/([A-Za-z0-9_.-]{1,100})$/u;
 /** Run-map dependency ids are stable kebab-case ids (the same check as
@@ -60,7 +60,7 @@ export async function uploadDatabaseProfile(request, token) {
     }
 }
 async function uploadDatabaseProfileOnce(request, token) {
-    const response = await fetch(haystackApiUrl(DATABASE_PROFILES_PATH), {
+    const response = await fetch(haystackApiUrl(repoApiPath(request.repository, DATABASE_PROFILES_PATH)), {
         method: 'POST',
         headers: {
             Authorization: `Bearer ${token}`,

package/dist/commands/feedback.js

@@ -53,7 +53,7 @@ export async function feedbackCommand(words, options) {
     const message = words.length === 1 && words[0] === '-' ? readFileSync(0, 'utf8') : words.join(' ');
     const request = buildFeedbackRequest(message, options, currentRepository());
     const { token } = await resolveAuthContext({ preferredLogin: options.account });
-    await haystackJson('/api/cli/feedback', token, {
+    await haystackJson('/v1/feedback', token, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(request),

package/dist/commands/init-telemetry.js

@@ -21,12 +21,12 @@
  *     stores or reads one), production's environment, the start command, the deploy and the off switches (13c).
  */
 import { execFileSync, spawnSync } from 'node:child_process';
-import { existsSync, lstatSync, readFileSync, realpathSync, statSync, writeFileSync } from 'node:fs';
+import { accessSync, constants, existsSync, lstatSync, readFileSync, realpathSync, statSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
+import { delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import chalk from 'chalk';
-import { classifyHttpError } from '../utils/haystack-api.js';
+import { classifyHttpError, repoApiPath } from '../utils/haystack-api.js';
 import { gatewayFetch } from './case-batch.js';
 import { CAPTURE_EVIDENCE_FRESH_HOURS, CAPTURE_STATUS_PATH, } from './capture-contract.js';
 import { captureAnswers, planCapture } from './init-capture.js';
@@ -103,7 +103,8 @@ function section(json, name) {
 }
 const LOCKFILES = [['pnpm-lock.yaml', 'pnpm'], ['package-lock.json', 'npm'], ['yarn.lock', 'yarn'], ['bun.lock', 'bun'], ['bun.lockb', 'bun']];
 /** The package manager that owns the app's lockfile: the nearest `packageManager` field, else the nearest lockfile, from
- * the app up to the repository root. null: no lockfile, so the dependency is written into package.json itself. */
+ * the app up to the repository root (`from` says which). null: no lockfile, so the dependency is written into package.json
+ * itself. */
 function packageManager(gitRoot, appDir) {
     for (let directory = appDir;; directory = dirname(directory)) {
         const manifest = join(directory, 'package.json');
@@ -111,16 +112,32 @@ function packageManager(gitRoot, appDir) {
             const declared = readPackage(manifest).json.packageManager;
             const name = typeof declared === 'string' ? /^(pnpm|npm|yarn|bun)@/.exec(declared)?.[1] : undefined;
             if (name)
-                return { name: name, root: directory };
+                return { name: name, root: directory, from: `${inside(gitRoot, manifest)}'s packageManager field` };
         }
         for (const [lockfile, name] of LOCKFILES) {
             if (isFile(join(directory, lockfile)))
-                return { name, root: directory };
+                return { name, root: directory, from: inside(gitRoot, join(directory, lockfile)) };
         }
         if (directory === gitRoot || dirname(directory) === directory)
             return null;
     }
 }
+/** Whether `command` is an executable on PATH (a package manager init would run, checked before it plans to). */
+function onPath(command) {
+    const extensions = process.platform === 'win32' ? (process.env.PATHEXT ?? '.EXE;.CMD;.BAT').split(';') : [''];
+    for (const directory of (process.env.PATH ?? '').split(delimiter)) {
+        if (directory === '')
+            continue;
+        for (const extension of extensions) {
+            try {
+                accessSync(join(directory, `${command}${extension}`), constants.X_OK);
+                return true;
+            }
+            catch { /* not in this directory */ }
+        }
+    }
+    return false;
+}
 /** The first release whose sites record repository-relative paths (what a registered tenant's src_prefix '' relies on)
  * and that ships the `./next` entry: earlier releases are not compatible with either integration. */
 const CLI_COMPATIBLE_SINCE = [0, 24, 0];
@@ -216,14 +233,29 @@ function planDependency(gitRoot, appDir, pkg, after, need) {
     const spec = `${CLI_PACKAGE}@${version}`;
     const dev = field === 'devDependencies';
     const workspaceRoot = isFile(join(appDir, 'pnpm-workspace.yaml')) ? ['--workspace-root'] : [];
-    // Each package manager's add, as it changes no lockfile entry but the CLI's own (lockfile-pin.ts): npm with its tree
-    // nested under the CLI (hoisting would replace packages the app already locks), pnpm through the merge.
+    // Each package manager's add, as it changes no lockfile entry but the CLI's own (lockfile-pin.ts; pnpm through the merge).
     const argv = manager === null ? null : {
         pnpm: ['pnpm', 'add', '--save-exact', dev ? '--save-dev' : '--save-prod', ...workspaceRoot, spec],
-        npm: ['npm', 'install', '--save-exact', dev ? '--save-dev' : '--save-prod', '--install-strategy=nested', spec],
+        npm: ['npm', 'install', '--save-exact', dev ? '--save-dev' : '--save-prod', spec],
         yarn: ['yarn', 'add', '--exact', ...(dev ? ['--dev'] : []), spec],
         bun: ['bun', 'add', '--exact', ...(dev ? ['--dev'] : []), spec],
     }[manager.name];
+    const appPath = inside(gitRoot, appDir) || '.';
+    // npm re-resolves entries the CLI does not own whatever the flags (39 in fosrl/pangolin, with --install-strategy=nested
+    // too), so init never rewrites an npm lockfile: the person adds the CLI with npm and sees the lockfile's diff.
+    if (manager?.name === 'npm' && argv) {
+        return { kind: 'manual', why: `${appPath} uses npm (${manager.from}), whose install also re-resolves lockfile entries the CLI does not own, so init`
+                + ` does not run it. Run \`${argv.join(' ')}\` in ${appPath}, check package-lock.json's diff, then run \`haystack init\` again` };
+    }
+    // A package manager that is not installed is never run (rule 13: telemetry never fails init).
+    if (manager && argv && !onPath(manager.name)) {
+        const provide = (manager.name === 'pnpm' || manager.name === 'yarn') && onPath('corepack')
+            ? `run \`corepack enable ${manager.name}\` (corepack is installed here)`
+            : `install it (${manager.name === 'bun' ? 'https://bun.sh' : manager.name === 'yarn' ? 'https://yarnpkg.com/getting-started/install' : 'https://pnpm.io/installation'})`;
+        return { kind: 'manual', why: `${appPath} uses ${manager.name} (${manager.from}), which is not installed here, so init did not run it. Either`
+                + ` ${provide} and run \`haystack init\` again, or run \`${argv.join(' ')}\` in ${appPath} wherever ${manager.name} is installed and then`
+                + ' run `haystack init` again' };
+    }
     const action = promoting ? `Moved from devDependencies to dependencies at ${version}` : `Pinned to ${version}`;
     const lockfileNote = manager?.name === 'pnpm'
         ? `, keeping every other entry of pnpm's lockfile as it was (pnpm's own add re-resolves packages the CLI shares with the app; init adds only the CLI's entries, then \`pnpm install --frozen-lockfile\`)`
@@ -247,12 +279,14 @@ function planDependency(gitRoot, appDir, pkg, after, need) {
 }
 /** The lockfile a package manager writes, in a format lockfile-pin.ts reads (bun's binary lockb aside). */
 function textLockfile(manager) {
-    const name = { pnpm: 'pnpm-lock.yaml', npm: 'package-lock.json', yarn: 'yarn.lock', bun: 'bun.lock' }[manager.name];
+    if (manager.name === 'npm')
+        throw new Error('init never runs npm to pin the CLI');
+    const name = { pnpm: 'pnpm-lock.yaml', yarn: 'yarn.lock', bun: 'bun.lock' }[manager.name];
     const path = join(manager.root, name);
     return isFile(path) ? { path, format: manager.name } : null;
 }
 /** Runs the add, so that the lockfile gains the CLI's entries and nothing else moves (rule 13); throws (init then restores
- * every file) when the package manager moved anything else. */
+ * telemetry's files and leaves telemetry manual) when the package manager moved anything else. */
 function pin(manager, appDir, argv) {
     const run = (command) => { execFileSync(command[0], command.slice(1), { cwd: appDir, stdio: ['ignore', 2, 2] }); };
     const lockfile = textLockfile(manager);
@@ -272,8 +306,8 @@ function pin(manager, appDir, argv) {
     const moved = lockfileDrift(lockfile.format, before, readFileSync(lockfile.path, 'utf8'), importer, CLI_PACKAGE);
     if (moved.length > 0) {
         throw new Error(`\`${argv.join(' ')}\` also changed ${moved.length} lockfile ${moved.length === 1 ? 'entry' : 'entries'} the CLI does not own`
-            + ` (${moved.slice(0, 5).join(', ')}${moved.length > 5 ? ', …' : ''}), so init put every file back. Add ${CLI_PACKAGE} at its exact version`
-            + ` to ${inside(manager.root, appDir) || '.'} yourself, keeping the lockfile's other entries, then run \`haystack init\` again`);
+            + ` (${moved.slice(0, 5).join(', ')}${moved.length > 5 ? ', …' : ''}). Add ${CLI_PACKAGE} at its exact version to`
+            + ` ${inside(manager.root, appDir) || '.'} yourself, keeping the lockfile's other entries, then run \`haystack init\` again`);
     }
 }
 function isNode(value) {
@@ -961,7 +995,7 @@ async function readJson(path, token) {
 }
 /** Lane A's registration of the application: its newest capture event, or null when it is not registered (404) or has none. */
 async function captureReceived(repository, app, token) {
-    const status = await readJson(`${CAPTURE_STATUS_PATH}?repository=${encodeURIComponent(repository)}&app=${encodeURIComponent(app)}`, token);
+    const status = await readJson(repoApiPath(repository, `${CAPTURE_STATUS_PATH}?app=${encodeURIComponent(app)}`), token);
     return status === null ? null : received(status.lastSeenAt, status.release);
 }
 function withReceived(part, evidence) {
@@ -1006,6 +1040,22 @@ export function previewTelemetry(plan, repository, notes) {
     const profile = dbProfile(repository, null, notes);
     return { telemetry: { capture: plan.capture, server: serverPartOf(plan), dbProfileCommand: profile?.command ?? null }, steps };
 }
+/** A telemetry plan with nothing planned, for a run whose telemetry could not be planned at all (failedTelemetry says why). */
+export function emptyTelemetryPlan() {
+    return { app: null, changes: [], notices: [], server: { status: 'manual', kind: null, steps: [] }, settings: null,
+        capture: { status: 'manual', steps: [], received: null }, captureRegistration: null };
+}
+/** Telemetry that could not be set up (a package manager failed, a file init could not read, Haystack not answering): each
+ * part it would have set up is manual with what happened, every file telemetry changed is back, and the rest of init stands
+ * (telemetry never fails init). */
+export function failedTelemetry(plan, failure) {
+    const step = `init could not set up telemetry: ${failure.replace(/\.?\s*$/, '')}. It put back every file telemetry changed; the rest of init is`
+        + ' done. Fix that, then run `haystack init` again.';
+    // A part that was already waiting for answers keeps its questions after what happened.
+    const part = (value) => (value.status === 'unsupported' ? value
+        : { status: 'manual', steps: [step, ...(value.status === 'manual' ? value.steps : [])], received: null });
+    return { telemetry: { capture: part(plan.capture), server: part(serverPartOf(plan)), dbProfileCommand: null }, steps: [step] };
+}
 /** Rule 8(e): the report, and what the person does for telemetry to arrive (the token, production's environment, the start,
  * the deploy) with the off switches (rule 13c). `onboarding` and `notes` feed the data profile. */
 export async function telemetryReport(plan, context) {