@haystackeditor/cli 0.26.0 → 0.27.1

package/dist/commands/init.js

@@ -56,7 +56,7 @@ export const AGENT_NOTE = [
     '  `haystack verify answer <question-id> <choice>`.',
     '- Read its short report. `--json` prints the same report as data; `--raw` prints the crawl\'s whole record (large), for scripts;',
     '  `haystack verify --help` explains the output and exit codes.',
-    '- If `haystack` is not installed, run each command as `npx -y @haystackeditor/cli@latest <command>`.',
+    '- If `haystack` is not installed, run each command as `npx -y -p @haystackeditor/cli@latest haystack <command>`.',
     '- If Haystack fails, confuses you or gets in your way, say so in a sentence with',
     '  `haystack feedback "<what happened>"` and keep going: the Haystack team sees it at once.',
     NOTE_END,
@@ -299,6 +299,33 @@ export function planInit(gitRoot) {
     const notices = [];
     return { changes: [...planStopHook(gitRoot, notices), ...planAgentNotes(gitRoot, notices)], notices };
 }
+/** Makes `changes` all or nothing: one that fails (an install that does not end as planned) restores every file they
+ * touched (bytes, not text: a lockfile can be binary), so no edit is left referencing what was never installed. */
+function applyAll(gitRoot, changes, say) {
+    const before = new Map();
+    for (const planned of changes) {
+        for (const path of [planned.target, ...(planned.run?.touches ?? [])]) {
+            if (!before.has(path))
+                before.set(path, existsSync(path) ? readFileSync(path) : null);
+        }
+    }
+    try {
+        for (const planned of changes) {
+            applyChange(gitRoot, planned);
+            say(chalk.green(`✓ ${planned.action === 'create' ? 'Created' : planned.action === 'delete' ? 'Deleted' : 'Updated'} ${planned.path}`));
+        }
+    }
+    catch (error) {
+        for (const [path, content] of before) {
+            if (content !== null)
+                writeFileSync(path, content);
+            else if (existsSync(path))
+                unlinkSync(path);
+        }
+        throw error;
+    }
+}
+const errorText = (error) => (error instanceof Error ? error.message : String(error));
 function applyChange(gitRoot, planned) {
     const inside = relative(gitRoot, planned.target);
     if (!inside.startsWith('..') && !isAbsolute(inside))
@@ -362,19 +389,35 @@ export async function initCommand(options) {
     // Read before anything else, so notes that cannot be used stop init with nothing done.
     const notes = options.notes === undefined ? null : readNotes(options.notes);
     const plan = planInit(gitRoot);
-    // Telemetry is part of onboarding (CAPTURE-V1 rule 8): planned on every run; a missing answer stops only it.
+    // Telemetry is part of onboarding (CAPTURE-V1 rule 8): planned on every run; a missing answer stops only it. It never fails
+    // init: whatever goes wrong with it (a file it cannot read, a package manager that fails, Haystack not answering) puts its
+    // own files back and leaves it manual with what happened, and the rest of init goes on.
     const telemetryModule = await import('./init-telemetry.js');
     const telemetryOptions = { app: options.app, origins: options.origin ?? [], consent: options.consent, urlRewrites: options.urlRewrites };
-    let telemetryPlan = await telemetryModule.planTelemetry(gitRoot, repository, telemetryOptions);
+    let telemetryFailure = null;
+    let telemetryPlan = telemetryModule.emptyTelemetryPlan();
+    try {
+        telemetryPlan = await telemetryModule.planTelemetry(gitRoot, repository, telemetryOptions);
+    }
+    catch (error) {
+        telemetryFailure = errorText(error);
+    }
     const telemetryFrom = plan.changes.length;
     plan.changes.push(...telemetryPlan.changes);
     plan.notices.push(...telemetryPlan.notices);
     let notesWritten = null;
     let telemetry = null;
+    /** Telemetry did not happen: its changes leave the plan (none of them was made), and the report says why. */
+    const telemetryFailed = (error) => {
+        telemetryFailure = errorText(error);
+        plan.changes.splice(telemetryFrom);
+        say(chalk.yellow(`Telemetry was not set up: ${telemetryFailure} The rest of init goes on; the telemetry report says what to do.`));
+    };
     // Before the apply (a preview, or no login), the report is the preview: what telemetry will do, `received` unchecked (null).
-    const report = () => telemetry ?? telemetryModule.previewTelemetry(telemetryPlan, repository, notes);
+    const report = () => (telemetryFailure !== null ? telemetryModule.failedTelemetry(telemetryPlan, telemetryFailure)
+        : telemetry ?? telemetryModule.previewTelemetry(telemetryPlan, repository, notes));
     const showPreview = () => {
-        const preview = telemetryModule.previewTelemetry(telemetryPlan, repository, notes);
+        const preview = report();
         for (const line of telemetryModule.formatTelemetry(preview.telemetry, preview.steps))
             say(line);
         say('');
@@ -424,44 +467,48 @@ export async function initCommand(options) {
             return;
         }
     }
-    // Browser capture's registration (rule 8b), which the preview announced: checked with Haystack now, and when the files
-    // need a new key the telemetry changes are planned again with it (or without capture's, when it is refused).
+    // Init's own changes (the agent instructions, the Stop hook) first, all or nothing: a failure there is init's.
+    try {
+        applyAll(gitRoot, plan.changes.slice(0, telemetryFrom), say);
+    }
+    catch (error) {
+        throw new Error(`${errorText(error)} Every file init changed was restored; nothing was changed.`);
+    }
+    // Then telemetry, all or nothing on its own. Browser capture's registration (rule 8b), which the preview announced, is
+    // checked with Haystack first, and when the files need a new key the telemetry changes are planned again with it (or
+    // without capture's, when it is refused).
     const approved = options.yes === true || plan.changes.length > 0;
-    const capture = telemetryPlan.captureRegistration
-        ? await telemetryModule.prepareCapture(telemetryPlan.captureRegistration, token, say, approved) : null;
-    if (capture?.replan) {
-        telemetryPlan = await telemetryModule.planTelemetry(gitRoot, repository, { ...telemetryOptions, registration: capture.replan });
-        plan.changes.splice(telemetryFrom, plan.changes.length - telemetryFrom, ...telemetryPlan.changes);
-    }
-    // All or nothing: a change that fails (an install that does not end as planned) restores every file the changes
-    // touched, so no edit is left referencing what was never installed.
-    // Bytes, not text: a lockfile can be binary (bun.lockb).
-    const before = new Map();
-    for (const planned of plan.changes) {
-        for (const path of [planned.target, ...(planned.run?.touches ?? [])]) {
-            if (!before.has(path))
-                before.set(path, existsSync(path) ? readFileSync(path) : null);
+    let capture = null;
+    if (telemetryFailure === null) {
+        try {
+            capture = telemetryPlan.captureRegistration
+                ? await telemetryModule.prepareCapture(telemetryPlan.captureRegistration, token, say, approved) : null;
+            if (capture?.replan) {
+                telemetryPlan = await telemetryModule.planTelemetry(gitRoot, repository, { ...telemetryOptions, registration: capture.replan });
+                plan.changes.splice(telemetryFrom, plan.changes.length - telemetryFrom, ...telemetryPlan.changes);
+            }
+            applyAll(gitRoot, plan.changes.slice(telemetryFrom), say);
         }
-    }
-    try {
-        for (const planned of plan.changes) {
-            applyChange(gitRoot, planned);
-            say(chalk.green(`✓ ${planned.action === 'create' ? 'Created' : planned.action === 'delete' ? 'Deleted' : 'Updated'} ${planned.path}`));
+        catch (error) {
+            try {
+                await capture?.rollback(say);
+            }
+            catch (rollbackError) {
+                say(chalk.yellow(`Capture's registration could not be put back: ${errorText(rollbackError)}`));
+            }
+            telemetryFailed(error);
         }
     }
-    catch (error) {
-        for (const [path, content] of before) {
-            if (content !== null)
-                writeFileSync(path, content);
-            else if (existsSync(path))
-                unlinkSync(path);
+    if (telemetryFailure === null && capture) {
+        try {
+            const captureFollowUp = await capture.finish(say);
+            if (captureFollowUp)
+                telemetryPlan.capture = telemetryModule.withCaptureStep(telemetryPlan.capture, captureFollowUp);
+        }
+        catch (error) {
+            telemetryPlan.capture = telemetryModule.withCaptureStep(telemetryPlan.capture, `Run \`haystack init\` again: Haystack did not take the app's origins (${errorText(error)}).`);
         }
-        await capture?.rollback(say);
-        throw new Error(`${error instanceof Error ? error.message : String(error)} Every file init changed was restored; nothing was changed.`);
     }
-    const captureFollowUp = await capture?.finish(say);
-    if (captureFollowUp)
-        telemetryPlan.capture = telemetryModule.withCaptureStep(telemetryPlan.capture, captureFollowUp);
     let onboarding;
     try {
         // The notes first: onboarding plans from the facts it starts with, and new notes are new facts (a new onboarding).
@@ -485,8 +532,18 @@ export async function initCommand(options) {
     reportOnboardingState(onboarding);
     say(formatOnboarding(onboarding));
     say('');
-    telemetry = await telemetryModule.telemetryReport(telemetryPlan, { repository, token, onboarding, notes });
-    for (const line of telemetryModule.formatTelemetry(telemetry.telemetry, telemetry.steps))
+    if (telemetryFailure === null) {
+        try {
+            telemetry = await telemetryModule.telemetryReport(telemetryPlan, { repository, token, onboarding, notes });
+        }
+        catch (error) {
+            // What Haystack holds could not be read: the report as previewed (`received` unchecked), and why.
+            const preview = telemetryModule.previewTelemetry(telemetryPlan, repository, notes);
+            telemetry = { telemetry: preview.telemetry, steps: [...preview.steps, `Run \`haystack init --json\` again to read what telemetry Haystack has received (it could not: ${errorText(error)}).`] };
+        }
+    }
+    const shown = report();
+    for (const line of telemetryModule.formatTelemetry(shown.telemetry, shown.steps))
         say(line);
     say('');
     if (onboarding.state === 'ready')

package/dist/commands/lockfile-pin.js

@@ -4,13 +4,14 @@
  * locks older versions of packages the CLI also uses):
  *   - yarn 1, yarn 4 and bun add only the new descriptors and entries; nothing else moves.
  *   - npm hoists the new tree and replaces hoisted packages the app already locks (ws, yaml, zod moved to the CLI's
- *     versions); with `--install-strategy=nested` it places the new tree under the dependency and moves nothing.
+ *     versions), and re-resolves other entries even with `--install-strategy=nested` (39 in fosrl/pangolin): init never
+ *     runs it (init-telemetry.ts leaves the npm install to the person, who sees the lockfile's diff).
  *   - pnpm re-resolves the dependencies of every package the new tree shares with the old one to the newest version in the
  *     graph (47 entries in Rallly, from @smithy/* to express), and no flag stops it. So init lets pnpm resolve the new
  *     dependency (`--lockfile-only`), keeps every entry the lockfile had, adds the entries only the new dependency
  *     reaches (mergePnpmLockfile), and installs exactly that (`pnpm install --frozen-lockfile`, which also proves it).
- * lockfileDrift checks the result for every format init can read, so a package manager that moves anything else fails the
- * change (and init restores every file).
+ * lockfileDrift checks the result for every format init runs, so a package manager that moves anything else fails the
+ * change (and init restores telemetry's files, leaving telemetry manual).
  */
 function unquote(text) {
     if (text.startsWith('\'') && text.endsWith('\''))
@@ -271,11 +272,6 @@ function entriesOf(format, text, importer) {
             }
         }
     }
-    else if (format === 'npm') {
-        const packages = JSON.parse(text).packages ?? {};
-        for (const [key, value] of Object.entries(packages))
-            out.set(key === (importer === '.' ? '' : importer) ? IMPORTER : key, JSON.stringify(value));
-    }
     else if (format === 'yarn') {
         for (const block of text.split(/\n\s*\n/)) {
             const lines = block.split('\n').filter(line => line.trim() !== '' && !line.startsWith('#'));

package/dist/commands/telemetry-token.js

@@ -22,7 +22,7 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import chalk from 'chalk';
 import { resolveAuthContext } from '../utils/auth.js';
-import { classifyHttpError, HaystackApiError } from '../utils/haystack-api.js';
+import { classifyHttpError, HaystackApiError, repoApiPath } from '../utils/haystack-api.js';
 import { gatewayFetch } from './case-batch.js';
 import { TELEMETRY_ENVIRONMENT, TELEMETRY_SERVER_STATUS_PATH, TELEMETRY_TOKEN_PATH, TELEMETRY_TOKEN_SHA256, TELEMETRY_TOKEN_VERSION, } from './capture-contract.js';
 /** GitHub's owner and repository name alphabets. */
@@ -51,7 +51,7 @@ async function confirmed(question) {
 }
 /** GET the repository's server-telemetry status: its active token's hash, the endpoint, the newest flush. */
 export async function readTelemetryServerStatus(repository, token) {
-    const path = `${TELEMETRY_SERVER_STATUS_PATH}?repository=${encodeURIComponent(repository)}`;
+    const path = repoApiPath(repository, TELEMETRY_SERVER_STATUS_PATH);
     const response = await gatewayFetch(path, token);
     if (!response.ok)
         throw await classifyHttpError(response, `Haystack API ${TELEMETRY_SERVER_STATUS_PATH}`);
@@ -199,7 +199,7 @@ async function mintUnderLock(repository, file, authToken, options) {
     let answer;
     try {
         const request = { repository, tokenSha256, rotate: options.rotate === true };
-        const response = await gatewayFetch(`${TELEMETRY_TOKEN_PATH}?repository=${encodeURIComponent(repository)}`, authToken, {
+        const response = await gatewayFetch(repoApiPath(repository, TELEMETRY_TOKEN_PATH), authToken, {
             method: 'POST', body: JSON.stringify(request),
         });
         if (!response.ok)

package/dist/commands/tokens.js

@@ -5,10 +5,10 @@
  *   - `haystack login --headless [--label NAME] [--scope repo:owner/name,...]`
  *       Opens the browser to mint a token via the auth-worker, then writes it
  *       locally so subsequent CLI calls auth via Bearer.
- *   - `haystack tokens list`
+ *   - `haystack auth tokens`
  *       Lists tokens on the server side (the local file only stores ONE
  *       active token at a time; the server may have many tied to your user).
- *   - `haystack tokens revoke <id>`
+ *   - `haystack auth revoke <id>`
  *       Revokes a server-side token. If the revoked token is the one
  *       currently on disk, the local file is wiped so the next CLI call
  *       doesn't keep using a dead token.
@@ -123,12 +123,12 @@ export async function headlessLoginCommand(opts) {
     console.log(`  ${chalk.dim('path:')} ${path}`);
     console.log(`  ${chalk.dim('id:')}   ${result.id}`);
     console.log(chalk.dim('  Subsequent `haystack` calls will use this token.'));
-    console.log(chalk.dim('  Revoke server-side with: haystack tokens revoke ' + result.id));
+    console.log(chalk.dim('  Revoke server-side with: haystack auth revoke ' + result.id));
 }
 export async function headlessLogoutCommand() {
     await clearHeadlessToken();
     console.log(chalk.green('✓ Headless token removed from disk.'));
-    console.log(chalk.dim('  Server-side token is still active. Revoke it with `haystack tokens revoke <id>`.'));
+    console.log(chalk.dim('  Server-side token is still active. Revoke it with `haystack auth revoke <id>`.'));
 }
 export async function listTokensCommand(opts) {
     const token = await loadToken();

package/dist/commands/verify-explore.js

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { resolveAuthContext } from '../utils/auth.js';
-import { haystackJson } from '../utils/haystack-api.js';
+import { haystackJson, repoApiPath } from '../utils/haystack-api.js';
 const RUN_ID = /^cv_[0-9a-f]{48}$/;
 const CASE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 const ACTION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
@@ -27,8 +27,8 @@ async function context(runId, repository) {
     const { token } = await resolveAuthContext({ owner, repo });
     return {
         token,
-        path: `/api/agent/cloud-verifier/runs/${runId}/cases`,
-        query: `?repository=${encodeURIComponent(repository)}`,
+        path: repoApiPath(repository, `/runs/${runId}/cases`),
+        query: '',
     };
 }
 export async function verifyCasesCommand(runId, options) {

package/dist/commands/verify-history.js

@@ -1,5 +1,5 @@
 import { resolveAuthContext } from '../utils/auth.js';
-import { haystackJson, HaystackApiError } from '../utils/haystack-api.js';
+import { haystackJson, HaystackApiError, repoApiPath } from '../utils/haystack-api.js';
 const HEALTH = ['healthy', 'degraded', 'infrastructure-error', 'not-executed', 'unknown'];
 const LIFECYCLES = ['complete', 'failed', 'cancelled', 'budget-stopped', 'account-action'];
 const RUN_ID = /^cv_[0-9a-f]{48}$/;
@@ -139,7 +139,7 @@ export async function verifyHistoryCommand(repository, options) {
     const auth = await resolveAuthContext({ preferredLogin: options.account, owner, repo: name });
     let response;
     try {
-        response = await haystackJson(`/api/agent/cloud-verifier/history/${encodeURIComponent(owner)}/${encodeURIComponent(name)}?limit=${limit}`, auth.token, { method: 'GET' });
+        response = await haystackJson(repoApiPath(`${owner}/${name}`, `/runs?limit=${limit}`), auth.token, { method: 'GET' });
     }
     catch (error) {
         if (error instanceof HaystackApiError && error.status === 404) {

package/dist/commands/verify-onboarding.js

@@ -10,17 +10,14 @@
 import chalk from 'chalk';
 import { withSchema } from '../schema.js';
 import { resolveAuthContext } from '../utils/auth.js';
-import { classifyHttpError, readWithRetries, SERVICE_SILENCE_LIMIT_MS, ServiceSilentError, transientReadFailure, } from '../utils/haystack-api.js';
+import { classifyHttpError, readWithRetries, SERVICE_SILENCE_LIMIT_MS, ServiceSilentError, transientReadFailure, repoApiPath, } from '../utils/haystack-api.js';
 import { trackOnboardingEvent } from '../utils/telemetry.js';
 import { gatewayFetch } from './case-batch.js';
 import { ONBOARDING_STAGES, ONBOARDING_VERSION, } from './onboarding-contract.js';
 import { sameNotes } from './onboarding-notes.js';
 import { deriveBaseSha, EXPLICIT_WALL_MS, resolveOriginRepository } from './verify-precompute.js';
 import { findGitRoot } from '../utils/hooks.js';
-const ONBOARDING_PATH = '/api/agent/cloud-verifier/onboarding';
-const FACTS_PATH = `${ONBOARDING_PATH}/facts`;
-const ANSWERS_PATH = `${ONBOARDING_PATH}/answers`;
-const NOTES_PATH = `${ONBOARDING_PATH}/notes`;
+const onboardingPath = (repository, rest = '') => repoApiPath(repository, `/onboarding${rest}`);
 const ONBOARD_RUN_ID = /^ob_[0-9a-f]{48}$/;
 const SHA256 = /^[0-9a-f]{64}$/;
 const COMMIT = /^[0-9a-f]{40}$/;
@@ -155,11 +152,11 @@ async function body(response, what) {
 export async function readOnboardingStatus(repository, baseCommit, token, onboardRunId = null) {
     if (!COMMIT.test(baseCommit))
         throw new Error(`Invalid base commit ${baseCommit}.`);
-    const path = `${ONBOARDING_PATH}?repository=${encodeURIComponent(repository)}&baseCommit=${baseCommit}`
-        + (onboardRunId === null ? '' : `&onboardRunId=${encodeURIComponent(onboardRunId)}`);
+    const path = onboardingPath(repository, `?base=${baseCommit}`)
+        + (onboardRunId === null ? '' : `&run=${encodeURIComponent(onboardRunId)}`);
     const response = await gatewayFetch(path, token);
     if (!response.ok)
-        throw await classifyHttpError(response, `Haystack API ${ONBOARDING_PATH}`);
+        throw await classifyHttpError(response, `Haystack API ${path}`);
     return parseOnboardingStatus(await body(response, 'a status'), { repository, baseCommit });
 }
 /** Rule 12's start POST: onboard this base now, before any change exists. Idempotent: a
@@ -167,11 +164,11 @@ export async function readOnboardingStatus(repository, baseCommit, token, onboar
 export async function startOnboarding(repository, baseCommit, token) {
     if (!COMMIT.test(baseCommit))
         throw new Error(`Invalid base commit ${baseCommit}.`);
-    const response = await gatewayFetch(`${ONBOARDING_PATH}?repository=${encodeURIComponent(repository)}`, token, {
+    const response = await gatewayFetch(onboardingPath(repository), token, {
         method: 'POST', body: JSON.stringify({ repository, baseCommit }),
     });
     if (!response.ok)
-        throw await classifyHttpError(response, `Haystack API ${ONBOARDING_PATH}`);
+        throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository)}`);
     return parseOnboardingStatus(await body(response, 'a status'), { repository, baseCommit });
 }
 /** How often a command reads onboarding status while it runs. The status route holds no read (a crawl's reads wait for a
@@ -357,9 +354,9 @@ function repositoryOf(value) {
     return `${origin.owner}/${origin.repository}`;
 }
 export async function readFacts(repository, token) {
-    const response = await gatewayFetch(`${FACTS_PATH}?repository=${encodeURIComponent(repository)}`, token);
+    const response = await gatewayFetch(onboardingPath(repository, '/facts'), token);
     if (!response.ok)
-        throw await classifyHttpError(response, `Haystack API ${FACTS_PATH}`);
+        throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository, '/facts')}`);
     return parseFactsView(await body(response, 'facts'), repository);
 }
 /** `haystack verify answer <question-id> <choice>`: files the answer to an open
@@ -379,7 +376,7 @@ export async function verifyAnswerCommand(questionId, choice, options) {
         if (!question.choices.includes(choice)) {
             throw new Error(`"${choice}" is not one of the question's choices: ${question.choices.map(item => JSON.stringify(item)).join(', ')}.`);
         }
-        const response = await gatewayFetch(`${ANSWERS_PATH}?repository=${encodeURIComponent(repository)}`, auth.token, {
+        const response = await gatewayFetch(onboardingPath(repository, '/answers'), auth.token, {
             method: 'POST', body: JSON.stringify({ repository, expectedFactsDigest: facts.factsDigest, questionId, answer: choice }),
         });
         if (response.status === 409 && attempt < 3) {
@@ -387,7 +384,7 @@ export async function verifyAnswerCommand(questionId, choice, options) {
             continue;
         }
         if (!response.ok)
-            throw await classifyHttpError(response, `Haystack API ${ANSWERS_PATH}`);
+            throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository, '/answers')}`);
         const view = parseFactsView(await body(response, 'facts'), repository);
         if (options.json) {
             process.stdout.write(`${JSON.stringify(withSchema('verify-answer', { facts: view }), null, 2)}\n`);
@@ -407,7 +404,7 @@ export async function writeOnboardingNotes(repository, notes, token) {
         if (sameNotes(facts.facts.notes, notes))
             return 'unchanged';
         const request = { repository, expectedFactsDigest: facts.factsDigest, notes };
-        const response = await gatewayFetch(`${NOTES_PATH}?repository=${encodeURIComponent(repository)}`, token, {
+        const response = await gatewayFetch(onboardingPath(repository, '/notes'), token, {
             method: 'POST', body: JSON.stringify(request),
         });
         if (response.status === 409 && attempt < 3) {
@@ -415,7 +412,7 @@ export async function writeOnboardingNotes(repository, notes, token) {
             continue;
         }
         if (!response.ok)
-            throw await classifyHttpError(response, `Haystack API ${NOTES_PATH}`);
+            throw await classifyHttpError(response, `Haystack API ${onboardingPath(repository, '/notes')}`);
         if (!sameNotes(parseFactsView(await body(response, 'facts'), repository).facts.notes, notes))
             invalid('the notes it answered with');
         return 'written';

package/dist/commands/verify-precompute.js

@@ -8,7 +8,7 @@ import chalk from 'chalk';
 import { NotLoggedInError, resolveAuthContext } from '../utils/auth.js';
 import { findGitRoot, parseRemoteUrl, } from '../utils/git.js';
 import { resolveVerifyBaseSha } from '../utils/verify-base.js';
-import { HaystackApiError, haystackFetch, haystackJson, REPO_NOT_ENTITLED_CODE, SUBSCRIPTION_REQUIRED_CODE, } from '../utils/haystack-api.js';
+import { HaystackApiError, haystackFetch, haystackJson, REPO_NOT_ENTITLED_CODE, SUBSCRIPTION_REQUIRED_CODE, repoApiPath, } from '../utils/haystack-api.js';
 import { trackPrecomputeEvent } from '../utils/telemetry.js';
 import { findSecretsInPatch, isSecretBearingPath } from '../utils/secret-paths.js';
 import { startPrecomputeDelivery } from './precompute-delivery.js';
@@ -325,8 +325,7 @@ function precomputeResult(response) {
  * service no longer has it). */
 async function uploadSourcePatch(request, token, signal, force = false) {
     const gzipped = Buffer.from(request.patchGzBase64, 'base64');
-    const path = `/api/agent/cloud-verifier/source-patches/${request.patchSha256}`
-        + `?owner=${encodeURIComponent(request.owner)}&repository=${encodeURIComponent(request.repository)}`;
+    const path = repoApiPath(`${request.owner}/${request.repository}`, `/patches/${request.patchSha256}`);
     const found = force ? null : await haystackFetch(path, token, { method: 'HEAD', signal }, [404]);
     if (found === null || found.status === 404) {
         await haystackFetch(path, token, { method: 'PUT', headers: { 'Content-Type': 'application/gzip' }, body: gzipped, signal });
@@ -339,7 +338,7 @@ async function submitCapture(request, token, signal) {
     const { patchGzBase64: _inline, ...named } = request;
     const submit = async (force) => {
         const patchBytes = await uploadSourcePatch(request, token, signal, force);
-        return haystackJson('/api/agent/cloud-verifier/front-half', token, { method: 'POST',
+        return haystackJson(repoApiPath(`${request.owner}/${request.repository}`, '/checks'), token, { method: 'POST',
             headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ ...named, patchBytes }), signal });
     };
     try {