@haystackeditor/cli 0.7.2 → 0.8.1

package/dist/index.js

@@ -15,8 +15,10 @@ import { Command } from 'commander';
 import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
 import { loginCommand, logoutCommand } from './commands/login.js';
-import { listSecrets, setSecret, deleteSecret } from './commands/secrets.js';
-import { handleSandbox } from './commands/config.js';
+import { listSecrets, setSecret, getSecret, getSecretsForRepo, deleteSecret } from './commands/secrets.js';
+import { handleSandbox, handleAgenticTool } from './commands/config.js';
+import { installSkills, listSkills } from './commands/skills.js';
+import { hooksInstall, hooksStatus, hooksUpdate } from './commands/hooks.js';
 const program = new Command();
 program
     .name('haystack')
@@ -25,14 +27,15 @@ program
 program
     .command('init')
     .description('Create .haystack.json configuration')
-    .option('-y, --yes', 'Use auto-detected defaults without prompting')
+    .option('-f, --force', 'Overwrite existing .haystack.json')
     .addHelpText('after', `
-This creates a .haystack.json file that configures:
-  • How to start your dev server
-  • Verification commands (build, lint, typecheck)
+This creates a .haystack.json file with auto-detected settings:
+  • Dev server command and port
+  • Services (for monorepos)
   • Auth bypass for sandbox environments
 
-Once set up, AI agents can automatically spin up and test your app.
+After running, use /setup-haystack in Claude Code (or give your AI agent
+.agents/skills/setup-haystack.md) to add verification flows.
 `)
     .action(initCommand);
 program
@@ -63,6 +66,20 @@ secrets
     .action((key, value, options) => {
     setSecret(key, value, options);
 });
+secrets
+    .command('get <key>')
+    .description('Get a secret value')
+    .option('-q, --quiet', 'Output only the value (for piping)')
+    .action((key, options) => {
+    getSecret(key, options);
+});
+secrets
+    .command('get-for-repo <keys...>')
+    .description('Get multiple secrets needed by a repo')
+    .option('--json', 'Output as JSON')
+    .action((keys, options) => {
+    getSecretsForRepo(keys, options);
+});
 secrets
     .command('delete <key>')
     .description('Delete a secret')
@@ -86,6 +103,89 @@ Examples:
   haystack config sandbox off     # Disable sandbox mode
 `)
     .action(handleSandbox);
+config
+    .command('agentic-tool [tool]')
+    .description('Set agentic tool (opencode|claude-code|codex|status)')
+    .addHelpText('after', `
+Tools:
+  opencode      OpenCode (Haystack billing) - default
+  claude-code   Claude Code (your Claude Max subscription)
+  codex         Codex CLI (your ChatGPT subscription)
+  status        Show current setting (default)
+
+This sets your account-level default. Projects can override
+this in .haystack.json under agentic.tool.
+
+Examples:
+  haystack config agentic-tool              # Show current setting
+  haystack config agentic-tool opencode     # Use Haystack billing
+  haystack config agentic-tool claude-code  # Use your Claude Max
+  haystack config agentic-tool codex        # Use your ChatGPT
+`)
+    .action(handleAgenticTool);
+// Skills subcommands
+const skills = program
+    .command('skills')
+    .description('Manage AI skills for Claude Code');
+skills
+    .command('install')
+    .description('Install Haystack skills into your coding CLI')
+    .option('--cli <name>', 'Target CLI: claude, codex, cursor, or manual')
+    .addHelpText('after', `
+This registers the Haystack MCP server with your coding CLI, enabling:
+  /setup-haystack         - AI-assisted project setup
+  /prepare-haystack       - Add accessibility attributes
+  /setup-haystack-secrets - Configure secrets
+
+Supported CLIs:
+  claude    Claude Code (auto-detected)
+  codex     Codex CLI (auto-detected)
+  cursor    Cursor IDE (auto-detected)
+  manual    Show manual setup instructions
+
+Examples:
+  haystack skills install              # Auto-detect and install
+  haystack skills install --cli codex  # Install for Codex only
+  haystack skills install --cli manual # Show manual instructions
+`)
+    .action(installSkills);
+skills
+    .command('list')
+    .description('List available Haystack skills')
+    .action(listSkills);
+// Hooks subcommands
+const hooks = program
+    .command('hooks')
+    .description('Manage git hooks for AI agent quality checks');
+hooks
+    .command('install')
+    .description('Install Haystack git hooks and Entire CLI')
+    .option('--version <version>', 'Entire CLI version (default: pinned)')
+    .option('-f, --force', 'Overwrite existing hooks')
+    .option('--skip-entire', 'Skip Entire binary download')
+    .addHelpText('after', `
+This installs:
+  • Git hooks for AI agent quality checks (pre-commit, commit-msg, etc.)
+  • Agent context detector (identifies AI agent sessions)
+  • Truncation checker (prevents code truncation by LLMs)
+  • Entire CLI binary for session tracking (powered by https://entire.dev)
+
+Hooks are installed to <repo>/hooks/ and git is configured to use them.
+
+Examples:
+  haystack hooks install              # Install with pinned Entire version
+  haystack hooks install --force      # Overwrite existing hooks
+  haystack hooks install --skip-entire # Only install Haystack hooks
+`)
+    .action(hooksInstall);
+hooks
+    .command('status')
+    .description('Check hooks installation status')
+    .action(hooksStatus);
+hooks
+    .command('update')
+    .description('Update Entire CLI to the latest version')
+    .action(hooksUpdate);
 // Show help if no command provided
 if (process.argv.length === 2) {
     program.help();

package/dist/types.d.ts

@@ -34,19 +34,43 @@ export interface HaystackConfig {
      */
     network?: NetworkConfig;
     /**
-     * Secrets for fixture fetching and other operations.
-     * These are injected as environment variables in the sandbox.
-     * Supports tokens for staging APIs, S3 credentials, etc.
+     * Secrets required by this project.
+     * Values are stored securely on the Haystack platform via `haystack secrets set`.
+     * At runtime, secrets are fetched and injected as environment variables.
      *
-     * ⚠️ SECURITY: Never commit real secrets to git!
-     * Use environment variable references: $ENV_VAR or ${ENV_VAR}
+     * This field declares WHAT secrets are needed, not their values.
+     * Use `haystack secrets set KEY VALUE` to store the actual values.
      *
      * @example
      * secrets:
-     *   STAGING_TOKEN: "$STAGING_API_TOKEN"    # Read from local env
-     *   AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID}"
+     *   OPENAI_API_KEY:
+     *     description: "OpenAI API key for LLM calls"
+     *     required: true
+     *   STAGING_TOKEN:
+     *     description: "Token for staging API access"
+     *     required: false
      */
-    secrets?: Record<string, string>;
+    secrets?: Record<string, SecretDeclaration>;
+}
+/**
+ * Secret declaration - describes what a secret is for, not its value
+ */
+export interface SecretDeclaration {
+    /** Human-readable description of what this secret is used for */
+    description?: string;
+    /**
+     * Whether this secret is required for verification to run.
+     * If true and the secret is not set, verification will fail with an error.
+     * If false, verification will continue with a warning.
+     * @default false
+     */
+    required?: boolean;
+    /**
+     * Services that use this secret.
+     * If specified, the secret is only injected into these services' environments.
+     * If omitted, the secret is available to all services.
+     */
+    services?: string[];
 }
 /**
  * Dev server configuration (simple mode)

package/dist/utils/hooks.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Utilities for haystack hooks install/status/update commands.
+ *
+ * Handles Entire CLI binary download, hook file copying, and git configuration.
+ */
+export declare const ENTIRE_DEFAULT_VERSION = "0.4.8";
+export declare const ENTIRE_GITHUB_REPO = "entireio/cli";
+export declare const HAYSTACK_BIN_DIR: string;
+export declare const ENTIRE_BIN_PATH: string;
+export declare function getPlatformAssetName(): string;
+export declare function findGitRoot(): string | null;
+export declare function getInstalledEntireVersion(): Promise<string | null>;
+export declare function getLatestEntireVersion(): Promise<string>;
+export declare function downloadEntireBinary(version: string): Promise<void>;
+/** Resolves the path to dist/assets/hooks/ (or src/assets/hooks/ in dev) */
+export declare function getAssetsDir(): string;
+/** Copy hook scripts and TypeScript modules into the target hooks directory */
+export declare function copyHookFiles(hooksDir: string): Promise<void>;
+/** Install npm dependencies in the hooks directory */
+export declare function installHookDeps(hooksDir: string): Promise<void>;
+/** Copy LLM rules template if none exists */
+export declare function copyLlmRulesTemplate(repoRoot: string): Promise<boolean>;
+/** Create .entire/settings.json and .entire/.gitignore */
+export declare function createEntireConfig(repoRoot: string): Promise<void>;
+/** Add .entire/metadata/ to repo .gitignore if not already present */
+export declare function updateGitignore(repoRoot: string): Promise<boolean>;

package/dist/utils/hooks.js

@@ -0,0 +1,226 @@
+/**
+ * Utilities for haystack hooks install/status/update commands.
+ *
+ * Handles Entire CLI binary download, hook file copying, and git configuration.
+ */
+import * as fs from 'fs/promises';
+import { existsSync } from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { execSync } from 'child_process';
+import { fileURLToPath } from 'url';
+// ============================================================================
+// Constants
+// ============================================================================
+export const ENTIRE_DEFAULT_VERSION = '0.4.8';
+export const ENTIRE_GITHUB_REPO = 'entireio/cli';
+export const HAYSTACK_BIN_DIR = path.join(os.homedir(), '.haystack', 'bin');
+export const ENTIRE_BIN_PATH = path.join(HAYSTACK_BIN_DIR, 'entire');
+const HOOK_SCRIPTS = [
+    'pre-commit',
+    'commit-msg',
+    'post-commit',
+    'pre-push',
+    'prepare-commit-msg',
+];
+// ============================================================================
+// Platform detection
+// ============================================================================
+const OS_MAP = {
+    darwin: 'darwin',
+    linux: 'linux',
+};
+const ARCH_MAP = {
+    arm64: 'arm64',
+    x64: 'amd64',
+};
+export function getPlatformAssetName() {
+    const osName = OS_MAP[process.platform];
+    const archName = ARCH_MAP[process.arch];
+    if (!osName || !archName) {
+        throw new Error(`Unsupported platform: ${process.platform}-${process.arch}. Entire CLI supports macOS and Linux (amd64/arm64).`);
+    }
+    return `entire_${osName}_${archName}.tar.gz`;
+}
+// ============================================================================
+// Git repo detection
+// ============================================================================
+export function findGitRoot() {
+    try {
+        return execSync('git rev-parse --show-toplevel', {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+// ============================================================================
+// Entire binary management
+// ============================================================================
+export async function getInstalledEntireVersion() {
+    if (!existsSync(ENTIRE_BIN_PATH))
+        return null;
+    try {
+        const output = execSync(`"${ENTIRE_BIN_PATH}" --version`, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        // Output is like "entire version 0.4.8" or just "0.4.8"
+        const match = output.match(/(\d+\.\d+\.\d+)/);
+        return match ? match[1] : output;
+    }
+    catch {
+        return null;
+    }
+}
+export async function getLatestEntireVersion() {
+    const response = await fetch(`https://api.github.com/repos/${ENTIRE_GITHUB_REPO}/releases/latest`, {
+        headers: {
+            'User-Agent': 'Haystack-CLI',
+            Accept: 'application/vnd.github.v3+json',
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch latest Entire release: ${response.status} ${response.statusText}`);
+    }
+    const data = (await response.json());
+    // tag_name is like "v0.4.8"
+    return data.tag_name.replace(/^v/, '');
+}
+export async function downloadEntireBinary(version) {
+    const assetName = getPlatformAssetName();
+    const tag = version.startsWith('v') ? version : `v${version}`;
+    // Fetch release to get asset download URL
+    const releaseResponse = await fetch(`https://api.github.com/repos/${ENTIRE_GITHUB_REPO}/releases/tags/${tag}`, {
+        headers: {
+            'User-Agent': 'Haystack-CLI',
+            Accept: 'application/vnd.github.v3+json',
+        },
+    });
+    if (!releaseResponse.ok) {
+        throw new Error(`Failed to fetch Entire release ${tag}: ${releaseResponse.status}`);
+    }
+    const release = (await releaseResponse.json());
+    const asset = release.assets.find((a) => a.name === assetName);
+    if (!asset) {
+        throw new Error(`No binary found for ${assetName} in Entire release ${tag}. Available: ${release.assets.map((a) => a.name).join(', ')}`);
+    }
+    // Download the tar.gz
+    const downloadResponse = await fetch(asset.browser_download_url, {
+        headers: { 'User-Agent': 'Haystack-CLI' },
+    });
+    if (!downloadResponse.ok) {
+        throw new Error(`Failed to download ${assetName}: ${downloadResponse.status}`);
+    }
+    const buffer = Buffer.from(await downloadResponse.arrayBuffer());
+    // Create temp dir, extract, and move binary
+    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'haystack-entire-'));
+    const tarPath = path.join(tmpDir, assetName);
+    try {
+        await fs.writeFile(tarPath, buffer);
+        execSync(`tar xzf "${tarPath}" -C "${tmpDir}"`, { stdio: 'pipe' });
+        // Ensure bin dir exists
+        await fs.mkdir(HAYSTACK_BIN_DIR, { recursive: true });
+        // Move the binary
+        const extractedBinary = path.join(tmpDir, 'entire');
+        if (!existsSync(extractedBinary)) {
+            throw new Error('Entire binary not found in extracted archive');
+        }
+        await fs.copyFile(extractedBinary, ENTIRE_BIN_PATH);
+        await fs.chmod(ENTIRE_BIN_PATH, 0o755);
+    }
+    finally {
+        // Clean up temp dir
+        await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+}
+// ============================================================================
+// Asset directory resolution
+// ============================================================================
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+/** Resolves the path to dist/assets/hooks/ (or src/assets/hooks/ in dev) */
+export function getAssetsDir() {
+    // From dist/utils/hooks.js → dist/assets/hooks/
+    // From src/utils/hooks.ts → src/assets/hooks/
+    return path.resolve(__dirname, '..', 'assets', 'hooks');
+}
+// ============================================================================
+// Hook file operations
+// ============================================================================
+/** Copy hook scripts and TypeScript modules into the target hooks directory */
+export async function copyHookFiles(hooksDir) {
+    const assetsDir = getAssetsDir();
+    const scriptsDir = path.join(assetsDir, 'scripts');
+    // Ensure hooks directory exists
+    await fs.mkdir(hooksDir, { recursive: true });
+    // Copy shell scripts (strip .sh extension, set executable)
+    for (const hook of HOOK_SCRIPTS) {
+        const src = path.join(scriptsDir, `${hook}.sh`);
+        const dest = path.join(hooksDir, hook);
+        await fs.copyFile(src, dest);
+        await fs.chmod(dest, 0o755);
+    }
+    // Copy agent-context module
+    await copyDirRecursive(path.join(assetsDir, 'agent-context'), path.join(hooksDir, 'agent-context'));
+    // Copy truncation-checker module
+    await copyDirRecursive(path.join(assetsDir, 'truncation-checker'), path.join(hooksDir, 'truncation-checker'));
+    // Copy hooks package.json
+    await fs.copyFile(path.join(assetsDir, 'package.json'), path.join(hooksDir, 'package.json'));
+}
+/** Install npm dependencies in the hooks directory */
+export async function installHookDeps(hooksDir) {
+    execSync('npm install --no-fund --no-audit', {
+        cwd: hooksDir,
+        stdio: 'pipe',
+        timeout: 60_000,
+    });
+}
+/** Copy LLM rules template if none exists */
+export async function copyLlmRulesTemplate(repoRoot) {
+    const dest = path.join(repoRoot, 'LLM_RULES.md');
+    if (existsSync(dest))
+        return false;
+    const src = path.join(getAssetsDir(), 'llm-rules-template.md');
+    await fs.copyFile(src, dest);
+    return true;
+}
+/** Create .entire/settings.json and .entire/.gitignore */
+export async function createEntireConfig(repoRoot) {
+    const entireDir = path.join(repoRoot, '.entire');
+    await fs.mkdir(entireDir, { recursive: true });
+    await fs.writeFile(path.join(entireDir, 'settings.json'), JSON.stringify({ enabled: true, telemetry: false }, null, 2) + '\n', 'utf-8');
+    await fs.writeFile(path.join(entireDir, '.gitignore'), 'tmp/\nsettings.local.json\nmetadata/\nlogs/\n', 'utf-8');
+}
+/** Add .entire/metadata/ to repo .gitignore if not already present */
+export async function updateGitignore(repoRoot) {
+    const gitignorePath = path.join(repoRoot, '.gitignore');
+    let content = '';
+    if (existsSync(gitignorePath)) {
+        content = await fs.readFile(gitignorePath, 'utf-8');
+    }
+    if (content.includes('.entire/metadata'))
+        return false;
+    const addition = '\n# Entire CLI local session data\n.entire/metadata/\n';
+    await fs.writeFile(gitignorePath, content + addition, 'utf-8');
+    return true;
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+async function copyDirRecursive(src, dest) {
+    await fs.mkdir(dest, { recursive: true });
+    const entries = await fs.readdir(src, { withFileTypes: true });
+    for (const entry of entries) {
+        const srcPath = path.join(src, entry.name);
+        const destPath = path.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            await copyDirRecursive(srcPath, destPath);
+        }
+        else {
+            await fs.copyFile(srcPath, destPath);
+        }
+    }
+}

package/dist/utils/skill.d.ts

@@ -5,6 +5,6 @@
 export declare function createSkillFile(): Promise<string>;
 /**
  * Create the .claude/commands/ files for Claude Code slash commands
- * Users can invoke with /setup-haystack or /prepare-haystack
+ * Users can invoke with /setup-haystack, /prepare-haystack, or /setup-haystack-secrets
  */
 export declare function createClaudeCommand(): Promise<string>;