@haystackeditor/cli 0.8.0 → 0.9.0

package/dist/types.js

@@ -1,6 +1,258 @@
 /**
  * Haystack CLI Types
  *
- * These types define the .haystack.json schema that sandbox.py reads.
+ * Zod schemas for .haystack.json configuration + CLI-only types.
+ * The config schema matches what agent/modal/sandbox.py expects to read.
  */
-export {};
+import { z } from 'zod';
+// =============================================================================
+// VERIFICATION COMMANDS
+// =============================================================================
+const VerificationCommandSchema = z.object({
+    /** Human-readable name (e.g., "Build", "Lint", "Typecheck") */
+    name: z.string(),
+    /** The shell command to run (e.g., "pnpm build", "pnpm lint") */
+    run: z.string(),
+});
+// =============================================================================
+// FIXTURE SOURCES
+// =============================================================================
+const FixtureEntrySchema = z.object({
+    /** Where to load fixture data from */
+    source: z.string().refine((val) => val === 'passthrough' ||
+        val.startsWith('file://') ||
+        val.startsWith('https://') ||
+        val.startsWith('http://') ||
+        val.startsWith('s3://') ||
+        val.startsWith('r2://') ||
+        val.startsWith('script://'), {
+        message: 'Source must be passthrough, or start with file://, https://, http://, s3://, r2://, or script://',
+    }),
+    /** Headers to include when fetching from remote source */
+    headers: z.record(z.string(), z.string()).optional(),
+    /** Cookies to include when fetching from remote source */
+    cookies: z.string().optional(),
+});
+// =============================================================================
+// DEV SERVER
+// =============================================================================
+const DevServerSchema = z.object({
+    /** Command to start dev server (e.g., "pnpm dev") */
+    command: z.string(),
+    /** Port the dev server runs on */
+    port: z.number(),
+    /** Pattern in stdout that indicates server is ready (e.g., "Local:") */
+    ready_pattern: z.string().optional(),
+    /** Environment variables to set when starting the server */
+    env: z.record(z.string(), z.string()).optional(),
+});
+// =============================================================================
+// BABYSITTER CONFIGURATION
+// =============================================================================
+/** Valid AI reviewer source identifiers that the merge queue can wait for */
+export const AI_REVIEWER_SOURCES = [
+    'cursor',
+    'coderabbit',
+    'copilot',
+    'greptile',
+    'sourcery',
+    'qodo',
+    'codeant',
+    'ellipsis',
+    'korbit',
+    'panto',
+    'bito',
+    'graphite',
+    'deepsource',
+    'snyk',
+    'codacy',
+    'sonarcloud',
+    'sweep',
+    'codeguru',
+    'codereviewer',
+    'codium',
+];
+export const AI_REVIEWER_DISPLAY_NAMES = {
+    cursor: 'Cursor BugBot',
+    coderabbit: 'CodeRabbit',
+    copilot: 'GitHub Copilot',
+    greptile: 'Greptile',
+    sourcery: 'Sourcery',
+    qodo: 'Qodo',
+    codeant: 'CodeAnt AI',
+    ellipsis: 'Ellipsis',
+    korbit: 'Korbit AI',
+    panto: 'Panto AI',
+    bito: 'Bito AI',
+    graphite: 'Graphite',
+    deepsource: 'DeepSource',
+    snyk: 'Snyk',
+    codacy: 'Codacy',
+    sonarcloud: 'SonarCloud',
+    sweep: 'Sweep AI',
+    codeguru: 'Amazon CodeGuru',
+    codereviewer: 'CodeReviewBot',
+    codium: 'Codium',
+};
+const AIReviewerSourceSchema = z.enum(AI_REVIEWER_SOURCES);
+const BabysitterConfigSchema = z.object({
+    /** Enable the Haystack auto-merge queue */
+    merge_queue: z.boolean().optional(),
+    /** Automatically rebase PRs that develop merge conflicts after pushes to the base branch */
+    auto_resolve_conflicts: z.boolean().optional(),
+    /** Grace period configuration before auto-merging */
+    merge_debounce: z.object({
+        /** Default wait time in minutes before auto-merging */
+        default_minutes: z.number().optional(),
+        /** Per-author wait time overrides (author login → minutes) */
+        authors: z.record(z.string(), z.number()).optional(),
+    }).optional(),
+    /** AI reviewer sources to wait for before starting the merge grace period */
+    expected_ai_reviewers: z.array(AIReviewerSourceSchema).optional(),
+});
+// =============================================================================
+// SERVICE (for monorepos)
+// =============================================================================
+const ServiceSchema = z.object({
+    /** Root directory relative to repo root */
+    root: z.string().optional(),
+    /** Command to start the service */
+    command: z.string(),
+    /** Port the service runs on (not required for batch jobs) */
+    port: z.number().optional(),
+    /** Pattern in stdout that indicates service is ready */
+    ready_pattern: z.string().optional(),
+    /** Environment variables to set */
+    env: z.record(z.string(), z.string()).optional(),
+    /** Service type: 'server' (default) or 'batch' (run once, no port) */
+    type: z.enum(['server', 'batch']).optional(),
+    /** Services that must be started before this service */
+    depends_on: z.array(z.string()).optional(),
+});
+// =============================================================================
+// VERIFICATION
+// =============================================================================
+const VerificationSchema = z.object({
+    /** Commands to run for verification (build, lint, test, etc.) */
+    commands: z.array(VerificationCommandSchema).optional(),
+    /** Fixture data sources keyed by endpoint pattern */
+    fixtures: z.record(z.string(), FixtureEntrySchema).optional(),
+});
+// =============================================================================
+// AUTH CONFIGURATION
+// =============================================================================
+const AuthStrategySchema = z.enum(['bypass', 'fixture', 'token', 'test_account']);
+const TokenInjectionSchema = z.object({
+    type: z.enum(['cookie', 'localStorage', 'sessionStorage', 'header']),
+    name: z.string(),
+    secret: z.string(),
+    cookie_options: z
+        .object({
+        path: z.string().optional(),
+        domain: z.string().optional(),
+        secure: z.boolean().optional(),
+        httpOnly: z.boolean().optional(),
+        sameSite: z.enum(['Strict', 'Lax', 'None']).optional(),
+    })
+        .optional(),
+});
+const LoginStepSchema = z.object({
+    action: z.enum(['navigate', 'type', 'click', 'wait', 'submit']),
+    url: z.string().optional(),
+    selector: z.string().optional(),
+    value: z.string().optional(),
+    timeout: z.number().optional(),
+});
+const TestAccountSchema = z.object({
+    credentials_secret: z.string(),
+    login_flow: z.array(LoginStepSchema),
+    success_selector: z.string().optional(),
+    failure_selector: z.string().optional(),
+});
+const AuthConfigSchema = z.object({
+    strategy: AuthStrategySchema.default('bypass'),
+    env: z.record(z.string(), z.string()).optional(),
+    fixture: z
+        .object({
+        pattern: z.string(),
+        source: z.string(),
+    })
+        .optional(),
+    token: TokenInjectionSchema.optional(),
+    test_account: TestAccountSchema.optional(),
+    fallback: AuthStrategySchema.optional(),
+});
+// =============================================================================
+// DATABASE CONFIGURATION
+// =============================================================================
+const DatabaseStrategySchema = z.enum(['fixture', 'memory', 'seed', 'docker', 'remote']);
+const DockerServiceSchema = z.object({
+    image: z.string(),
+    port: z.number(),
+    env: z.record(z.string(), z.string()).optional(),
+    health_check: z.string().optional(),
+    health_timeout: z.number().optional(),
+});
+const DatabaseConfigBaseSchema = z.object({
+    strategy: DatabaseStrategySchema.default('fixture'),
+    env: z.record(z.string(), z.string()).optional(),
+    seed_command: z.string().optional(),
+    migrate_command: z.string().optional(),
+    services: z.array(DockerServiceSchema).optional(),
+    read_only: z.boolean().optional(),
+    ready_timeout: z.number().optional(),
+});
+const DatabaseConfigSchema = DatabaseConfigBaseSchema.extend({
+    fallback: DatabaseConfigBaseSchema.optional(),
+});
+// =============================================================================
+// AGENTIC CONFIGURATION
+// =============================================================================
+const AgenticToolSchema = z.enum(['opencode', 'claude-code', 'codex']);
+const AgenticSchema = z.object({
+    tool: AgenticToolSchema.optional(),
+});
+// =============================================================================
+// NETWORK CONFIGURATION
+// =============================================================================
+const NetworkConfigSchema = z.object({
+    /** Additional hosts/domains to allow egress to */
+    allow: z.array(z.string()).optional(),
+});
+// =============================================================================
+// SECRET DECLARATION
+// =============================================================================
+const SecretDeclarationSchema = z.object({
+    description: z.string().optional(),
+    required: z.boolean().optional(),
+    services: z.array(z.string()).optional(),
+});
+// =============================================================================
+// MAIN CONFIG
+// =============================================================================
+export const HaystackConfigSchema = z.object({
+    /** Config version (must be "1") */
+    version: z.literal('1'),
+    /** Project name (for display) */
+    name: z.string().optional(),
+    /** Package manager override (auto-detected if not specified) */
+    package_manager: z.enum(['npm', 'pnpm', 'yarn', 'bun']).optional(),
+    /** Development server configuration */
+    dev_server: DevServerSchema.optional(),
+    /** Multiple services (for monorepos) */
+    services: z.record(z.string(), ServiceSchema).optional(),
+    /** Verification configuration */
+    verification: VerificationSchema.optional(),
+    /** Auth configuration for sandbox verification */
+    auth: AuthConfigSchema.optional(),
+    /** Agentic configuration (project-level override) */
+    agentic: AgenticSchema.optional(),
+    /** Database configuration for sandbox verification */
+    database: DatabaseConfigSchema.optional(),
+    /** Network egress configuration */
+    network: NetworkConfigSchema.optional(),
+    /** Secrets required by this project */
+    secrets: z.record(z.string(), SecretDeclarationSchema).optional(),
+    /** Babysitter configuration for autonomous PR maintenance */
+    babysitter: BabysitterConfigSchema.optional(),
+});

package/dist/utils/analysis-api.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Haystack Analysis API client.
+ *
+ * Polls the result endpoint by PR identifier to check if analysis is ready,
+ * then fetches detailed results (bug detection + rule violations).
+ *
+ * Analysis is triggered automatically by the GitHub App webhook when a PR
+ * is created or updated — the CLI does not need to trigger it directly.
+ */
+export interface AnalysisVerdict {
+    state: 'good-to-merge' | 'needs-input' | 'failed';
+    bugCount: number;
+    warningCount: number;
+    ruleViolationCount: number;
+    summary: string;
+    issues: AnalysisIssue[];
+    reviewUrl: string;
+    /** Whether the PR was auto-merged after analysis */
+    autoMerged?: boolean;
+}
+export interface AnalysisIssue {
+    file: string;
+    line?: number;
+    message: string;
+    severity: 'error' | 'warning' | 'info';
+    source: 'bug-detection' | 'rule-violation';
+}
+export interface SynthesisDisplayIssue {
+    category: string;
+    summary: string;
+    detail: string;
+    agentFixPrompt?: string;
+    source?: string;
+}
+export interface VerifiedBug {
+    originalTitle: string;
+    verified: boolean;
+    assessedSeverity: 'low' | 'medium' | 'high' | 'critical';
+    likelihood?: 'rare' | 'uncommon' | 'common';
+    rationale: string;
+    source?: {
+        type: string;
+        commentId?: number;
+        author?: string;
+    };
+}
+export interface HumanReviewReason {
+    type: string;
+    severity: string;
+    reason: string;
+    source?: string;
+}
+export interface RatingSynthesis {
+    haystackRating: 1 | 2 | 3 | 4 | 5;
+    analysisVerdict?: 'clean' | 'has-issues';
+    synthesis: string;
+    synthesisDisplay?: SynthesisDisplayIssue[];
+    verifiedBugs: VerifiedBug[];
+    reviewRecommendation: {
+        canAutoMerge: boolean;
+    };
+    needsHumanReview?: boolean;
+    humanReviewReasons?: HumanReviewReason[];
+    phase?: 1 | 2;
+    verificationImpact?: string;
+    verificationConfidence?: {
+        level: 'high' | 'medium' | 'low' | 'none';
+        summary: string;
+    };
+    verification?: {
+        success: boolean;
+        lint?: {
+            success: boolean;
+            output?: string;
+        };
+        test?: {
+            success: boolean;
+            output?: string;
+        };
+        build?: {
+            success: boolean;
+            output?: string;
+        };
+    };
+}
+export type AnalysisReadyResult = {
+    status: 'ready';
+} | {
+    status: 'pending';
+} | {
+    status: 'error';
+    message: string;
+};
+/**
+ * Check if analysis results are available for a PR by polling the result endpoint.
+ * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.
+ */
+export declare function checkAnalysisReady(owner: string, repo: string, prNumber: number, token?: string): Promise<AnalysisReadyResult>;
+/**
+ * Fetch analysis results once complete. Combines bug detection and rule violations.
+ */
+export declare function fetchAnalysisResults(owner: string, repo: string, prNumber: number, token?: string): Promise<AnalysisVerdict>;
+/**
+ * Fetch the full rating synthesis for a PR.
+ * This is the rich analysis data shown on the Haystack feed — includes
+ * verdict, rating, structured findings, verified bugs, and agent fix prompts.
+ */
+export declare function fetchRatingSynthesis(owner: string, repo: string, prNumber: number, token?: string): Promise<RatingSynthesis | null>;

package/dist/utils/analysis-api.js

@@ -0,0 +1,194 @@
+/**
+ * Haystack Analysis API client.
+ *
+ * Polls the result endpoint by PR identifier to check if analysis is ready,
+ * then fetches detailed results (bug detection + rule violations).
+ *
+ * Analysis is triggered automatically by the GitHub App webhook when a PR
+ * is created or updated — the CLI does not need to trigger it directly.
+ */
+// ============================================================================
+// Constants
+// ============================================================================
+const PROD_API_BASE = 'https://8z9ssbamdj.execute-api.us-west-2.amazonaws.com/prod';
+// ============================================================================
+// API helpers
+// ============================================================================
+function apiHeaders(token) {
+    const headers = {
+        'Cache-Control': 'no-cache',
+        'User-Agent': 'Haystack-CLI',
+    };
+    if (token) {
+        headers['X-GitHub-Token'] = token;
+    }
+    return headers;
+}
+// ============================================================================
+// API functions
+// ============================================================================
+/**
+ * Check if analysis results are available for a PR by polling the result endpoint.
+ * Returns 'ready' if complete, 'pending' if not yet available, or 'error' for server failures.
+ */
+export async function checkAnalysisReady(owner, repo, prNumber, token) {
+    const url = `${PROD_API_BASE}/v3/result/${owner}/${repo}/${prNumber}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            headers: apiHeaders(token),
+        });
+    }
+    catch (err) {
+        return { status: 'error', message: err.message };
+    }
+    if (response.status === 404)
+        return { status: 'pending' };
+    if (!response.ok) {
+        return { status: 'error', message: `HTTP ${response.status}` };
+    }
+    let data;
+    try {
+        data = await response.json();
+    }
+    catch {
+        return { status: 'error', message: 'Invalid JSON response' };
+    }
+    return data.status === 'COMPLETED' ? { status: 'ready' } : { status: 'pending' };
+}
+/**
+ * Fetch analysis results once complete. Combines bug detection and rule violations.
+ */
+export async function fetchAnalysisResults(owner, repo, prNumber, token) {
+    const prIdentifier = `${owner}/${repo}#${prNumber}`;
+    const encodedId = encodeURIComponent(prIdentifier);
+    const reviewUrl = `https://haystackeditor.com/review/${owner}/${repo}/${prNumber}`;
+    const issues = [];
+    // Fetch bug detection
+    try {
+        const bugUrl = `${PROD_API_BASE}/v2/analysis/${encodedId}/bug_detection.json`;
+        const bugResp = await fetch(bugUrl, {
+            headers: apiHeaders(token),
+        });
+        if (bugResp.ok) {
+            const bugData = await bugResp.json();
+            if (bugData.bugs) {
+                for (const bug of bugData.bugs) {
+                    issues.push({
+                        file: bug.file || 'unknown',
+                        line: bug.line,
+                        message: bug.description || 'Bug detected',
+                        severity: bug.severity === 'critical' || bug.severity === 'high' ? 'error' : 'warning',
+                        source: 'bug-detection',
+                    });
+                }
+            }
+        }
+    }
+    catch {
+        // Bug detection not available — not fatal
+    }
+    // Fetch rule violations
+    try {
+        const rulesUrl = `${PROD_API_BASE}/v2/analysis/${encodedId}/rule_violations.json`;
+        const rulesResp = await fetch(rulesUrl, {
+            headers: apiHeaders(token),
+        });
+        if (rulesResp.ok) {
+            const rulesData = await rulesResp.json();
+            if (rulesData.violations) {
+                for (const v of rulesData.violations) {
+                    issues.push({
+                        file: v.file || 'unknown',
+                        line: v.line,
+                        message: v.message || `Rule violation: ${v.rule || 'unknown'}`,
+                        severity: v.severity === 'error' ? 'error' : 'warning',
+                        source: 'rule-violation',
+                    });
+                }
+            }
+        }
+    }
+    catch {
+        // Rule violations not available — not fatal
+    }
+    // Fetch merge decision (to check if auto-merged)
+    let autoMerged = false;
+    try {
+        const mergeUrl = `${PROD_API_BASE}/v2/analysis/${encodedId}/merge_decision.json`;
+        const mergeResp = await fetch(mergeUrl, {
+            headers: apiHeaders(token),
+        });
+        if (mergeResp.ok) {
+            const mergeData = await mergeResp.json();
+            autoMerged = mergeData.autoMerged === true;
+        }
+    }
+    catch {
+        // Merge decision not available — not fatal
+    }
+    const bugCount = issues.filter(i => i.source === 'bug-detection').length;
+    const ruleViolationCount = issues.filter(i => i.source === 'rule-violation').length;
+    const warningCount = issues.filter(i => i.severity === 'warning').length;
+    const errorCount = issues.filter(i => i.severity === 'error').length;
+    const state = errorCount === 0 && warningCount === 0 ? 'good-to-merge' : 'needs-input';
+    // Build summary
+    let summary;
+    if (state === 'good-to-merge') {
+        summary = autoMerged ? 'No issues found. PR was auto-merged.' : 'No issues found. Safe to merge.';
+    }
+    else {
+        const parts = [];
+        if (errorCount > 0)
+            parts.push(`${errorCount} error(s)`);
+        if (warningCount > 0)
+            parts.push(`${warningCount} warning(s)`);
+        if (bugCount > 0)
+            parts.push(`${bugCount} bug(s)`);
+        if (ruleViolationCount > 0)
+            parts.push(`${ruleViolationCount} rule violation(s)`);
+        summary = parts.join(', ') + ' found.';
+    }
+    return {
+        state,
+        bugCount,
+        warningCount,
+        ruleViolationCount,
+        summary,
+        issues,
+        reviewUrl,
+        autoMerged,
+    };
+}
+/**
+ * Fetch the full rating synthesis for a PR.
+ * This is the rich analysis data shown on the Haystack feed — includes
+ * verdict, rating, structured findings, verified bugs, and agent fix prompts.
+ */
+export async function fetchRatingSynthesis(owner, repo, prNumber, token) {
+    // Use v3/result endpoint (same as the Lambda serves generic files)
+    const url = `${PROD_API_BASE}/v3/result/${owner}/${repo}/${prNumber}/rating_synthesis.json`;
+    try {
+        const response = await fetch(url, {
+            headers: apiHeaders(token),
+        });
+        if (!response.ok)
+            return null;
+        const data = await response.json();
+        // Handle presigned URL redirect (Lambda returns { download_url } for large files)
+        // Presigned S3 URLs include auth in query params — do NOT forward the GitHub token
+        // (S3 rejects requests with both presigned auth and an Authorization/custom header)
+        if (data.download_url) {
+            const s3Resp = await fetch(data.download_url, {
+                headers: { 'User-Agent': 'Haystack-CLI' },
+            });
+            if (!s3Resp.ok)
+                return null;
+            return await s3Resp.json();
+        }
+        return data;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/utils/config.js

@@ -9,7 +9,7 @@ const CONFIG_FILENAME = '.haystack.json';
  */
 export async function findConfigPath(startDir = process.cwd()) {
     let dir = startDir;
-    while (true) {
+    for (;;) {
         const configPath = path.join(dir, CONFIG_FILENAME);
         try {
             await fs.access(configPath);

package/dist/utils/git.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Git utilities for haystack submit command.
+ *
+ * Provides functions for git operations: branch management, push, remote parsing.
+ */
+export { findGitRoot } from './hooks.js';
+export interface GitRemoteInfo {
+    owner: string;
+    repo: string;
+    remoteName: string;
+}
+export interface GitBranchInfo {
+    currentBranch: string;
+    defaultBranch: string;
+    isClean: boolean;
+    hasUncommittedChanges: boolean;
+    hasUnpushedCommits: boolean;
+}
+/**
+ * Get the current branch name
+ */
+export declare function getCurrentBranch(): string;
+/**
+ * Get the default branch (main or master)
+ */
+export declare function getDefaultBranch(): string;
+/**
+ * Check if working directory has uncommitted changes
+ */
+export declare function hasUncommittedChanges(): boolean;
+/**
+ * Check if current branch has unpushed commits
+ */
+export declare function hasUnpushedCommits(): boolean;
+/**
+ * Get comprehensive branch info
+ */
+export declare function getBranchInfo(): GitBranchInfo;
+/**
+ * Create a new branch from current HEAD
+ */
+export declare function createBranch(branchName: string): void;
+/**
+ * Check if a branch exists locally
+ */
+export declare function branchExists(branchName: string): boolean;
+/**
+ * Check if a branch exists on remote
+ */
+export declare function remoteBranchExists(remoteName: string, branchName: string): boolean;
+/**
+ * Checkout an existing branch
+ */
+export declare function checkoutBranch(branchName: string): void;
+/**
+ * Push current branch to remote with upstream tracking
+ */
+export declare function pushBranch(remoteName: string, branchName: string): void;
+/**
+ * Parse remote URL to extract owner and repo
+ * Supports both SSH and HTTPS URLs
+ */
+export declare function parseRemoteUrl(remoteName?: string): GitRemoteInfo;
+/**
+ * Get the last commit message (first line only)
+ */
+export declare function getLastCommitMessage(): string;
+/**
+ * Get the last commit SHA (short)
+ */
+export declare function getLastCommitSha(): string;
+/**
+ * Get full commit messages (subject + body) for all commits since base branch.
+ * Returns the combined log, or empty string if no commits or on error.
+ */
+export declare function getCommitMessagesSinceBase(baseBranch: string): string;
+/**
+ * Get the number of commits ahead of base branch
+ */
+export declare function getCommitsAhead(baseBranch: string): number;