@haystackeditor/cli 0.8.1 → 0.9.0

package/dist/commands/triage.js

@@ -0,0 +1,354 @@
+/**
+ * triage command — View Haystack analysis results for any PR.
+ *
+ * Fetches the full rating synthesis (same data shown on the Haystack feed)
+ * and displays verdict, findings, verified bugs, and agent fix prompts.
+ *
+ * Accepts a PR identifier in several formats:
+ *   haystack triage 123                  # Uses current repo's owner/repo
+ *   haystack triage owner/repo#123       # Fully qualified
+ *   haystack triage https://github.com/owner/repo/pull/123
+ */
+import chalk from 'chalk';
+import { checkAnalysisReady, fetchRatingSynthesis } from '../utils/analysis-api.js';
+import { parseRemoteUrl } from '../utils/git.js';
+import { loadToken } from './login.js';
+// ============================================================================
+// PR identifier parsing
+// ============================================================================
+/**
+ * Parse a PR identifier from various formats:
+ *   123                                    -> uses current repo
+ *   #123                                   -> uses current repo
+ *   owner/repo#123                         -> fully qualified
+ *   https://github.com/owner/repo/pull/123 -> GitHub URL
+ */
+function parsePRIdentifier(identifier) {
+    // GitHub URL: https://github.com/owner/repo/pull/123
+    const urlMatch = identifier.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/);
+    if (urlMatch) {
+        return { owner: urlMatch[1], repo: urlMatch[2], prNumber: parseInt(urlMatch[3], 10) };
+    }
+    // Fully qualified: owner/repo#123
+    const qualifiedMatch = identifier.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+    if (qualifiedMatch) {
+        return { owner: qualifiedMatch[1], repo: qualifiedMatch[2], prNumber: parseInt(qualifiedMatch[3], 10) };
+    }
+    // Bare number: 123 or #123
+    const numberMatch = identifier.match(/^#?(\d+)$/);
+    if (numberMatch) {
+        const prNumber = parseInt(numberMatch[1], 10);
+        // Infer owner/repo from git remote
+        try {
+            const remote = parseRemoteUrl('origin');
+            return { owner: remote.owner, repo: remote.repo, prNumber };
+        }
+        catch {
+            throw new Error(`Cannot determine repository for PR #${prNumber}.\n` +
+                `Use the full format: haystack triage owner/repo#${prNumber}`);
+        }
+    }
+    throw new Error(`Invalid PR identifier: "${identifier}"\n\n` +
+        `Accepted formats:\n` +
+        `  haystack triage 123\n` +
+        `  haystack triage owner/repo#123\n` +
+        `  haystack triage https://github.com/owner/repo/pull/123`);
+}
+// ============================================================================
+// Output formatting
+// ============================================================================
+function ratingLabel(rating) {
+    switch (rating) {
+        case 5: return chalk.green.bold('5/5') + chalk.green(' — Safe to merge');
+        case 4: return chalk.green('4/5') + chalk.dim(' — Low risk');
+        case 3: return chalk.yellow('3/5') + chalk.dim(' — Moderate risk');
+        case 2: return chalk.red('2/5') + chalk.dim(' — High risk');
+        case 1: return chalk.red.bold('1/5') + chalk.red(' — Critical issues');
+        default: return chalk.dim(`${rating}/5`);
+    }
+}
+function verdictLabel(verdict) {
+    switch (verdict) {
+        case 'clean': return chalk.green.bold('Clean');
+        case 'has-issues': return chalk.yellow.bold('Has Issues');
+        default: return chalk.dim('Unknown');
+    }
+}
+function severityIcon(severity) {
+    switch (severity) {
+        case 'critical': return chalk.red.bold('✗✗');
+        case 'high': return chalk.red('✗');
+        case 'medium': return chalk.yellow('!');
+        case 'low': return chalk.blue('·');
+        default: return chalk.dim('-');
+    }
+}
+function printRichOutput(pr, synthesis) {
+    const reviewUrl = `https://haystackeditor.com/review/${pr.owner}/${pr.repo}/${pr.prNumber}`;
+    console.log(chalk.bold('\n' + '━'.repeat(60)));
+    console.log(chalk.bold(`  Haystack Analysis: ${pr.owner}/${pr.repo}#${pr.prNumber}`));
+    console.log(chalk.bold('━'.repeat(60) + '\n'));
+    // Rating & verdict
+    console.log(`  ${chalk.dim('Rating:')}   ${ratingLabel(synthesis.haystackRating)}`);
+    console.log(`  ${chalk.dim('Verdict:')}  ${verdictLabel(synthesis.analysisVerdict)}`);
+    if (synthesis.phase) {
+        const phaseLabel = synthesis.phase === 2 ? 'Final (post-verification)' : 'Preliminary (pre-verification)';
+        console.log(`  ${chalk.dim('Phase:')}    ${chalk.dim(phaseLabel)}`);
+    }
+    if (synthesis.verificationConfidence) {
+        const conf = synthesis.verificationConfidence;
+        const levelColor = conf.level === 'high' ? chalk.green : conf.level === 'medium' ? chalk.yellow : chalk.red;
+        console.log(`  ${chalk.dim('Verified:')} ${levelColor(conf.level)} — ${chalk.dim(conf.summary)}`);
+    }
+    if (synthesis.reviewRecommendation?.canAutoMerge) {
+        console.log(`  ${chalk.dim('Merge:')}    ${chalk.green('Safe to auto-merge')}`);
+    }
+    // Verification results (build/test/lint)
+    if (synthesis.verification) {
+        const v = synthesis.verification;
+        const parts = [];
+        if (v.build)
+            parts.push(v.build.success ? chalk.green('build ✓') : chalk.red('build ✗'));
+        if (v.test)
+            parts.push(v.test.success ? chalk.green('test ✓') : chalk.red('test ✗'));
+        if (v.lint)
+            parts.push(v.lint.success ? chalk.green('lint ✓') : chalk.red('lint ✗'));
+        if (parts.length > 0) {
+            console.log(`  ${chalk.dim('Checks:')}   ${parts.join('  ')}`);
+        }
+    }
+    // Findings (synthesisDisplay) — the main actionable content
+    if (synthesis.synthesisDisplay && synthesis.synthesisDisplay.length > 0) {
+        console.log(chalk.bold('\n  Findings\n'));
+        for (let i = 0; i < synthesis.synthesisDisplay.length; i++) {
+            const finding = synthesis.synthesisDisplay[i];
+            const sourceTag = finding.source ? chalk.dim(` (via ${finding.source})`) : '';
+            console.log(`  ${chalk.yellow(`${i + 1}.`)} ${chalk.bold(finding.category)}${sourceTag}`);
+            console.log(`     ${finding.summary}`);
+            if (finding.detail) {
+                // Indent multi-line detail
+                const detailLines = finding.detail.split('\n');
+                for (const line of detailLines) {
+                    console.log(`     ${chalk.dim(line)}`);
+                }
+            }
+            console.log('');
+        }
+    }
+    // Verified bugs
+    const confirmedBugs = (synthesis.verifiedBugs || []).filter(b => b.verified);
+    if (confirmedBugs.length > 0) {
+        console.log(chalk.bold('  Verified Bugs\n'));
+        for (const bug of confirmedBugs) {
+            const sourceTag = bug.source ? chalk.dim(` (via ${bug.source.type}${bug.source.author ? `: ${bug.source.author}` : ''})`) : '';
+            console.log(`  ${severityIcon(bug.assessedSeverity)} ${chalk.bold(bug.originalTitle)}${sourceTag}`);
+            console.log(`     ${chalk.dim('Severity:')} ${bug.assessedSeverity}${bug.likelihood ? `, ${bug.likelihood} occurrence` : ''}`);
+            console.log(`     ${bug.rationale}`);
+            console.log('');
+        }
+    }
+    // Human review reasons
+    if (synthesis.humanReviewReasons && synthesis.humanReviewReasons.length > 0) {
+        console.log(chalk.bold('  Human Review Required\n'));
+        for (const reason of synthesis.humanReviewReasons) {
+            const icon = reason.severity === 'high' || reason.severity === 'critical'
+                ? chalk.red('!')
+                : chalk.yellow('·');
+            console.log(`  ${icon} ${reason.reason}`);
+            if (reason.source) {
+                console.log(`     ${chalk.dim(`Source: ${reason.source}`)}`);
+            }
+        }
+        console.log('');
+    }
+    // Agent fix prompts — the key actionable output for coding agents
+    const fixableFindings = (synthesis.synthesisDisplay || []).filter(f => f.agentFixPrompt);
+    if (fixableFindings.length > 0) {
+        console.log(chalk.bold('  Agent Fix Prompts'));
+        console.log(chalk.dim('  (Copy these to your coding agent to fix the issues)\n'));
+        for (let i = 0; i < fixableFindings.length; i++) {
+            const finding = fixableFindings[i];
+            console.log(chalk.cyan(`  --- Fix ${i + 1}: ${finding.category} ---`));
+            console.log(`  ${finding.agentFixPrompt}`);
+            console.log('');
+        }
+    }
+    // Verification impact
+    if (synthesis.verificationImpact) {
+        console.log(`  ${chalk.dim('Verification impact:')} ${synthesis.verificationImpact}`);
+        console.log('');
+    }
+    console.log(`  ${chalk.dim('Full review:')} ${chalk.cyan(reviewUrl)}`);
+    console.log('');
+}
+function printJsonOutput(pr, synthesis) {
+    const reviewUrl = `https://haystackeditor.com/review/${pr.owner}/${pr.repo}/${pr.prNumber}`;
+    const output = {
+        owner: pr.owner,
+        repo: pr.repo,
+        prNumber: pr.prNumber,
+        haystackRating: synthesis.haystackRating,
+        analysisVerdict: synthesis.analysisVerdict,
+        phase: synthesis.phase,
+        canAutoMerge: synthesis.reviewRecommendation?.canAutoMerge ?? false,
+        needsHumanReview: synthesis.needsHumanReview,
+        findings: (synthesis.synthesisDisplay || []).map(f => ({
+            category: f.category,
+            summary: f.summary,
+            detail: f.detail,
+            agentFixPrompt: f.agentFixPrompt || null,
+            source: f.source || null,
+        })),
+        verifiedBugs: (synthesis.verifiedBugs || []).filter(b => b.verified).map(b => ({
+            title: b.originalTitle,
+            severity: b.assessedSeverity,
+            likelihood: b.likelihood,
+            rationale: b.rationale,
+            source: b.source || null,
+        })),
+        humanReviewReasons: synthesis.humanReviewReasons || [],
+        verification: synthesis.verification || null,
+        verificationConfidence: synthesis.verificationConfidence || null,
+        reviewUrl,
+    };
+    console.log(JSON.stringify(output, null, 2));
+}
+// ============================================================================
+// Polling
+// ============================================================================
+const POLL_INTERVAL_MS = 5_000;
+const POLL_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+async function waitForAnalysis(owner, repo, prNumber, token, quiet) {
+    const deadline = Date.now() + POLL_TIMEOUT_MS;
+    let consecutiveErrors = 0;
+    while (Date.now() < deadline) {
+        const result = await checkAnalysisReady(owner, repo, prNumber, token);
+        if (result.status === 'ready')
+            return 'ready';
+        if (result.status === 'error') {
+            consecutiveErrors++;
+            if (consecutiveErrors >= 5)
+                return 'error';
+        }
+        else {
+            consecutiveErrors = 0;
+        }
+        if (!quiet) {
+            process.stderr.write(`\r  ${chalk.dim('Waiting for analysis to complete...')}${'  '.repeat(5)}`);
+        }
+        await new Promise(r => setTimeout(r, POLL_INTERVAL_MS));
+    }
+    return 'pending';
+}
+// ============================================================================
+// Main command
+// ============================================================================
+export async function triageCommand(identifier, options) {
+    // Parse PR identifier
+    let pr;
+    try {
+        pr = parsePRIdentifier(identifier);
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
+        process.exit(1);
+    }
+    // Load GitHub token for private repo auth
+    const token = await loadToken() || undefined;
+    if (!options.json) {
+        console.log(chalk.dim(`\nFetching analysis for ${pr.owner}/${pr.repo}#${pr.prNumber}...`));
+    }
+    // Check if analysis is ready — resolve to a terminal state before fetching
+    let analysisReady = false;
+    const readyResult = await checkAnalysisReady(pr.owner, pr.repo, pr.prNumber, token);
+    if (readyResult.status === 'ready') {
+        analysisReady = true;
+    }
+    else if (readyResult.status === 'pending') {
+        if (options.wait === false) {
+            if (options.json) {
+                console.log(JSON.stringify({
+                    owner: pr.owner, repo: pr.repo, prNumber: pr.prNumber, status: 'pending',
+                }, null, 2));
+            }
+            else {
+                console.log(chalk.yellow('\n  Analysis is still in progress.'));
+                console.log(chalk.dim('  Re-run without --no-wait to poll until complete.\n'));
+            }
+            return;
+        }
+        // Wait for analysis
+        if (!options.json) {
+            console.log(chalk.dim('  Analysis in progress, waiting...'));
+        }
+        const waitResult = await waitForAnalysis(pr.owner, pr.repo, pr.prNumber, token, options.json);
+        if (!options.json) {
+            process.stderr.write('\r' + ' '.repeat(60) + '\r');
+        }
+        if (waitResult === 'ready') {
+            analysisReady = true;
+        }
+        else if (waitResult === 'pending') {
+            if (options.json) {
+                console.log(JSON.stringify({
+                    owner: pr.owner, repo: pr.repo, prNumber: pr.prNumber, status: 'pending',
+                }, null, 2));
+            }
+            else {
+                console.log(chalk.yellow('\n  Timed out waiting for analysis.'));
+                console.log(chalk.dim('  Try again later: ') + chalk.cyan(`haystack triage ${pr.owner}/${pr.repo}#${pr.prNumber}\n`));
+            }
+            return;
+        }
+        else {
+            // waitResult === 'error'
+            if (options.json) {
+                console.log(JSON.stringify({
+                    owner: pr.owner, repo: pr.repo, prNumber: pr.prNumber, status: 'error',
+                }, null, 2));
+            }
+            else {
+                console.error(chalk.red('\n  Analysis check failed.\n'));
+            }
+            process.exit(1);
+        }
+    }
+    else {
+        // readyResult.status === 'error'
+        if (options.json) {
+            console.log(JSON.stringify({
+                owner: pr.owner, repo: pr.repo, prNumber: pr.prNumber,
+                status: 'error', message: readyResult.message,
+            }, null, 2));
+        }
+        else {
+            console.error(chalk.red(`\n  Analysis check failed: ${readyResult.message}\n`));
+        }
+        process.exit(1);
+    }
+    if (!analysisReady)
+        return;
+    // Fetch the full rating synthesis
+    const synthesis = await fetchRatingSynthesis(pr.owner, pr.repo, pr.prNumber, token);
+    if (!synthesis) {
+        if (options.json) {
+            console.log(JSON.stringify({
+                owner: pr.owner, repo: pr.repo, prNumber: pr.prNumber,
+                status: 'error', message: 'Rating synthesis not available',
+            }, null, 2));
+        }
+        else {
+            console.error(chalk.yellow('\n  Analysis completed but rating synthesis is not available yet.'));
+            console.log(chalk.dim('  Try again in a moment, or view the full review:'));
+            console.log(chalk.cyan(`  https://haystackeditor.com/review/${pr.owner}/${pr.repo}/${pr.prNumber}\n`));
+        }
+        process.exit(1);
+    }
+    // Output
+    if (options.json) {
+        printJsonOutput(pr, synthesis);
+    }
+    else {
+        printRichOutput(pr, synthesis);
+    }
+}

package/dist/index.d.ts

@@ -9,6 +9,9 @@
  *   npx @haystackeditor/cli init           # Set up .haystack.json
  *   npx @haystackeditor/cli status         # Check configuration
  *   npx @haystackeditor/cli login          # Authenticate with GitHub
+ *   npx @haystackeditor/cli submit         # Create a PR (auto-merge or review)
+ *   npx @haystackeditor/cli check-pending  # Check analysis status
+ *   npx @haystackeditor/cli triage 123     # View analysis results for a PR
  *   npx @haystackeditor/cli secrets list   # List stored secrets
  */
 export {};

package/dist/index.js

@@ -9,6 +9,9 @@
  *   npx @haystackeditor/cli init           # Set up .haystack.json
  *   npx @haystackeditor/cli status         # Check configuration
  *   npx @haystackeditor/cli login          # Authenticate with GitHub
+ *   npx @haystackeditor/cli submit         # Create a PR (auto-merge or review)
+ *   npx @haystackeditor/cli check-pending  # Check analysis status
+ *   npx @haystackeditor/cli triage 123     # View analysis results for a PR
  *   npx @haystackeditor/cli secrets list   # List stored secrets
  */
 import { Command } from 'commander';
@@ -16,14 +19,19 @@ import { statusCommand } from './commands/status.js';
 import { initCommand } from './commands/init.js';
 import { loginCommand, logoutCommand } from './commands/login.js';
 import { listSecrets, setSecret, getSecret, getSecretsForRepo, deleteSecret } from './commands/secrets.js';
-import { handleSandbox, handleAgenticTool } from './commands/config.js';
+import { handleSandbox, handleAgenticTool, handleAutoMerge, handleWaitForReviewers } from './commands/config.js';
 import { installSkills, listSkills } from './commands/skills.js';
 import { hooksInstall, hooksStatus, hooksUpdate } from './commands/hooks.js';
+import { submitCommand } from './commands/submit.js';
+import { checkPendingCommand } from './commands/check-pending.js';
+import { installSessionHooks, sessionHooksStatus } from './commands/install-session-hooks.js';
+import { listPolicies, addPolicy, removePolicy, initPolicies, addInstruction } from './commands/policy.js';
+import { triageCommand } from './commands/triage.js';
 const program = new Command();
 program
     .name('haystack')
     .description('Set up Haystack verification for your project')
-    .version('0.3.0');
+    .version('0.9.0');
 program
     .command('init')
     .description('Create .haystack.json configuration')
@@ -50,6 +58,107 @@ program
     .command('logout')
     .description('Remove stored credentials')
     .action(logoutCommand);
+program
+    .command('submit')
+    .description('Create a PR from current changes')
+    .option('--title <title>', 'PR title (default: last commit message)')
+    .option('--body <body>', 'PR body (default: commit messages since base)')
+    .option('--body-file <path>', 'Read PR body from file (use "-" for stdin)')
+    .option('--base <branch>', 'Base branch (default: main or master)')
+    .option('--draft', 'Create as draft PR')
+    .option('--review [reviewer]', 'Request human review (BLOCKS auto-merge — only use when explicitly asked)')
+    .option('--force', 'Skip pre-PR triage checks')
+    .option('--no-wait', 'Skip waiting for analysis results')
+    .addHelpText('after', `
+This command is designed for AI coding agents to submit PRs.
+
+  1. Runs pre-PR triage (code review, rules, intent drift) via sub-agents
+  2. Pushes the current branch to origin
+  3. Creates a pull request on GitHub
+  4. Waits for Haystack analysis results (triggered via GitHub App webhook)
+
+Pre-PR Triage:
+  Before creating the PR, haystack spawns parallel sub-agents to check for:
+  • Code review bugs (logic errors, null crashes, security issues)
+  • Rule violations (from .haystack/pr-rules.yml)
+  • Intent drift (AI agent deviations from user instructions)
+
+  Use --force to skip triage entirely.
+  Use --no-wait to skip waiting for analysis results.
+
+Review Routing:
+  By default, PRs enter the auto-merge queue and merge automatically once
+  Haystack analysis passes. This is the correct default for most PRs.
+
+  ⚠ Only use --review when the user EXPLICITLY asks for human review.
+  --review BLOCKS auto-merge — the PR will NOT merge until a human approves,
+  which delays merging. Do not add --review "just to be safe".
+
+  • --review             Labels the PR "haystack:needs-review" for the
+                         needs-assignment queue (a teammate will pick it up)
+  • --review <username>  Same label, plus requests review from that GitHub user
+
+Examples:
+  haystack submit                      # Triage, create PR, auto-merge queue
+  haystack submit --force              # Skip triage
+  haystack submit --no-wait            # Don't wait for analysis
+  haystack submit --title "Fix auth"   # Custom PR title
+  haystack submit --body "## Summary"  # Custom PR body (inline)
+  haystack submit --body-file body.md  # Read body from file (supports markdown)
+  echo "## Summary" | haystack submit --body-file -  # Read body from stdin
+  haystack submit --base develop       # Target a different base branch
+  haystack submit --draft              # Create as draft PR
+  haystack submit --review             # ⚠ Blocks auto-merge, needs human approval
+  haystack submit --review octocat     # ⚠ Blocks auto-merge, requests review from octocat
+`)
+    .action(submitCommand);
+program
+    .command('check-pending')
+    .description('Check status of pending Haystack analysis')
+    .option('--json', 'Output as JSON')
+    .option('--hook', 'Minimal output for session-start hooks')
+    .option('--clear', 'Clear pending submit state')
+    .addHelpText('after', `
+After \`haystack submit\`, this checks whether the analysis finished
+and shows a two-state verdict:
+
+  Good to merge     — No issues found, safe to merge
+  Needs your input  — Bugs or rule violations found
+
+This runs automatically on CLI session start if session hooks are installed.
+
+Examples:
+  haystack check-pending              # Rich terminal output
+  haystack check-pending --hook       # Minimal output (for hooks)
+  haystack check-pending --json       # Machine-readable JSON
+  haystack check-pending --clear      # Clear pending state
+`)
+    .action(checkPendingCommand);
+program
+    .command('triage <pr>')
+    .description('View Haystack analysis results for a PR')
+    .option('--json', 'Output as JSON')
+    .option('--no-wait', 'Exit immediately if analysis is still pending')
+    .addHelpText('after', `
+Look up triage results (bugs, rule violations, verdict) for any PR.
+
+PR identifier formats:
+  123                                     PR number (uses current repo)
+  #123                                    PR number with hash
+  owner/repo#123                          Fully qualified
+  https://github.com/owner/repo/pull/123  GitHub URL
+
+By default, if analysis is still in progress, the command will poll
+for up to 5 minutes. Use --no-wait to exit immediately instead.
+
+Examples:
+  haystack triage 42                          # Current repo, PR #42
+  haystack triage acme/widgets#99             # Specific repo
+  haystack triage https://github.com/o/r/pull/1  # From URL
+  haystack triage 42 --json                   # Machine-readable output
+  haystack triage 42 --no-wait                # Don't wait if pending
+`)
+    .action(triageCommand);
 // Secrets subcommands
 const secrets = program
     .command('secrets')
@@ -123,6 +232,52 @@ Examples:
   haystack config agentic-tool codex        # Use your ChatGPT
 `)
     .action(handleAgenticTool);
+config
+    .command('auto-merge [action]')
+    .description('Auto-merge safe PRs submitted via haystack submit (on|off|status)')
+    .addHelpText('after', `
+Actions:
+  on, enable    Enable auto-merge for safe PRs
+  off, disable  Disable auto-merge
+  status        Show current status (default)
+
+When enabled, PRs submitted via \`haystack submit\` will be
+automatically merged if Haystack analysis finds no issues
+(safe to merge). PRs with bugs or rule violations still
+require manual review.
+
+Examples:
+  haystack config auto-merge         # Show current status
+  haystack config auto-merge on      # Enable auto-merge
+  haystack config auto-merge off     # Disable auto-merge
+`)
+    .action(handleAutoMerge);
+config
+    .command('wait-for-reviewers [action] [reviewers...]')
+    .description('Configure which AI reviewers the merge queue waits for')
+    .addHelpText('after', `
+Actions:
+  list          Show current expected reviewers (default)
+  add <names>   Add one or more AI reviewer sources
+  remove <names> Remove one or more AI reviewer sources
+  clear         Remove all expected reviewers
+
+AI reviewer sources are stored in .haystack.json under
+babysitter.expected_ai_reviewers. The merge queue will
+wait for these reviewers to post before starting the
+grace period.
+
+Run \`haystack config wait-for-reviewers list\` to see
+all available reviewer sources and which are enabled.
+
+Examples:
+  haystack config wait-for-reviewers                    # Show status
+  haystack config wait-for-reviewers add cursor         # Wait for Cursor BugBot
+  haystack config wait-for-reviewers add cursor coderabbit  # Add multiple
+  haystack config wait-for-reviewers remove cursor      # Stop waiting for Cursor
+  haystack config wait-for-reviewers clear              # Wait for none
+`)
+    .action(handleWaitForReviewers);
 // Skills subcommands
 const skills = program
     .command('skills')
@@ -186,6 +341,81 @@ hooks
     .command('update')
     .description('Update Entire CLI to the latest version')
     .action(hooksUpdate);
+hooks
+    .command('install-session')
+    .description('Install session-start hooks for coding CLIs')
+    .option('--cli <name>', 'Target CLI: claude, codex, gemini, or all')
+    .addHelpText('after', `
+Configures your coding CLI to run \`haystack check-pending\` on session start.
+This shows pending PR analysis results when you open a new terminal session.
+
+  Claude Code:  Native SessionStart hook (.claude/settings.json)
+  Codex CLI:    AGENTS.md instructions
+  Gemini CLI:   GEMINI.md instructions
+
+Examples:
+  haystack hooks install-session              # Auto-detect CLIs
+  haystack hooks install-session --cli claude # Claude Code only
+  haystack hooks install-session --cli all    # All detected CLIs
+`)
+    .action(installSessionHooks);
+hooks
+    .command('session-status')
+    .description('Check session hook installation status')
+    .action(sessionHooksStatus);
+// Policy subcommands
+const policy = program
+    .command('policy')
+    .description('Manage review policies (.haystack/review-policy.md)');
+policy
+    .command('list')
+    .description('List all review policies')
+    .action(listPolicies);
+policy
+    .command('add [name]')
+    .description('Add a new review policy interactively')
+    .addHelpText('after', `
+This command prompts for:
+  • Policy name (e.g., "Infrastructure changes")
+  • File patterns (comma-separated globs, e.g., "terraform/**,*.tf")
+  • Severity (critical, high, medium, low)
+  • Reason (why this requires human review)
+
+Examples:
+  haystack policy add                    # Interactive add
+  haystack policy add "Database changes" # Start with name
+`)
+    .action(addPolicy);
+policy
+    .command('remove <name>')
+    .description('Remove a review policy by name')
+    .action(removePolicy);
+policy
+    .command('add-instruction [text]')
+    .description('Add a semantic review instruction')
+    .addHelpText('after', `
+Instructions are natural language directives that override default review behavior.
+They apply to all PRs (not file-pattern-gated).
+
+Examples:
+  haystack policy add-instruction "Never flag weak test coverage as needing review"
+  haystack policy add-instruction   # Interactive prompt
+`)
+    .action(addInstruction);
+policy
+    .command('init')
+    .description('Create initial review-policy.md with example policies')
+    .option('-f, --force', 'Overwrite existing file')
+    .addHelpText('after', `
+Creates .haystack/review-policy.md with sensible defaults:
+  • Infrastructure changes (terraform, pulumi, cdk)
+  • Secret files (*.secret*, *.env*, credentials)
+  • CI/CD pipelines (GitHub Actions, GitLab CI, etc.)
+
+The generated policies appear in Haystack's "Human Review Needed"
+section when a PR touches matching files.
+`)
+    .action(initPolicies);
 // Show help if no command provided
 if (process.argv.length === 2) {
     program.help();

package/dist/tools/detect.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Auto-detection utilities for framework, monorepo, and service configuration.
+ * Used by the setup wizard to provide smart defaults.
+ */
+export interface DetectedFramework {
+    name: string;
+    devCommand: string;
+    port: number;
+    readyPattern: string;
+    configFile: string;
+}
+export interface DetectedService {
+    name: string;
+    root: string;
+    type: 'server' | 'batch';
+    framework?: DetectedFramework;
+    /** Services this service depends on (detected from proxy config) */
+    depends_on?: string[];
+}
+export interface ProxyTarget {
+    /** Path pattern being proxied (e.g., "/api") */
+    path: string;
+    /** Target URL (e.g., "http://localhost:8787") */
+    target: string;
+    /** Port extracted from target */
+    port: number;
+}
+export interface ProjectDetection {
+    isMonorepo: boolean;
+    packageManager: 'npm' | 'pnpm' | 'yarn' | 'bun';
+    frameworks: DetectedFramework[];
+    services: DetectedService[];
+    /** Proxy targets detected from config files */
+    proxyTargets: ProxyTarget[];
+    suggestions: {
+        projectName: string;
+        devCommand: string;
+        port: number;
+        readyPattern: string;
+        authBypassEnv?: string;
+    };
+}
+/**
+ * Main detection function - analyzes a project directory
+ */
+export declare function detectProject(rootDir?: string): ProjectDetection;
+/**
+ * Format detection results for display to user
+ */
+export declare function formatDetectionSummary(detection: ProjectDetection): string;