@haystackeditor/cli 0.9.0 → 0.10.0

package/README.md

@@ -1,68 +1,43 @@
 # @haystackeditor/cli
 
-Set up Haystack verification for your project. When PRs are opened, an AI agent spins up your app in a sandbox and verifies changes work correctly.
+Set up Haystack for your project. When PRs are opened, Haystack automatically analyzes them for bugs, intent drift, and rule violations.
 
 ## Quick Start
 
-### Fastest: AI-Assisted Setup
-
-```bash
-npx @haystackeditor/cli skills install
-```
-
-This auto-detects your coding CLI (Claude Code, Codex, Cursor) and installs the Haystack MCP server.
-
-Then invoke the setup in your coding CLI:
-
-| CLI | How to invoke |
-|-----|---------------|
-| **Claude Code** | `/setup-haystack` |
-| **Codex CLI** | `/setup-haystack` or ask "set up haystack verification" |
-| **Cursor** | `/setup-haystack` (in Composer) |
-
-The AI will analyze your codebase, create `.haystack.json`, and configure verification flows.
-
-### Alternative: Direct CLI Setup
-
-For quick setup without AI assistance:
-
 ```bash
-npx @haystackeditor/cli init
+npm install -g @haystackeditor/cli
+haystack login
+haystack setup
 ```
 
-This runs an interactive wizard that auto-detects your project and creates `.haystack.json`.
+The `setup` command walks you through an interactive wizard:
 
-### Additional Skills
-
-| Skill | Purpose |
-|-------|---------|
-| `/setup-haystack` | **Start here** - diagnoses project, creates config |
-| `/prepare-haystack` | Add aria-labels and data-testid for browser automation |
-| `/setup-haystack-secrets` | Configure API keys, LLM credentials, secrets |
+1. **Select repositories** to configure
+2. **Scan for coding rules** (conventions your team follows)
+3. **Scan for CI/bot signals** (checks to wait for before merging)
+4. **Scan for review policies** (who should review what)
+5. **Review and toggle** discovered items
+6. **Write `.haystack.json`** to your repos
 
 ---
 
 ## CLI Commands
 
-All commands can be run directly:
-
-### `haystack skills`
+### `haystack setup`
 
-Install AI skills into your coding CLI (auto-detects Claude Code, Codex, Cursor):
+Interactive onboarding wizard — scan your repos and generate `.haystack.json`:
 
 ```bash
-npx @haystackeditor/cli skills install              # Auto-detect CLI
-npx @haystackeditor/cli skills install --cli codex  # Install for Codex
-npx @haystackeditor/cli skills install --cli cursor # Install for Cursor
-npx @haystackeditor/cli skills install --cli manual # Show manual setup
-npx @haystackeditor/cli skills list                 # List available skills
+haystack setup
 ```
 
 ### `haystack init`
 
+Quick local setup — auto-detects your project and creates `.haystack.json` without scanning:
+
 ```bash
-npx @haystackeditor/cli init       # Interactive wizard
-npx @haystackeditor/cli init -y    # Accept all defaults
+haystack init              # Auto-detect and create config
+haystack init --force      # Overwrite existing .haystack.json
 ```
 
 ### `haystack status`
@@ -70,22 +45,22 @@ npx @haystackeditor/cli init -y    # Accept all defaults
 Check if your project is configured:
 
 ```bash
-npx @haystackeditor/cli status
+haystack status
 ```
 
 ### `haystack login`
 
-Authenticate with GitHub (required for secrets management):
+Authenticate with GitHub (required for setup and secrets):
 
 ```bash
-npx @haystackeditor/cli login
+haystack login
 ```
 
 This uses GitHub's device flow - you'll get a code to enter at github.com/login/device.
 
 ```bash
 # Log out (removes stored credentials)
-npx @haystackeditor/cli logout
+haystack logout
 ```
 
 ### `haystack secrets`
@@ -94,13 +69,13 @@ Manage secrets that will be injected into your sandbox environment:
 
 ```bash
 # List all secrets (keys only, values are never shown)
-npx @haystackeditor/cli secrets list
+haystack secrets list
 
 # Set a secret
-npx @haystackeditor/cli secrets set OPENAI_API_KEY sk-xxx
+haystack secrets set OPENAI_API_KEY sk-xxx
 
 # Delete a secret
-npx @haystackeditor/cli secrets delete OPENAI_API_KEY
+haystack secrets delete OPENAI_API_KEY
 ```
 
 Secrets are encrypted and stored securely. They're automatically injected as environment variables when the sandbox runs your app.
@@ -109,10 +84,10 @@ Secrets are encrypted and stored securely. They're automatically injected as env
 
 ```bash
 # Org-scoped (available to all repos in the org)
-npx @haystackeditor/cli secrets set API_KEY xxx --scope org --scope-id myorg
+haystack secrets set API_KEY xxx --scope org --scope-id myorg
 
 # Repo-scoped (available only to this repo)
-npx @haystackeditor/cli secrets set API_KEY xxx --scope repo --scope-id owner/repo
+haystack secrets set API_KEY xxx --scope repo --scope-id owner/repo
 ```
 
 ### `haystack submit`
@@ -120,14 +95,14 @@ npx @haystackeditor/cli secrets set API_KEY xxx --scope repo --scope-id owner/re
 Create a PR from current changes. Runs pre-PR triage (code review, rules validation, intent drift), pushes your branch, and opens the PR.
 
 ```bash
-haystack submit                      # Triage → create PR → wait for analysis
+haystack submit                      # Triage -> create PR -> wait for analysis
 haystack submit --title "Fix auth"   # Custom PR title
 haystack submit --draft              # Create as draft PR
 haystack submit --force              # Skip triage checks
 haystack submit --no-wait            # Don't wait for analysis results
 ```
 
-**Review routing**: By default, PRs go to the auto-merge queue — if analysis passes, the PR is merged automatically. Use `--review` to route it for human review instead:
+**Review routing**: By default, PRs go to the auto-merge queue -- if analysis passes, the PR is merged automatically. Use `--review` to route it for human review instead:
 
 ```bash
 haystack submit --review             # Needs review (goes to assignment queue)
@@ -148,7 +123,7 @@ haystack triage 42 --json                   # Machine-readable JSON output
 haystack triage 42 --no-wait                # Don't wait if analysis is pending
 ```
 
-The `--json` output includes `agentFixPrompt` fields — ready-to-paste instructions for coding agents to fix each finding.
+The `--json` output includes `agentFixPrompt` fields -- ready-to-paste instructions for coding agents to fix each finding.
 
 ### `haystack check-pending`
 
@@ -165,49 +140,34 @@ haystack check-pending --clear      # Clear pending state
 
 ## Configuration
 
-The `init` command creates `.haystack.json`:
-
-```yaml
-version: "1"
-name: my-app
-
-dev_server:
-  command: pnpm dev
-  port: 3000
-  ready_pattern: "Local:"
-  env:
-    SKIP_AUTH: "true"
-
-verification:
-  commands:
-    - name: build
-      run: pnpm build
-    - name: lint
-      run: pnpm lint
+The `setup` wizard writes `.haystack.json` to your repos with discovered rules, signals, and policies. You can also create a base config locally with `haystack init`:
+
+```json
+{
+  "version": "1",
+  "name": "my-app",
+  "dev_server": {
+    "command": "pnpm dev",
+    "port": 3000,
+    "ready_pattern": "Local:",
+    "env": {
+      "SKIP_AUTH": "true"
+    }
+  }
+}
 ```
 
-### Customizing After Init
-
-| If your app has... | Add this |
-|-------------------|----------|
-| Login/authentication | Auth bypass env var in `dev_server.env` |
-| Key user journeys | Flows describing what to verify |
-| API calls needing auth | Fixtures to mock responses |
-
-Use `/setup-haystack` in Claude Code for AI-assisted configuration of flows and fixtures.
-
 ---
 
 ## How It Works
 
-1. Run `npx @haystackeditor/cli init` or use `/setup-haystack` in Claude Code
-2. Commit the generated `.haystack.json`
-3. Install the [Haystack GitHub App](https://haystackeditor.com/github-app)
-4. When PRs are opened, Haystack's AI agent:
-   - Spins up your app in a cloud sandbox
-   - Runs verification commands
-   - Captures screenshots and evidence
+1. Run `haystack setup` to configure your repos (or `haystack init` for local-only config)
+2. Install the [Haystack GitHub App](https://haystackeditor.com/github-app)
+3. When PRs are opened, Haystack automatically:
+   - Analyzes the code for bugs, intent drift, and rule violations
    - Reports results on the PR
+   - Routes the PR to the right inbox tab (Good to Merge, Issues Found, etc.)
+   - If auto-merge is enabled, clean PRs merge automatically
 
 ## License
 

package/dist/assets/hooks/package.json

@@ -5,7 +5,7 @@
   "type": "module",
   "description": "Git hooks for AI agent quality checks (installed by @haystackeditor/cli)",
   "dependencies": {
-    "tree-sitter": "^0.22.4",
-    "tree-sitter-typescript": "^0.23.2"
+    "tree-sitter": "0.22.4",
+    "tree-sitter-typescript": "0.23.2"
   }
 }

package/dist/commands/dismiss.d.ts

@@ -0,0 +1,17 @@
+/**
+ * dismiss & mark-reviewed commands — User overrides for PR findings.
+ *
+ * haystack dismiss <pr>        — Dismiss analysis findings for a PR
+ * haystack mark-reviewed <pr>  — Mark human review as not needed for a PR
+ *
+ * Each posts a user override to the Haystack API so the PR moves toward
+ * "Good to Merge" in the feed.
+ *
+ * Accepts a PR identifier in several formats:
+ *   123                                    # Uses current repo's owner/repo
+ *   owner/repo#123                         # Fully qualified
+ *   https://github.com/owner/repo/pull/123 # GitHub URL
+ */
+export declare function dismissCommand(identifier: string): Promise<void>;
+export declare function markReviewedCommand(identifier: string): Promise<void>;
+export declare function undismissCommand(identifier: string): Promise<void>;

package/dist/commands/dismiss.js

@@ -0,0 +1,201 @@
+/**
+ * dismiss & mark-reviewed commands — User overrides for PR findings.
+ *
+ * haystack dismiss <pr>        — Dismiss analysis findings for a PR
+ * haystack mark-reviewed <pr>  — Mark human review as not needed for a PR
+ *
+ * Each posts a user override to the Haystack API so the PR moves toward
+ * "Good to Merge" in the feed.
+ *
+ * Accepts a PR identifier in several formats:
+ *   123                                    # Uses current repo's owner/repo
+ *   owner/repo#123                         # Fully qualified
+ *   https://github.com/owner/repo/pull/123 # GitHub URL
+ */
+import chalk from 'chalk';
+import { loadToken } from './login.js';
+import { parseRemoteUrl } from '../utils/git.js';
+// ============================================================================
+// PR identifier parsing (shared with triage — duplicated to avoid circular deps)
+// ============================================================================
+function parsePRIdentifier(identifier, commandName) {
+    const urlMatch = identifier.match(/^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/);
+    if (urlMatch) {
+        return { owner: urlMatch[1], repo: urlMatch[2], prNumber: parseInt(urlMatch[3], 10) };
+    }
+    const qualifiedMatch = identifier.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+    if (qualifiedMatch) {
+        return { owner: qualifiedMatch[1], repo: qualifiedMatch[2], prNumber: parseInt(qualifiedMatch[3], 10) };
+    }
+    const numberMatch = identifier.match(/^#?(\d+)$/);
+    if (numberMatch) {
+        const prNumber = parseInt(numberMatch[1], 10);
+        try {
+            const remote = parseRemoteUrl('origin');
+            return { owner: remote.owner, repo: remote.repo, prNumber };
+        }
+        catch {
+            throw new Error(`Cannot determine repository for PR #${prNumber}.\n` +
+                `Use the full format: haystack ${commandName} owner/repo#${prNumber}`);
+        }
+    }
+    throw new Error(`Invalid PR identifier: "${identifier}"\n\n` +
+        `Accepted formats:\n` +
+        `  haystack ${commandName} 123\n` +
+        `  haystack ${commandName} owner/repo#123\n` +
+        `  haystack ${commandName} https://github.com/owner/repo/pull/123`);
+}
+// ============================================================================
+// GitHub API helpers
+// ============================================================================
+async function getPRHeadSha(owner, repo, prNumber, token) {
+    const response = await fetch(`https://api.github.com/repos/${owner}/${repo}/pulls/${prNumber}`, {
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: 'application/vnd.github.v3+json',
+            'User-Agent': 'Haystack-CLI',
+        },
+    });
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new Error(`PR #${prNumber} not found in ${owner}/${repo}`);
+        }
+        throw new Error(`Failed to fetch PR: HTTP ${response.status}`);
+    }
+    const data = await response.json();
+    return data.head.sha;
+}
+// ============================================================================
+// User override API
+// ============================================================================
+const HAYSTACK_API = 'https://haystackeditor.com';
+async function postUserOverride(repoFullName, prNumber, commitSha, type, token) {
+    const response = await fetch(`${HAYSTACK_API}/api/user-override`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+            'User-Agent': 'Haystack-CLI',
+        },
+        body: JSON.stringify({ repoFullName, prNumber, commitSha, type }),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        if (response.status === 401) {
+            throw new Error('Authentication failed. Run `haystack login` to re-authenticate.');
+        }
+        if (response.status === 403) {
+            throw new Error('Access denied — you may not have permission to this repository.');
+        }
+        throw new Error(`API error (${response.status}): ${body}`);
+    }
+}
+async function deleteUserOverrides(repoFullName, prNumber, token) {
+    const response = await fetch(`${HAYSTACK_API}/api/user-override`, {
+        method: 'DELETE',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+            'User-Agent': 'Haystack-CLI',
+        },
+        body: JSON.stringify({ repoFullName, prNumber }),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        if (response.status === 401) {
+            throw new Error('Authentication failed. Run `haystack login` to re-authenticate.');
+        }
+        if (response.status === 403) {
+            throw new Error('Access denied — you may not have permission to this repository.');
+        }
+        throw new Error(`API error (${response.status}): ${body}`);
+    }
+}
+// ============================================================================
+// Shared runner
+// ============================================================================
+async function runOverride(identifier, type, commandName) {
+    // Parse PR identifier
+    let pr;
+    try {
+        pr = parsePRIdentifier(identifier, commandName);
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
+        process.exit(1);
+    }
+    // Require auth
+    const token = await loadToken();
+    if (!token) {
+        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+        process.exit(1);
+    }
+    const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
+    const repoFullName = `${pr.owner}/${pr.repo}`;
+    const actionLabel = type === 'findings-dismissed'
+        ? 'Dismissing findings'
+        : 'Marking review as not needed';
+    console.log(chalk.dim(`\n${actionLabel} for ${prLabel}...`));
+    // Get PR HEAD SHA
+    let headSha;
+    try {
+        headSha = await getPRHeadSha(pr.owner, pr.repo, pr.prNumber, token);
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
+        process.exit(1);
+    }
+    // Post the override
+    try {
+        await postUserOverride(repoFullName, pr.prNumber, headSha, type, token);
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
+        process.exit(1);
+    }
+    // Success
+    if (type === 'findings-dismissed') {
+        console.log(chalk.green(`\n  Findings dismissed for ${prLabel}`));
+    }
+    else {
+        console.log(chalk.green(`\n  Review marked as not needed for ${prLabel}`));
+    }
+    console.log(chalk.dim(`  Commit: ${headSha.slice(0, 7)}`));
+    console.log(chalk.dim('  The PR will move to "Good to Merge" in the feed.\n'));
+}
+// ============================================================================
+// Exported commands
+// ============================================================================
+export async function dismissCommand(identifier) {
+    await runOverride(identifier, 'findings-dismissed', 'dismiss');
+}
+export async function markReviewedCommand(identifier) {
+    await runOverride(identifier, 'review-not-needed', 'mark-reviewed');
+}
+export async function undismissCommand(identifier) {
+    let pr;
+    try {
+        pr = parsePRIdentifier(identifier, 'undismiss');
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
+        process.exit(1);
+    }
+    const token = await loadToken();
+    if (!token) {
+        console.error(chalk.red('\nNot logged in. Run `haystack login` first.\n'));
+        process.exit(1);
+    }
+    const prLabel = `${pr.owner}/${pr.repo}#${pr.prNumber}`;
+    const repoFullName = `${pr.owner}/${pr.repo}`;
+    console.log(chalk.dim(`\nClearing overrides for ${prLabel}...`));
+    try {
+        await deleteUserOverrides(repoFullName, pr.prNumber, token);
+    }
+    catch (err) {
+        console.error(chalk.red(`\n${err.message}\n`));
+        process.exit(1);
+    }
+    console.log(chalk.green(`\n  Overrides cleared for ${prLabel}`));
+    console.log(chalk.dim('  The PR will return to its original feed bucket.\n'));
+}

package/dist/commands/init.js

@@ -7,7 +7,8 @@ import chalk from 'chalk';
 import * as path from 'path';
 import { detectProject } from '../utils/detect.js';
 import { saveConfig, configExists } from '../utils/config.js';
-import { createSkillFile, createClaudeCommand } from '../utils/skill.js';
+// HIDDEN: Verification flow — uncomment to re-enable
+// import { createSkillFile, createClaudeCommand } from '../utils/skill.js';
 import { validateConfigSecurity, formatSecurityReport } from '../utils/secrets.js';
 export async function initCommand(options) {
     console.log(chalk.cyan('\n🌾 Haystack Setup\n'));
@@ -36,23 +37,17 @@ export async function initCommand(options) {
     const config = buildConfigFromDetection(detected);
     const configPath = await saveConfig(config);
     console.log(chalk.green(`✓ Created ${configPath}`));
-    // Create skill file for agent discovery
-    const skillPath = await createSkillFile();
-    console.log(chalk.green(`✓ Created ${skillPath}`));
-    // Create Claude Code slash command
-    const commandPath = await createClaudeCommand();
-    console.log(chalk.green(`✓ Created ${commandPath}`));
+    // HIDDEN: Verification flow — uncomment to re-enable
+    // // Create skill file for agent discovery
+    // const skillPath = await createSkillFile();
+    // console.log(chalk.green(`✓ Created ${skillPath}`));
+    //
+    // // Create Claude Code slash command
+    // const commandPath = await createClaudeCommand();
+    // console.log(chalk.green(`✓ Created ${commandPath}`));
     // Security validation
     await runSecurityCheck(configPath);
-    // Print next steps - direct to skill
-    console.log(chalk.cyan('\n━'.repeat(60)));
-    console.log(chalk.cyan.bold('\n📋 NEXT: Add verification flows\n'));
-    console.log(chalk.white('Base config created. Now an AI agent needs to add flows.\n'));
-    console.log(chalk.bold('Option 1: Claude Code'));
-    console.log(chalk.dim('  Run /setup-haystack in Claude Code\n'));
-    console.log(chalk.bold('Option 2: Other AI agents'));
-    console.log(chalk.dim('  Give your agent: "Read .agents/skills/setup-haystack.md and follow it"\n'));
-    console.log(chalk.cyan('━'.repeat(60) + '\n'));
+    console.log(chalk.green('\nDone! Run `haystack setup` to configure rules, signals, and policies.\n'));
 }
 /**
  * Run security check on config file
@@ -91,12 +86,13 @@ function buildConfigFromDetection(detected) {
             version: '1',
             name: path.basename(process.cwd()),
             services,
-            verification: {
-                commands: [
-                    { name: 'build', run: `${detected.packageManager} build` },
-                    { name: 'lint', run: `${detected.packageManager} lint` },
-                ],
-            },
+            // HIDDEN: Verification flow — uncomment to re-enable
+            // verification: {
+            //   commands: [
+            //     { name: 'build', run: `${detected.packageManager} build` },
+            //     { name: 'lint', run: `${detected.packageManager} lint` },
+            //   ],
+            // },
         };
     }
     return {
@@ -108,11 +104,12 @@ function buildConfigFromDetection(detected) {
             ready_pattern: detected.suggestedReadyPattern || 'Local:',
             ...(Object.keys(env).length > 0 ? { env } : {}),
         },
-        verification: {
-            commands: [
-                { name: 'build', run: `${detected.packageManager} build` },
-                { name: 'lint', run: `${detected.packageManager} lint` },
-            ],
-        },
+        // HIDDEN: Verification flow — uncomment to re-enable
+        // verification: {
+        //   commands: [
+        //     { name: 'build', run: `${detected.packageManager} build` },
+        //     { name: 'lint', run: `${detected.packageManager} lint` },
+        //   ],
+        // },
     };
 }

package/dist/commands/pr-status.d.ts

@@ -0,0 +1,16 @@
+/**
+ * pr-status command — Show the current Haystack status of a PR.
+ *
+ * Calls the classify-debug endpoint to determine which inbox bucket the PR
+ * is in (analyzing, auto-fixing, good-to-merge, issues, needs-assignment, etc.)
+ * and displays a human-readable summary.
+ *
+ * Accepts a PR identifier in several formats:
+ *   123                                    # Uses current repo's owner/repo
+ *   owner/repo#123                         # Fully qualified
+ *   https://github.com/owner/repo/pull/123 # GitHub URL
+ */
+export interface PRStatusOptions {
+    json?: boolean;
+}
+export declare function prStatusCommand(identifier: string, options: PRStatusOptions): Promise<void>;