@haystackeditor/cli 0.9.0 → 0.10.0

package/dist/commands/submit.d.ts

@@ -18,5 +18,6 @@ export interface SubmitOptions {
     review?: string | true;
     force?: boolean;
     wait?: boolean;
+    autoFix?: boolean;
 }
 export declare function submitCommand(options: SubmitOptions): Promise<void>;

package/dist/commands/submit.js

@@ -287,6 +287,19 @@ export async function submitCommand(options) {
         }
     }
     // -------------------------------------------------------------------------
+    // Step 6b: Apply auto-fix label if --auto-fix
+    // -------------------------------------------------------------------------
+    if (options.autoFix) {
+        try {
+            await ensureHaystackLabels(remoteInfo.owner, remoteInfo.repo, ['haystack:auto-fix']);
+            await addLabelsToIssue(remoteInfo.owner, remoteInfo.repo, prNumber, ['haystack:auto-fix']);
+            console.log(chalk.green('✓ Auto-fix enabled for this PR'));
+        }
+        catch (err) {
+            console.log(chalk.yellow(`⚠ Could not set auto-fix label: ${err.message}`));
+        }
+    }
+    // -------------------------------------------------------------------------
     // Step 7: Request review if --review
     // -------------------------------------------------------------------------
     if (options.review) {
@@ -318,6 +331,9 @@ export async function submitCommand(options) {
     if (autoMergeEnabled) {
         console.log(`  ${chalk.dim('Merge:')}  ${chalk.green('Auto-merge if safe')}`);
     }
+    if (options.autoFix) {
+        console.log(`  ${chalk.dim('Fix:')}    ${chalk.cyan('Auto-fix issues before Feed')}`);
+    }
     if (options.review) {
         const reviewer = typeof options.review === 'string' ? options.review : 'needs assignment';
         console.log(`  ${chalk.dim('Review:')} ${chalk.yellow(reviewer)}`);
@@ -388,6 +404,16 @@ export async function submitCommand(options) {
                         console.log(chalk.dim(`  ${verdict.summary}`));
                     }
                 }
+                else if (options.autoFix) {
+                    // Auto-fix flow: agent fixes straightforward issues in the background.
+                    // Issues appear in Feed immediately — user can review while agent works.
+                    console.log(chalk.cyan.bold('  ⚙ Auto-fix triggered\n'));
+                    console.log(chalk.dim(`  ${verdict.summary}\n`));
+                    console.log(chalk.dim('  Coding agent is fixing straightforward issues in the background.'));
+                    console.log(chalk.dim('  Issues that need your judgment are in the Feed now.\n'));
+                    const reviewUrl = `https://haystackeditor.com/review/${remoteInfo.owner}/${remoteInfo.repo}/${prNumber}`;
+                    console.log(`  ${chalk.dim('Feed:')} ${chalk.cyan(reviewUrl)}\n`);
+                }
                 else {
                     console.log(chalk.yellow.bold('  ⚠ Needs your input\n'));
                     console.log(chalk.dim(`  ${verdict.summary}\n`));
@@ -397,7 +423,9 @@ export async function submitCommand(options) {
                         console.log(`  ${icon} ${chalk.dim(loc)} ${issue.message}`);
                     }
                 }
-                console.log(`\n  ${chalk.dim('Review:')} ${chalk.cyan(verdict.reviewUrl)}\n`);
+                if (!options.autoFix || verdict.state === 'good-to-merge') {
+                    console.log(`\n  ${chalk.dim('Review:')} ${chalk.cyan(verdict.reviewUrl)}\n`);
+                }
             }
             catch {
                 console.log(chalk.yellow('⚠ Analysis complete but could not fetch results.'));

package/dist/index.d.ts

@@ -7,11 +7,15 @@
  *
  * Usage:
  *   npx @haystackeditor/cli init           # Set up .haystack.json
+ *   npx @haystackeditor/cli setup          # Interactive onboarding wizard
  *   npx @haystackeditor/cli status         # Check configuration
  *   npx @haystackeditor/cli login          # Authenticate with GitHub
  *   npx @haystackeditor/cli submit         # Create a PR (auto-merge or review)
  *   npx @haystackeditor/cli check-pending  # Check analysis status
  *   npx @haystackeditor/cli triage 123     # View analysis results for a PR
+ *   npx @haystackeditor/cli dismiss 123    # Dismiss findings for a PR
+ *   npx @haystackeditor/cli mark-reviewed 123 # Mark review as not needed
+ *   npx @haystackeditor/cli pr-status 123  # Show PR status in Haystack pipeline
  *   npx @haystackeditor/cli secrets list   # List stored secrets
  */
 export {};

package/dist/index.js

@@ -7,11 +7,15 @@
  *
  * Usage:
  *   npx @haystackeditor/cli init           # Set up .haystack.json
+ *   npx @haystackeditor/cli setup          # Interactive onboarding wizard
  *   npx @haystackeditor/cli status         # Check configuration
  *   npx @haystackeditor/cli login          # Authenticate with GitHub
  *   npx @haystackeditor/cli submit         # Create a PR (auto-merge or review)
  *   npx @haystackeditor/cli check-pending  # Check analysis status
  *   npx @haystackeditor/cli triage 123     # View analysis results for a PR
+ *   npx @haystackeditor/cli dismiss 123    # Dismiss findings for a PR
+ *   npx @haystackeditor/cli mark-reviewed 123 # Mark review as not needed
+ *   npx @haystackeditor/cli pr-status 123  # Show PR status in Haystack pipeline
  *   npx @haystackeditor/cli secrets list   # List stored secrets
  */
 import { Command } from 'commander';
@@ -27,6 +31,9 @@ import { checkPendingCommand } from './commands/check-pending.js';
 import { installSessionHooks, sessionHooksStatus } from './commands/install-session-hooks.js';
 import { listPolicies, addPolicy, removePolicy, initPolicies, addInstruction } from './commands/policy.js';
 import { triageCommand } from './commands/triage.js';
+import { dismissCommand, markReviewedCommand, undismissCommand } from './commands/dismiss.js';
+import { prStatusCommand } from './commands/pr-status.js';
+import { setupCommand } from './commands/setup.js';
 const program = new Command();
 program
     .name('haystack')
@@ -42,10 +49,29 @@ This creates a .haystack.json file with auto-detected settings:
   • Services (for monorepos)
   • Auth bypass for sandbox environments
 
-After running, use /setup-haystack in Claude Code (or give your AI agent
-.agents/skills/setup-haystack.md) to add verification flows.
+After running, use \`haystack setup\` to scan your repos for rules,
+CI signals, and review policies.
 `)
     .action(initCommand);
+program
+    .command('setup')
+    .description('Interactive onboarding wizard — scan repos for rules, signals, and policies')
+    .addHelpText('after', `
+This walks you through Haystack setup step by step:
+
+  1. Select GitHub repositories to configure
+  2. Scan for coding rules (conventions your team follows)
+  3. Scan for CI/bot signals (checks to wait for before merging)
+  4. Scan for review policies (who should review what)
+  5. Review and toggle discovered items
+  6. Write .haystack.json to your repos
+
+Requires authentication — run \`haystack login\` first.
+
+Examples:
+  haystack setup
+`)
+    .action(setupCommand);
 program
     .command('status')
     .description('Check if .haystack.json exists and is valid')
@@ -68,6 +94,7 @@ program
     .option('--draft', 'Create as draft PR')
     .option('--review [reviewer]', 'Request human review (BLOCKS auto-merge — only use when explicitly asked)')
     .option('--force', 'Skip pre-PR triage checks')
+    .option('--auto-fix', 'Auto-fix analysis issues in a sandbox before surfacing to Feed')
     .option('--no-wait', 'Skip waiting for analysis results')
     .addHelpText('after', `
 This command is designed for AI coding agents to submit PRs.
@@ -85,6 +112,7 @@ Pre-PR Triage:
 
   Use --force to skip triage entirely.
   Use --no-wait to skip waiting for analysis results.
+  Use --auto-fix to auto-fix analysis issues before surfacing to Feed.
 
 Review Routing:
   By default, PRs enter the auto-merge queue and merge automatically once
@@ -99,7 +127,8 @@ Review Routing:
   • --review <username>  Same label, plus requests review from that GitHub user
 
 Examples:
-  haystack submit                      # Triage, create PR, auto-merge queue
+  haystack submit --auto-fix           # Recommended: triage, create PR, auto-fix issues
+  haystack submit                      # Triage, create PR, auto-merge queue (no auto-fix)
   haystack submit --force              # Skip triage
   haystack submit --no-wait            # Don't wait for analysis
   haystack submit --title "Fix auth"   # Custom PR title
@@ -159,6 +188,87 @@ Examples:
   haystack triage 42 --no-wait                # Don't wait if pending
 `)
     .action(triageCommand);
+program
+    .command('dismiss <pr>')
+    .description('Dismiss analysis findings for a PR')
+    .addHelpText('after', `
+Dismiss analysis findings for a PR, moving it from "Issues Found" to
+"Good to Merge" in the Haystack feed.
+
+The override is tied to the PR's current HEAD commit. If a new commit is
+pushed, the override is invalidated and you'll need to dismiss again.
+
+PR identifier formats:
+  123                                     PR number (uses current repo)
+  #123                                    PR number with hash
+  owner/repo#123                          Fully qualified
+  https://github.com/owner/repo/pull/123  GitHub URL
+
+Examples:
+  haystack dismiss 42                  # Dismiss findings for PR #42
+  haystack dismiss acme/widgets#99     # Dismiss for specific repo
+`)
+    .action(dismissCommand);
+program
+    .command('mark-reviewed <pr>')
+    .description('Mark human review as not needed for a PR')
+    .addHelpText('after', `
+Mark human review as not needed for a PR, moving it from "Needs Review"
+to "Good to Merge" in the Haystack feed.
+
+The override is tied to the PR's current HEAD commit. If a new commit is
+pushed, the override is invalidated and you'll need to mark it again.
+
+PR identifier formats:
+  123                                     PR number (uses current repo)
+  #123                                    PR number with hash
+  owner/repo#123                          Fully qualified
+  https://github.com/owner/repo/pull/123  GitHub URL
+
+Examples:
+  haystack mark-reviewed 42                  # Mark review not needed for PR #42
+  haystack mark-reviewed acme/widgets#99     # Mark for specific repo
+`)
+    .action(markReviewedCommand);
+program
+    .command('undismiss <pr>')
+    .description('Undo a dismiss or mark-reviewed override for a PR')
+    .addHelpText('after', `
+Clear all overrides (dismissed findings and/or review-not-needed) for a PR,
+returning it to its original feed bucket.
+
+PR identifier formats:
+  123                                     PR number (uses current repo)
+  #123                                    PR number with hash
+  owner/repo#123                          Fully qualified
+  https://github.com/owner/repo/pull/123  GitHub URL
+
+Examples:
+  haystack undismiss 42                  # Undo overrides for PR #42
+  haystack undismiss acme/widgets#99     # Undo for specific repo
+`)
+    .action(undismissCommand);
+program
+    .command('pr-status <pr>')
+    .description('Show the current Haystack status of a PR')
+    .option('--json', 'Output as JSON')
+    .addHelpText('after', `
+Show what bucket a PR is in within the Haystack pipeline:
+  analyzing, auto-fixing, good-to-merge, issues, needs-assignment, etc.
+
+PR identifier formats:
+  123                                     PR number (uses current repo)
+  #123                                    PR number with hash
+  owner/repo#123                          Fully qualified
+  https://github.com/owner/repo/pull/123  GitHub URL
+
+Examples:
+  haystack pr-status 42                          # Current repo, PR #42
+  haystack pr-status acme/widgets#99             # Specific repo
+  haystack pr-status https://github.com/o/r/pull/1  # From URL
+  haystack pr-status 42 --json                   # Machine-readable output
+`)
+    .action(prStatusCommand);
 // Secrets subcommands
 const secrets = program
     .command('secrets')

package/dist/triage/prompts.d.ts

@@ -11,7 +11,7 @@
  * Build the code review prompt.
  * Always runs — looks for objective bugs in the diff.
  */
-export declare function buildCodeReviewPrompt(baseBranch: string, outputPath: string): string;
+export declare function buildCodeReviewPrompt(baseBranch: string, outputPath: string, precomputedDiff?: string | null): string;
 /**
  * Build the rules validator prompt.
  * Runs if .haystack/pr-rules.yml exists OR agent instruction files are found.
@@ -21,11 +21,11 @@ export declare function buildCodeReviewPrompt(baseBranch: string, outputPath: st
 export declare function buildRulesValidatorPrompt(baseBranch: string, rulesYaml: string, outputPath: string, agentPolicies?: {
     filename: string;
     content: string;
-}[]): string | null;
+}[], precomputedDiff?: string | null): string | null;
 /**
  * Build the intent drift prompt.
  * Only runs if relevant trace files exist.
  *
  * @returns The prompt string, or null if no trace files provided.
  */
-export declare function buildIntentDriftPrompt(baseBranch: string, traceFiles: string[], outputPath: string): string | null;
+export declare function buildIntentDriftPrompt(baseBranch: string, traceFiles: string[], outputPath: string, precomputedDiff?: string | null): string | null;

package/dist/triage/prompts.js

@@ -59,15 +59,27 @@ const INTENT_DRIFT_SCHEMA = `{
  * Build the code review prompt.
  * Always runs — looks for objective bugs in the diff.
  */
-export function buildCodeReviewPrompt(baseBranch, outputPath) {
-    return `You are a pre-PR code reviewer. Your job is to find OBJECTIVE BUGS in the code changes that will cause incorrect runtime behavior.
+export function buildCodeReviewPrompt(baseBranch, outputPath, precomputedDiff) {
+    const diffSection = precomputedDiff
+        ? `## Diff (precomputed)
+
+\`\`\`diff
+${precomputedDiff}
+\`\`\`
 
 ## Instructions
 
-1. Run \`git diff ${baseBranch}...HEAD --name-only\` to see which files changed.
-2. Run \`git diff ${baseBranch}...HEAD\` to see the full diff. For large diffs, review file by file.
-3. For each changed file, read the surrounding code if needed to understand context.
-4. Identify only REAL BUGS — things that will definitely crash, produce wrong results, or corrupt data.
+1. Review the diff above.
+2. If you need more context for a specific function, read just that section of the file — do NOT read entire large files.
+3. Identify only REAL BUGS — things that will definitely crash, produce wrong results, or corrupt data.`
+        : `## Instructions
+
+1. Run \`git diff ${baseBranch}...HEAD\` to see the full diff.
+2. If you need more context for a specific function, read just that section of the file — do NOT read entire large files.
+3. Identify only REAL BUGS — things that will definitely crash, produce wrong results, or corrupt data.`;
+    return `You are a pre-PR code reviewer. Your job is to find OBJECTIVE BUGS in the code changes that will cause incorrect runtime behavior.
+
+${diffSection}
 
 ## What to flag
 
@@ -110,7 +122,7 @@ Be extremely conservative. False positives waste the developer's time. Only flag
  *
  * @returns The prompt string, or null if no rules content or agent policies provided.
  */
-export function buildRulesValidatorPrompt(baseBranch, rulesYaml, outputPath, agentPolicies) {
+export function buildRulesValidatorPrompt(baseBranch, rulesYaml, outputPath, agentPolicies, precomputedDiff) {
     const hasRules = rulesYaml.trim().length > 0;
     const hasPolicies = agentPolicies && agentPolicies.length > 0;
     if (!hasRules && !hasPolicies)
@@ -165,14 +177,26 @@ For each extracted policy violation:
 
 `;
     }
-    return `You are a PR rules validator. Your job is to check the code changes against project rules and policies, then flag violations.
+    const diffInstructions = precomputedDiff
+        ? `## Diff (precomputed)
 
-${rulesSection}${policiesSection}## Instructions
+\`\`\`diff
+${precomputedDiff}
+\`\`\`
 
-1. Run \`git diff ${baseBranch}...HEAD --name-only\` to see which files changed.
-2. Run \`git diff ${baseBranch}...HEAD\` to see the full diff.
-3. Check ONLY the changed code (lines added or modified in the diff), not pre-existing code.
-4. If you need more context, read the relevant source files.
+## Instructions
+
+1. Review the diff above.
+2. Check ONLY the changed code (lines added or modified in the diff), not pre-existing code.
+3. If you need more context, read just the relevant section of the file — do NOT read entire large files.`
+        : `## Instructions
+
+1. Run \`git diff ${baseBranch}...HEAD\` to see the full diff.
+2. Check ONLY the changed code (lines added or modified in the diff), not pre-existing code.
+3. If you need more context, read just the relevant section of the file — do NOT read entire large files.`;
+    return `You are a PR rules validator. Your job is to check the code changes against project rules and policies, then flag violations.
+
+${rulesSection}${policiesSection}${diffInstructions}
 
 ## Important
 
@@ -199,7 +223,7 @@ ${RULES_VALIDATOR_SCHEMA}
  *
  * @returns The prompt string, or null if no trace files provided.
  */
-export function buildIntentDriftPrompt(baseBranch, traceFiles, outputPath) {
+export function buildIntentDriftPrompt(baseBranch, traceFiles, outputPath, precomputedDiff) {
     if (traceFiles.length === 0)
         return null;
     const traceFileList = traceFiles.map(f => `- \`${f}\``).join('\n');
@@ -218,7 +242,7 @@ ${traceFileList}
    - The user's original instruction/prompt (the first message)
    - Any follow-up instructions or corrections from the user
 
-3. Run \`git diff ${baseBranch}...HEAD\` to see what was actually implemented.
+3. ${precomputedDiff ? 'Review the diff below' : `Run \`git diff ${baseBranch}...HEAD\``} to see what was actually implemented.
 
 4. Compare the user's intent against the actual implementation. Look for:
 
@@ -262,5 +286,11 @@ ${INTENT_DRIFT_SCHEMA}
 
 - **error**: Core user intent violated — the main thing they asked for is wrong or missing
 - **warning**: Secondary requirement missed or approximated
-- **info**: Minor simplification that mostly still works as intended`;
+- **info**: Minor simplification that mostly still works as intended${precomputedDiff ? `
+
+## Diff (precomputed)
+
+\`\`\`diff
+${precomputedDiff}
+\`\`\`` : ''}`;
 }

package/dist/triage/runner.js

@@ -15,11 +15,11 @@ import { findRelevantTraces } from './traces.js';
 // ============================================================================
 const TRIAGE_DIR = '.haystack/triage';
 const TIMEOUT_MS = 300_000; // 5 minutes per checker
-/** Max agentic turns per checker */
+/** Max agentic turns per checker — kept tight since these are read-only tasks */
 const MAX_TURNS = {
-    'code-review': 30,
-    'rules-validator': 30,
-    'intent-drift': 30,
+    'code-review': 10,
+    'rules-validator': 10,
+    'intent-drift': 10,
 };
 // ============================================================================
 // Agent policy file discovery
@@ -232,13 +232,27 @@ export async function runTriage(gitRoot, baseBranch) {
         rmSync(triageDir, { recursive: true });
     }
     mkdirSync(triageDir, { recursive: true });
+    // Pre-compute the diff once so sub-agents don't waste turns running git diff.
+    // Includes 10 lines of context around each hunk for reviewability.
+    let precomputedDiff = null;
+    try {
+        const diffOutput = execSync(`git diff ${baseBranch}...HEAD -U10`, { cwd: gitRoot, encoding: 'utf-8', maxBuffer: 5 * 1024 * 1024 }).trim();
+        // Only inline if the diff is under 100K chars — beyond that, let the agent
+        // run git diff itself (it can paginate or review file-by-file).
+        if (diffOutput.length > 0 && diffOutput.length <= 100_000) {
+            precomputedDiff = diffOutput;
+        }
+    }
+    catch {
+        // git diff failed — agents will run it themselves
+    }
     // Build checker configs
     const checkers = [];
     // 1. Code review (always runs)
     const codeReviewOutput = join(triageDir, 'code-review.json');
     checkers.push({
         name: 'code-review',
-        prompt: buildCodeReviewPrompt(baseBranch, codeReviewOutput),
+        prompt: buildCodeReviewPrompt(baseBranch, codeReviewOutput, precomputedDiff),
         outputFile: codeReviewOutput,
         maxTurns: MAX_TURNS['code-review'],
     });
@@ -249,7 +263,7 @@ export async function runTriage(gitRoot, baseBranch) {
     const agentPolicyFiles = discoverAgentPolicyFiles(gitRoot);
     if (hasRulesYaml || agentPolicyFiles.length > 0) {
         const rulesValidatorOutput = join(triageDir, 'rules-validator.json');
-        const rulesPrompt = buildRulesValidatorPrompt(baseBranch, rulesYaml, rulesValidatorOutput, agentPolicyFiles);
+        const rulesPrompt = buildRulesValidatorPrompt(baseBranch, rulesYaml, rulesValidatorOutput, agentPolicyFiles, precomputedDiff);
         if (rulesPrompt) {
             checkers.push({
                 name: 'rules-validator',
@@ -263,7 +277,7 @@ export async function runTriage(gitRoot, baseBranch) {
     const traceFiles = findRelevantTraces(gitRoot, baseBranch);
     if (traceFiles.length > 0) {
         const intentDriftOutput = join(triageDir, 'intent-drift.json');
-        const driftPrompt = buildIntentDriftPrompt(baseBranch, traceFiles, intentDriftOutput);
+        const driftPrompt = buildIntentDriftPrompt(baseBranch, traceFiles, intentDriftOutput, precomputedDiff);
         if (driftPrompt) {
             checkers.push({
                 name: 'intent-drift',

package/dist/utils/pending-state.d.ts

@@ -18,6 +18,8 @@ export interface PendingSubmit {
     status: 'polling' | 'completed' | 'failed' | 'stale';
     analysisResult?: AnalysisVerdict;
     resolvedAt?: string;
+    autoFix?: boolean;
+    autoFixStatus?: 'pending' | 'fixing' | 'fixed' | 'failed' | 'timed_out';
 }
 /**
  * Save pending submit state to disk.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Set up Haystack verification for your project",
   "type": "module",
   "bin": {
@@ -32,18 +32,18 @@
     "url": "https://github.com/haystackeditor/haystack-review/issues"
   },
   "dependencies": {
-    "chalk": "^5.3.0",
-    "commander": "^12.0.0",
-    "fast-glob": "^3.3.0",
-    "glob": "^10.3.10",
-    "inquirer": "^9.2.0",
-    "yaml": "^2.3.4",
-    "zod": "^3.22.4"
+    "chalk": "5.6.2",
+    "commander": "12.1.0",
+    "fast-glob": "3.3.3",
+    "glob": "10.5.0",
+    "inquirer": "9.3.8",
+    "yaml": "2.8.2",
+    "zod": "3.25.76"
   },
   "devDependencies": {
-    "@types/inquirer": "^9.0.0",
-    "@types/node": "^20.10.0",
-    "typescript": "^5.3.0"
+    "@types/inquirer": "9.0.9",
+    "@types/node": "20.19.30",
+    "typescript": "5.9.3"
   },
   "files": [
     "dist"