@hiveai/cli 0.12.3 → 0.12.4

package/dist/index.js

@@ -2743,7 +2743,7 @@ ${SEED_FOOTER(stack)}` });
 }
 
 // src/commands/init.ts
-var HAIVE_GITHUB_ACTION_REF = `v${"0.12.3"}`;
+var HAIVE_GITHUB_ACTION_REF = `v${"0.12.4"}`;
 var PROJECT_CONTEXT_TEMPLATE = `# Project context
 
 > Generated by \`haive init\`. Run \`haive init --bootstrap\` to auto-fill from your codebase,
@@ -2778,7 +2778,7 @@ This repo uses **hAIve** for shared context. The map:
 1. **Before editing** for a goal, call \`get_briefing\` (task + files/symbols) to load ranked context \u2014 or \`mem_relevant_to\` if project context is already loaded this session.
 2. **When an approach fails**, call \`mem_tried\` right away so the next agent skips the dead end.
 3. **Before closing** a substantive session, run the \`post_task\` prompt to capture what was learned.
-4. **Before final response**, run \`haive enforce finish\`. If it blocks, commit/push, bump/tag shippable releases, then rerun it.
+4. **Before final response**, run \`haive enforce finish\`. If it blocks, commit/push, bump/tag shippable releases, wait for GitHub Actions to pass when applicable, then rerun it.
 
 If the haive MCP server is not available, tell the developer rather than silently skipping it.
 
@@ -2805,7 +2805,7 @@ This repository uses **hAIve**. Running \`haive init\` means the team expects ag
 
 - On failure: **\`mem_tried\`** immediately.
 - Before closing a substantive session: MCP prompt **\`post_task\`** when there is something worth capturing.
-- Before final response: **\`haive enforce finish\`** must pass; it checks commit/push and release version/tag protocol.
+- Before final response: **\`haive enforce finish\`** must pass; it checks commit/push, release version/tag protocol, and GitHub Actions success for pushed HEAD when the repo has a GitHub remote.
 
 ## If haive MCP is missing
 
@@ -7440,7 +7440,7 @@ This creates/updates a single rolling recap that **get_briefing automatically su
 
 Calling \`mem_session_end\` also **clears the pending-distill marker** (if any), confirming that this session's learnings have been properly captured rather than left as an auto-recap skeleton.
 
-### 7. Verify the git/release exit protocol \u2014 always
+### 7. Verify the git/release/pipeline exit protocol \u2014 always
 Run **\`haive enforce finish\`** before your final response.
 
 This executable gate checks the multi-agent git-sync decision:
@@ -7448,11 +7448,12 @@ This executable gate checks the multi-agent git-sync decision:
 - shippable package changes have a lockstep version bump
 - the release tag \`vX.Y.Z\` exists when a version was bumped
 - commits and tags have been pushed
+- the pushed HEAD's GitHub Actions workflow runs have completed successfully when the repo has a GitHub remote
 - agents never run \`npm publish\` (publication remains human-owned)
 
-If it blocks, fix the reported Git/version/tag/push issue before telling the developer the task is done.
+If it blocks, fix the reported Git/version/tag/push/pipeline issue before telling the developer the task is done.
 
-When done, respond with a brief summary: "Saved N memories: [list of IDs]. Session recap saved. hAIve finish gate passed."
+When done, respond with a brief summary: "Saved N memories: [list of IDs]. Session recap saved. hAIve finish gate passed; GitHub Actions passed when applicable."
 `;
   return {
     description: "Post-task reflection: capture what you learned before closing the session",
@@ -7531,7 +7532,7 @@ When done, respond with: "Imported N memories: [list of IDs]" or "Nothing action
   };
 }
 var SERVER_NAME = "haive";
-var SERVER_VERSION = "0.12.3";
+var SERVER_VERSION = "0.12.4";
 function jsonResult(data) {
   return {
     content: [
@@ -13001,7 +13002,7 @@ function registerDoctor(program2) {
         fix: "Edit .ai/haive.config.json: set autoSessionEnd: true (or re-run `haive init` without --manual)."
       });
     }
-    findings.push(...await collectInstallFindings(root, "0.12.3"));
+    findings.push(...await collectInstallFindings(root, "0.12.4"));
     findings.push(...await collectToolchainFindings(root));
     try {
       const legacyRaw = execSync3("haive-mcp --version", {
@@ -13009,7 +13010,7 @@ function registerDoctor(program2) {
         timeout: 3e3,
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
-      const cliVersion = "0.12.3";
+      const cliVersion = "0.12.4";
       if (legacyRaw && legacyRaw !== cliVersion) {
         findings.push({
           severity: "warn",
@@ -14371,6 +14372,7 @@ async function buildFinishReport(dir) {
       code: "release-version-not-required",
       message: "No shippable package code changed since upstream; no version/tag required."
     });
+    findings.push(...await verifyGithubActionsForHead(root, status));
     return finishReport(root, initialized, mode, findings, config);
   }
   findings.push({
@@ -14457,6 +14459,7 @@ async function buildFinishReport(dir) {
       impact: 10
     });
   }
+  findings.push(...await verifyGithubActionsForHead(root, status));
   return finishReport(root, initialized, mode, findings, config);
 }
 function finishReport(root, initialized, mode, findings, config) {
@@ -14600,7 +14603,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
       findings: [{ severity: "info", code: "enforcement-off", message: "hAIve enforcement is disabled." }]
     });
   }
-  findings.push(...await inspectIntegrationVersions(root, "0.12.3"));
+  findings.push(...await inspectIntegrationVersions(root, "0.12.4"));
   if (config.enforcement?.requireBriefingFirst !== false && stage !== "ci") {
     const hasBriefing = await hasRecentBriefingMarker2(paths, sessionId);
     findings.push(hasBriefing ? { severity: "ok", code: "briefing-loaded", message: "A recent hAIve briefing marker exists." } : {
@@ -15152,6 +15155,108 @@ async function remoteTagExists(root, tag) {
     return null;
   }
 }
+async function verifyGithubActionsForHead(root, status) {
+  if (!status.upstream) return [];
+  if (status.ahead > 0) {
+    return [{
+      severity: "info",
+      code: "github-actions-waiting-for-push",
+      message: "GitHub Actions verification waits until HEAD is pushed."
+    }];
+  }
+  const remote = await githubRemoteForCurrentBranch(root);
+  if (!remote) {
+    return [{
+      severity: "info",
+      code: "github-actions-not-applicable",
+      message: "No GitHub remote was detected; GitHub Actions pipeline verification was skipped."
+    }];
+  }
+  const sha = (await runCommand4("git", ["rev-parse", "HEAD"], root).catch(() => "")).trim();
+  if (!sha) {
+    return [{
+      severity: "error",
+      code: "github-actions-head-unreadable",
+      message: "Could not read HEAD SHA for GitHub Actions verification.",
+      fix: "Run `git rev-parse HEAD`, then verify GitHub Actions manually before finishing.",
+      impact: 30
+    }];
+  }
+  let runs;
+  try {
+    const raw = await runCommand4("gh", [
+      "run",
+      "list",
+      "--commit",
+      sha,
+      "--limit",
+      "50",
+      "--json",
+      "conclusion,databaseId,name,status,workflowName"
+    ], root);
+    runs = JSON.parse(raw);
+  } catch {
+    return [{
+      severity: "error",
+      code: "github-actions-unverified",
+      message: "Could not verify GitHub Actions runs for HEAD.",
+      fix: "Install/authenticate GitHub CLI, then run `gh run list --commit $(git rev-parse HEAD)` and ensure every workflow is successful before finishing.",
+      reason: `Detected GitHub remote ${remote}, but hAIve could not query workflow runs.`,
+      impact: 50
+    }];
+  }
+  if (runs.length === 0) {
+    return [{
+      severity: "error",
+      code: "github-actions-runs-missing",
+      message: "No GitHub Actions runs were found for HEAD.",
+      fix: "Wait for GitHub to create the workflow runs, or verify that the push was not skipped by a `[skip ci]` head commit; rerun `haive enforce finish` after the runs appear.",
+      impact: 50
+    }];
+  }
+  const pending = runs.filter((run) => run.status !== "completed");
+  if (pending.length > 0) {
+    return [{
+      severity: "error",
+      code: "github-actions-pending",
+      message: `${pending.length}/${runs.length} GitHub Actions workflow run(s) for HEAD are still pending: ${formatGithubRunNames(pending)}.`,
+      fix: "Wait for the runs to finish (`gh run watch <run-id> --exit-status`), then rerun `haive enforce finish`.",
+      impact: 50
+    }];
+  }
+  const failed = runs.filter((run) => run.conclusion !== "success");
+  if (failed.length > 0) {
+    return [{
+      severity: "error",
+      code: "github-actions-failed",
+      message: `${failed.length}/${runs.length} GitHub Actions workflow run(s) for HEAD did not pass: ${formatGithubRunNames(failed)}.`,
+      fix: "Inspect the failed run logs with `gh run view <run-id> --log`, fix the issue, push the fix, then rerun `haive enforce finish`.",
+      impact: 80
+    }];
+  }
+  return [{
+    severity: "ok",
+    code: "github-actions-pass",
+    message: `All ${runs.length} GitHub Actions workflow run(s) for HEAD completed successfully.`
+  }];
+}
+async function githubRemoteForCurrentBranch(root) {
+  const branch = (await runCommand4("git", ["branch", "--show-current"], root).catch(() => "")).trim();
+  const branchRemote = branch ? (await runCommand4("git", ["config", "--get", `branch.${branch}.remote`], root).catch(() => "")).trim() : "";
+  const remoteName = branchRemote || "origin";
+  const remoteUrl = (await runCommand4("git", ["config", "--get", `remote.${remoteName}.url`], root).catch(() => "")).trim();
+  if (!isGithubRemoteUrl(remoteUrl)) return null;
+  return remoteUrl;
+}
+function isGithubRemoteUrl(url) {
+  return /(^git@github\.com:|github\.com[/:])/.test(url);
+}
+function formatGithubRunNames(runs) {
+  return runs.slice(0, 6).map((run) => {
+    const label = run.workflowName ?? run.name ?? "workflow";
+    return run.databaseId ? `${label}#${run.databaseId}` : label;
+  }).join(", ");
+}
 function buildScore(findings, threshold = 80) {
   const checks = {
     total: findings.length,
@@ -15608,7 +15713,7 @@ function shellQuote(value) {
 
 // src/index.ts
 var program = new Command56();
-program.name("haive").description("hAIve - repo-native memory and context policy for coding-agent harnesses").version("0.12.3").option("--advanced", "show maintenance and experimental commands in help");
+program.name("haive").description("hAIve - repo-native memory and context policy for coding-agent harnesses").version("0.12.4").option("--advanced", "show maintenance and experimental commands in help");
 registerInit(program);
 registerWelcome(program);
 registerResolveProject(program);