npm - @hone-ai/cli - Versions diffs - 1.18.0 → 1.20.0 - Mend

@hone-ai/cli 1.18.0 → 1.20.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (35) hide show

package/bin/hone-mcp.js +9 -0
package/hone-cli.js +2171 -82
package/lib/agent-eval-judge.js +60 -0
package/lib/agent-eval-probes-adversarial.js +45 -0
package/lib/agent-eval-probes-boundary.js +0 -0
package/lib/agent-eval-probes-faithfulness.js +59 -0
package/lib/agent-eval-probes-safety.js +28 -0
package/lib/agent-executor.js +139 -0
package/lib/architect-config.js +121 -0
package/lib/bundle-paths.js +141 -0
package/lib/ci-gate-chooser.js +267 -0
package/lib/doctor-admin-merge.js +3 -2
package/lib/doctor-architecture.js +213 -0
package/lib/emit-pr.js +167 -0
package/lib/eval-evidence.js +213 -0
package/lib/eval-graders.js +98 -1
package/lib/git-env.js +94 -0
package/lib/git-helpers.js +3 -2
package/lib/judge-provider.js +63 -0
package/lib/materialize-diff.js +345 -0
package/lib/mcp-tools.js +310 -0
package/lib/patch-apply.js +108 -0
package/lib/pipeline-config.js +300 -0
package/lib/pipeline-status.js +27 -2
package/lib/refresh-knowledge.js +7 -0
package/lib/release-review-cache.js +162 -0
package/lib/release-review-config.js +4 -2
package/lib/schedule-cron.js +141 -0
package/lib/skill-eval-runner.js +667 -0
package/lib/stack-paths.js +84 -6
package/lib/story-classifier-extract.js +2 -1
package/lib/verify-patch.js +78 -0
package/lib/verify-pr.js +141 -0
package/mcp-server.js +67 -0
package/package.json +8 -5

package/lib/stack-paths.js CHANGED Viewed

@@ -235,10 +235,72 @@ function parsePlatformConfigPaths(yamlText) {
   return out;
 }
+/**
+ * Parse adopter-discovered `platform.metadata_types.config[].path` entries
+ * from a `.pipeline-config.yml` text. HC-018: closes the classifier loop
+ * by feeding setup-time-discovered CONFIG metadata locations into
+ * `classifyPathsForRepo` so adopter platforms (Salesforce, NetSuite, dbt,
+ * Terraform, ...) classify as CONFIG without needing to be hardcoded
+ * into STACK_PATH_TABLE.
+ *
+ * The YAML shape emitted by cli/lib/config-augment.js is:
+ *   platform:
+ *     metadata_types:
+ *       config:
+ *         - { type: customObjects, path: "force-app/main/default/objects/", count: 18 }
+ *
+ * Some discover paths are comma-joined multi-paths
+ * (e.g. "force-app/main/default/classes, force-app/main/default/triggers")
+ * — those are split into individual entries.
+ *
+ * Returned values are raw filesystem paths (NOT regex). The caller
+ * anchors + escapes them before unioning into `extraConfigPaths`.
+ *
+ * @param {string} yamlText
+ * @returns {string[]} raw path strings discovered under metadata_types.config[]
+ */
+function parsePlatformMetadataTypesConfigPaths(yamlText) {
+  if (typeof yamlText !== 'string' || yamlText.length === 0) return [];
+  const blockMatch = yamlText.match(/^platform:\s*\n((?:[ \t]+.*\n?)*)/m);
+  if (!blockMatch) return [];
+  const block = blockMatch[1];
+  // metadata_types: <body> — body lines indented strictly more than the key
+  const mtMatch = block.match(/^([ \t]*)metadata_types:\s*\n((?:\1[ \t]+.*\n?)*)/m);
+  if (!mtMatch) return [];
+  const mtBody = mtMatch[2];
+  // config: <body> under metadata_types — same indent-bounded scan
+  const cfgMatch = mtBody.match(/^([ \t]*)config:\s*\n((?:\1[ \t]+.*\n?)*)/m);
+  if (!cfgMatch) return [];
+  const cfgBody = cfgMatch[2];
+  // Match each inline-mapping item: `- { ..., path: "VALUE", ... }`
+  // (also accepts single-quoted and bare-token paths)
+  const out = [];
+  const re = /-\s*\{[^}]*\bpath:\s*(?:"([^"]+)"|'([^']+)'|([^,}\s]+))/g;
+  let m;
+  while ((m = re.exec(cfgBody)) !== null) {
+    const raw = (m[1] || m[2] || m[3] || '').trim();
+    if (!raw) continue;
+    // Discover code sometimes joins multiple paths with ", " — split them.
+    for (const piece of raw.split(/\s*,\s*/)) {
+      const v = piece.trim();
+      if (v) out.push(v);
+    }
+  }
+  return out;
+}
+/**
+ * Escape a literal filesystem path so it can be used as a RegExp pattern.
+ */
+function escapeRegexLiteral(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 /**
  * Higher-level classifier composing platform fingerprint detection +
- * adopter-supplied `.pipeline-config.yml platform.config_paths` + the
- * pure `classifyPathsForStack` core.
+ * adopter-supplied `.pipeline-config.yml platform.config_paths` +
+ * setup-discovered `platform.metadata_types.config[].path` (HC-018) +
+ * the pure `classifyPathsForStack` core.
  *
  * Pure-helper-with-injected-I/O shape (same as compliance-check.js):
  * caller wraps `fs.existsSync` and `fs.readFileSync` so the helper can
@@ -249,7 +311,12 @@ function parsePlatformConfigPaths(yamlText) {
  * @param {string} opts.repoRoot - absolute path to repo root
  * @param {(relativePath: string) => boolean} [opts.fileExists] - filesystem check
  * @param {(relativePath: string) => string|null} [opts.readFile] - file reader
- * @returns {{ category: string, detectedPlatforms: string[], configPathsUsed: string[] }}
+ * @returns {{
+ *   category: string,
+ *   detectedPlatforms: string[],
+ *   configPathsUsed: string[],
+ *   metadataConfigPathsUsed: string[]
+ * }}
  */
 function classifyPathsForRepo(opts = {}) {
   const { paths, repoRoot, fileExists, readFile } = opts;
@@ -261,19 +328,28 @@ function classifyPathsForRepo(opts = {}) {
     detectedPlatforms = detectPlatforms({ repoRoot, fileExists });
   } catch { /* defensive — if the module is unavailable, treat as no platforms */ }
-  // Read adopter-supplied platform.config_paths from .pipeline-config.yml (best-effort)
+  // Read adopter-supplied platform.config_paths + discovered metadata_types
+  // from .pipeline-config.yml (best-effort)
   let configPathsUsed = [];
+  let metadataConfigPathsUsed = [];
   try {
     if (typeof readFile === 'function') {
       const yamlText = readFile('.pipeline-config.yml');
       if (typeof yamlText === 'string' && yamlText.length > 0) {
         configPathsUsed = parsePlatformConfigPaths(yamlText);
+        metadataConfigPathsUsed = parsePlatformMetadataTypesConfigPaths(yamlText);
       }
     }
   } catch { /* defensive — bad YAML / missing file is a no-op */ }
-  const category = classifyPathsForStack(paths, { extraConfigPaths: configPathsUsed });
-  return { category, detectedPlatforms, configPathsUsed };
+  // metadata_types paths are raw filesystem prefixes — anchor + escape
+  // so a discovered `force-app/main/default/objects/` is matched as a
+  // path prefix, not as a free-form regex.
+  const metadataPatterns = metadataConfigPathsUsed.map(p => '^' + escapeRegexLiteral(p));
+  const extraConfigPaths = configPathsUsed.concat(metadataPatterns);
+  const category = classifyPathsForStack(paths, { extraConfigPaths });
+  return { category, detectedPlatforms, configPathsUsed, metadataConfigPathsUsed };
 }
 module.exports = {
@@ -282,4 +358,6 @@ module.exports = {
   classifyPathsForStack,
   classifyPathsForRepo,
   parsePlatformConfigPaths,
+  parsePlatformMetadataTypesConfigPaths,
+  escapeRegexLiteral,
 };

package/lib/story-classifier-extract.js CHANGED Viewed

@@ -19,6 +19,7 @@
  */
 const { execSync } = require('node:child_process');
+const { gitEnv } = require('./git-env');
 const fs = require('node:fs');
 const path = require('node:path');
@@ -181,7 +182,7 @@ function extractRecentlyModifiedOverlap(repoRoot, touchedFiles, windowDays) {
     try {
       const out = execSync(
         `git log --since="${w} days ago" --format=%H -- ${JSON.stringify(rel)}`,
-        { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+        { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
       ).trim();
       if (out) return true;
     } catch {

package/lib/verify-patch.js ADDED Viewed

@@ -0,0 +1,78 @@
+'use strict';
+/**
+ * verify-patch.js — HC-019n-followup-24 (pipeline-recovery condition 6).
+ *
+ * Condition 5 proved step_4's diff APPLIES. Condition 6 runs the adopter's test
+ * command against the applied diff and reports pass/fail — the first ground
+ * truth in the pipeline that the generated code does not BREAK the suite.
+ *
+ * The command runs inside a throwaway git WORKTREE checked out from HEAD, so the
+ * adopter's real tree (including uncommitted work) is never touched. This module
+ * is the pure half — resolving the command and interpreting an exit code into a
+ * verdict. The worktree lifecycle and process exec live in the CLI command,
+ * calling verdictFromRun() with the result, so this stays I/O-free and
+ * unit-testable.
+ *
+ * See .github/pipeline/HC-019n-followup-24/architect.md. NOTE the honest limit:
+ * a passing suite means "does not regress", NOT "the story is correctly
+ * implemented" — the existing tests may not cover the new behaviour.
+ */
+/** Exit codes, matching the check-patch convention so scripts can branch. */
+const EXIT = {
+  PASS: 0,          // tests passed on the applied diff
+  NO_DIFF: 1,       // no diff / fetch failure (condition-5 precondition unmet)
+  DOES_NOT_APPLY: 2, // diff did not apply
+  TESTS_FAILED: 3,  // diff applied, tests failed
+  TIMEOUT: 4,       // the command exceeded --timeout
+};
+/**
+ * Resolve which command to run.
+ *
+ * Priority: an explicit --command wins; else the adopter's configured
+ * ci.local_command; else the documented default `make ci`. Never an empty
+ * string (an empty command would "succeed" vacuously and report a false pass).
+ *
+ * @param {string|undefined} explicit  --command flag
+ * @param {string|undefined} configured ci_local_command from run config
+ * @returns {string}
+ */
+function resolveCommand(explicit, configured) {
+  const pick = (explicit && explicit.trim())
+    || (configured && configured.trim())
+    || 'make ci';
+  return pick;
+}
+/**
+ * Interpret a completed command run into a condition-6 verdict.
+ *
+ * @param {{ code: number|null, timedOut: boolean, stdout?: string, stderr?: string }} run
+ * @returns {{ verdict: 'pass'|'fail'|'timeout', exitCode: number, detail: string }}
+ */
+function verdictFromRun(run) {
+  if (run.timedOut) {
+    return { verdict: 'timeout', exitCode: EXIT.TIMEOUT, detail: 'test command exceeded the timeout' };
+  }
+  if (run.code === 0) {
+    return { verdict: 'pass', exitCode: EXIT.PASS, detail: 'tests passed on the applied diff' };
+  }
+  return {
+    verdict: 'fail',
+    exitCode: EXIT.TESTS_FAILED,
+    detail: `tests failed (exit ${run.code})` + (lastMeaningfulLine(run) ? `: ${lastMeaningfulLine(run)}` : ''),
+  };
+}
+/** The most useful one-liner from a failed run's output, for the report. */
+function lastMeaningfulLine({ stdout = '', stderr = '' }) {
+  const combined = `${stdout}\n${stderr}`.split('\n')
+    .map(l => l.trim())
+    .filter(Boolean);
+  // Prefer a line that names a failure; else the last non-empty line.
+  const failLine = combined.reverse().find(l => /fail|error|✗|not ok|assert/i.test(l));
+  return (failLine || combined[0] || '').slice(0, 200);
+}
+module.exports = { EXIT, resolveCommand, verdictFromRun, lastMeaningfulLine };

package/lib/verify-pr.js ADDED Viewed

@@ -0,0 +1,141 @@
+'use strict';
+/**
+ * verify-pr.js — HC-019n-followup-32 (pipeline-standards G4 §2, G3 functional half).
+ *
+ * The POST-emit-pr verification the recovery deferred. `check-patch` (cond 5) →
+ * `verify-patch` (cond 6, runs the tests) → `emit-pr` (cond 7, opens the PR) →
+ * **`verify-pr`** (this): once a real PR exists, run the real skill audit and the
+ * real CI gate against it — the two artifacts (step-5b-skill-audit.md,
+ * step-5c-ci.md) the server DAG can only MODEL, never execute (see
+ * HC-019n-followup-31: those steps are serverExecutable:false).
+ *
+ * This module is the PURE half — CI-gate mode resolution, `gh pr checks`
+ * interpretation, and the verdict — I/O-free and unit-testable. The gh/make-ci
+ * execution + artifact writes live in the CLI command.
+ *
+ * Unlike the code-reviewer prompt's step_5c (which DIAGNOSES + auto-fixes CI in a
+ * loop), verify-pr only VERIFIES and REPORTS a verdict — a CLI command states the
+ * truth; the operator (or a later closed loop) acts on it. NOTE the honest limit:
+ * a green CI gate means the checks passed, not that the change is correct.
+ */
+/** Exit codes, extending the check/verify-patch convention. */
+const EXIT = {
+  PASS: 0,        // all required CI gates green (skill audit is informational)
+  NO_PR: 1,       // could not resolve a PR / branch to verify
+  GATE_RED: 2,    // a required CI gate is failing
+  GATE_PENDING: 3, // checks did not reach a terminal state within the timeout
+  ERROR: 4,       // gh / command execution error
+};
+const GATE_MODES = ['github', 'local', 'both', 'none'];
+/**
+ * Resolve the CI-gate mode. Precedence: explicit --mode > config ci.gate >
+ * default 'github' (backward compat, matching the step_5c prompt contract).
+ */
+function resolveGateMode(explicit, configGate) {
+  const norm = (v) => {
+    const s = String(v == null ? '' : v).toLowerCase().trim();
+    return GATE_MODES.includes(s) ? s : null;
+  };
+  return norm(explicit) || norm(configGate) || 'github';
+}
+/**
+ * Interpret `gh pr checks <PR> --json name,state,bucket` output (an array).
+ * `bucket` is gh's own classification: pass | fail | pending | skipping | cancel.
+ *
+ * @param {Array<{name?:string, bucket?:string, state?:string, link?:string}>} rows
+ * @returns {{ total:number, passed:number, failed:number, pending:number,
+ *   skipped:number, failures:string[], allTerminal:boolean, allGreen:boolean }}
+ */
+function interpretGhChecks(rows) {
+  const list = Array.isArray(rows) ? rows : [];
+  let passed = 0, failed = 0, pending = 0, skipped = 0;
+  const failures = [];
+  for (const r of list) {
+    const bucket = String(r.bucket || r.state || '').toLowerCase();
+    if (bucket === 'pass') passed++;
+    else if (bucket === 'fail' || bucket === 'cancel') { failed++; failures.push(r.name || '(unnamed check)'); }
+    else if (bucket === 'skipping' || bucket === 'skipped') skipped++;
+    else pending++; // pending / queued / in_progress / unknown
+  }
+  return {
+    total: list.length,
+    passed, failed, pending, skipped, failures,
+    allTerminal: pending === 0,
+    // Green = at least one check, none failed, none still pending.
+    allGreen: list.length > 0 && failed === 0 && pending === 0,
+  };
+}
+/**
+ * Compute the overall CI-gate verdict from the per-mode results.
+ *
+ * @param {{ mode:string, gh?:object|null, local?:{code:number,timedOut:boolean}|null }} o
+ * @returns {{ verdict:'pass'|'fail'|'pending'|'disabled', exitCode:number, detail:string }}
+ */
+function ciGateVerdict({ mode, gh, local }) {
+  if (mode === 'none') {
+    return { verdict: 'disabled', exitCode: EXIT.PASS, detail: 'ci.gate=none — CI verification explicitly disabled (audit row only)' };
+  }
+  const parts = [];
+  let anyFail = false, anyPending = false;
+  if (mode === 'github' || mode === 'both') {
+    if (!gh) { anyFail = true; parts.push('github: could not read checks'); }
+    else if (gh.failed > 0) { anyFail = true; parts.push(`github: ${gh.failed}/${gh.total} failing (${gh.failures.join(', ')})`); }
+    else if (!gh.allTerminal) { anyPending = true; parts.push(`github: ${gh.pending} check(s) still pending`); }
+    else if (gh.total === 0) { anyPending = true; parts.push('github: no checks reported yet'); }
+    else parts.push(`github: ${gh.passed}/${gh.total} green`);
+  }
+  if (mode === 'local' || mode === 'both') {
+    if (!local) { anyFail = true; parts.push('local: command did not run'); }
+    else if (local.timedOut) { anyPending = true; parts.push('local: command timed out'); }
+    else if (local.code !== 0) { anyFail = true; parts.push(`local: \`make ci\` exit ${local.code}`); }
+    else parts.push('local: passed');
+  }
+  if (anyFail) return { verdict: 'fail', exitCode: EXIT.GATE_RED, detail: parts.join(' | ') };
+  if (anyPending) return { verdict: 'pending', exitCode: EXIT.GATE_PENDING, detail: parts.join(' | ') };
+  return { verdict: 'pass', exitCode: EXIT.PASS, detail: parts.join(' | ') };
+}
+/**
+ * Render the step-5c-ci.md gate matrix with a truthful provenance column.
+ * @returns {string} markdown
+ */
+function renderStep5cArtifact({ storyId, mode, prRef, gh, local, verdict }) {
+  const lines = [];
+  lines.push(`# Step 5c — CI Gate Verification (${storyId || 'unknown-story'})`);
+  lines.push('');
+  lines.push(`- **PR / branch:** ${prRef || '(unknown)'}`);
+  lines.push(`- **CI gate mode:** ${mode}`);
+  lines.push(`- **Verdict:** ${verdict.verdict.toUpperCase()} — ${verdict.detail}`);
+  lines.push(`- **Produced by:** \`hone verify-pr\` (real execution — NOT an LLM description; HC-019n-followup-32)`);
+  lines.push('');
+  lines.push('| Check | Result | Provenance |');
+  lines.push('|---|---|---|');
+  if (mode === 'none') {
+    lines.push('| (CI verification) | DISABLED | ci.gate=none |');
+  }
+  if ((mode === 'github' || mode === 'both') && gh) {
+    if (gh.total === 0) lines.push('| (github checks) | none reported | github |');
+    else {
+      lines.push(`| github checks | ${gh.passed} pass / ${gh.failed} fail / ${gh.pending} pending / ${gh.skipped} skip | github |`);
+      for (const f of gh.failures) lines.push(`| ❌ ${f} | FAIL | github |`);
+    }
+  }
+  if ((mode === 'local' || mode === 'both')) {
+    if (!local) lines.push('| local `make ci` | did not run | local |');
+    else lines.push(`| local \`make ci\` | ${local.timedOut ? 'TIMEOUT' : local.code === 0 ? 'PASS' : `FAIL (exit ${local.code})`} | ${local.code === 0 ? 'OPERATOR-VERIFIED-LOCAL' : 'local'} |`);
+  }
+  lines.push('');
+  lines.push('> Honest limit: a green CI gate means the checks passed, not that the change is correct.');
+  return lines.join('\n') + '\n';
+}
+module.exports = {
+  EXIT, GATE_MODES, resolveGateMode, interpretGhChecks, ciGateVerdict, renderStep5cArtifact,
+};

package/mcp-server.js ADDED Viewed

@@ -0,0 +1,67 @@
+'use strict';
+/**
+ * mcp-server.js — HC-COMM-012 (A1 P1): the Hone MCP server (stdio).
+ *
+ * A THIN bridge: it exposes the pipeline tool handlers (lib/mcp-tools.js, which shell
+ * out to the `hone` CLI) over the Model Context Protocol so Claude Code (and later
+ * any MCP editor) can drive the server-mode pipeline. It contains NO pipeline logic,
+ * NO prompts, NO agent chains — the moat stays server-side (architect memo HC-COMM-012).
+ *
+ * stdout is the MCP protocol channel — NEVER write logs to it; use stderr.
+ */
+const { Server } = require('@modelcontextprotocol/sdk/server/index.js');
+const { StdioServerTransport } = require('@modelcontextprotocol/sdk/server/stdio.js');
+const { ListToolsRequestSchema, CallToolRequestSchema } = require('@modelcontextprotocol/sdk/types.js');
+const { TOOLS, readHoneConfig } = require('./lib/mcp-tools');
+function buildServer() {
+  let version = '0.0.0';
+  try { version = require('./package.json').version; } catch { /* keep default */ }
+  const server = new Server({ name: 'hone', version }, { capabilities: { tools: {} } });
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: TOOLS.map((t) => ({
+      name: t.name,
+      description: t.description,
+      inputSchema: t.inputSchema,
+      annotations: { readOnlyHint: !!t.readOnly },
+    })),
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const tool = TOOLS.find((t) => t.name === req.params.name);
+    if (!tool) {
+      return { content: [{ type: 'text', text: `Unknown tool: ${req.params.name}` }], isError: true };
+    }
+    try {
+      const result = await tool.handler(req.params.arguments || {});
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }], isError: !!result.isError };
+    } catch (e) {
+      return { content: [{ type: 'text', text: `Tool error: ${e && e.message ? e.message : String(e)}` }], isError: true };
+    }
+  });
+  return server;
+}
+async function start() {
+  const server = buildServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  // Preflight (stderr only — stdout is the protocol channel). Editor-agnostic: this
+  // is the same signal in Claude Code, Cursor, Windsurf, or any MCP client.
+  const cfg = readHoneConfig();
+  process.stderr.write(
+    `hone MCP server ready — api=${cfg.apiUrl}, token=${cfg.hasToken ? 'present' : 'MISSING (run `hone init --token <t>`)'}, ${TOOLS.length} tools. ` +
+    `Run hone_doctor if calls fail.\n`,
+  );
+}
+if (require.main === module) {
+  start().catch((e) => {
+    process.stderr.write(`hone MCP server failed to start: ${e && e.message ? e.message : String(e)}\n`);
+    process.exit(1);
+  });
+}
+module.exports = { buildServer, start };

package/package.json CHANGED Viewed

@@ -1,17 +1,19 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {
-    "hone": "./bin/hone.js"
+    "hone": "./bin/hone.js",
+    "hone-mcp": "./bin/hone-mcp.js"
   },
   "files": [
     "bin/",
     "hone-cli.js",
     "lib/",
     "!lib/*.test.js",
-    "schema/"
+    "schema/",
+    "mcp-server.js"
   ],
   "scripts": {
     "test": "echo \"No tests yet\" && exit 0",
@@ -21,10 +23,11 @@
     "postinstall": "echo '\\n  Hone AI CLI installed successfully.\\n  Next: run `hone init --token <YOUR_TOKEN>` to configure.\\n  Docs: https://github.com/subbareddyvani/hone-server\\n'"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "ajv": "^8.20.0",
-    "axios": "^1.6.0",
+    "axios": "^1.20.0",
     "commander": "^11.0.0",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.3.2"
   },
   "engines": {
     "node": ">=18.0.0"