@hone-ai/cli 1.19.0 → 1.20.0

package/lib/pipeline-status.js

@@ -15,7 +15,9 @@ const yaml = require('js-yaml');
 
 // ── Canonical step file naming convention (H-009/A2) ───────────────
 // Verified across .github/pipeline/H-001/, H-014/, H-029/, H-035/, H-076/.
-// step_3b is conditional (manual E2E mode only).
+// step_3b is conditional. HC-019n-followup-28 gave it an activation path:
+// run-story enables it (config.enableConditional) when e2e.spec_generation != 'never';
+// the orchestrator then runs it when the story requires an E2E plan, else skips it.
 // step_5b is conditional (SA-002 skill audit, present when story consults skills).
 // step_5c is conditional (H-076 CI gate, present after PR creation).
 //
@@ -83,7 +85,19 @@ const CONDITIONAL_STEPS = new Set(STEPS.filter(s => s.conditional).map(s => s.ke
 // get gobbled. The adopter-facing setup-ai-pipeline.sh default stays as
 // the H-005-canonical `[A-Z]+[-_][A-Za-z0-9]+` — pinned by
 // tests/regression/H-005-pizza-tracker-non-jira-regex.test.js.
-const STORY_ID_PATTERN = /(E[0-9]+-[A-Z][A-Za-z0-9]*(?:-followup-[0-9]+[a-z]?(?=[-_]|$))?|[A-Z]+[-_][A-Za-z0-9]+(?:-followup-[0-9]+[a-z]?(?=[-_]|$))?)/;
+// HC-CI-005: the middle alternative is NEW. `[A-Z]+[-_][A-Za-z0-9]+` stops at
+// the first segment, so a letters-letters-digits id read as only its first two
+// parts: HC-CI-003 -> "HC-CI", HC-COMM-007 -> "HC-COMM", HC-RC-002 -> "HC-RC".
+// That silently broke the HC-019b-followup-1 F1 architect-config lookup, which
+// keys on the extracted id — a miss looks identical to "no architect needed".
+//
+// The new alternative is deliberately NARROW: letters, letters, then DIGITS.
+// A generic trailing `(?:-[A-Za-z0-9]+)*` would be greedy and swallow branch
+// prose — `HC-052-add-uuid-validation` would extract "HC-052-add". Verified:
+// with this alternative that branch still yields "HC-052".
+// Order matters — regex alternation is first-match-wins, so this must precede
+// the general form or the general form shadows it.
+const STORY_ID_PATTERN = /(E[0-9]+-[A-Z][A-Za-z0-9]*(?:-followup-[0-9]+[a-z]?(?=[-_]|$))?|[A-Z]+[-_][A-Z]+[-_][0-9]+[a-z]?(?:-followup-[0-9]+[a-z]?(?=[-_]|$))?|[A-Z]+[-_][A-Za-z0-9]+(?:-followup-[0-9]+[a-z]?(?=[-_]|$))?)/;
 
 // ─────────────────────────────────────────────────────────────────────
 // extractStoryIdFromBranch — pure regex on branch name

package/lib/verify-patch.js

@@ -0,0 +1,78 @@
+'use strict';
+/**
+ * verify-patch.js — HC-019n-followup-24 (pipeline-recovery condition 6).
+ *
+ * Condition 5 proved step_4's diff APPLIES. Condition 6 runs the adopter's test
+ * command against the applied diff and reports pass/fail — the first ground
+ * truth in the pipeline that the generated code does not BREAK the suite.
+ *
+ * The command runs inside a throwaway git WORKTREE checked out from HEAD, so the
+ * adopter's real tree (including uncommitted work) is never touched. This module
+ * is the pure half — resolving the command and interpreting an exit code into a
+ * verdict. The worktree lifecycle and process exec live in the CLI command,
+ * calling verdictFromRun() with the result, so this stays I/O-free and
+ * unit-testable.
+ *
+ * See .github/pipeline/HC-019n-followup-24/architect.md. NOTE the honest limit:
+ * a passing suite means "does not regress", NOT "the story is correctly
+ * implemented" — the existing tests may not cover the new behaviour.
+ */
+
+/** Exit codes, matching the check-patch convention so scripts can branch. */
+const EXIT = {
+  PASS: 0,          // tests passed on the applied diff
+  NO_DIFF: 1,       // no diff / fetch failure (condition-5 precondition unmet)
+  DOES_NOT_APPLY: 2, // diff did not apply
+  TESTS_FAILED: 3,  // diff applied, tests failed
+  TIMEOUT: 4,       // the command exceeded --timeout
+};
+
+/**
+ * Resolve which command to run.
+ *
+ * Priority: an explicit --command wins; else the adopter's configured
+ * ci.local_command; else the documented default `make ci`. Never an empty
+ * string (an empty command would "succeed" vacuously and report a false pass).
+ *
+ * @param {string|undefined} explicit  --command flag
+ * @param {string|undefined} configured ci_local_command from run config
+ * @returns {string}
+ */
+function resolveCommand(explicit, configured) {
+  const pick = (explicit && explicit.trim())
+    || (configured && configured.trim())
+    || 'make ci';
+  return pick;
+}
+
+/**
+ * Interpret a completed command run into a condition-6 verdict.
+ *
+ * @param {{ code: number|null, timedOut: boolean, stdout?: string, stderr?: string }} run
+ * @returns {{ verdict: 'pass'|'fail'|'timeout', exitCode: number, detail: string }}
+ */
+function verdictFromRun(run) {
+  if (run.timedOut) {
+    return { verdict: 'timeout', exitCode: EXIT.TIMEOUT, detail: 'test command exceeded the timeout' };
+  }
+  if (run.code === 0) {
+    return { verdict: 'pass', exitCode: EXIT.PASS, detail: 'tests passed on the applied diff' };
+  }
+  return {
+    verdict: 'fail',
+    exitCode: EXIT.TESTS_FAILED,
+    detail: `tests failed (exit ${run.code})` + (lastMeaningfulLine(run) ? `: ${lastMeaningfulLine(run)}` : ''),
+  };
+}
+
+/** The most useful one-liner from a failed run's output, for the report. */
+function lastMeaningfulLine({ stdout = '', stderr = '' }) {
+  const combined = `${stdout}\n${stderr}`.split('\n')
+    .map(l => l.trim())
+    .filter(Boolean);
+  // Prefer a line that names a failure; else the last non-empty line.
+  const failLine = combined.reverse().find(l => /fail|error|✗|not ok|assert/i.test(l));
+  return (failLine || combined[0] || '').slice(0, 200);
+}
+
+module.exports = { EXIT, resolveCommand, verdictFromRun, lastMeaningfulLine };

package/lib/verify-pr.js

@@ -0,0 +1,141 @@
+'use strict';
+/**
+ * verify-pr.js — HC-019n-followup-32 (pipeline-standards G4 §2, G3 functional half).
+ *
+ * The POST-emit-pr verification the recovery deferred. `check-patch` (cond 5) →
+ * `verify-patch` (cond 6, runs the tests) → `emit-pr` (cond 7, opens the PR) →
+ * **`verify-pr`** (this): once a real PR exists, run the real skill audit and the
+ * real CI gate against it — the two artifacts (step-5b-skill-audit.md,
+ * step-5c-ci.md) the server DAG can only MODEL, never execute (see
+ * HC-019n-followup-31: those steps are serverExecutable:false).
+ *
+ * This module is the PURE half — CI-gate mode resolution, `gh pr checks`
+ * interpretation, and the verdict — I/O-free and unit-testable. The gh/make-ci
+ * execution + artifact writes live in the CLI command.
+ *
+ * Unlike the code-reviewer prompt's step_5c (which DIAGNOSES + auto-fixes CI in a
+ * loop), verify-pr only VERIFIES and REPORTS a verdict — a CLI command states the
+ * truth; the operator (or a later closed loop) acts on it. NOTE the honest limit:
+ * a green CI gate means the checks passed, not that the change is correct.
+ */
+
+/** Exit codes, extending the check/verify-patch convention. */
+const EXIT = {
+  PASS: 0,        // all required CI gates green (skill audit is informational)
+  NO_PR: 1,       // could not resolve a PR / branch to verify
+  GATE_RED: 2,    // a required CI gate is failing
+  GATE_PENDING: 3, // checks did not reach a terminal state within the timeout
+  ERROR: 4,       // gh / command execution error
+};
+
+const GATE_MODES = ['github', 'local', 'both', 'none'];
+
+/**
+ * Resolve the CI-gate mode. Precedence: explicit --mode > config ci.gate >
+ * default 'github' (backward compat, matching the step_5c prompt contract).
+ */
+function resolveGateMode(explicit, configGate) {
+  const norm = (v) => {
+    const s = String(v == null ? '' : v).toLowerCase().trim();
+    return GATE_MODES.includes(s) ? s : null;
+  };
+  return norm(explicit) || norm(configGate) || 'github';
+}
+
+/**
+ * Interpret `gh pr checks <PR> --json name,state,bucket` output (an array).
+ * `bucket` is gh's own classification: pass | fail | pending | skipping | cancel.
+ *
+ * @param {Array<{name?:string, bucket?:string, state?:string, link?:string}>} rows
+ * @returns {{ total:number, passed:number, failed:number, pending:number,
+ *   skipped:number, failures:string[], allTerminal:boolean, allGreen:boolean }}
+ */
+function interpretGhChecks(rows) {
+  const list = Array.isArray(rows) ? rows : [];
+  let passed = 0, failed = 0, pending = 0, skipped = 0;
+  const failures = [];
+  for (const r of list) {
+    const bucket = String(r.bucket || r.state || '').toLowerCase();
+    if (bucket === 'pass') passed++;
+    else if (bucket === 'fail' || bucket === 'cancel') { failed++; failures.push(r.name || '(unnamed check)'); }
+    else if (bucket === 'skipping' || bucket === 'skipped') skipped++;
+    else pending++; // pending / queued / in_progress / unknown
+  }
+  return {
+    total: list.length,
+    passed, failed, pending, skipped, failures,
+    allTerminal: pending === 0,
+    // Green = at least one check, none failed, none still pending.
+    allGreen: list.length > 0 && failed === 0 && pending === 0,
+  };
+}
+
+/**
+ * Compute the overall CI-gate verdict from the per-mode results.
+ *
+ * @param {{ mode:string, gh?:object|null, local?:{code:number,timedOut:boolean}|null }} o
+ * @returns {{ verdict:'pass'|'fail'|'pending'|'disabled', exitCode:number, detail:string }}
+ */
+function ciGateVerdict({ mode, gh, local }) {
+  if (mode === 'none') {
+    return { verdict: 'disabled', exitCode: EXIT.PASS, detail: 'ci.gate=none — CI verification explicitly disabled (audit row only)' };
+  }
+  const parts = [];
+  let anyFail = false, anyPending = false;
+
+  if (mode === 'github' || mode === 'both') {
+    if (!gh) { anyFail = true; parts.push('github: could not read checks'); }
+    else if (gh.failed > 0) { anyFail = true; parts.push(`github: ${gh.failed}/${gh.total} failing (${gh.failures.join(', ')})`); }
+    else if (!gh.allTerminal) { anyPending = true; parts.push(`github: ${gh.pending} check(s) still pending`); }
+    else if (gh.total === 0) { anyPending = true; parts.push('github: no checks reported yet'); }
+    else parts.push(`github: ${gh.passed}/${gh.total} green`);
+  }
+  if (mode === 'local' || mode === 'both') {
+    if (!local) { anyFail = true; parts.push('local: command did not run'); }
+    else if (local.timedOut) { anyPending = true; parts.push('local: command timed out'); }
+    else if (local.code !== 0) { anyFail = true; parts.push(`local: \`make ci\` exit ${local.code}`); }
+    else parts.push('local: passed');
+  }
+
+  if (anyFail) return { verdict: 'fail', exitCode: EXIT.GATE_RED, detail: parts.join(' | ') };
+  if (anyPending) return { verdict: 'pending', exitCode: EXIT.GATE_PENDING, detail: parts.join(' | ') };
+  return { verdict: 'pass', exitCode: EXIT.PASS, detail: parts.join(' | ') };
+}
+
+/**
+ * Render the step-5c-ci.md gate matrix with a truthful provenance column.
+ * @returns {string} markdown
+ */
+function renderStep5cArtifact({ storyId, mode, prRef, gh, local, verdict }) {
+  const lines = [];
+  lines.push(`# Step 5c — CI Gate Verification (${storyId || 'unknown-story'})`);
+  lines.push('');
+  lines.push(`- **PR / branch:** ${prRef || '(unknown)'}`);
+  lines.push(`- **CI gate mode:** ${mode}`);
+  lines.push(`- **Verdict:** ${verdict.verdict.toUpperCase()} — ${verdict.detail}`);
+  lines.push(`- **Produced by:** \`hone verify-pr\` (real execution — NOT an LLM description; HC-019n-followup-32)`);
+  lines.push('');
+  lines.push('| Check | Result | Provenance |');
+  lines.push('|---|---|---|');
+  if (mode === 'none') {
+    lines.push('| (CI verification) | DISABLED | ci.gate=none |');
+  }
+  if ((mode === 'github' || mode === 'both') && gh) {
+    if (gh.total === 0) lines.push('| (github checks) | none reported | github |');
+    else {
+      lines.push(`| github checks | ${gh.passed} pass / ${gh.failed} fail / ${gh.pending} pending / ${gh.skipped} skip | github |`);
+      for (const f of gh.failures) lines.push(`| ❌ ${f} | FAIL | github |`);
+    }
+  }
+  if ((mode === 'local' || mode === 'both')) {
+    if (!local) lines.push('| local `make ci` | did not run | local |');
+    else lines.push(`| local \`make ci\` | ${local.timedOut ? 'TIMEOUT' : local.code === 0 ? 'PASS' : `FAIL (exit ${local.code})`} | ${local.code === 0 ? 'OPERATOR-VERIFIED-LOCAL' : 'local'} |`);
+  }
+  lines.push('');
+  lines.push('> Honest limit: a green CI gate means the checks passed, not that the change is correct.');
+  return lines.join('\n') + '\n';
+}
+
+module.exports = {
+  EXIT, GATE_MODES, resolveGateMode, interpretGhChecks, ciGateVerdict, renderStep5cArtifact,
+};

package/mcp-server.js

@@ -0,0 +1,67 @@
+'use strict';
+/**
+ * mcp-server.js — HC-COMM-012 (A1 P1): the Hone MCP server (stdio).
+ *
+ * A THIN bridge: it exposes the pipeline tool handlers (lib/mcp-tools.js, which shell
+ * out to the `hone` CLI) over the Model Context Protocol so Claude Code (and later
+ * any MCP editor) can drive the server-mode pipeline. It contains NO pipeline logic,
+ * NO prompts, NO agent chains — the moat stays server-side (architect memo HC-COMM-012).
+ *
+ * stdout is the MCP protocol channel — NEVER write logs to it; use stderr.
+ */
+const { Server } = require('@modelcontextprotocol/sdk/server/index.js');
+const { StdioServerTransport } = require('@modelcontextprotocol/sdk/server/stdio.js');
+const { ListToolsRequestSchema, CallToolRequestSchema } = require('@modelcontextprotocol/sdk/types.js');
+const { TOOLS, readHoneConfig } = require('./lib/mcp-tools');
+
+function buildServer() {
+  let version = '0.0.0';
+  try { version = require('./package.json').version; } catch { /* keep default */ }
+  const server = new Server({ name: 'hone', version }, { capabilities: { tools: {} } });
+
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: TOOLS.map((t) => ({
+      name: t.name,
+      description: t.description,
+      inputSchema: t.inputSchema,
+      annotations: { readOnlyHint: !!t.readOnly },
+    })),
+  }));
+
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const tool = TOOLS.find((t) => t.name === req.params.name);
+    if (!tool) {
+      return { content: [{ type: 'text', text: `Unknown tool: ${req.params.name}` }], isError: true };
+    }
+    try {
+      const result = await tool.handler(req.params.arguments || {});
+      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }], isError: !!result.isError };
+    } catch (e) {
+      return { content: [{ type: 'text', text: `Tool error: ${e && e.message ? e.message : String(e)}` }], isError: true };
+    }
+  });
+
+  return server;
+}
+
+async function start() {
+  const server = buildServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  // Preflight (stderr only — stdout is the protocol channel). Editor-agnostic: this
+  // is the same signal in Claude Code, Cursor, Windsurf, or any MCP client.
+  const cfg = readHoneConfig();
+  process.stderr.write(
+    `hone MCP server ready — api=${cfg.apiUrl}, token=${cfg.hasToken ? 'present' : 'MISSING (run `hone init --token <t>`)'}, ${TOOLS.length} tools. ` +
+    `Run hone_doctor if calls fail.\n`,
+  );
+}
+
+if (require.main === module) {
+  start().catch((e) => {
+    process.stderr.write(`hone MCP server failed to start: ${e && e.message ? e.message : String(e)}\n`);
+    process.exit(1);
+  });
+}
+
+module.exports = { buildServer, start };

package/package.json

@@ -1,17 +1,19 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {
-    "hone": "./bin/hone.js"
+    "hone": "./bin/hone.js",
+    "hone-mcp": "./bin/hone-mcp.js"
   },
   "files": [
     "bin/",
     "hone-cli.js",
     "lib/",
     "!lib/*.test.js",
-    "schema/"
+    "schema/",
+    "mcp-server.js"
   ],
   "scripts": {
     "test": "echo \"No tests yet\" && exit 0",
@@ -21,10 +23,11 @@
     "postinstall": "echo '\\n  Hone AI CLI installed successfully.\\n  Next: run `hone init --token <YOUR_TOKEN>` to configure.\\n  Docs: https://github.com/subbareddyvani/hone-server\\n'"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "ajv": "^8.20.0",
-    "axios": "^1.6.0",
+    "axios": "^1.20.0",
     "commander": "^11.0.0",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.3.2"
   },
   "engines": {
     "node": ">=18.0.0"