@hone-ai/cli 1.26.0 → 1.27.0

package/hone-cli.js

@@ -7353,6 +7353,7 @@ program
   .option('--command <cmd>', 'Test command (default: ci.local_command from config, else `make ci`)')
   .option('--timeout <sec>', 'Seconds before the test command is killed', '600')
   .option('--keep', 'Leave the worktree in place for debugging')
+  .option('--no-provision', 'Do not install/link dependencies into the isolated worktree (HC-COMM-010-followup-6)')
   .option('--report', 'HC-019n-followup-34: report the verdict back to the server (closed loop, advisory)')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .action(async (workflowId, opts) => {
@@ -7418,7 +7419,7 @@ program
     const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'hone-verify-'));
     const diffFile = path.join(os.tmpdir(), `hone-verify-${Date.now()}.diff`);
     fs.writeFileSync(diffFile, diff);
-    const command = resolveCommand(opts.command, runConfig?.ci_local_command);
+    const command = resolveCommand(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }) // followup-7: file re-read + Makefile/npm-aware default;
     let cleanupDone = false;
     const cleanup = () => {
       if (cleanupDone || opts.keep) return;
@@ -7458,6 +7459,16 @@ program
         reportVerdict = 'does_not_apply'; reportDetail = applyDetail;
       } else {
         // 5. Run the adopter's test command in the worktree.
+        // HC-COMM-010-followup-6: a bare worktree has no dependencies — provision it
+        // (link the repo's node_modules when the lockfile is unchanged, else run the
+        // lockfile's install, or ci.install_command). Fail-open; --no-provision opts out.
+        if (opts.provision !== false) {
+          const { planProvision, provisionWorktree } = require('./lib/worktree-provision');
+          const { readCIConfigDetails } = require('./lib/pipeline-config');
+          const plan = planProvision({ worktreeDir: wt, parentDir: process.cwd(), installCommand: readCIConfigDetails(process.cwd()).install_command });
+          const prov = provisionWorktree(plan, { worktreeDir: wt, exec: spawnSync });
+          if (opts.format !== 'json') console.log(`  provisioning: ${prov.summary}`);
+        }
         if (opts.format !== 'json') console.log(`  running: ${command}  (in isolated worktree, timeout ${opts.timeout}s)`);
         const run = spawnSync(command, {
           cwd: wt, shell: true, encoding: 'utf8',
@@ -7523,6 +7534,7 @@ program
   .option('--command <cmd>', 'Test command for --verify (default: ci.local_command, else `make ci`)')
   .option('--timeout <sec>', 'Seconds before the verify test command is killed', '600')
   .option('--keep', 'Leave the worktree in place for debugging')
+  .option('--no-provision', 'Do not install/link dependencies into the isolated worktree (HC-COMM-010-followup-6)')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .action(async (workflowId, opts) => {
     const { execFileSync, spawnSync } = require('child_process');
@@ -7634,7 +7646,7 @@ program
     const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'hone-emit-'));
     const diffFile = path.join(os.tmpdir(), `hone-emit-${Date.now()}.diff`);
     fs.writeFileSync(diffFile, diff);
-    const command = resolveCommand(opts.command, runConfig?.ci_local_command);
+    const command = resolveCommand(opts.command, runConfig?.ci_local_command, { cwd: process.cwd() }) // followup-7: file re-read + Makefile/npm-aware default;
     // `worktree add -b` creates the branch ref BEFORE apply/verify. If we bail
     // before a successful commit (apply fails, verify fails), that empty branch
     // (pointing at HEAD) must be torn down too — else "a failing diff never
@@ -7679,6 +7691,16 @@ program
         // 4b. Re-verify inline (default) — a failing diff never reaches a branch.
         let verifyOk = true;
         if (doVerify) {
+          // HC-COMM-010-followup-6: a bare worktree has no dependencies — provision it
+          // (link the repo's node_modules when the lockfile is unchanged, else run the
+          // lockfile's install, or ci.install_command). Fail-open; --no-provision opts out.
+          if (opts.provision !== false) {
+            const { planProvision, provisionWorktree } = require('./lib/worktree-provision');
+            const { readCIConfigDetails } = require('./lib/pipeline-config');
+            const plan = planProvision({ worktreeDir: wt, parentDir: process.cwd(), installCommand: readCIConfigDetails(process.cwd()).install_command });
+            const prov = provisionWorktree(plan, { worktreeDir: wt, exec: spawnSync });
+            if (opts.format !== 'json') console.log(`  provisioning: ${prov.summary}`);
+          }
           if (opts.format !== 'json') console.log(`  verifying: ${command}  (in isolated worktree, timeout ${opts.timeout}s)`);
           const run = spawnSync(command, {
             cwd: wt, shell: true, encoding: 'utf8',

package/lib/pipeline-config.js

@@ -33,7 +33,7 @@ const path = require('node:path');
 const KNOWN_THRESHOLD_KEYS = ['estimate_full_sdlc', 'recently_modified_window_days'];
 
 const CI_GATE_MODES = ['github', 'local', 'both', 'none'];
-const KNOWN_CI_GATE_KEYS = ['gate', 'local_command'];
+const KNOWN_CI_GATE_KEYS = ['gate', 'local_command', 'install_command']; // install_command: HC-COMM-010-followup-6
 const DEFAULT_CI_LOCAL_COMMAND = 'make ci';
 
 /**
@@ -111,6 +111,29 @@ function normalizeCIGate(raw) {
  * @param {string} repoRoot
  * @returns {{ gate: 'github'|'local'|'both'|'none', local_command: string }}
  */
+/**
+ * HC-COMM-010-followup-6/-7: the ci: block details readCIGateConfig deliberately
+ * does not expose (its return shape is pinned): whether local_command was set
+ * EXPLICITLY in the file (vs the `make ci` default), and an optional
+ * install_command used to provision the verification worktree.
+ * @returns {{ local_command: string|null, local_command_explicit: boolean, install_command: string|null }}
+ */
+function readCIConfigDetails(repoRoot) {
+  const none = { local_command: null, local_command_explicit: false, install_command: null };
+  if (!repoRoot || typeof repoRoot !== 'string') return none;
+  for (const p of [path.join(repoRoot, '.pipeline-config.yml'), path.join(repoRoot, '.github/.pipeline-config.yml')]) {
+    if (!fs.existsSync(p)) continue;
+    let parsed;
+    try { parsed = require('js-yaml').load(fs.readFileSync(p, 'utf8')); } catch { continue; }
+    const block = parsed && typeof parsed === 'object' ? parsed.ci : null;
+    if (!block || typeof block !== 'object') continue;
+    const lc = typeof block.local_command === 'string' && block.local_command.trim() ? block.local_command.trim() : null;
+    const ic = typeof block.install_command === 'string' && block.install_command.trim() ? block.install_command.trim() : null;
+    return { local_command: lc, local_command_explicit: lc !== null, install_command: ic };
+  }
+  return none;
+}
+
 function readCIGateConfig(repoRoot) {
   const defaults = { gate: 'github', local_command: DEFAULT_CI_LOCAL_COMMAND };
   if (!repoRoot || typeof repoRoot !== 'string') return defaults;
@@ -417,6 +440,7 @@ function readAgentEvalConfig(repoRoot) {
 }
 
 module.exports = {
+  readCIConfigDetails,
   EXECUTION_MODES,
   DEFAULT_EXECUTION_MODE,
   EDITOR_MODE_CONSENT_NOTE,

package/lib/verify-patch.js

@@ -38,12 +38,50 @@ const EXIT = {
  * @param {string|undefined} configured ci_local_command from run config
  * @returns {string}
  */
-function resolveCommand(explicit, configured) {
-  const pick = (explicit && explicit.trim())
-    || (configured && configured.trim())
-    || 'make ci';
-  return pick;
+const DEFAULT_COMMAND = 'make ci';
+function _hasMakeCiTarget(cwd) {
+  try { const f = require('node:fs'); const p = require('node:path').join(cwd, 'Makefile'); return f.existsSync(p) && /^ci\s*:/m.test(f.readFileSync(p, 'utf8')); } catch { return false; }
 }
+function _npmTestScript(cwd) {
+  try {
+    const f = require('node:fs'); const p = require('node:path').join(cwd, 'package.json');
+    if (!f.existsSync(p)) return null;
+    const t = JSON.parse(f.readFileSync(p, 'utf8'))?.scripts?.test;
+    return (typeof t === 'string' && t.trim() && !/no test specified/i.test(t)) ? 'npm test' : null;
+  } catch { return null; }
+}
+/**
+ * HC-COMM-010-followup-7: tiered resolution. Without `opts.cwd` this is the
+ * original pure function (explicit → configured → `make ci`). With `opts.cwd`:
+ *   1. --command (explicit)
+ *   2. ci.local_command set EXPLICITLY in the file NOW (re-read at verify/emit
+ *      time — the run config captured it at creation and may be stale)
+ *   3. the run config's ci_local_command, unless it is just the stamped default
+ *   4. `make ci` if the Makefile has a ci target
+ *   5. `npm test` if package.json has a real test script
+ *   6. `make ci` (documented default; fails loudly)
+ * @returns {{command:string, source:string}}
+ */
+function resolveCommandDetailed(explicit, configured, opts = {}) {
+  const e = (typeof explicit === 'string' ? explicit : '').trim();
+  if (e) return { command: e, source: '--command' };
+  const cwd = opts && opts.cwd;
+  if (cwd) {
+    try {
+      const { readCIConfigDetails } = require('./pipeline-config');
+      const d = readCIConfigDetails(cwd);
+      if (d.local_command_explicit) return { command: d.local_command, source: 'ci.local_command (config file)' };
+    } catch { /* fall through */ }
+  }
+  const c = (typeof configured === 'string' ? configured : '').trim();
+  if (c && c !== DEFAULT_COMMAND) return { command: c, source: 'run config' };
+  if (cwd) {
+    if (_hasMakeCiTarget(cwd)) return { command: DEFAULT_COMMAND, source: 'Makefile ci target' };
+    const npm = _npmTestScript(cwd); if (npm) return { command: npm, source: 'package.json test script' };
+  }
+  return { command: DEFAULT_COMMAND, source: 'default' };
+}
+function resolveCommand(explicit, configured, opts) { return resolveCommandDetailed(explicit, configured, opts).command; }
 
 /**
  * Interpret a completed command run into a condition-6 verdict.
@@ -75,4 +113,4 @@ function lastMeaningfulLine({ stdout = '', stderr = '' }) {
   return (failLine || combined[0] || '').slice(0, 200);
 }
 
-module.exports = { EXIT, resolveCommand, verdictFromRun, lastMeaningfulLine };
+module.exports = { EXIT, resolveCommand, resolveCommandDetailed, DEFAULT_COMMAND, verdictFromRun, lastMeaningfulLine };

package/lib/worktree-provision.js

@@ -0,0 +1,64 @@
+'use strict';
+/**
+ * worktree-provision.js — HC-COMM-010-followup-6: "verify in an isolated
+ * worktree" implies "provision the worktree". A bare `git worktree add` has no
+ * node_modules, so a Node adopter's test command failed with "Cannot find
+ * package 'vitest'" before any test ran (found 2026-09-05, run 4ab3a962).
+ *
+ * Plan (pure) → execute (injected exec). Fast path: when the worktree's
+ * lockfile is byte-identical to the repo's and the repo already has
+ * node_modules, LINK it (seconds, no network). Otherwise run the lockfile's
+ * install. Explicit `ci.install_command` wins. Fail-open: a provisioning
+ * failure is reported and the test command still runs (it will fail clearly).
+ */
+const fs = require('node:fs');
+const path = require('node:path');
+
+const LOCKFILES = [
+  ['package-lock.json',   'npm ci --no-audit --no-fund'],
+  ['npm-shrinkwrap.json', 'npm ci --no-audit --no-fund'],
+  ['pnpm-lock.yaml',      'pnpm install --frozen-lockfile'],
+  ['yarn.lock',           'yarn install --frozen-lockfile'],
+];
+const INSTALL_TIMEOUT_MS = 10 * 60 * 1000;
+
+function planProvision({ worktreeDir, parentDir, installCommand = null, fsMod = fs }) {
+  const ex = (p) => { try { return fsMod.existsSync(p); } catch { return false; } };
+  const rd = (p) => { try { return fsMod.readFileSync(p, 'utf8'); } catch { return null; } };
+  if (installCommand && String(installCommand).trim()) {
+    return { kind: 'install', command: String(installCommand).trim(), reason: 'ci.install_command' };
+  }
+  for (const [lock, cmd] of LOCKFILES) {
+    const wl = path.join(worktreeDir, lock);
+    if (!ex(wl)) continue;
+    const pl = path.join(parentDir, lock); const pnm = path.join(parentDir, 'node_modules');
+    if (ex(pnm) && ex(pl) && rd(wl) !== null && rd(wl) === rd(pl)) {
+      return { kind: 'link', target: pnm, reason: `${lock} unchanged — linking the repo's node_modules` };
+    }
+    return { kind: 'install', command: cmd, reason: `${lock} present${ex(pnm) ? ' but changed' : ''}` };
+  }
+  if (ex(path.join(worktreeDir, 'package.json'))) {
+    return { kind: 'install', command: 'npm install --no-audit --no-fund', reason: 'package.json without a lockfile' };
+  }
+  return { kind: 'none', reason: 'no dependency manifest detected' };
+}
+
+/** @returns {{ok:boolean, did:'none'|'link'|'install', summary:string, command?:string}} */
+function provisionWorktree(plan, { worktreeDir, exec, fsMod = fs }) {
+  if (!plan || plan.kind === 'none') return { ok: true, did: 'none', summary: `skipped (${plan ? plan.reason : 'no plan'})` };
+  if (plan.kind === 'link') {
+    try {
+      const dest = path.join(worktreeDir, 'node_modules');
+      if (!fsMod.existsSync(dest)) fsMod.symlinkSync(plan.target, dest, 'dir');
+      return { ok: true, did: 'link', summary: `linked node_modules (${plan.reason})` };
+    } catch (e) { return { ok: false, did: 'link', summary: `link failed (${e.message}) — tests run unprovisioned` }; }
+  }
+  try {
+    const run = exec(plan.command, { cwd: worktreeDir, shell: true, encoding: 'utf8', timeout: INSTALL_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'pipe'] });
+    const ok = run && run.status === 0;
+    const tail = ok ? '' : ` — ${String((run && (run.stderr || run.stdout)) || '').trim().split('\n').filter(Boolean).pop() || 'install failed'}`;
+    return { ok, did: 'install', command: plan.command, summary: `${ok ? 'ran' : 'FAILED'} \`${plan.command}\` (${plan.reason})${tail}` };
+  } catch (e) { return { ok: false, did: 'install', command: plan.command, summary: `install threw (${e.message}) — tests run unprovisioned` }; }
+}
+
+module.exports = { planProvision, provisionWorktree, LOCKFILES, INSTALL_TIMEOUT_MS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.26.0",
+  "version": "1.27.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {