@hone-ai/cli 1.32.0 → 1.33.0

package/lib/run-target.js

@@ -0,0 +1,97 @@
+'use strict';
+/**
+ * HC-GF-106 — the ONE place a `run-story` verb turns its argument into the run it acts on.
+ *
+ * `--status`, `--kill` and `--approve` each forwarded the argument verbatim (`runId || storyIdOrRunId`),
+ * so a story ID reached the server as a run ID and the route's UUID check answered `Run not found` —
+ * while `--help` promised "the latest workflow run for this story". Observed 2026-09-11:
+ * `hone run-story TICK-002 --kill` printed `Failed: Run not found` and left the paused run untouched.
+ * Every verb that acts on an existing run resolves here, so no two of them can disagree about which
+ * run that is, and none can fall back to sending the story ID.
+ *
+ * HC-GF-108 — the lookup asks the server for the story in the repository (`storyId`, `repoName`)
+ * instead of reading the org's 100 most recent runs, which reported "not found" for a story whose runs
+ * were all older than that. It still filters every row itself: a server that predates the filters
+ * ignores them and returns the org's most recent runs, and whatever this returns is posted to.
+ *
+ * I/O is the injected `client` (the CLI's axios instance). No console, no exit — the caller renders
+ * `error` and decides the exit code.
+ */
+
+const RUN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+// GET /orchestrate clamps `limit` to 1..100, lists newest first, and is scoped to the caller's org.
+// Filtered, its first row IS the story's latest run in the repository. From a server that ignores the
+// filters, the first match in the widest window is the latest run whenever that run is in the window —
+// and when it is not, the lookup says "not found" rather than picking an older one.
+const LOOKUP_LIMIT = 100;
+
+const isRunId = (s) => typeof s === 'string' && RUN_ID.test(s);
+
+/**
+ * One GET /orchestrate. `filtered` is true only when the server echoed every filter sent: a server
+ * that predates the filters echoes none of them and lists the org's most recent runs instead.
+ */
+async function listRuns(client, filters) {
+  const qs = new URLSearchParams({ limit: String(LOOKUP_LIMIT), ...filters });
+  const { data } = await client.get(`/orchestrate?${qs}`);
+  const runs = Array.isArray(data && data.runs) ? data.runs : [];
+  const filtered = Object.entries(filters).every(([k, v]) => Boolean(data) && data[k] === v);
+  return { runs, filtered };
+}
+
+/**
+ * @param {object} p
+ * @param {{ get(path: string): Promise<{ data: any }> }} p.client
+ * @param {string} p.idOrStory  what the operator typed: a run ID or a story ID
+ * @param {string} p.repoName   the repository a story ID is scoped to — the name the start path records
+ * @param {string} p.flag       the verb as typed (e.g. `--kill`, `--approve step_0`), for the hint
+ * @returns {Promise<{ runId: string, run: object|null, source: 'run-id'|'story' } | { error: string }>}
+ *          Rejects only when the lookup request itself fails.
+ */
+async function resolveRunTarget({ client, idOrStory, repoName, flag }) {
+  if (isRunId(idOrStory)) return { runId: idOrStory, run: null, source: 'run-id' };
+
+  const byRunId = `pass a run ID instead: hone run-story <runId> ${flag}`;
+  // Nothing to look up: an empty story ID, or a checkout at `/`, whose directory name is empty. Said here,
+  // rather than as the server's 400 for an empty filter, which names a query parameter nobody typed.
+  if (!idOrStory || !repoName) {
+    return {
+      error: `Cannot look up a run without a story ID and a repository name (story ${JSON.stringify(idOrStory || '')}, repository ${JSON.stringify(repoName || '')}).\n`
+        + `  Name the repository with --repo <name>, or ${byRunId}`,
+    };
+  }
+
+  // A row for another story, or whose id is not a run ID, is never a target — whichever server answered.
+  const forStory = (runs) => runs.filter(r => r && r.story_id === idOrStory && isRunId(r.id));
+
+  const here = await listRuns(client, { storyId: idOrStory, repoName });
+  const run = forStory(here.runs).find(r => r.repo_name === repoName);
+  if (run) return { runId: run.id, run, source: 'story' };
+
+  // Not in this repository — so where does the story have runs? A filtering server needs a story-only
+  // lookup to say; one that ignored the filters already returned everything this lookup can see. The
+  // answer is "not found" either way, so a failed hint lookup costs the hint, never the answer.
+  const wide = here.filtered
+    ? await listRuns(client, { storyId: idOrStory }).catch(() => ({ runs: [] }))
+    : here;
+
+  const elsewhere = [...new Set(forStory(wide.runs).map(r => r.repo_name))];
+  if (elsewhere.length) {
+    return {
+      error: `No workflow run for story ${idOrStory} in repository ${repoName}; it has runs in: ${elsewhere.join(', ')}.\n`
+        + `  Target that repository with --repo ${elsewhere[0]}, or ${byRunId}`,
+    };
+  }
+  const searched = here.filtered
+    ? "searched all of your org's runs"
+    : here.runs.length < LOOKUP_LIMIT
+      ? `searched all ${here.runs.length} runs in your org`
+      : `searched your org's ${here.runs.length} most recent runs`;
+  return {
+    error: `No workflow run found for story ${idOrStory} in repository ${repoName} (${searched}).\n`
+      + `  To act on a run by its ID, ${byRunId}   (run IDs: hone workflows)`,
+  };
+}
+
+module.exports = { resolveRunTarget, isRunId, LOOKUP_LIMIT };

package/lib/verify-patch.js

@@ -25,6 +25,9 @@ const EXIT = {
   DOES_NOT_APPLY: 2, // diff did not apply
   TESTS_FAILED: 3,  // diff applied, tests failed
   TIMEOUT: 4,       // the command exceeded --timeout
+  // HC-GF-008: the command itself could not start, so nothing about the patch is known. Not 5 or 6:
+  // emit-pr re-exits with these codes, and those two are its BRANCH_CONFLICT and PUBLISH_FAILED.
+  UNRESOLVED: 7,
 };
 
 /**
@@ -83,11 +86,81 @@ function resolveCommandDetailed(explicit, configured, opts = {}) {
 }
 function resolveCommand(explicit, configured, opts) { return resolveCommandDetailed(explicit, configured, opts).command; }
 
+/**
+ * HC-GF-008 — did the resolved command itself fail to START?
+ *
+ * The resolver's last tier is a guess (`make ci`), and a guess that names nothing came back as
+ * `tests failed (exit 2)`: the builder blamed for a command that does not exist, on every
+ * greenfield repo and every `npm init` manifest. Measured before building, on real processes —
+ * GNU make 4.3 + dash and make 3.81 + bash differ only in quote characters.
+ *
+ * Absence is the RUNNER's own words about a name the command contains:
+ *   - the shell exits 127 saying it cannot find a program the command names
+ *     (`sh: uv: command not found`, dash `sh: 7: uv: not found`, `sh: ./ci.sh: No such file or directory`);
+ *   - top-level make says a goal the command names has no rule (`No rule to make target 'ci'.  Stop.`),
+ *     or that there is no makefile at all.
+ * Deliberately NOT absence, because something started and the patch is a plausible cause: a missing
+ * prerequisite (`No rule to make target 'test', needed by 'ci'` names `test`, which the command does not),
+ * `make[1]:` (a sub-make a recipe ran), a tool missing inside a recipe or an npm script, and a 127 whose
+ * not-found line names nothing in the command. The command's own words are the discriminator throughout.
+ * Every residual lands on `fail`, which blocks exactly as before — the safe side.
+ *
+ * @returns {{ missing: string, reason: string } | null}
+ */
+const SHELL_NOT_FOUND_RE = /^[^\s:]*sh(?::\s*line\s+\d+)?:\s*(?:\d+:\s*)?(\S+):\s*(?:command not found|not found|No such file or directory)\s*$/gm;
+const MAKE_NO_RULE_RE = /^make: \*\*\* No rule to make target [`'\u2018]([^`'\u2019]+)['\u2019]/gm;
+const MAKE_NO_MAKEFILE_RE = /^make: \*\*\* No targets specified and no makefile found\./m;
+
+function commandAbsence(command, { code, stdout = '', stderr = '' } = {}) {
+  const cmd = String(command || '').trim();
+  if (!cmd) return null;
+  const words = new Set(cmd.split(/[\s;&|()<>]+/).filter(Boolean));
+  const out = `${stdout || ''}\n${stderr || ''}`;
+  if (code === 127) {
+    // `shell: true` runs /bin/sh, so these are sh's own words — bash-as-sh or dash.
+    for (const m of out.matchAll(SHELL_NOT_FOUND_RE)) {
+      if (words.has(m[1])) return { missing: m[1], reason: `\`${m[1]}\` is not installed or not on PATH` };
+    }
+    return null;
+  }
+  if (words.has('make')) {
+    for (const m of out.matchAll(MAKE_NO_RULE_RE)) {
+      if (words.has(m[1])) return { missing: m[1], reason: `no Makefile target \`${m[1]}\`` };
+    }
+    if (MAKE_NO_MAKEFILE_RE.test(out)) return { missing: 'Makefile', reason: 'no Makefile' };
+  }
+  return null;
+}
+
+/**
+ * HC-GF-008 — the environment an adopter's verification command runs in.
+ *
+ * make exports its recursion state to every recipe, so a `hone` verb run from a make target — or from
+ * `make ci` itself — hands that state to the command it verifies. Measured on GNU make 3.81 and 4.3:
+ *   - MAKELEVEL=1 turns the verified make's own `make: *** No rule to make target` into `make[1]: …`,
+ *     the prefix of a sub-make a recipe ran, so the absent-command check went inert (it passed alone and
+ *     failed under `make ci`);
+ *   - MAKEFLAGS=i (ignore errors) and MAKEFLAGS=n (dry run) make a failing `make ci` exit 0, and
+ *     GNUMAKEFLAGS=i does the same on make 4 — a pass for tests that failed or never ran, which under
+ *     enforce approves the gate.
+ * The verified command is the adopter's own top-level invocation: level 0, no inherited flags. Returns a
+ * copy; the caller's environment is untouched.
+ */
+const INHERITED_MAKE_VARS = ['MAKELEVEL', 'MAKEFLAGS', 'GNUMAKEFLAGS'];
+function verifyCommandEnv(base = process.env) {
+  const env = { ...base };
+  for (const key of INHERITED_MAKE_VARS) delete env[key];
+  return env;
+}
+
 /**
  * Interpret a completed command run into a condition-6 verdict.
  *
- * @param {{ code: number|null, timedOut: boolean, stdout?: string, stderr?: string }} run
- * @returns {{ verdict: 'pass'|'fail'|'timeout', exitCode: number, detail: string }}
+ * Pass the `command` that ran and the resolver's `source` for it: without them an absent command is
+ * indistinguishable from a failing one (HC-GF-008), and the CLI's two executors both do.
+ *
+ * @param {{ code: number|null, timedOut: boolean, stdout?: string, stderr?: string, command?: string, source?: string }} run
+ * @returns {{ verdict: 'pass'|'fail'|'timeout'|'unresolved', exitCode: number, detail: string }}
  */
 function verdictFromRun(run) {
   if (run.timedOut) {
@@ -96,6 +169,18 @@ function verdictFromRun(run) {
   if (run.code === 0) {
     return { verdict: 'pass', exitCode: EXIT.PASS, detail: 'tests passed on the applied diff' };
   }
+  const absent = commandAbsence(run.command, run);
+  if (absent) {
+    return {
+      verdict: 'unresolved',
+      exitCode: EXIT.UNRESOLVED,
+      detail: `tests never ran: ${absent.reason}`
+        + (run.source === 'default'
+          ? ` — no test command is configured or detected, so \`${run.command}\` was a guess; set ci.local_command in .pipeline-config.yml`
+          : ''),
+      missing: absent.missing,
+    };
+  }
   const sum = summarizeFailure(run);
   // HC-GF-023: lead with HOW MANY. "1 of 8 named" and "the only failure" are
   // different situations that this line used to render identically.
@@ -265,5 +350,5 @@ function classifyGateRun(run) {
 module.exports = {
   EXIT, resolveCommand, resolveCommandDetailed, DEFAULT_COMMAND,
   AUX_GATES, AUX_DETECT, resolveAuxGates, classifyGateRun,
-  verdictFromRun, lastMeaningfulLine, summarizeFailure, FAILURE_LINE_RE,
+  verdictFromRun, commandAbsence, verifyCommandEnv, lastMeaningfulLine, summarizeFailure, FAILURE_LINE_RE,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {