@hone-ai/cli 1.33.0 → 1.34.0

package/hone-cli.js

@@ -5552,7 +5552,9 @@ program
     const config = getConfig();
     const client = api(config);
     try {
-      const { data } = await client.get(`/orchestrate/${encodeURIComponent(runId)}/step-instruction`);
+      // HC-GF-092: advertise what this CLI can honour. The server serves the highest it also
+      // knows, so an older CLI — which sends nothing — keeps being served contract 1.
+      const { data } = await client.get(`/orchestrate/${encodeURIComponent(runId)}/step-instruction?contracts=1,2`);
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
       console.log(`Step:      ${data.stepKey} (${data.agent})`);
       console.log(`Contract:  ${data.contractVersion}`);
@@ -5573,15 +5575,36 @@ program
   .command('submit-step <runId> <stepKey>')
   .description('Submit editor-executed output for an awaiting_editor step (HC-COMM-010 B3)')
   .option('--file <path>', 'Read the step output from this file')
+  .option('--from-tree', 'HC-GF-091: render the artifact from the working tree against HEAD instead of reading one file — the agent writes files with its own tools, so no single model response has to hold the whole build')
+  .option('--test-report <text>', 'With --from-tree: the test-run report to carry verbatim. Never invented when absent.')
   .option('--contract <version>', 'Instruction contract version (from step-instruction)', '1')
   .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
   .action(async (runId, stepKey, opts) => {
     const config = getConfig();
     const client = api(config);
     try {
-      if (!opts.file) { console.error('Provide the output via --file <path> (the text your editor produced).'); process.exit(1); }
+      if (opts.file && opts.fromTree) { console.error('Use --file OR --from-tree, not both: they are two different claims about where the build is.'); process.exit(1); }
+      // HC-GF-092: under contract 2 the instruction told the agent to WRITE the files with its own
+      // tools. A hand-assembled --file artifact means the instruction and the submission disagree
+      // about where the build is, and the server cannot see that — only this side can.
+      if (String(opts.contract) === '2' && !opts.fromTree) {
+        console.error('Contract 2 is the from-tree contract: the instruction told the agent to write the files with its own tools. Re-run with --from-tree, or fetch a contract 1 instruction if you really did assemble the output by hand.');
+        process.exit(1);
+      }
+      if (!opts.file && !opts.fromTree) { console.error('Provide the output via --file <path> (the text your editor produced), or --from-tree to render it from the working tree.'); process.exit(1); }
       const fs = require('fs');
-      const output = fs.readFileSync(opts.file, 'utf8');
+      let output;
+      if (opts.fromTree) {
+        const { renderFromTree } = require('./lib/tree-artifact');
+        const rendered = renderFromTree({ repoRoot: process.cwd(), testReport: opts.testReport });
+        output = rendered.text;
+        // Say what was left out BEFORE the submission, not after: a file the tree has and the
+        // artifact does not is a decision the operator has to be able to see.
+        for (const s2 of rendered.skipped) console.error(`not included: ${s2.path} — ${s2.reason}`);
+        console.error(`from-tree: ${rendered.files.length} file(s), ${rendered.deletes.length} deletion(s), ${rendered.skipped.length} skipped`);
+      } else {
+        output = fs.readFileSync(opts.file, 'utf8');
+      }
       const { data } = await client.post(
         `/orchestrate/${encodeURIComponent(runId)}/step/${encodeURIComponent(stepKey)}/editor-output`,
         { contractVersion: opts.contract, output }

package/lib/headroom.js

@@ -0,0 +1,63 @@
+'use strict';
+/**
+ * HC-GF-089 — how close a step came to its limits, said before it hits one.
+ *
+ * The largest local build used 793s of its 900s limit and nothing said so. Until now the only way to
+ * learn where a limit bites was to hit it: HC-GF-114 exists because the cut-off path had never fired
+ * in the entire run history, and reaching it took lowering a cap by hand. A run one slow story away
+ * from a timeout should say so while it still completes.
+ *
+ * ADVISORY by construction. This never blocks, never routes back and never changes a verdict — it
+ * prints. A signal that could fail a run would need a far higher bar than "approaching a limit", and
+ * a warning that reads like a rejection trains operators to ignore it.
+ */
+
+/** HC-GF-080's per-message output cap — what the CLI child actually runs with. */
+const TOKEN_CAP_PER_MESSAGE = 128_000;
+
+/** Three quarters. Low enough to give a story's worth of warning, high enough not to fire routinely. */
+const THRESHOLD = 0.75;
+
+/** A ratio, or null when there is nothing to judge — a missing limit is not a limit of zero. */
+function ratio(used, limit) {
+  const u = Number(used);
+  const l = Number(limit);
+  if (!Number.isFinite(u) || !Number.isFinite(l) || l <= 0 || u < 0) return null;
+  return u / l;
+}
+
+/**
+ * One line when a step passed THRESHOLD of its time or per-message token budget, else null.
+ * @param {object} generation HC-GF-079's generation report, as stored on the step row.
+ */
+function headroomLine(generation) {
+  const g = generation && typeof generation === 'object' ? generation : {};
+
+  const timeRatio = ratio(g.elapsed_ms, g.timeout_ms);
+  // The BUSIEST message decides: a build whose last message nearly filled the cap is at risk even
+  // when the earlier ones were small, and an average would hide exactly that.
+  const counts = (Array.isArray(g.output_tokens) ? g.output_tokens : [])
+    .map(Number).filter((n) => Number.isFinite(n) && n >= 0);
+  const busiest = counts.length ? Math.max(...counts) : null;
+  const tokenRatio = busiest === null ? null : ratio(busiest, TOKEN_CAP_PER_MESSAGE);
+
+  const parts = [];
+  if (timeRatio !== null && timeRatio >= THRESHOLD) {
+    parts.push(`time ${Math.round(timeRatio * 100)}% `
+      + `(${Math.round(Number(g.elapsed_ms) / 1000)}s of ${Math.round(Number(g.timeout_ms) / 1000)}s)`);
+  }
+  if (tokenRatio !== null && tokenRatio >= THRESHOLD) {
+    parts.push(`tokens ${Math.round(tokenRatio * 100)}% `
+      + `(${busiest} of ${TOKEN_CAP_PER_MESSAGE} in one message)`);
+  }
+  if (!parts.length) return null;
+  // HC-GF-129: the threshold has no upper bound, so every ratio from 75% to infinity used to get
+  // the same reassurance. On run 692b0c29 a call that ran 550,017ms against a 550,000ms ceiling —
+  // it TIMED OUT, `complete: false`, the build was cut off — was reported as "not over it".
+  // At or past 1.0 the limit was reached, and saying otherwise is simply false.
+  const over = (timeRatio !== null && timeRatio >= 1) || (tokenRatio !== null && tokenRatio >= 1);
+  return `headroom: ${parts.join(', ')} — `
+    + (over ? 'the limit was REACHED: this call was cut off' : 'close to the limit, not over it');
+}
+
+module.exports = { headroomLine, TOKEN_CAP_PER_MESSAGE, THRESHOLD };

package/lib/materialize-diff.js

@@ -37,7 +37,18 @@ const path = require('node:path');
  * perfectly valid. Line-anchoring is also strictly better for a body that
  * contains an indented or info-tagged fence of its own.
  */
-const FILE_BLOCK_RE = /^[ \t]*```[ \t]*file[ \t]*:[ \t]*([^\n`]+?)[ \t]*\r?\n([\s\S]*?)^[ \t]*```[ \t]*\r?$/gim;
+/**
+ * HC-GF-127: the fence is 3 OR MORE backticks, and the closer must MATCH the opener (backreference).
+ *
+ * It used to be exactly three, so a block closed on the first ``` line inside it: a README carrying
+ * a ```js sample ended AT the sample, the rest was lost, and `malformed` came back empty — the
+ * artifact looked valid and materialized to the wrong bytes. Widening the opener alone would not
+ * help; only a matching closer lets a wider fence carry content that contains a narrower one.
+ *
+ * 3-backtick blocks parse exactly as before: `\1` on a 3-backtick opener IS the old literal. Pinned
+ * against 48 artifacts captured from real runs.
+ */
+const FILE_BLOCK_RE = /^[ \t]*(`{3,})[ \t]*file[ \t]*:[ \t]*([^\n`]+?)[ \t]*\r?\n([\s\S]*?)^[ \t]*\1[ \t]*\r?$/gim;
 
 /**
  * The line-anchored closer necessarily absorbs the newline that terminates the
@@ -69,7 +80,7 @@ const EDIT_BLOCK_RE = new RegExp(
   'gim');
 
 /** HC-GF-109: the opening line of an edit block, whether or not the block parses — compared, so none is lost. */
-const EDIT_OPEN_RE = /^[ \t]*```[ \t]*edit[ \t]*:[ \t]*([^\n`]+?)[ \t]*\r?$/gim;
+const EDIT_OPEN_RE = /^[ \t]*`{3,}[ \t]*edit[ \t]*:[ \t]*([^\n`]+?)[ \t]*\r?$/gim;
 
 /**
  * The OLD/NEW split inside an edit block. `<<<<<<< OLD` … `=======` … `>>>>>>> NEW`.
@@ -129,11 +140,12 @@ function extractFileBlocks(output) {
   const files = [];
   const seen = new Set();
   for (const m of scope.matchAll(FILE_BLOCK_RE)) {
-    const rel = normalizeRepoPath(m[1]);
+    // HC-GF-127: m[1] is the fence itself now, so the path and body moved to m[2]/m[3].
+    const rel = normalizeRepoPath(m[2]);
     if (!rel) continue;            // rejected (traversal/absolute) — see below
     if (seen.has(rel)) continue;   // first block wins on a dup path
     seen.add(rel);
-    files.push({ path: rel, contents: blockBody(m[2]) });
+    files.push({ path: rel, contents: blockBody(m[3]) });
   }
 
   // HC-019n-followup-27: region edits for files too big to bundle whole.

package/lib/mcp-tools.js

@@ -164,18 +164,39 @@ async function stepInstruction({ runId, cwd } = {}) {
 // hone_submit_step — submit editor-executed output (HC-COMM-010 B3). Output
 // travels via a temp file (1MB-class payloads must not ride argv); the file
 // is best-effort deleted after the shell-out.
-async function submitStep({ runId, stepKey, output, contractVersion = '1', cwd } = {}) {
+async function submitStep({ runId, stepKey, output, contractVersion = '1', fromTree = false, testReport, cwd } = {}) {
   if (!runId) return { isError: true, detail: 'runId is required' };
   if (!stepKey) return { isError: true, detail: 'stepKey is required' };
-  if (typeof output !== 'string' || output.trim() === '') {
-    return { isError: true, detail: 'output is required (the complete step output text)' };
+
+  // HC-GF-130: DELEGATE the from-tree render to the CLI rather than rendering here and submitting
+  // the result with `--file`. That is what shipped in HC-GF-091, and HC-GF-092's guard — which
+  // refuses `--contract 2` without `--from-tree` — turned the one caller that HAD built from the
+  // tree away. The guard reads the flag, not the provenance, so the adopter's primary path was
+  // blocked while the CLI fallback worked. Delegating also removes a second producer of the same
+  // artifact, which is the shape HC-GF-127 had to unpick across three parsers.
+  const hasOutput = typeof output === 'string' && output.trim() !== '';
+  if (fromTree && hasOutput) {
+    return { isError: true, detail: 'pass output OR fromTree, not both: they are two different claims about where the build is' };
   }
-  const tmp = path.join(os.tmpdir(), `hone-editor-output-${Date.now()}-${process.pid}.txt`);
-  try {
+  if (!fromTree && !hasOutput) {
+    return { isError: true, detail: 'output is required (the complete step output text), or set fromTree' };
+  }
+
+  const base = ['submit-step', String(runId), String(stepKey), '--contract', String(contractVersion), '--format', 'json'];
+  let tmp = null;
+  if (fromTree) {
+    base.push('--from-tree');
+    // Never invented: an absent report stays absent, the same rule the CLI and the prompt carry.
+    if (typeof testReport === 'string' && testReport.trim() !== '') base.push('--test-report', testReport);
+  } else {
+    // Output travels via a temp file — 1MB-class payloads must not ride argv.
+    tmp = path.join(os.tmpdir(), `hone-editor-output-${Date.now()}-${process.pid}.txt`);
     fsSync.writeFileSync(tmp, output, 'utf8');
-    const r = await runHone(
-      ['submit-step', String(runId), String(stepKey), '--file', tmp, '--contract', String(contractVersion), '--format', 'json'],
-      { cwd });
+    base.push('--file', tmp);
+  }
+
+  try {
+    const r = await module.exports._internal.runHone(base, { cwd });
     if (r.error) return { isError: true, detail: r.error };
     const data = parseLastJson(r.stdout);
     return {
@@ -188,7 +209,7 @@ async function submitStep({ runId, stepKey, output, contractVersion = '1', cwd }
         : (r.stderr || r.stdout || 'submission failed').slice(0, 500),
     };
   } finally {
-    try { fsSync.unlinkSync(tmp); } catch { /* best-effort cleanup */ }
+    if (tmp) { try { fsSync.unlinkSync(tmp); } catch { /* best-effort cleanup */ } }
   }
 }
 
@@ -432,10 +453,12 @@ const TOOLS = [
       properties: {
         runId: { type: 'string' },
         stepKey: { type: 'string' },
-        output: { type: 'string' },
+        output: { type: 'string', description: 'The complete step output text. Omit when fromTree is true.' },
         contractVersion: { type: 'string', default: '1' },
+        fromTree: { type: 'boolean', default: false, description: 'HC-GF-091: render the artifact from the working tree against HEAD — write the files with your own tools first, then submit. Removes the single-response output ceiling.' },
+        testReport: { type: 'string', description: 'With fromTree: your test-run report, carried verbatim. Omit if you did not run them; it is never invented for you.' },
       },
-      required: ['runId', 'stepKey', 'output'],
+      required: ['runId', 'stepKey'],
     },
     handler: submitStep,
   },
@@ -455,4 +478,6 @@ module.exports = {
   killWorkflow,
   runStory, status, verifyPatch, checkPatch, showStep, approve, emitPr, verifyPr, agentEval, derive, sync, doctor,
   runHone, parseRunStarted, parseLastJson, honeBin, readHoneConfig, TOOLS,
+  // HC-GF-130: exposed so a test can observe the argv handed to the CLI without running it.
+  _internal: { runHone },
 };

package/lib/run-report.js

@@ -262,6 +262,42 @@ function buildReport(run, extra = {}) {
   // "none" would be a claim the report cannot support for a run that never ran the check.
   for (const s of steps) {
     const d = s.diagnostics || {};
+    // HC-GF-089: how close this step came to its limits. worthKnowing, never needsYou — approaching
+    // a limit is not an action item, and an advisory that reads like one trains operators to ignore
+    // it. Absent when the server projected no headroom fields, which means "nothing to judge".
+    //
+    // Computed inline rather than imported: this module is deliberately dependency-free (see the
+    // header), and the numbers come from stored data like every other line here. cli/lib/headroom.js
+    // owns the same thresholds for the status surface, and HC-GF-089's tests pin the two agree.
+    const hr = d.headroom;
+    if (hr && typeof hr === 'object') {
+      const el = Number(hr.elapsed_ms);
+      const to = Number(hr.timeout_ms);
+      const toks = (Array.isArray(hr.output_tokens) ? hr.output_tokens : [])
+        .map(Number).filter((n) => Number.isFinite(n) && n >= 0);
+      const busiest = toks.length ? Math.max(...toks) : null;
+      const near = [];
+      if (Number.isFinite(el) && Number.isFinite(to) && to > 0 && el / to >= 0.75) {
+        near.push(`time ${Math.round((el / to) * 100)}% (${Math.round(el / 1000)}s of ${Math.round(to / 1000)}s)`);
+      }
+      if (busiest !== null && busiest / 128000 >= 0.75) {
+        near.push(`tokens ${Math.round((busiest / 128000) * 100)}% (${busiest} of 128000 in one message)`);
+      }
+      // HC-GF-129: `>= 0.75` has no upper bound, so this said "not over it" about a call that had
+      // gone over and died (run 692b0c29: 550,017ms of a 550,000ms ceiling, cut off). The wording
+      // and the PLACEMENT are wrong together — worthKnowing is right for a near miss, and wrong
+      // for a call that actually hit its limit, which is exactly what an operator needs to see.
+      const overTime = Number.isFinite(el) && Number.isFinite(to) && to > 0 && el >= to;
+      const overTokens = busiest !== null && busiest >= 128000;
+      if (near.length && (overTime || overTokens)) {
+        needsYou.push({
+          what: `${s.stepKey} headroom: ${near.join(', ')} — the limit was REACHED: that call was cut off`,
+          how: `hone show step ${run.runId} ${s.stepKey}`,
+        });
+      } else if (near.length) {
+        worthKnowing.push(`${s.stepKey} headroom: ${near.join(', ')} — close to the limit, not over it`);
+      }
+    }
     if (Array.isArray(d.invented_paths) && d.invented_paths.length) {
       needsYou.push({
         what: `${s.stepKey} named ${d.invented_paths.length} path(s) that do not exist in the repo, and was accepted anyway`,

package/lib/tree-artifact.js

@@ -0,0 +1,166 @@
+'use strict';
+/**
+ * tree-artifact.js — HC-GF-091: render a step_4 artifact from the WORKING TREE.
+ *
+ * Editor mode had the same single-response ceiling as the server: `hone submit-step` read one
+ * file and `hone_submit_step` took a string, so the editor model still re-typed every changed
+ * file into a single response under its own output cap. The agent has already written those
+ * files with its own tools; this renders the artifact from what is on disk instead.
+ *
+ * The output is consumed by `cli/lib/materialize-diff.js`. Its exit modes, enumerated before a
+ * line was written (HC-GF-117), and what this module does about each:
+ *
+ *   files[]     whole-file blocks   — HANDLED: created + modified files
+ *   deletes[]   `DELETE: <path>`    — HANDLED: deleted files
+ *   edits[]     region edits        — DELIBERATELY NOT: from-tree always sends whole files. The
+ *                                     tree is the truth; an anchor-based edit would reintroduce
+ *                                     exactly the drift this removes.
+ *   malformed[] unparsable block    — DELIBERATELY NOT REACHABLE: every fence we emit is longer
+ *                                     than any fence run inside the file it wraps (see below).
+ *   noChanges   the honest no-op    — HANDLED: a clean tree says NO CHANGES rather than nothing.
+ *
+ * Dependency-free by intent, like `cli/lib/headroom.js`: `git`, `fs` and `path` only.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { gitEnv } = require('./git-env');
+
+/** Bytes above which we do not attempt to inline a file at all. */
+const MAX_FILE_BYTES = 1_000_000;
+
+/**
+ * SC-002-followup-2: git exports GIT_DIR / GIT_WORK_TREE / GIT_INDEX_FILE to the processes it
+ * spawns, and those BEAT `cwd`. Without gitEnv() this renders a different repository's tree when
+ * it runs under a git hook — and it would look like a perfectly normal build.
+ */
+function gitOut(repoRoot, args) {
+  return execFileSync('git', args, { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+}
+
+/**
+ * A fence wide enough to carry this content.
+ *
+ * HC-GF-127: the block closes on a line matching its OWN fence, so a file holding a ```js sample
+ * needs at least four backticks. Before that fix the format could not carry such a file at all and
+ * this module refused it by name; the parsers now take 3-or-more with a matching closer.
+ */
+function fenceFor(content) {
+  let longest = 2;
+  for (const line of String(content).split('\n')) {
+    const m = /^[ \t]*(`{3,})/.exec(line);
+    if (m && m[1].length > longest) longest = m[1].length;
+  }
+  return '`'.repeat(longest + 1);
+}
+
+/** NUL in the first 8000 bytes is git's own binary heuristic. */
+function looksBinary(buf) {
+  const n = Math.min(buf.length, 8000);
+  for (let i = 0; i < n; i++) if (buf[i] === 0) return true;
+  return false;
+}
+
+/**
+ * Paths changed against HEAD, plus untracked files.
+ *
+ * `git diff --name-status HEAD` alone does NOT see untracked files, so the obvious one-command
+ * implementation ships a build missing every file the agent created — the first named mutation
+ * target. `ls-files --others --exclude-standard` is the other half, and it is what honours
+ * .gitignore: a node_modules SYMLINK is a file to a naive directory walk
+ * (HC-COMM-010-followup-8), and git excludes it because the adopter said so.
+ */
+function collectPaths(repoRoot) {
+  const changed = [];
+  const deleted = [];
+  let hasHead = true;
+  try { gitOut(repoRoot, ['rev-parse', '--verify', 'HEAD']); } catch { hasHead = false; }
+
+  if (hasHead) {
+    const out = gitOut(repoRoot, ['diff', '--name-status', '--no-renames', 'HEAD']);
+    for (const line of out.split('\n')) {
+      if (!line.trim()) continue;
+      const tab = line.indexOf('\t');
+      if (tab === -1) continue;
+      const status = line.slice(0, tab).trim();
+      const rel = line.slice(tab + 1).trim();
+      if (!rel) continue;
+      if (status.startsWith('D')) deleted.push(rel);
+      else changed.push(rel);
+    }
+  }
+  const others = gitOut(repoRoot, ['ls-files', '--others', '--exclude-standard']);
+  for (const rel of others.split('\n')) if (rel.trim()) changed.push(rel.trim());
+
+  return {
+    changed: [...new Set(changed)].sort(),
+    deleted: [...new Set(deleted)].sort(),
+  };
+}
+
+/**
+ * Render the artifact.
+ *
+ * @param {object}  opts
+ * @param {string}  opts.repoRoot    repository to read
+ * @param {string} [opts.testReport] the agent's own test-run report, carried verbatim. NEVER
+ *                                   invented: an absent report stays absent, because a fabricated
+ *                                   "N passing" is the anti-fabrication failure the step_4
+ *                                   validator already exists to catch.
+ * @returns {{ text: string, files: string[], deletes: string[], skipped: Array<{path,reason}> }}
+ */
+function renderFromTree({ repoRoot, testReport } = {}) {
+  if (!repoRoot) throw new Error('renderFromTree: repoRoot is required');
+  const { changed, deleted } = collectPaths(repoRoot);
+
+  const blocks = [];
+  const included = [];
+  const skipped = [];
+
+  for (const rel of changed) {
+    const abs = path.join(repoRoot, rel);
+    let st;
+    try { st = fs.lstatSync(abs); } catch { skipped.push({ path: rel, reason: 'unreadable' }); continue; }
+    // Structural, and deliberately silent: a symlink is not file content. materialize-diff would
+    // write a REGULAR file holding the link's target bytes, converting it without saying so. Naming
+    // every one of these would also put `node_modules` in the artifact of any repo whose .gitignore
+    // says `node_modules/` — a directory pattern that does not match the symlink (HC-COMM-010-followup-8).
+    if (st.isSymbolicLink() || !st.isFile()) continue;
+    if (st.size > MAX_FILE_BYTES) { skipped.push({ path: rel, reason: `larger than ${MAX_FILE_BYTES} bytes` }); continue; }
+
+    const buf = fs.readFileSync(abs);
+    if (looksBinary(buf)) { skipped.push({ path: rel, reason: 'binary' }); continue; }
+
+    const content = buf.toString('utf8');
+    const fence = fenceFor(content);
+    const body = content.endsWith('\n') ? content.slice(0, -1) : content;
+    blocks.push(`${fence}file: ${rel}\n${body}\n${fence}`);
+    included.push(rel);
+  }
+
+  const lines = ['## Changed Files', ''];
+
+  if (!included.length && !deleted.length) {
+    // The honest no-op, in the shape the validator and the materialiser both already accept.
+    lines.push('NO CHANGES — the working tree matches HEAD.');
+  } else {
+    for (const b of blocks) { lines.push(b, ''); }
+    for (const rel of deleted) lines.push(`DELETE: ${rel}`);
+    if (deleted.length) lines.push('');
+  }
+
+  if (skipped.length) {
+    // Named, not silent: a file that is in the tree and not in the artifact must be visible as a
+    // decision. Kept out of the Changed Files blocks so it can never parse as one.
+    lines.push('### Not included', '');
+    for (const s of skipped) lines.push(`- \`${s.path}\` — ${s.reason}`);
+    lines.push('');
+  }
+
+  if (testReport) lines.push('### Test run', '', String(testReport).trim(), '');
+
+  return { text: lines.join('\n'), files: included, deletes: deleted, skipped };
+}
+
+module.exports = { renderFromTree, _internal: { fenceFor, looksBinary, collectPaths, MAX_FILE_BYTES } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {