@hone-ai/cli 1.33.0 → 1.35.0

package/lib/untrusted-code-env.js

@@ -0,0 +1,51 @@
+'use strict';
+/**
+ * untrusted-code-env.js — HC-GF-269. The environment for code Hone did not write.
+ *
+ * verify-patch, emit-pr and verify-pr run a shell command in a tree that holds step_4's patch — an
+ * LLM's output, and its tests — and auto-verify (HC-GF-064) runs it the moment a run pauses, before
+ * anyone has read it. The worktree isolates the FILES. The environment was the operator's whole
+ * shell. Measured on local run 7a4b09b2 (2026-09-24): `tests/e2e/dashboard.smoke.test.js:27` read
+ * `process.env.HONE_TOKEN` inside `hone verify-patch`, received the operator's local dogfood token and
+ * sent it to production — the target `ci.e2e` pins — which answered 401. Story text can come from a
+ * GitHub issue, so whoever can file one can try to steer the builder into a test that sends it
+ * somewhere else.
+ *
+ * The rule: Hone's own namespace never reaches code Hone did not write. Every `HONE_*` variable goes,
+ * by PREFIX rather than by list — the CLI reads six credential or endpoint variables today, and a
+ * list is out of date the day a seventh is added. The adopter's own variables all stay: database
+ * URLs, cloud profiles, proxies, toolchain. The cost is Hone's own SETTINGS an adopter's CI may read
+ * (`HONE_SOURCE_DIRS`, docs/sdlc/setup.md): exported in the operator's shell they no longer reach the
+ * command, so set them in the command itself — `ci.local_command` or `--command`.
+ *
+ * Sibling to `git-env.js` (variables that select a REPOSITORY) and `verdict-env.js` (variables that
+ * invert a RESULT), and separate for the same reason they are: this scrub withholds CREDENTIALS, and
+ * unlike those two it also applies to installs — a patched package.json's `postinstall` is code the
+ * builder wrote too.
+ *
+ * NOT A SANDBOX. The child still runs as the operator, with $HOME and the network: `~/.honerc` holds
+ * the same token and any test can read it. This closes the leak that was measured — a credential
+ * handed to generated code in its environment — not a patch written to steal one. HC-GF-270 keeps an
+ * outside party's patch from running unattended at all (cli/lib/story-provenance.js); OS isolation of
+ * the child remains a separate opt-in.
+ */
+
+/** Hone's namespace: the CLI's and the server's variables, credentials among them. */
+const HONE_PREFIX = 'HONE_';
+
+/** Case-folded: Windows resolves `process.env.HONE_TOKEN` against a key spelled `Hone_Token`. */
+function isHoneVar(key) {
+  return String(key).toUpperCase().startsWith(HONE_PREFIX);
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} [base] Base env; defaults to process.env. Injectable for tests.
+ * @returns {NodeJS.ProcessEnv} a copy — the caller's environment is untouched
+ */
+function withoutHoneVars(base) {
+  const env = { ...(base || process.env) };
+  for (const key of Object.keys(env)) if (isHoneVar(key)) delete env[key];
+  return env;
+}
+
+module.exports = { withoutHoneVars, isHoneVar, HONE_PREFIX };

package/lib/verdict-env.js

@@ -0,0 +1,31 @@
+'use strict';
+/**
+ * verdict-env.js — HC-GF-144. The environment for a subprocess whose VERDICT we read.
+ *
+ * `node --test` exports NODE_TEST_CONTEXT and NODE_TEST_WORKER_ID to every process it spawns, and
+ * a nested `node --test` that inherits them exits 0 EVEN WHEN TESTS FAIL (measured: exit 1 with a
+ * clean env, exit 0 with the variable). Anything whose exit code is believed must run without them.
+ *
+ * Sibling to `git-env.js`, and deliberately separate: that one removes the variables that select a
+ * REPOSITORY, this one removes the variables that invert a RESULT. Merging them would apply each
+ * scrub where it is not wanted.
+ *
+ * NOT for subprocesses that exist to USE the operator's toolchain — pip, npm and playwright
+ * installs need the real environment (proxy, registry, an active virtualenv), and scrubbing it
+ * there is the bug rather than the fix.
+ */
+
+/** Variables a parent test runner exports that flip a child runner's exit code. */
+const VERDICT_FLIPPING_VARS = ['NODE_TEST_CONTEXT', 'NODE_TEST_WORKER_ID'];
+
+/**
+ * @param {NodeJS.ProcessEnv} [base] Base env; defaults to process.env. Injectable for tests.
+ * @returns {NodeJS.ProcessEnv}
+ */
+function verdictEnv(base) {
+  const env = { ...(base || process.env) };
+  for (const key of VERDICT_FLIPPING_VARS) delete env[key];
+  return env;
+}
+
+module.exports = { verdictEnv, VERDICT_FLIPPING_VARS };

package/lib/verify-patch.js

@@ -18,6 +18,8 @@
  * implemented" — the existing tests may not cover the new behaviour.
  */
 
+const { withoutHoneVars } = require('./untrusted-code-env');
+
 /** Exit codes, matching the check-patch convention so scripts can branch. */
 const EXIT = {
   PASS: 0,          // tests passed on the applied diff
@@ -28,6 +30,16 @@ const EXIT = {
   // HC-GF-008: the command itself could not start, so nothing about the patch is known. Not 5 or 6:
   // emit-pr re-exits with these codes, and those two are its BRANCH_CONFLICT and PUBLISH_FAILED.
   UNRESOLVED: 7,
+  // HC-GF-201: the environment was incomplete, so nothing was observed about the diff.
+  // Distinct from TESTS_FAILED on purpose — emit-pr re-exits these codes, and a run that
+  // could not run is not a result (HC-CI-016).
+  NOT_RUN: 8,
+  // HC-GF-270: this run's story text came from a source Hone does not trust, so the patch was
+  // never executed and NO verdict was reported. A refusal, not a failure — nothing is known
+  // about the diff. Pass --trust-source to run it having read it.
+  // MUST stay numerically identical to emit-pr.js's EXIT.UNTRUSTED_SOURCE: emit-pr re-exits
+  // these codes, so the two maps are byte-compatible by contract.
+  UNTRUSTED_SOURCE: 9,
 };
 
 /**
@@ -53,6 +65,16 @@ function _npmTestScript(cwd) {
     return (typeof t === 'string' && t.trim() && !/no test specified/i.test(t)) ? 'npm test' : null;
   } catch { return null; }
 }
+/**
+ * HC-GF-223: the sources that are a DECLARATION rather than this resolver's own guess. Overriding a
+ * declared command narrows the evidence; overriding the terminal `make ci` guess supplies evidence
+ * where there was none, and must not be penalised (HC-GF-008 named that tier a guess for the same
+ * reason).
+ */
+const DECLARED_SOURCES = [
+  'ci.local_command (config file)', 'run config', 'Makefile ci target', 'package.json test script',
+];
+
 /**
  * HC-COMM-010-followup-7: tiered resolution. Without `opts.cwd` this is the
  * original pure function (explicit → configured → `make ci`). With `opts.cwd`:
@@ -63,11 +85,21 @@ function _npmTestScript(cwd) {
  *   4. `make ci` if the Makefile has a ci target
  *   5. `npm test` if package.json has a real test script
  *   6. `make ci` (documented default; fails loudly)
- * @returns {{command:string, source:string}}
+ * @returns {{command:string, source:string, replaced?:{command:string,source:string}|null}}
+ *   `replaced` (HC-GF-223) is what an explicit --command displaced, when that was a declaration.
  */
 function resolveCommandDetailed(explicit, configured, opts = {}) {
   const e = (typeof explicit === 'string' ? explicit : '').trim();
-  if (e) return { command: e, source: '--command' };
+  if (e) {
+    // What `--command` replaced. An operator narrows this command because the configured one cannot
+    // run in the worktree verify-patch creates, and a subset that passes is not a verification of
+    // the change — so the caller needs to know what did NOT run, not just what did.
+    const base = resolveCommandDetailed(null, configured, opts);
+    const replaced = DECLARED_SOURCES.includes(base.source) && base.command !== e
+      ? { command: base.command, source: base.source }
+      : null;
+    return { command: e, source: '--command', replaced };
+  }
   const cwd = opts && opts.cwd;
   if (cwd) {
     try {
@@ -145,10 +177,15 @@ function commandAbsence(command, { code, stdout = '', stderr = '' } = {}) {
  *     enforce approves the gate.
  * The verified command is the adopter's own top-level invocation: level 0, no inherited flags. Returns a
  * copy; the caller's environment is untouched.
+ *
+ * HC-GF-269: and none of Hone's own variables. The command runs the builder's patch and tests, so it
+ * gets no `HONE_*` credential or endpoint (see untrusted-code-env.js). The scrub runs LAST, after the
+ * caller has merged in whatever it publishes on purpose (HC-GF-192's `plan.env`, HC-GF-193's
+ * `plan.controlEnv`) — so a sandbox cannot be used to hand a Hone credential to generated code either.
  */
 const INHERITED_MAKE_VARS = ['MAKELEVEL', 'MAKEFLAGS', 'GNUMAKEFLAGS'];
 function verifyCommandEnv(base = process.env) {
-  const env = { ...base };
+  const env = withoutHoneVars(base);
   for (const key of INHERITED_MAKE_VARS) delete env[key];
   return env;
 }
@@ -162,11 +199,43 @@ function verifyCommandEnv(base = process.env) {
  * @param {{ code: number|null, timedOut: boolean, stdout?: string, stderr?: string, command?: string, source?: string }} run
  * @returns {{ verdict: 'pass'|'fail'|'timeout'|'unresolved', exitCode: number, detail: string }}
  */
-function verdictFromRun(run) {
+function verdictFromRun(run, provisioning = null) {
+  // HC-GF-201: provisioning state is an INPUT to the verdict, not a side note. The
+  // run that exposed this printed `provisioning: linked node_modules` honestly and
+  // then blamed the patch for the roots it had not linked, because this function had
+  // no parameter for it and the `ok:false` was discarded before the verdict was computed.
+  if (provisioning && provisioning.ok === false) {
+    const roots = (provisioning.unprovisioned || []).map((u) => u.root).join(', ');
+    return {
+      verdict: 'not_run',
+      exitCode: EXIT.NOT_RUN,
+      detail: `environment incomplete — could not provision: ${roots}. `
+        + 'Nothing was observed about this change.',
+    };
+  }
   if (run.timedOut) {
     return { verdict: 'timeout', exitCode: EXIT.TIMEOUT, detail: 'test command exceeded the timeout' };
   }
   if (run.code === 0) {
+    // HC-GF-223: a pass under an operator-supplied command is evidence about a SUBSET. Measured on
+    // run `437246a7`: `--command "node --test <3 files>"` reported `pass` to the server and the same
+    // diff then failed `make ci` with 6 failures, from Redis state the subset could not see. The
+    // enforce gate (HC-GF-099) was satisfied by a verification that examined a third of the surface.
+    //
+    // The EXIT CODE stays PASS on purpose: the tests that ran did pass, and changing what exit 0
+    // means would silently change the contract for every adopter and every chained command (the same
+    // argument HC-GF-026 makes for lint). The VERDICT is what the server gates on, and both readers
+    // — `orchestrate.js` (`isGreen = verdict === 'pass'`) and `verification-refusal.js` — treat any
+    // other value as not green, so naming it here is what closes the false pass.
+    if (run.replaced && run.replaced.command) {
+      return {
+        verdict: 'pass_narrowed',
+        exitCode: EXIT.PASS,
+        detail: `tests passed under an operator-supplied command, but \`${run.replaced.command}\` `
+          + `(${run.replaced.source}) did not run — this is evidence about a subset, not a `
+          + 'verification of the change',
+      };
+    }
     return { verdict: 'pass', exitCode: EXIT.PASS, detail: 'tests passed on the applied diff' };
   }
   const absent = commandAbsence(run.command, run);
@@ -348,6 +417,7 @@ function classifyGateRun(run) {
 }
 
 module.exports = {
+  DECLARED_SOURCES,
   EXIT, resolveCommand, resolveCommandDetailed, DEFAULT_COMMAND,
   AUX_GATES, AUX_DETECT, resolveAuxGates, classifyGateRun,
   verdictFromRun, commandAbsence, verifyCommandEnv, lastMeaningfulLine, summarizeFailure, FAILURE_LINE_RE,

package/lib/verify-pr.js

@@ -21,11 +21,12 @@
 
 /** Exit codes, extending the check/verify-patch convention. */
 const EXIT = {
-  PASS: 0,        // all required CI gates green (skill audit is informational)
+  PASS: 0,        // all required CI gates green, and no BLOCKER skill assertion fired
   NO_PR: 1,       // could not resolve a PR / branch to verify
   GATE_RED: 2,    // a required CI gate is failing
   GATE_PENDING: 3, // checks did not reach a terminal state within the timeout
   ERROR: 4,       // gh / command execution error
+  SKILL_BLOCKER: 5, // CI passed, but a BLOCKER skill assertion fired in `hone step-5b` (HC-GF-227)
 };
 
 const GATE_MODES = ['github', 'local', 'both', 'none'];

package/lib/worktree-provision.js

@@ -13,6 +13,7 @@
  */
 const fs = require('node:fs');
 const path = require('node:path');
+const { withoutHoneVars } = require('./untrusted-code-env');
 
 const LOCKFILES = [
   ['package-lock.json',   'npm ci --no-audit --no-fund'],
@@ -104,7 +105,7 @@ function planProvision({ worktreeDir, parentDir, installCommand = null, fsMod =
 }
 
 /** @returns {{ok:boolean, did:'none'|'link'|'install', summary:string, command?:string}} */
-function provisionWorktree(plan, { worktreeDir, exec, fsMod = fs }) {
+function provisionWorktree(plan, { worktreeDir, exec, fsMod = fs, env = process.env }) {
   if (!plan || plan.kind === 'none') return { ok: true, did: 'none', summary: `skipped (${plan ? plan.reason : 'no plan'})` };
   // HC-GF-024: recognised-but-unautomated. ok:true keeps the fail-open contract (the
   // test command still runs), but the summary names the manifest so a later
@@ -120,14 +121,73 @@ function provisionWorktree(plan, { worktreeDir, exec, fsMod = fs }) {
     } catch (e) { return { ok: false, did: 'link', summary: `link failed (${e.message}) — tests run unprovisioned` }; }
   }
   try {
-    const run = exec(plan.command, { cwd: worktreeDir, shell: true, encoding: 'utf8', timeout: INSTALL_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'pipe'] });
+    // HC-GF-269: the install runs the PATCHED manifest, so a `postinstall` step_4 wrote runs here —
+    // before the test command, and whether or not it passes. It keeps the operator's toolchain
+    // (proxy, registry, virtualenv: HC-GF-144) and loses only Hone's own `HONE_*` variables.
+    const run = exec(plan.command, { cwd: worktreeDir, shell: true, encoding: 'utf8', timeout: INSTALL_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'pipe'], env: withoutHoneVars(env) });
     const ok = run && run.status === 0;
     const tail = ok ? '' : ` — ${String((run && (run.stderr || run.stdout)) || '').trim().split('\n').filter(Boolean).pop() || 'install failed'}`;
     return { ok, did: 'install', command: plan.command, summary: `${ok ? 'ran' : 'FAILED'} \`${plan.command}\` (${plan.reason})${tail}` };
   } catch (e) { return { ok: false, did: 'install', command: plan.command, summary: `install threw (${e.message}) — tests run unprovisioned` }; }
 }
 
+
+/**
+ * Every directory in `dir` that owns a package manifest — HC-GF-201.
+ *
+ * `planProvision` tests exactly one directory, and this repo has three roots:
+ * `node_modules`, `cli/node_modules`, `server/node_modules`. The two it skipped are
+ * where `ci.unit` runs (`node --test cli/lib/*.test.js`), so a worktree built by
+ * `verify-patch` ran those tests against absent modules and the resulting
+ * `Cannot find module` lines were counted as the PATCH failing tests.
+ *
+ * Bounded depth on purpose: a manifest inside `node_modules` is a dependency's, not
+ * a root of the repo under test.
+ */
+function discoverPackageRoots(dir, { fsMod = fs, maxDepth = 3 } = {}) {
+  const SKIP = new Set(['node_modules', '.git', '.hg', 'dist', 'build', 'coverage', 'vendor']);
+  const out = [];
+  const walk = (rel, depth) => {
+    const abs = rel === '.' ? dir : path.join(dir, rel);
+    let entries = [];
+    try { entries = fsMod.readdirSync(abs, { withFileTypes: true }); } catch { return; }
+    if (entries.some((e) => e.isFile() && e.name === 'package.json')) out.push(rel);
+    if (depth >= maxDepth) return;
+    for (const e of entries) {
+      if (!e.isDirectory() || SKIP.has(e.name) || e.name.startsWith('.')) continue;
+      walk(rel === '.' ? e.name : path.join(rel, e.name), depth + 1);
+    }
+  };
+  walk('.', 0);
+  return out;
+}
+
+/**
+ * Provision every discovered root, reporting the ones we MEANT to provision and could not.
+ *
+ * The distinction is load-bearing and was named in this story's step_1 plan: `kind:'none'`
+ * (no manifest) and `kind:'unsupported'` (Python/Go/Rust — deliberately not automated) mean
+ * there is nothing to do, NOT that provisioning failed. Counting them would make every
+ * non-Node adopter's every run report NOT RUN forever.
+ */
+function provisionAllRoots(entries, { provision = provisionWorktree } = {}) {
+  const results = [];
+  const unprovisioned = [];
+  for (const { root, plan, worktreeDir, exec } of entries) {
+    if (plan.kind === 'none' || plan.kind === 'unsupported') {
+      results.push({ root, did: plan.kind, summary: plan.reason || plan.kind });
+      continue;
+    }
+    const r = provision(plan, { worktreeDir, exec, root });
+    results.push({ root, did: r.did || 'failed', summary: r.summary });
+    if (!r.ok) unprovisioned.push({ root, reason: r.summary || 'provisioning failed' });
+  }
+  return { ok: unprovisioned.length === 0, results, unprovisioned };
+}
+
 module.exports = {
+  discoverPackageRoots,
+  provisionAllRoots,
   planProvision, provisionWorktree,
   LOCKFILES, RECOGNISED_MANIFESTS, ALL_MANIFEST_NAMES, INSTALL_TIMEOUT_MS,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.33.0",
+  "version": "1.35.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {