@hone-ai/cli 1.34.0 → 1.35.0

package/lib/worktree-provision.js

@@ -13,6 +13,7 @@
  */
 const fs = require('node:fs');
 const path = require('node:path');
+const { withoutHoneVars } = require('./untrusted-code-env');
 
 const LOCKFILES = [
   ['package-lock.json',   'npm ci --no-audit --no-fund'],
@@ -104,7 +105,7 @@ function planProvision({ worktreeDir, parentDir, installCommand = null, fsMod =
 }
 
 /** @returns {{ok:boolean, did:'none'|'link'|'install', summary:string, command?:string}} */
-function provisionWorktree(plan, { worktreeDir, exec, fsMod = fs }) {
+function provisionWorktree(plan, { worktreeDir, exec, fsMod = fs, env = process.env }) {
   if (!plan || plan.kind === 'none') return { ok: true, did: 'none', summary: `skipped (${plan ? plan.reason : 'no plan'})` };
   // HC-GF-024: recognised-but-unautomated. ok:true keeps the fail-open contract (the
   // test command still runs), but the summary names the manifest so a later
@@ -120,14 +121,73 @@ function provisionWorktree(plan, { worktreeDir, exec, fsMod = fs }) {
     } catch (e) { return { ok: false, did: 'link', summary: `link failed (${e.message}) — tests run unprovisioned` }; }
   }
   try {
-    const run = exec(plan.command, { cwd: worktreeDir, shell: true, encoding: 'utf8', timeout: INSTALL_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'pipe'] });
+    // HC-GF-269: the install runs the PATCHED manifest, so a `postinstall` step_4 wrote runs here —
+    // before the test command, and whether or not it passes. It keeps the operator's toolchain
+    // (proxy, registry, virtualenv: HC-GF-144) and loses only Hone's own `HONE_*` variables.
+    const run = exec(plan.command, { cwd: worktreeDir, shell: true, encoding: 'utf8', timeout: INSTALL_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'pipe'], env: withoutHoneVars(env) });
     const ok = run && run.status === 0;
     const tail = ok ? '' : ` — ${String((run && (run.stderr || run.stdout)) || '').trim().split('\n').filter(Boolean).pop() || 'install failed'}`;
     return { ok, did: 'install', command: plan.command, summary: `${ok ? 'ran' : 'FAILED'} \`${plan.command}\` (${plan.reason})${tail}` };
   } catch (e) { return { ok: false, did: 'install', command: plan.command, summary: `install threw (${e.message}) — tests run unprovisioned` }; }
 }
 
+
+/**
+ * Every directory in `dir` that owns a package manifest — HC-GF-201.
+ *
+ * `planProvision` tests exactly one directory, and this repo has three roots:
+ * `node_modules`, `cli/node_modules`, `server/node_modules`. The two it skipped are
+ * where `ci.unit` runs (`node --test cli/lib/*.test.js`), so a worktree built by
+ * `verify-patch` ran those tests against absent modules and the resulting
+ * `Cannot find module` lines were counted as the PATCH failing tests.
+ *
+ * Bounded depth on purpose: a manifest inside `node_modules` is a dependency's, not
+ * a root of the repo under test.
+ */
+function discoverPackageRoots(dir, { fsMod = fs, maxDepth = 3 } = {}) {
+  const SKIP = new Set(['node_modules', '.git', '.hg', 'dist', 'build', 'coverage', 'vendor']);
+  const out = [];
+  const walk = (rel, depth) => {
+    const abs = rel === '.' ? dir : path.join(dir, rel);
+    let entries = [];
+    try { entries = fsMod.readdirSync(abs, { withFileTypes: true }); } catch { return; }
+    if (entries.some((e) => e.isFile() && e.name === 'package.json')) out.push(rel);
+    if (depth >= maxDepth) return;
+    for (const e of entries) {
+      if (!e.isDirectory() || SKIP.has(e.name) || e.name.startsWith('.')) continue;
+      walk(rel === '.' ? e.name : path.join(rel, e.name), depth + 1);
+    }
+  };
+  walk('.', 0);
+  return out;
+}
+
+/**
+ * Provision every discovered root, reporting the ones we MEANT to provision and could not.
+ *
+ * The distinction is load-bearing and was named in this story's step_1 plan: `kind:'none'`
+ * (no manifest) and `kind:'unsupported'` (Python/Go/Rust — deliberately not automated) mean
+ * there is nothing to do, NOT that provisioning failed. Counting them would make every
+ * non-Node adopter's every run report NOT RUN forever.
+ */
+function provisionAllRoots(entries, { provision = provisionWorktree } = {}) {
+  const results = [];
+  const unprovisioned = [];
+  for (const { root, plan, worktreeDir, exec } of entries) {
+    if (plan.kind === 'none' || plan.kind === 'unsupported') {
+      results.push({ root, did: plan.kind, summary: plan.reason || plan.kind });
+      continue;
+    }
+    const r = provision(plan, { worktreeDir, exec, root });
+    results.push({ root, did: r.did || 'failed', summary: r.summary });
+    if (!r.ok) unprovisioned.push({ root, reason: r.summary || 'provisioning failed' });
+  }
+  return { ok: unprovisioned.length === 0, results, unprovisioned };
+}
+
 module.exports = {
+  discoverPackageRoots,
+  provisionAllRoots,
   planProvision, provisionWorktree,
   LOCKFILES, RECOGNISED_MANIFESTS, ALL_MANIFEST_NAMES, INSTALL_TIMEOUT_MS,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.34.0",
+  "version": "1.35.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {