@hone-ai/cli 1.34.0 → 1.35.0

package/lib/bundle-source-dirs.js

@@ -0,0 +1,79 @@
+'use strict';
+/**
+ * HC-GF-178 — plan a bundle that represents EVERY declared source directory.
+ *
+ * The previous loop drained `source_dirs` in order and stopped at the cap:
+ *
+ *     for (const dir of sourceDirs) { bundleDirectory(...); if (count >= maxFiles) break; }
+ *
+ * Measured 2026-09-17 on this repo, `cli/` holds 137 bundlable files against a default cap of 30,
+ * so it filled the cap alone and `enterprise-assets`, `scripts`, `server` and `.github` were never
+ * read. The derive agent graded the repository B (21/24) on a fifth of it and said so itself; the
+ * CLI printed `Bundling 30 source files...` and nothing else.
+ *
+ * It decides the artefact, not just the report: bundling `server` first produced a `node-developer`
+ * skill describing the server, bundling `cli` first produced one describing the CLI. Four pipeline
+ * steps load whichever one exists.
+ *
+ * Raising the cap is not the fix — whole files up to 50,000 chars are sent with no truncation, so
+ * a few hundred files is megabytes. This allocates the cap fairly instead, and reports what it
+ * could not include so the caller can say so out loud.
+ */
+
+/**
+ * @param {{sourceDirs: string[], maxFiles: number, listFiles: (dir: string) => string[]}} input
+ * @returns {{selected: string[], perDir: Record<string, {available: number, included: number}>,
+ *            dropped: string[]}}
+ */
+function planBundle({ sourceDirs = [], maxFiles = 0, listFiles }) {
+  if (typeof listFiles !== 'function') {
+    throw new TypeError('planBundle requires a `listFiles` function — refusing to guess a layout');
+  }
+  const dirs = sourceDirs.filter(d => typeof d === 'string' && d.trim());
+  const available = new Map(dirs.map(d => [d, listFiles(d) || []]));
+  const perDir = {};
+  for (const d of dirs) perDir[d] = { available: available.get(d).length, included: 0 };
+
+  const cap = Math.max(0, Number(maxFiles) || 0);
+  const taken = new Map(dirs.map(d => [d, 0]));
+
+  // Round 1 — an equal share, so a huge first directory cannot drain the cap. Directories with
+  // fewer files than their share simply take what they have and release the remainder.
+  const share = dirs.length ? Math.floor(cap / dirs.length) : 0;
+  for (const d of dirs) taken.set(d, Math.min(share, available.get(d).length));
+
+  // Round 2 — redistribute what is left, one at a time, so a fair share never wastes capacity on
+  // a repo with several tiny directories and one large one.
+  let used = [...taken.values()].reduce((a, b) => a + b, 0);
+  let progress = true;
+  while (used < cap && progress) {
+    progress = false;
+    for (const d of dirs) {
+      if (used >= cap) break;
+      if (taken.get(d) < available.get(d).length) {
+        taken.set(d, taken.get(d) + 1);
+        used++;
+        progress = true;
+      }
+    }
+  }
+
+  // Round 3 — when the cap is smaller than the directory count, round 1 gave everyone 0 and round 2
+  // filled from the front. That is unavoidable; what is NOT acceptable is staying silent about it.
+  const selected = [];
+  for (const d of dirs) {
+    const n = taken.get(d);
+    perDir[d].included = n;
+    selected.push(...available.get(d).slice(0, n));
+  }
+
+  const dropped = dirs
+    .filter(d => perDir[d].included < perDir[d].available || perDir[d].available === 0)
+    .map(d => (perDir[d].available === 0
+      ? `${d}: no bundlable files found`
+      : `${d}: ${perDir[d].included} of ${perDir[d].available} files`));
+
+  return { selected, perDir, dropped };
+}
+
+module.exports = { planBundle };

package/lib/doctor-bind-default.js

@@ -20,7 +20,19 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { execSync } = require('node:child_process');
+const { execFileSync } = require('node:child_process');
+const { gitEnv } = require('./git-env');
+
+// HC-GF-180: directories that are vendored or generated wherever they SIT. The allow-list below
+// is prefix-matched, which silently failed for `.claude/worktrees/<name>/node_modules/…` — the
+// check reported 179 violations, every one a vendored playwright file, burying the single real
+// violation in this repo's own entrypoint. Matched per path SEGMENT instead.
+const ANYWHERE_DIRS = ['node_modules', '.git', 'dist', 'build', 'coverage', '.venv', '__pycache__'];
+// A git worktree is a DUPLICATE checkout of this repo. Every allow-listed prefix above fails
+// inside one (`.claude/worktrees/<name>/server/seeds/learnings/…` does not start with
+// `server/seeds/learnings/`), so a worktree both re-reports every finding and defeats every
+// exemption. Scanning it is duplicate work on files nobody would edit there.
+const ANYWHERE_PATHS = ['.claude/worktrees/'];
 
 const DEFAULT_ALLOWED_PATH_PREFIXES = [
   'tests/',
@@ -43,14 +55,117 @@ const DEFAULT_ALLOWED_PATH_PREFIXES = [
 // Files to ALSO skip by extension
 const SKIP_EXT = ['.md', '.test.js', '.test.ts', '.test.py', '.spec.js'];
 
+// What each pass reads. Applied to the file LIST, so grep is never handed anything else.
+const LITERAL_EXT = ['.py', '.js', '.ts', '.go', '.rb', '.java', '.kt', '.yml', '.yaml', '.toml', '.json', '.sh'];
+const LISTEN_EXT = ['.js', '.ts', '.mjs'];
+
+// Paths per grep call, in bytes. Under the smallest ARG_MAX in use (macOS: 1 MiB, shared with the
+// environment), so the list is split here rather than by xargs, whose exit status on macOS is 1 for
+// "no match" and for "grep was killed" alike.
+const BATCH_BYTES = 128 * 1024;
+// Each subprocess is local, but a hung one must not hang `hone doctor`: git falls back to the walk,
+// and grep reports the scan as not completed.
+const SCAN_TIMEOUT_MS = 60 * 1000;
+
+/** A repo-relative, `/`-separated path the scan must never read (a directory is pruned whole). */
+function isExcluded(rel) {
+  if (rel.split('/').some(seg => ANYWHERE_DIRS.includes(seg))) return true;
+  return ANYWHERE_PATHS.some(pth => `${rel}/`.includes(pth));
+}
+
+/**
+ * A regular file, not a symlink. grep follows a symlink it is handed, so a tracked link into
+ * `node_modules/` (or out of the repo) would be read; `grep -r` never followed one, nor does the walk.
+ * A tracked file deleted from the working tree is dropped here too, so grep is never handed a path
+ * it cannot open, and a read error can mean only that the scan failed.
+ */
+function isRegularFile(repoRoot, rel) {
+  try { return fs.lstatSync(path.join(repoRoot, rel)).isFile(); } catch { return false; }
+}
+
+// HC-GF-313: the scan used to be `grep -r .`, which descends into every directory and left the
+// exclusions above to JS, AFTER grep had read the files. Measured 2026-09-25 in a checkout with 23
+// worktrees: one pass took 47.99 s and 1,811 of its 1,917 lines came from `.claude/worktrees/`.
+// The list is built first, so an excluded directory is never opened.
+//
+// `git ls-files --cached --others --exclude-standard` is every tracked file plus every untracked one
+// that is not ignored — a new file is scanned before it is committed — and it never enters an ignored
+// `node_modules/` or a nested checkout. It does not descend into submodules: those are separate repos.
+function listScanFiles(repoRoot, run) {
+  try {
+    const out = run('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard'], {
+      cwd: repoRoot, env: gitEnv(), encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024, timeout: SCAN_TIMEOUT_MS,
+    });
+    const listed = [...new Set(out.split('\0').filter(Boolean))];
+    // An empty list is a directory git ignores or does not track, not an empty repo — walk it
+    // rather than report `ok` having read nothing.
+    if (listed.length > 0) return listed.filter(f => !isExcluded(f));
+  } catch { /* not a git work tree, no git, or it timed out: walk it */ }
+  return walkScanFiles(repoRoot);
+}
+
+/** The non-git fallback: a walk that prunes an excluded directory instead of reading it. */
+function walkScanFiles(repoRoot) {
+  const files = [];
+  const pending = [''];
+  while (pending.length) {
+    const dir = pending.pop();
+    let entries;
+    try { entries = fs.readdirSync(path.join(repoRoot, dir), { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      const rel = dir ? `${dir}/${e.name}` : e.name;
+      if (isExcluded(rel)) continue;
+      // Symlinks are not followed, as `grep -r` did not follow them.
+      if (e.isDirectory()) pending.push(rel);
+      else if (e.isFile()) files.push(rel);
+    }
+  }
+  return files;
+}
+
+/**
+ * `grep -EnH` over exactly `files`, printed as `./path:line:text`, the shape the parsers expect.
+ * Returns null when any batch did not complete, so a partial result is never read as a clean one.
+ */
+function grepFiles(repoRoot, files, pattern, run) {
+  let out = '';
+  for (let i = 0; i < files.length;) {
+    const batch = [];
+    let bytes = 0;
+    while (i < files.length && (batch.length === 0 || bytes + Buffer.byteLength(files[i]) + 3 <= BATCH_BYTES)) {
+      bytes += Buffer.byteLength(files[i]) + 3;
+      batch.push(`./${files[i]}`);
+      i += 1;
+    }
+    try {
+      out += run('grep', ['-EnH', '-e', pattern, '--', ...batch], {
+        cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+        maxBuffer: 4 * 1024 * 1024, timeout: SCAN_TIMEOUT_MS,
+      });
+    } catch (e) {
+      // Exit 1 is "nothing in this batch matched". Anything else — a file grep could not read (2),
+      // no grep (ENOENT), a signal, a timeout, output cut off at maxBuffer (ENOBUFS): the last three
+      // have no exit status at all — means the batch was not scanned, and whatever it printed is a
+      // prefix, not an answer.
+      if (e.status === 1) continue;
+      return null;
+    }
+  }
+  return out;
+}
+
 /**
  * @param {object} args
  * @param {string} args.repoRoot
  * @param {string[]} [args.allowedPaths]   path prefixes to skip (default: DEFAULT_ALLOWED_PATH_PREFIXES)
+ * @param {Function} [args.execFileSyncImpl]  injectable for tests; defaults to child_process.execFileSync
  * @returns {{ name: 'bind-default', status: 'ok'|'drift'|'skip', reason: string, suggestedFix?: string }}
  */
 function checkBindDefault(args) {
-  const { repoRoot, allowedPaths = DEFAULT_ALLOWED_PATH_PREFIXES } = args || {};
+  const {
+    repoRoot, allowedPaths = DEFAULT_ALLOWED_PATH_PREFIXES, execFileSyncImpl = execFileSync,
+  } = args || {};
   const name = 'bind-default';
 
   if (!repoRoot || typeof repoRoot !== 'string') {
@@ -60,19 +175,25 @@ function checkBindDefault(args) {
     return { name, status: 'skip', reason: `repoRoot does not exist: ${repoRoot}` };
   }
 
-  // grep -rE "0\.0\.0\.0" with file exclusions
-  let raw = '';
-  try {
-    raw = execSync(
-      `grep -rEn '0\\.0\\.0\\.0' . ` +
-      `--include='*.py' --include='*.js' --include='*.ts' --include='*.go' --include='*.rb' --include='*.java' --include='*.kt' ` +
-      `--include='*.yml' --include='*.yaml' --include='*.toml' --include='*.json' --include='*.sh' ` +
-      `2>/dev/null || true`,
-      { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 4 * 1024 * 1024 },
-    );
-  } catch {
-    return { name, status: 'skip', reason: 'grep failed (or no source files matched)' };
-  }
+  const scanFiles = listScanFiles(repoRoot, execFileSyncImpl)
+    .filter(f => [...LITERAL_EXT, ...LISTEN_EXT].some(ext => f.endsWith(ext)))
+    .filter(f => isRegularFile(repoRoot, f));
+  const withExt = (exts) => scanFiles.filter(f => exts.some(ext => f.endsWith(ext)));
+  const notCompleted = (what) => ({
+    name, status: 'skip', reason: `grep did not complete, so the ${what} scan has no result`,
+  });
+
+  const raw = grepFiles(repoRoot, withExt(LITERAL_EXT), '0\\.0\\.0\\.0', execFileSyncImpl);
+  if (raw === null) return notCompleted('wildcard-literal');
+
+  // ── HC-GF-180: a bind with NO host is the violation the literal scan cannot see ──────────
+  // `app.listen(PORT, cb)` binds every interface at runtime and contains no `0.0.0.0` to grep for.
+  // This repo's own entrypoint was exactly that (`server/src/index.js:312`, confirmed by `lsof`
+  // reporting `*:4000`) while the check reported `ok` — a clean result from a scan that could not
+  // have found it. Only the first argument matters: a second argument that is a host (a string, or
+  // anything reading an env var) is a correct bind; a function is a callback and means no host.
+  const hostless = grepFiles(repoRoot, withExt(LISTEN_EXT), '\\.listen\\(', execFileSyncImpl);
+  if (hostless === null) return notCompleted('listen()');
 
   const offenders = [];
   for (const line of raw.split('\n')) {
@@ -84,6 +205,9 @@ function checkBindDefault(args) {
 
     // Filter out allowed paths
     if (allowedPaths.some(p => file.startsWith(p))) continue;
+    // HC-GF-180: …and vendored/generated dirs at ANY depth, not just the repo root.
+    if (file.split('/').some(seg => ANYWHERE_DIRS.includes(seg))) continue;
+    if (ANYWHERE_PATHS.some(pth => file.includes(pth))) continue;
     // Filter out test/spec files by extension
     if (SKIP_EXT.some(ext => file.endsWith(ext))) continue;
     // Filter out env-var-driven binds (legitimate use)
@@ -92,24 +216,74 @@ function checkBindDefault(args) {
     if (/^\s*(#|\/\/|--).*0\.0\.0\.0/.test(content)) continue;
     // Filter out docstrings/multiline strings (Python """, JS template literals, block comments)
     if (/^\s*("""|'''|\/\*|\*)/.test(content)) continue;
-    // Filter out lines that describe/document the pattern rather than use it
-    if (/override|example|usage|default.*is|should|must|can\s/i.test(content) && !/=\s*['"]0\.0\.0\.0/.test(content)) continue;
+    // HC-GF-180: the literal counts only as a VALUE, not as a mention. The heuristics below used
+    // to guess from surrounding words ("example", "should", …) and let six mentions through on
+    // this repo — prompt text quoting the rule, a trailing `// 0.0.0.0` comment, and this file's
+    // own strings — while the one real violation was a bind with no literal at all.
+    //
+    // A value sits in argument or assignment position: preceded by `(`, `,`, `=` or `:` and
+    // followed by `)`, `,`, or the end of the line. Prose keeps its quotes but not that shape.
+    const asValue = /(?:[(,=:]\s*)['"`]0\.0\.0\.0['"`]\s*(?:[),\]}]|$)/.test(content)
+      || /\b(host|hostname|bind|address|addr)\b\s*[:=]\s*['"`]?0\.0\.0\.0/i.test(content);
+    if (!asValue) continue;
 
     offenders.push({ file, line: lineNo, content: content.trim().slice(0, 100) });
   }
 
+  for (const line of hostless.split('\n')) {
+    if (!line.trim()) continue;
+    const m = line.match(/^\.\/(.+?):(\d+):(.*)$/);
+    if (!m) continue;
+    const [, file, lineNo, content] = m;
+    if (allowedPaths.some(p => file.startsWith(p))) continue;
+    if (file.split('/').some(seg => ANYWHERE_DIRS.includes(seg))) continue;
+    if (ANYWHERE_PATHS.some(pth => file.includes(pth))) continue;
+    if (SKIP_EXT.some(ext => file.endsWith(ext))) continue;
+    if (/^\s*(#|\/\/|--|\*)/.test(content)) continue;
+
+    // What follows `.listen(` up to the matching-ish close. A second argument that is a string
+    // literal or an env-var read is a host; `() =>`, `function`, or no second argument at all is
+    // not, and Node then defaults to every interface.
+    const call = /\.listen\(([^)]*)/.exec(content);
+    if (!call) continue;
+    const args = call[1];
+    const second = args.split(',').slice(1).join(',').trim();
+    const hasHost = second.length > 0
+      && !/^(\(|function\b|async\b)/.test(second)
+      && !/^\w+\s*=>/.test(second);
+    if (hasHost) continue;
+    // `.listen()` with no args at all is usually a net/http server reusing a bound socket.
+    if (args.trim() === '') continue;
+
+    offenders.push({
+      file, line: lineNo,
+      content: `${content.trim().slice(0, 80)}  [no host argument — binds every interface]`,
+    });
+  }
+
   if (offenders.length === 0) {
     return {
       name,
       status: 'ok',
-      reason: 'no literal 0.0.0.0 binds found in production code',
+      // HC-GF-180: say what was actually checked. The old wording named only the literal
+      // scan, so a clean result read as proof of something narrower than the check now does
+      // — and a reader comparing message to behaviour would have concluded the hostless
+      // pass did not run.
+      reason: 'no wildcard binds in production code: no 0.0.0.0 literal in value position, '
+        + 'and no listen() without an explicit host',
     };
   }
 
   // Prescriptive language per SC-006-L1
+  // HC-GF-180: a hostless bind in an ENTRYPOINT is the one an operator must see; it is what
+  // actually opens a port on every interface. Sorting it to the front stops it hiding behind
+  // "(+N more)", which is where `server/src/index.js` sat while the check reported 179 findings.
+  const rank = (o) => (/(^|\/)(index|server|app|main)\.(js|ts|mjs)$/.test(o.file) ? 0 : 1);
+  offenders.sort((a, b) => rank(a) - rank(b));
   const detail = offenders.slice(0, 5).map(o => `${o.file}:${o.line}`).join(', ');
   return {
     name,
+    offenders,
     status: 'drift',
     reason: `MUST NOT bind 0.0.0.0 from code (per E13-A-L1). Never default to a wildcard host; always read from BIND_HOST env-var with 127.0.0.1 fallback. Found ${offenders.length} violation(s): ${detail}${offenders.length > 5 ? ` (+${offenders.length - 5} more)` : ''}`,
     suggestedFix: 'Use os.getenv("BIND_HOST", "127.0.0.1") or process.env.BIND_HOST || "127.0.0.1". See reliability/SKILL.md §Bind to localhost by default.',

package/lib/doctor-local-run.js

@@ -20,8 +20,118 @@
 const { execFile } = require('child_process');
 
 const PROBE_TIMEOUT_MS = 60_000;
+const TOKEN_PROBE_TIMEOUT_MS = 10_000;
 
 /** Ask the server what it will spend on. The answer must come from the server, never config. */
+
+/**
+ * HC-GF-180: name the wrong-server case, which the server cannot.
+ *
+ * A token minted by one server does not validate against another (different `JWT_SECRET`), and the
+ * only signal is `Submit failed: Invalid or expired token` — which reads as an expiry. Recovering
+ * from that message meant reading route source to learn how to mint a local token.
+ *
+ * @param {string|null|undefined} configApi  the `api` recorded in ~/.honerc
+ * @param {string} apiUrl                    the server about to be used
+ * @returns {string|null} a warning naming BOTH servers, or null when they agree / nothing is known
+ */
+function describeTokenMismatch(configApi, apiUrl) {
+  const norm = (u) => (typeof u === 'string' ? u.trim().replace(/\/+$/, '') : null);
+  const a = norm(configApi);
+  const b = norm(apiUrl);
+  if (!a || !b || a === b) return null;
+  return `the token in ~/.honerc was minted by ${a}, but this check targets ${b}. `
+    + 'A token does not validate across servers — they sign with different JWT_SECRETs — so a run '
+    + 'will be refused with a message that says the token is invalid, not that it belongs '
+    + 'elsewhere. Mint one for this server (POST /admin/tokens) and export it as HONE_TOKEN — it '
+    + 'takes precedence over ~/.honerc, so the credentials kept there stay untouched.';
+}
+
+/**
+ * HC-GF-267: which token will a run SEND? The same resolution as getConfig() in cli/hone-cli.js —
+ * `process.env.HONE_TOKEN || rc.token` — including the `||`, so an EMPTY HONE_TOKEN falls through
+ * to ~/.honerc there and here alike. Returns the source label; the value is never rendered.
+ */
+function resolveTokenInEffect(env, rc) {
+  if (env && env.HONE_TOKEN) return { token: env.HONE_TOKEN, source: 'HONE_TOKEN' };
+  if (rc && rc.token) return { token: rc.token, source: '~/.honerc' };
+  return { token: null, source: null };
+}
+
+/**
+ * HC-GF-267: ask the server whether it accepts the token a run will send, instead of inferring it
+ * from the `api` field ~/.honerc happens to record. That field is the same whether the token works
+ * or not — exactly the status-field trap this file was written around. `GET /usage/me` sits behind
+ * the same `auth` middleware a run does and changes nothing but the `tokens.last_used` audit stamp
+ * that middleware writes on every authenticated request.
+ *
+ * Only a 401 means refused. Anything else — a network error, a 5xx, a 503 with no DB — says
+ * nothing about the token, so it is `unknown` and the caller falls back to the inference.
+ * The token goes in the header and nowhere else: no field of the result carries it.
+ */
+async function probeToken(apiUrl, token, fetchImpl) {
+  if (!token) return { verdict: 'unknown' };
+  const f = fetchImpl || globalThis.fetch;
+  try {
+    const res = await f(`${apiUrl.replace(/\/$/, '')}/usage/me`, {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(TOKEN_PROBE_TIMEOUT_MS),
+    });
+    if (res.ok) return { verdict: 'accepted' };
+    if (res.status !== 401) return { verdict: 'unknown' };
+    let error = null;
+    try {
+      const body = await res.json();
+      if (body && typeof body.error === 'string') error = body.error.slice(0, 80);
+    } catch { /* an unparseable 401 is still a refusal */ }
+    return { verdict: 'refused', error };
+  } catch {
+    return { verdict: 'unknown' };
+  }
+}
+
+/**
+ * HC-GF-267: the token advice, decided by the token a run will actually send.
+ *
+ * describeTokenMismatch compares ~/.honerc's `api` with the target — but when HONE_TOKEN is set,
+ * ~/.honerc's token is never sent, so that comparison describes a credential no run uses. Measured
+ * 2026-09-24: with a local HONE_TOKEN exported, runs got 200s while this check warned that "a run
+ * will be refused" and prescribed `hone init`, which overwrites ~/.honerc and the production
+ * credentials kept there.
+ *
+ * @param {{source:string|null, probe:{verdict:string,error?:string|null}, rcApi:?string, apiUrl:string}} s
+ * @returns {string|null}
+ */
+function describeTokenInEffect({ source, probe, rcApi, apiUrl }) {
+  if (probe.verdict === 'accepted') return null;
+  const target = String(apiUrl).trim().replace(/\/+$/, '');
+  const said = probe.error ? ` ("${probe.error}")` : '';
+
+  if (source === 'HONE_TOKEN') {
+    // ~/.honerc is not consulted, so nothing it records can be evidence either way. Only the
+    // server's own refusal is worth reporting.
+    if (probe.verdict !== 'refused') return null;
+    return `the token in HONE_TOKEN is refused by ${target}${said}. HONE_TOKEN takes precedence, `
+      + 'so ~/.honerc is not consulted and changing it will not help. Mint a token for this '
+      + 'server (POST /admin/tokens) and export that as HONE_TOKEN instead.';
+  }
+
+  const mismatch = describeTokenMismatch(rcApi, apiUrl);
+  if (mismatch || probe.verdict !== 'refused') return mismatch;
+  const remedy = 'Mint one (POST /admin/tokens) and export it as HONE_TOKEN — it takes precedence '
+    + 'over ~/.honerc, so the credentials kept there stay untouched.';
+  // No mismatch and refused means ~/.honerc either names THIS server or names none. Only the first
+  // supports a diagnosis; a hand-edited ~/.honerc with no `api` says nothing about where it came from.
+  if (typeof rcApi !== 'string' || !rcApi.trim()) {
+    return `the token in ~/.honerc is refused by ${target}${said}, and ~/.honerc records no server `
+      + `for it, so it may have been minted by another one. ${remedy}`;
+  }
+  return `the token in ~/.honerc is refused by ${target}${said}, although ~/.honerc records this `
+    + 'server — so it was revoked, or the server\'s database or JWT_SECRET changed after it was '
+    + `minted (HC-GF-212). ${remedy}`;
+}
+
 async function fetchHealth(apiUrl, fetchImpl) {
   const f = fetchImpl || globalThis.fetch;
   const res = await f(`${apiUrl.replace(/\/$/, '')}/health`, { method: 'GET' });
@@ -80,6 +190,21 @@ async function checkLocalRun(opts = {}) {
   const apiUrl = opts.apiUrl;
   const examined = [];
 
+  // HC-GF-180: a $0 verdict is useless if the run is refused before it starts. The stored token
+  // may belong to a DIFFERENT server, and the only signal then is "Invalid or expired token",
+  // which names an expiry rather than the mismatch. Read it here so the check can say which.
+  let rc = null;
+  try {
+    const readConfig = opts.readConfig || (() => {
+      const p = require('node:path').join(require('node:os').homedir(), '.honerc');
+      return JSON.parse(require('node:fs').readFileSync(p, 'utf8'));
+    });
+    rc = readConfig() || {};
+    examined.push('~/.honerc target');
+  } catch { /* no config, or unreadable — a different problem with a different fix */ }
+  // HC-GF-267: …but ~/.honerc's token is only the one a run sends when HONE_TOKEN is unset.
+  const inEffect = resolveTokenInEffect(opts.env || process.env, rc);
+
   let health;
   try {
     health = await fetchHealth(apiUrl, opts.fetchImpl);
@@ -168,11 +293,22 @@ async function checkLocalRun(opts = {}) {
     };
   }
 
+  // HC-GF-180: the mismatch is ADVICE, not a verdict. This check answers one question — what will
+  // a run cost — and `status: ok` means $0.00 (pinned by cli/lib/doctor-local-run.test.js). An
+  // earlier version returned `drift` here, which hijacked the cost contract for an auth concern
+  // and made the result depend on whatever `~/.honerc` happened to hold. It is appended to the
+  // guidance instead, where an operator reads it before the server refuses them.
+  // HC-GF-267: decided by the token a run will send, and by the server when it can be asked.
+  const tokenProbe = await probeToken(apiUrl, inEffect.token, opts.fetchImpl);
+  if (tokenProbe.verdict !== 'unknown') examined.push('token in effect');
+  const tokenNote = describeTokenInEffect({
+    source: inEffect.source, probe: tokenProbe, rcApi: rc && rc.api, apiUrl });
   return {
     name: 'local-run', status: 'ok', examined: examined.length,
     reason: 'a run started now costs $0.00 and cannot reach a paid provider',
     suggestedFix: `server: ${apiUrl} · provider: claude_cli · fallback: disabled · ` +
             `probe: ok${probe.model ? ` (${probe.model})` : ''}` +
+            (tokenNote ? `\n  ⚠ ${tokenNote}` : '') +
             (llm.auth && llm.auth.api_key_visible
               ? '\n  Note: a metered API key is visible in this shell. The provider scrubs it ' +
                 'from the child, but you may want it unset.'
@@ -180,4 +316,6 @@ async function checkLocalRun(opts = {}) {
   };
 }
 
-module.exports = { checkLocalRun, probeLocalClaude, fetchHealth };
+module.exports = {
+  describeTokenMismatch, describeTokenInEffect, resolveTokenInEffect, probeToken,
+  checkLocalRun, probeLocalClaude, fetchHealth };

package/lib/emit-pr.js

@@ -35,6 +35,10 @@ const EXIT = {
   BRANCH_CONFLICT: 5, // local branch already exists (not overwritten)
   PUBLISH_FAILED: 6,  // push or gh pr create failed (no remote / no auth / rejected)
   UNRESOLVED: 7,      // --verify could not start the test command (HC-GF-008) — no commit made
+  // HC-GF-270: the run's story text came from an untrusted source — nothing executed, no
+  // branch created. MUST stay equal to verify-patch.js's EXIT.UNTRUSTED_SOURCE (this map is
+  // byte-compatible with verify-patch's 0–4 by contract, and 9 is shared for the same reason).
+  UNTRUSTED_SOURCE: 9,
 };
 
 /**
@@ -77,14 +81,36 @@ function buildBranchName({ storyId, workflowId, override }) {
  * spoofed (the commit is authored by the adopter's own git identity).
  *
  * @param {{storyId:string, summary?:string, workflowId:string, headSha:string,
- *          verifyState:'pass'|'skipped'}} o
+ *          verifyState:'pass'|'pass_narrowed'|'skipped', replacedCommand?:string}} o
  */
-function buildCommitMessage({ storyId, summary, workflowId, headSha, verifyState }) {
+/**
+ * HC-GF-223: the verify verdict → what emit-pr does with it, as a function rather than a branch
+ * buried in a 200-line action, so it can be tested by behaviour (the move HC-GF-144 made for
+ * `verdictEnv`). `null` means no branch is emitted.
+ *
+ * `pass_narrowed` emits: the tests that ran DID pass, so there is a deliverable, and refusing it
+ * would punish the operator who cannot run the configured command in that worktree at all — the
+ * half of HC-GF-223 still open. The qualification travels in the commit message and the PR body,
+ * and the gate is blocked by the verdict `verify-patch --report` sends, not by withholding a branch.
+ */
+function verifyStateFor(verdict) {
+  if (verdict === 'pass') return 'pass';
+  if (verdict === 'pass_narrowed') return 'pass_narrowed';
+  return null;
+}
+
+function buildCommitMessage({ storyId, summary, workflowId, headSha, verifyState, replacedCommand }) {
   const subjectStory = storyId || 'story';
   const subjectText = (summary && summary.trim().split('\n')[0].trim()) || 'apply generated changes';
+  // HC-GF-223: three states, not two. A run under an operator-supplied command passed on a SUBSET,
+  // and a commit that says "pass" for it is the overclaim this repo keeps finding.
   const verifyLine = verifyState === 'pass'
     ? `Verified by \`hone verify-patch\` against HEAD ${headSha}: pass.`
-    : `Diff applies against HEAD ${headSha}; verify skipped.`;
+    : verifyState === 'pass_narrowed'
+      ? `Partially verified against HEAD ${headSha}: the tests run under an operator-supplied `
+        + `command passed${replacedCommand ? `, but \`${replacedCommand}\` did not run` : ''} — `
+        + 'evidence about a subset, not a verification of the change.'
+      : `Diff applies against HEAD ${headSha}; verify skipped.`;
   return [
     `${subjectStory}: ${subjectText}`,
     '',
@@ -112,13 +138,19 @@ const HONEST_LIMIT = [
  * PR body. Always a draft's body; always carries HONEST_LIMIT verbatim.
  *
  * @param {{storyId:string, workflowId:string, headSha:string,
- *          verifyState:'pass'|'skipped', command?:string, runUrl?:string}} o
+ *          verifyState:'pass'|'pass_narrowed'|'skipped', command?:string, replacedCommand?:string, runUrl?:string}} o
  */
-function buildPrBody({ storyId, workflowId, headSha, verifyState, command, runUrl }) {
+function buildPrBody({ storyId, workflowId, headSha, verifyState, command, replacedCommand, runUrl }) {
   const verification = verifyState === 'pass'
     ? `- Verification: \`hone verify-patch\` — tests PASSED against HEAD \`${headSha}\`` +
       (command ? ` using \`${command}\`` : '')
-    : `- Verification: SKIPPED — diff applies against HEAD \`${headSha}\`, tests not run at emit time`;
+    // HC-GF-223: a reviewer must be able to see that the configured command never ran.
+    : verifyState === 'pass_narrowed'
+      ? `- Verification: PARTIAL — tests passed against HEAD \`${headSha}\``
+        + (command ? ` using \`${command}\`` : '')
+        + `${replacedCommand ? `, but \`${replacedCommand}\` did not run` : ''}`
+        + '; this is evidence about a subset, not a verification of the change'
+      : `- Verification: SKIPPED — diff applies against HEAD \`${headSha}\`, tests not run at emit time`;
   const lines = [
     '## Summary',
     `Automated change for ${storyId || 'a story'}, generated by the Hone SDLC pipeline.`,
@@ -157,6 +189,7 @@ function decidePublish({ branchExists, openPrUrl }) {
 }
 
 module.exports = {
+  verifyStateFor,
   EXIT,
   HONEST_LIMIT,
   slugifyRef,

package/lib/git-helpers.js

@@ -5,7 +5,11 @@
  * Extracted from cli/hone-cli.js's inline `getSkillLastModifiedDays`
  * (which was added inline for LC-003 — `hone audit-learnings`). LC-004
  * adds a sibling `getFirstCommitDateMs` for the captured_at-fallback
- * path — both helpers share the same execSync error-handling shape.
+ * path — both helpers share the same error-handling shape.
+ *
+ * Both run git with an argument array, never a shell string, and a bounded
+ * timeout (HC-GF-097-followup-2): the path is a tracked file's name, and
+ * double quotes do not stop `$(...)` or backticks inside it.
  *
  * Pure-helper-with-injected-IO style: each helper accepts `repoRoot`
  * + the relative file path, returns a primitive (number-of-days,
@@ -19,11 +23,18 @@
  *
  * Issue: #143 (LC-004) — captured_at fallback to git log file mtime.
  */
-const { execSync } = require('node:child_process');
+const { execFileSync } = require('node:child_process');
 const { gitEnv } = require('./git-env');
 const fs = require('node:fs');
 const path = require('node:path');
 
+// A timeout throws, which each helper already reads as null ("unknown"). `git log -1` stops at the
+// first match. `--follow` walks the whole history: measured 2026-09-26 at 11.4-16.9 s through this
+// helper on a synthetic 1M-commit repo (a loaded laptop), so 10 s would turn a large adopter repo's
+// answer into null. It gets 60 s.
+const GIT_LOG_TIMEOUT_MS = 10_000;
+const GIT_FOLLOW_TIMEOUT_MS = 60_000;
+
 /**
  * Last-modified Unix timestamp (seconds) for a tracked file, via
  * `git log -1 --format=%ct -- <path>`. Returns null if:
@@ -39,9 +50,9 @@ function getLastCommitTimestampSeconds(repoRoot, relativePath) {
   const abs = path.join(repoRoot, relativePath);
   if (!fs.existsSync(abs)) return null;
   try {
-    const out = execSync(
-      `git log -1 --format=%ct -- ${JSON.stringify(relativePath)}`,
-      { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+    const out = execFileSync(
+      'git', ['log', '-1', '--format=%ct', '--', relativePath],
+      { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: GIT_LOG_TIMEOUT_MS }
     ).trim();
     if (!out) return null;
     const seconds = Number(out);
@@ -74,9 +85,9 @@ function getFirstCommitDateMs(repoRoot, relativePath) {
   const abs = path.join(repoRoot, relativePath);
   if (!fs.existsSync(abs)) return null;
   try {
-    const out = execSync(
-      `git log --diff-filter=A --follow --format=%at -- ${JSON.stringify(relativePath)}`,
-      { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }
+    const out = execFileSync(
+      'git', ['log', '--diff-filter=A', '--follow', '--format=%at', '--', relativePath],
+      { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: GIT_FOLLOW_TIMEOUT_MS }
     ).trim();
     if (!out) return null;
     // Multiple ADD events possible (file renames); take the OLDEST (last line)