@hone-ai/cli 1.35.0 → 1.35.1

package/hone-cli.js

@@ -39,6 +39,7 @@ const { parseReviewJSON } = require('./lib/parse-review-json');
 const { resolveBaseRef, getMaxDiffChars } = require('./lib/release-review-config');
 const { gitEnv } = require('./lib/git-env');
 const { collectIncludePaths } = require('./lib/include-paths');
+const { runArgsError, orchestratePath } = require('./lib/run-target'); // HC-GF-270-followup-1
 const program = new Command();
 
 // ── Config resolution ─────────────────────────────────────────────────────────
@@ -68,6 +69,31 @@ function requireAdminKey() {
   return adminKey;
 }
 
+/**
+ * HC-GF-270-followup-1: refuse a caller-supplied run id, batch id, step key or attempt that is not one,
+ * with exit 2. Called as the FIRST statement of a verb's action, before getConfig() or api(), so a
+ * refusal makes no request, reads no ~/.honerc, and runs no probe, gh call or CI command.
+ */
+function refuseBadRunArgs(checks) {
+  const msg = runArgsError(checks);
+  if (msg) {
+    console.error(msg);
+    process.exit(2);
+  }
+}
+
+/**
+ * The arguments check-patch, verify-patch and emit-pr turn into a step-output URL. HC-GF-270 (second
+ * review MEDIUM-1): the step key goes into a URL and a file name, and URL resolution collapses `..` —
+ * `--step-key ../../<other run>/step/step_4` fetched ANOTHER run's patch while THIS run's config was
+ * assessed. A step key is a step key, a run id is a run id, and an attempt is a whole number.
+ */
+const stepFetchChecks = (workflowId, opts) => [
+  { label: '<workflowId>', kind: 'runId', value: workflowId },
+  { label: '--step-key', kind: 'stepKey', value: opts.stepKey },
+  { label: '--attempt', kind: 'attempt', value: opts.attempt, optional: true },
+];
+
 function getConfig() {
   // Priority: env var → ~/.honerc → error
   const rc     = readRc();
@@ -188,6 +214,8 @@ program
   .option('--workflow-id <id>', 'The run id to report the verdict against (for --report)')
   .option('--timeout <s>', 'Seconds to allow each probe (default 5 — raise it for packs that need a real generation)', '5')
   .action(async (opts) => {
+    // HC-GF-270-followup-1: a --workflow-id is checked before any probe spends provider quota.
+    refuseBadRunArgs([{ label: '--workflow-id', kind: 'runId', value: opts.workflowId, optional: true }]);
     const { readAgentEvalConfig } = require('./lib/pipeline-config');
     const { runAgent } = require('./lib/agent-executor');
     const { runCheck } = require('./lib/eval-graders');
@@ -343,7 +371,7 @@ program
       } else {
         try {
           const client = api(getConfig());
-          await client.post(`/orchestrate/${opts.workflowId}/verdict`, {
+          await client.post(orchestratePath([opts.workflowId, 'verdict']), {
             source: 'agent-eval',
             stepKey: 'step_4',
             verdict: anyFailed ? 'fail' : 'pass',
@@ -3060,23 +3088,25 @@ program
         console.log('No .github/learnings/ directory found — nothing to retract.');
         return;
       }
-      const yaml = require('js-yaml');
+      // HC-GF-311-followup-1: per learning, in every schema `hone promote` reads — not just the file's top level.
+      const { parseRetracted } = require('./lib/learnings-parse');
       const files = fs.readdirSync(learningsDir).filter(f => f.endsWith('.yml'));
       for (const file of files) {
-        try {
-          const parsed = yaml.load(fs.readFileSync(path.join(learningsDir, file), 'utf8'));
-          const entries = Array.isArray(parsed) ? parsed : [parsed];
-          for (const entry of entries) {
-            if (entry?.status === 'retracted' && entry.id) {
-              payload.push({
-                id: entry.id,
-                repo_name: repoName,
-                reason: entry.retraction_reason || 'Retracted (no reason provided in YAML)',
-              });
-            }
-          }
-        } catch (e) {
-          console.warn(`  ⚠ ${file}: parse error — ${e.message}`);
+        // One unreadable entry (a directory or a dangling link named *.yml) must not hide the rest.
+        let content;
+        try { content = fs.readFileSync(path.join(learningsDir, file), 'utf8'); }
+        catch (e) { console.warn(`  ⚠ ${file}: read error — ${e.message}`); continue; }
+        const { retracted, parseError } = parseRetracted(content);
+        if (parseError) {
+          console.warn(`  ⚠ ${file}: parse error — ${parseError.message}`);
+          continue;
+        }
+        for (const { id, reason } of retracted) {
+          payload.push({
+            id,
+            repo_name: repoName,
+            reason: reason || 'Retracted (no reason provided in YAML)',
+          });
         }
       }
       if (payload.length === 0) {
@@ -4955,10 +4985,19 @@ program
     }
     // Path B: GitHub issue fetch via gh
     else if (issueId) {
+      // HC-GF-270-followup-1: an issue number or an issue URL, which are the forms gh accepts, and
+      // nothing else. gh reads an argument that begins with `-` as a flag even without a shell.
+      if (!/^[1-9]\d*$/.test(issueId) && !/^https:\/\/[^/\s]+\/[^/\s]+\/[^/\s]+\/issues\/[1-9]\d*$/.test(issueId)) {
+        console.error(`error: <issueId> must be an issue number like 142, or an issue URL (got ${JSON.stringify(issueId)})`);
+        console.error('usage: hone classify-story 142');
+        console.error('       hone classify-story --input-file inputs.yml');
+        process.exit(2);
+      }
       try {
-        const out = execSync(
-          `gh issue view ${issueId} --json title,body,labels,url`,
-          { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }
+        // An argument list, not a shell string, and a bound: a hung gh must not hang the command.
+        const out = require('child_process').execFileSync(
+          'gh', ['issue', 'view', String(issueId), '--json', 'title,body,labels,url'],
+          { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 30_000 }
         );
         issueMeta = JSON.parse(out);
         const labels = (issueMeta.labels || []).map(l => l.name);
@@ -4980,6 +5019,10 @@ program
           is_first_of_its_kind: false,
         };
       } catch (e) {
+        if (e && e.code === 'ETIMEDOUT') {
+          console.error(`error: gh issue view ${issueId} timed out after 30s`);
+          process.exit(2);
+        }
         console.error(`error: gh issue view ${issueId} failed: ${(e.stderr || '').toString().trim() || e.message}`);
         console.error(`hint: install GitHub CLI (cli.github.com), run \`gh auth login\`, or pass --input-file <path>`);
         process.exit(2);
@@ -5924,7 +5967,7 @@ program
     try {
       // HC-GF-092: advertise what this CLI can honour. The server serves the highest it also
       // knows, so an older CLI — which sends nothing — keeps being served contract 1.
-      const { data } = await client.get(`/orchestrate/${encodeURIComponent(runId)}/step-instruction?contracts=1,2`);
+      const { data } = await client.get(orchestratePath([runId, 'step-instruction'], { contracts: '1,2' }));
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
       console.log(`Step:      ${data.stepKey} (${data.agent})`);
       console.log(`Contract:  ${data.contractVersion}`);
@@ -5976,7 +6019,7 @@ program
         output = fs.readFileSync(opts.file, 'utf8');
       }
       const { data } = await client.post(
-        `/orchestrate/${encodeURIComponent(runId)}/step/${encodeURIComponent(stepKey)}/editor-output`,
+        orchestratePath([runId, 'step', stepKey, 'editor-output']),
         { contractVersion: opts.contract, output }
       );
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
@@ -6182,7 +6225,7 @@ program
 
         let status;
         try {
-          const { data: pollData } = await client.get(`/orchestrate/${pollRunId}`);
+          const { data: pollData } = await client.get(orchestratePath([pollRunId]));
           status = pollData;
         } catch (e) {
           console.error(`Poll error: ${e.message}`);
@@ -6250,7 +6293,8 @@ program
                 console.log(`  ${remedy.stepKey} named the files it needs. Re-queue with:`);
                 console.log(`    ${cmd}`);
                 if (remedy.truncated) {
-                  console.log(`    ⚠ it asked for more than ${remedy.paths.length} files; the rest were dropped.`);
+                  // HC-GF-263-followup-1: the cap counts entries, and one file may have several.
+                  console.log(`    ⚠ it asked for more than ${remedy.paths.length} paths; the rest were dropped.`);
                 }
               }
               // H5: say how many requested paths were withheld from the command, never what they were.
@@ -6352,14 +6396,14 @@ program
 
             if (answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes') {
               try {
-                await client.post(`/orchestrate/${pollRunId}/approve`, { stepKey: d.stepKey });
+                await client.post(orchestratePath([pollRunId, 'approve']), { stepKey: d.stepKey });
                 console.log('  Approved — workflow resuming...');
               } catch (e) {
                 console.error(`  Approve failed: ${e.response?.data?.error || e.message}`);
               }
             } else if (answer.toLowerCase() === 'kill') {
               try {
-                await client.post(`/orchestrate/${pollRunId}/kill`, { reason: 'CLI kill' });
+                await client.post(orchestratePath([pollRunId, 'kill']), { reason: 'CLI kill' });
                 console.log('  Workflow killed.');
                 process.exit(0);
               } catch (e) {
@@ -6388,7 +6432,7 @@ program
     if (opts.status) {
       try {
         const statusId = await existingRunId('--status');
-        const { data } = await client.get(`/orchestrate/${statusId}`);
+        const { data } = await client.get(orchestratePath([statusId]));
         if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
         console.log('');
         console.log(`Workflow: ${data.runId}`);
@@ -6438,7 +6482,7 @@ program
     if (opts.kill) {
       try {
         const killId = await existingRunId('--kill');
-        const { data } = await client.post(`/orchestrate/${killId}/kill`, { reason: 'CLI kill' });
+        const { data } = await client.post(orchestratePath([killId, 'kill']), { reason: 'CLI kill' });
         console.log(`Workflow ${data.runId} killed.`);
       } catch (e) {
         console.error(`Failed: ${e.response?.data?.error || e.message}`);
@@ -6452,7 +6496,7 @@ program
       let approveId;
       try {
         approveId = await existingRunId(`--approve ${opts.approve}`);
-        await client.post(`/orchestrate/${approveId}/approve`,
+        await client.post(orchestratePath([approveId, 'approve']),
           { stepKey: opts.approve, acknowledgeAbort: opts.acknowledgeAbort === true,
             acknowledgeFailedVerdict: opts.acknowledgeFailedVerdict === true });
         console.log(`Gate ${opts.approve} approved. Workflow resuming.`);
@@ -6606,6 +6650,10 @@ program
   // auto-approve on output text, which never ran. Approve overnight on evidence with `hone follow-batch`.
   .option('--overnight', 'Enable Night Shift mode (longer timeouts, max 25 stories; step_4/step_5 still pause for approval)', false)
   .action(async (opts) => {
+    refuseBadRunArgs([ // HC-GF-270-followup-1
+      { label: '--status', kind: 'batchId', value: opts.status, optional: true },
+      { label: '--report', kind: 'batchId', value: opts.report, optional: true },
+    ]);
     const config = getConfig();
     const client = api(config);
 
@@ -6650,7 +6698,7 @@ program
       try {
         const format = opts.format === 'json' ? 'json' : 'md';
         const { data, headers } = await client.get(
-          `/orchestrate/batch/${opts.report}/report`,
+          orchestratePath(['batch', opts.report, 'report']),
           { params: { format }, responseType: 'text', transformResponse: [(d) => d] }
         );
         if (format === 'json') {
@@ -6701,7 +6749,7 @@ program
     // ── --status <batchId> ────────────────────────────────────
     if (opts.status) {
       try {
-        const { data } = await client.get(`/orchestrate/batch/${opts.status}`);
+        const { data } = await client.get(orchestratePath(['batch', opts.status]));
         if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
         console.log('');
         console.log(`Batch:    ${data.batchId}`);
@@ -7561,13 +7609,15 @@ showCmd
   .option('--attempt <n>', 'Specific attempt number (default: latest)')
   .option('--prompt', 'Also print the exact prompt this step sent to the model (HC-GF-055)')
   .action(async (workflowId, stepKey, opts) => {
+    refuseBadRunArgs([ // HC-GF-270-followup-1
+      { label: '<workflowId>', kind: 'runId', value: workflowId },
+      { label: '<stepKey>', kind: 'stepKey', value: stepKey },
+      { label: '--attempt', kind: 'attempt', value: opts.attempt, optional: true },
+    ]);
     const config = getConfig();
     const client = api(config);
     try {
-      const q = [];
-      if (opts.attempt) q.push(`attempt=${opts.attempt}`);
-      if (opts.prompt) q.push('prompt=1');
-      const url = `/orchestrate/${workflowId}/step/${stepKey}${q.length ? `?${q.join('&')}` : ''}`;
+      const url = orchestratePath([workflowId, 'step', stepKey], { attempt: opts.attempt, prompt: opts.prompt ? '1' : undefined });
       const r = await client.get(url);
       const s = r.data;
       console.log(`── step output ──────────────────────────────────────────`);
@@ -7624,6 +7674,7 @@ program
   .option('--attempt <n>', 'Specific attempt number (default: latest)')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .action(async (workflowId, opts) => {
+    refuseBadRunArgs(stepFetchChecks(workflowId, opts)); // HC-GF-270-followup-1
     const { execFileSync } = require('child_process');
     const os = require('os');
     const { extractDiff, interpretApplyCheck } = require('./lib/patch-apply');
@@ -7639,8 +7690,7 @@ program
 
     let output;
     try {
-      const url = `/orchestrate/${workflowId}/step/${opts.stepKey}` +
-        (opts.attempt ? `?attempt=${opts.attempt}` : '');
+      const url = orchestratePath([workflowId, 'step', opts.stepKey], { attempt: opts.attempt });
       const r = await client.get(url);
       output = r.data?.output;
     } catch (e) {
@@ -7764,6 +7814,7 @@ program
   .option('--trust-source', 'HC-GF-270: run a patch whose story text came from a source Hone does not trust (you have read the diff)')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .action(async (workflowId, opts) => {
+    refuseBadRunArgs(stepFetchChecks(workflowId, opts)); // HC-GF-270(-followup-1): first, before any config read
     const { execFileSync, spawnSync } = require('child_process');
     // HC-GF-200: refuse a mistyped bound HERE, naming the flag. Left to node,
     // a NaN becomes `RangeError: ... It must be an integer. Received NaN` from
@@ -7782,13 +7833,6 @@ program
     const { gitEnv } = require('./lib/git-env');
     const config = getConfig();
     const client = api(config);
-    // HC-GF-270 (second review MEDIUM-1): the step key goes into a URL and a file name, and URL
-    // resolution collapses `..` — `--step-key ../../<other run>/step/step_4` fetched ANOTHER run's
-    // patch while THIS run's config was assessed. A step key is a step key.
-    if (!/^step_[0-9a-z_]+$/i.test(String(opts.stepKey || ''))) {
-      console.error(`--step-key must name a step, like step_4 (got ${JSON.stringify(opts.stepKey)})`);
-      process.exit(2);
-    }
     const sameRun = (id) => String(id).toLowerCase() === String(workflowId).toLowerCase();
 
     const emit = (obj, humanLine) => {
@@ -7806,8 +7850,7 @@ program
     let runStoryId = null;
     let runFetchFailed = false;
     try {
-      const url = `/orchestrate/${encodeURIComponent(workflowId)}/step/${encodeURIComponent(opts.stepKey)}` +
-        (opts.attempt ? `?attempt=${opts.attempt}` : '');
+      const url = orchestratePath([workflowId, 'step', opts.stepKey], { attempt: opts.attempt });
       const r = await client.get(url);
       // The step output must be THIS run's: nothing else ties the patch to the config assessed below.
       if (r.data?.runId && !sameRun(r.data.runId)) throw new Error(`the server returned ${opts.stepKey} for a different run`);
@@ -7817,7 +7860,7 @@ program
       verifiedAttempt = r.data?.attempt != null ? Number(r.data.attempt) : undefined;
       // best-effort: pull the run's ci_local_command for the default
       try {
-        const runR = await client.get(`/orchestrate/${encodeURIComponent(workflowId)}`);
+        const runR = await client.get(orchestratePath([workflowId]));
         // HC-GF-270 (security review BLOCKER-1): the id is ENCODED above, so a crafted
         // `<uuid>/step/step_4?` cannot turn this into a fetch of some other endpoint that answers
         // 200 with no config. And a body that is not THIS run is not this run's config.
@@ -8234,7 +8277,7 @@ program
     // change the local exit code (the verdict is already true locally).
     if (opts.report && reportVerdict) {
       try {
-        await client.post(`/orchestrate/${encodeURIComponent(workflowId)}/verdict`, {
+        await client.post(orchestratePath([workflowId, 'verdict']), {
           source: 'verify-patch',
           stepKey: opts.stepKey,
           verdict: reportVerdict,
@@ -8268,11 +8311,12 @@ program
   .description('What happened on a run, and what still needs you')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .action(async (runId, opts) => {
+    refuseBadRunArgs([{ label: '<runId>', kind: 'runId', value: runId }]); // HC-GF-270-followup-1
     const { buildReport, renderReport } = require('./lib/run-report');
     const config = getConfig();
     const client = api(config);
     try {
-      const { data } = await client.get(`/orchestrate/${runId}`);
+      const { data } = await client.get(orchestratePath([runId]));
       const report = buildReport(data);
       if (opts.format === 'json') console.log(JSON.stringify(report, null, 2));
       else console.log(renderReport(report));
@@ -8334,8 +8378,8 @@ program
     const client = api(config);
     const repoName = opts.repo || path.basename(process.cwd());
     const io = {
-      fetchBatch: async (id) => (await client.get(`/orchestrate/batch/${encodeURIComponent(id)}`)).data,
-      fetchRun: async (id) => (await client.get(`/orchestrate/${encodeURIComponent(id)}`)).data,
+      fetchBatch: async (id) => (await client.get(orchestratePath(['batch', id]))).data,
+      fetchRun: async (id) => (await client.get(orchestratePath([id]))).data,
       runVerb: (argv) => new Promise((resolve) => {
         const child = spawn(process.execPath, [process.argv[1], ...argv],
           { cwd: process.cwd(), env: process.env, stdio: ['ignore', 'inherit', 'inherit'] });
@@ -8389,6 +8433,7 @@ program
   .option('--no-provision', 'Do not install/link dependencies into the isolated worktree (HC-COMM-010-followup-6)')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .action(async (workflowId, opts) => {
+    refuseBadRunArgs(stepFetchChecks(workflowId, opts)); // HC-GF-270(-followup-1): first, before any config read
     const { execFileSync, spawnSync } = require('child_process');
     // HC-GF-200: refuse a mistyped bound HERE, naming the flag. Left to node,
     // a NaN becomes `RangeError: ... It must be an integer. Received NaN` from
@@ -8411,13 +8456,6 @@ program
     const { gitEnv } = require('./lib/git-env');
     const config = getConfig();
     const client = api(config);
-    // HC-GF-270 (second review MEDIUM-1): the step key goes into a URL and a file name, and URL
-    // resolution collapses `..` — `--step-key ../../<other run>/step/step_4` fetched ANOTHER run's
-    // patch while THIS run's config was assessed. A step key is a step key.
-    if (!/^step_[0-9a-z_]+$/i.test(String(opts.stepKey || ''))) {
-      console.error(`--step-key must name a step, like step_4 (got ${JSON.stringify(opts.stepKey)})`);
-      process.exit(2);
-    }
     const sameRun = (id) => String(id).toLowerCase() === String(workflowId).toLowerCase();
 
     // --open-pr implies --push (cannot open a PR against an unpushed branch).
@@ -8440,14 +8478,13 @@ program
     // never arrived.
     let runStoryId = null;
     try {
-      const url = `/orchestrate/${encodeURIComponent(workflowId)}/step/${encodeURIComponent(opts.stepKey)}` +
-        (opts.attempt ? `?attempt=${opts.attempt}` : '');
+      const url = orchestratePath([workflowId, 'step', opts.stepKey], { attempt: opts.attempt });
       const r = await client.get(url);
       // The step output must be THIS run's: nothing else ties the patch to the config assessed below.
       if (r.data?.runId && !sameRun(r.data.runId)) throw new Error(`the server returned ${opts.stepKey} for a different run`);
       output = r.data?.output;
       try {
-        const runR = await client.get(`/orchestrate/${encodeURIComponent(workflowId)}`);
+        const runR = await client.get(orchestratePath([workflowId]));
         // HC-GF-270 (security review BLOCKER-1): see verify-patch — encoded id, and a body that
         // is not THIS run does not count as its config.
         if (runR.data?.runId && !sameRun(runR.data.runId)) throw new Error('run id mismatch');
@@ -8766,6 +8803,8 @@ program
   .option('--workflow-id <id>', 'the run id to report the verdict against (required with --report)')
   .option('--format <fmt>', 'pretty or json', 'pretty')
   .action(async (prOrBranch, opts) => {
+    // HC-GF-270-followup-1: a --workflow-id is checked before any gh call or CI command runs.
+    refuseBadRunArgs([{ label: '--workflow-id', kind: 'runId', value: opts.workflowId, optional: true }]);
     const { execFileSync, spawnSync } = require('child_process');
     // HC-GF-200: refuse a mistyped bound HERE, naming the flag. Left to node,
     // a NaN becomes `RangeError: ... It must be an integer. Received NaN` from
@@ -8867,7 +8906,7 @@ program
       } else {
         try {
           const client = api(getConfig());
-          await client.post(`/orchestrate/${opts.workflowId}/verdict`, {
+          await client.post(orchestratePath([opts.workflowId, 'verdict']), {
             source: 'verify-pr',
             stepKey: 'step_5c',
             verdict: verdict.verdict,

package/lib/learnings-parse.js

@@ -284,11 +284,55 @@ function parseSchemaD(doc, includePromoted = false) {
   }];
 }
 
+// ─────────────────────────────────────────────────────────────────────
+// parseRetracted — the entries `hone retract --from-yaml` sends
+//
+// HC-GF-311-followup-1: the retract action read only each file's TOP level, so a Schema C
+// file offered its story frame, which has no `id`, and every per-learning
+// `status: retracted` beneath it was skipped. Measured 2026-09-26 on
+// origin/main: 14 retracted learnings in 12 files, and the dry-run found 0.
+// Each id below is the one the matching parseSchemaX gives `hone promote`,
+// because the server can only retract a row under the id it was promoted as.
+// The id stays the value YAML loaded, not String(id): both commands send it
+// through JSON, so `id: 2026-09-26` (a Date) arrives as the same ISO string.
+// An entry with no id is skipped; promote sent those under the file name.
+// A learning must say `retracted` itself: a story-level status is not
+// inherited here, because a retraction is a claim about one learning.
+// Returns { schema, retracted: [{ id, reason }], parseError? }; reason is
+// null when the entry gives no `retraction_reason`.
+// ─────────────────────────────────────────────────────────────────────
+function parseRetracted(content) {
+  let parsed;
+  try { parsed = yaml.load(content); }
+  catch (e) { return { schema: SCHEMA_UNKNOWN, retracted: [], parseError: e }; }
+
+  const schema = detectSchema(parsed);
+  const isRetracted = (e) => e && typeof e === 'object' && e.status === 'retracted';
+  const entry = (id, e) => ({ id, reason: e.retraction_reason || null });
+
+  let retracted = [];
+  if (schema === SCHEMA_A) {
+    retracted = parsed.filter(i => isRetracted(i) && i.id).map(i => entry(i.id, i));
+  } else if (schema === SCHEMA_B) {
+    retracted = parsed.enterprise_candidates
+      .filter(c => isRetracted(c) && c.id !== null && c.id !== undefined)
+      .map(c => entry(`${parsed.story_id}-${c.id}`, c));
+  } else if (schema === SCHEMA_C) {
+    retracted = parsed.learnings.filter(l => isRetracted(l) && l.id).map(l => entry(l.id, l));
+  } else if (schema === SCHEMA_D) {
+    if (isRetracted(parsed) && (parsed.id || parsed.story_id)) retracted = [entry(parsed.id || parsed.story_id, parsed)];
+  } else if (isRetracted(parsed) && parsed.id) {
+    // Any other single dict keeps the top-level read the action always did.
+    retracted = [entry(parsed.id, parsed)];
+  }
+  return { schema, retracted };
+}
+
 // ─────────────────────────────────────────────────────────────────────
 // writeBackPromoted — schema-aware idempotent regex rewrite
 //
 // All 3 schemas write per-item `status: promoted` because `hone retract`
-// at cli/hone-cli.js:1349 reads `entry?.status === 'retracted'` per-item.
+// (parseRetracted above) reads `status: retracted` per-item.
 // Replacing per-item status with a top-level marker would break retract.
 // ─────────────────────────────────────────────────────────────────────
 function writeBackPromoted(content, schema, idsPromoted) {
@@ -424,6 +468,7 @@ module.exports = {
   SCHEMA_UNKNOWN,
   detectSchema,
   parseLearningsFile,
+  parseRetracted,
   writeBackPromoted,
   // LC-001 / #58 G2 partial: categorization API (advisory).
   LEARNING_CATEGORIES,

package/lib/mcp-tools.js

@@ -13,6 +13,7 @@ const { spawn } = require('node:child_process');
 const fsSync = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { privateTempFile } = require('./private-temp');
 
 // Resolve the CLI binary. Default `hone` (the installed bin); overridable for tests
 // / non-global installs via HONE_CLI_BIN (e.g. a path to hone-cli.js run with node).
@@ -24,12 +25,15 @@ function honeBin() {
 // default) — but WITHOUT exiting on a missing token (the MCP server must start and
 // report the problem via a preflight / hone_doctor, not die). Editor-agnostic:
 // works from any MCP client that passes HONE_TOKEN/HONE_API in the server env.
+// HC-GF-304-followup-1: reports THAT a token exists, never the token. Nothing here sends one — every
+// tool shells out to the CLI, which reads its own — and `token` was returned to callers that read
+// only `hasToken`, one serialization away from the stderr preflight.
 function readHoneConfig() {
   let rc = {};
   try { rc = JSON.parse(fsSync.readFileSync(path.join(os.homedir(), '.honerc'), 'utf8')) || {}; } catch { rc = {}; }
   const token = process.env.HONE_TOKEN || rc.token || null;
   const apiUrl = process.env.HONE_API || rc.api || 'https://api.hone.ai';
-  return { token, apiUrl, hasToken: !!token };
+  return { apiUrl, hasToken: !!token };
 }
 
 // Run a `hone` subcommand, capturing stdout/stderr/exit. Never throws — returns a
@@ -163,7 +167,7 @@ async function stepInstruction({ runId, cwd } = {}) {
 
 // hone_submit_step — submit editor-executed output (HC-COMM-010 B3). Output
 // travels via a temp file (1MB-class payloads must not ride argv); the file
-// is best-effort deleted after the shell-out.
+// and its directory are best-effort deleted after the shell-out.
 async function submitStep({ runId, stepKey, output, contractVersion = '1', fromTree = false, testReport, cwd } = {}) {
   if (!runId) return { isError: true, detail: 'runId is required' };
   if (!stepKey) return { isError: true, detail: 'stepKey is required' };
@@ -184,18 +188,20 @@ async function submitStep({ runId, stepKey, output, contractVersion = '1', fromT
 
   const base = ['submit-step', String(runId), String(stepKey), '--contract', String(contractVersion), '--format', 'json'];
   let tmp = null;
-  if (fromTree) {
-    base.push('--from-tree');
-    // Never invented: an absent report stays absent, the same rule the CLI and the prompt carry.
-    if (typeof testReport === 'string' && testReport.trim() !== '') base.push('--test-report', testReport);
-  } else {
-    // Output travels via a temp file — 1MB-class payloads must not ride argv.
-    tmp = path.join(os.tmpdir(), `hone-editor-output-${Date.now()}-${process.pid}.txt`);
-    fsSync.writeFileSync(tmp, output, 'utf8');
-    base.push('--file', tmp);
-  }
-
   try {
+    if (fromTree) {
+      base.push('--from-tree');
+      // Never invented: an absent report stays absent, the same rule the CLI and the prompt carry.
+      if (typeof testReport === 'string' && testReport.trim() !== '') base.push('--test-report', testReport);
+    } else {
+      // Output travels via a temp file — 1MB-class payloads must not ride argv. HC-GF-304-followup-1: in a
+      // directory only this call created (mode 0700). The old pid-named file could not collide, but its
+      // name was predictable in a shared /tmp. Created inside the `try` so a failed write removes it too.
+      tmp = privateTempFile('hone-editor-output', 'output.txt');
+      fsSync.writeFileSync(tmp.file, output, 'utf8');
+      base.push('--file', tmp.file);
+    }
+
     const r = await module.exports._internal.runHone(base, { cwd });
     if (r.error) return { isError: true, detail: r.error };
     const data = parseLastJson(r.stdout);
@@ -209,7 +215,7 @@ async function submitStep({ runId, stepKey, output, contractVersion = '1', fromT
         : (r.stderr || r.stdout || 'submission failed').slice(0, 500),
     };
   } finally {
-    if (tmp) { try { fsSync.unlinkSync(tmp); } catch { /* best-effort cleanup */ } }
+    if (tmp) tmp.remove(); // the directory, not just the file; never throws
   }
 }
 

package/lib/private-temp.js

@@ -12,6 +12,13 @@
  * A clock is not an identity. `fs.mkdtempSync` creates a new directory with a random suffix, atomically, with
  * mode 0700, so the file inside it belongs to exactly one invocation whatever the time, and nobody else can
  * plant or replace it.
+ *
+ * HC-CI-081: `remove` is a recursive delete of a computed path in a root every process of this user shares, so
+ * it deletes only a directory shaped like the one `mkdtempSync` made for it: a direct child of the temp root,
+ * named `<prefix>-` plus mkdtemp's six characters. On 2026-09-26 a local mutation run replaced the mkdtemp with
+ * `os.tmpdir()` and left `remove` as it was, so each call was `rm -rf $TMPDIR`. It ran outside the sandbox, in
+ * the tmpdir the self-hosted runners share, and deleted three other tests' directories mid-run on runner 2
+ * (HC-CI-063's, HC-CI-064's and HC-GF-098's; run 36211682382, attempt 1).
  */
 
 const fs = require('node:fs');
@@ -21,14 +28,25 @@ const path = require('node:path');
 /**
  * @param {string} prefix  names the owner in the directory, e.g. 'hone-emit'
  * @param {string} name    the file's name inside its private directory, e.g. 'patch.diff'
- * @returns {{ file: string, remove: () => void }}  `remove` deletes the directory and never throws
+ * @returns {{ file: string, remove: () => void }}  `remove` deletes the directory and never throws; a directory
+ *   it did not make is left alone
  */
 function privateTempFile(prefix, name) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), `${prefix}-`));
+  const root = path.resolve(os.tmpdir());
+  const dir = fs.mkdtempSync(path.join(root, `${prefix}-`));
   return {
     file: path.join(dir, name),
-    remove: () => { try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* best-effort */ } },
+    remove: () => {
+      if (!madeBy(root, prefix, dir)) return;
+      try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* best-effort */ }
+    },
   };
 }
 
+/** Whether `dir` is what `mkdtempSync(path.join(root, prefix + '-'))` returns: that prefix, six more characters. */
+function madeBy(root, prefix, dir) {
+  const base = path.basename(dir);
+  return path.dirname(dir) === root && base.startsWith(`${prefix}-`) && base.length === prefix.length + 7;
+}
+
 module.exports = { privateTempFile };

package/lib/run-target.js

@@ -94,4 +94,69 @@ async function resolveRunTarget({ client, idOrStory, repoName, flag }) {
   };
 }
 
-module.exports = { resolveRunTarget, isRunId, LOOKUP_LIMIT };
+/**
+ * HC-GF-270-followup-1 — what a caller-supplied argument must look like before any verb builds a URL
+ * from it. HC-GF-270 checked the step key inline in two verbs; five more verbs took a run id, a step key
+ * or an attempt that nothing checked. Encoding alone is not enough: `encodeURIComponent('..') === '..'`,
+ * and axios resolves the request path with `new URL()`, which collapses dot segments, so
+ * `/orchestrate/../verdict` goes out as `/verdict`.
+ */
+const isStepKey = (s) => typeof s === 'string' && /^step_[0-9a-z_]+$/i.test(s);
+const isAttempt = (s) => (typeof s === 'string' || typeof s === 'number') && /^[1-9]\d{0,8}$/.test(String(s));
+const isBatchId = isRunId;
+
+const KINDS = {
+  runId: { ok: isRunId, why: 'must be a run ID (a UUID)', hint: ' — run IDs: hone workflows' },
+  batchId: { ok: isBatchId, why: 'must be a batch ID (a UUID)', hint: ' — batch IDs: hone queue-stories --list' },
+  stepKey: { ok: isStepKey, why: 'must name a step, like step_4', hint: '' },
+  attempt: { ok: isAttempt, why: 'must be a whole number from 1, like 2', hint: '' },
+};
+
+/**
+ * The first failed check's message, or null when every check passes.
+ * @param {Array<{ label: string, kind: 'runId'|'batchId'|'stepKey'|'attempt', value: any, optional?: boolean }>} checks
+ *   `label` is the flag or positional as the operator typed it. An `optional` check passes when the value
+ *   is undefined (a flag that was not given); an empty string is always checked.
+ */
+function runArgsError(checks) {
+  for (const { label, kind, value, optional } of checks) {
+    if (optional && value === undefined) continue;
+    const k = KINDS[kind];
+    if (!k) throw new TypeError(`runArgsError: unknown kind ${JSON.stringify(kind)}`);
+    // JSON.stringify: a crafted value's control characters are escaped, never printed raw to the terminal.
+    if (!k.ok(value)) return `${label} ${k.why} (got ${JSON.stringify(value === undefined ? null : value)})${k.hint}`;
+  }
+  return null;
+}
+
+/**
+ * The one way a CLI verb builds an `/orchestrate/…` path. Each segment is encoded exactly once, and the
+ * segments encoding cannot make safe (empty, `.`, `..`, null, undefined) throw: every caller-supplied value
+ * has passed `runArgsError` first, so a throw here is a bug, not an input error. Query values that are
+ * null, undefined, false or '' are dropped; the rest go through URLSearchParams.
+ *
+ * Callers pass raw values. A pre-encoded segment would be encoded twice (`%` becomes `%25`), and the
+ * HC-GF-270-followup-1 scan fails on one.
+ */
+function orchestratePath(segments, query) {
+  if (!Array.isArray(segments) || segments.length === 0) throw new TypeError('orchestratePath: segments must be a non-empty array');
+  const parts = segments.map((v, i) => {
+    if (v === null || v === undefined) throw new TypeError(`orchestratePath: segment ${i} is ${v}`);
+    const s = String(v);
+    if (s === '' || s === '.' || s === '..') throw new TypeError(`orchestratePath: segment ${i} is ${JSON.stringify(s)}`);
+    return encodeURIComponent(s);
+  });
+  const base = ['', 'orchestrate', ...parts].join('/');
+  const qs = new URLSearchParams();
+  for (const [k, v] of Object.entries(query || {})) {
+    if (v === null || v === undefined || v === false || v === '') continue;
+    qs.append(k, String(v));
+  }
+  const q = qs.toString();
+  return q ? `${base}?${q}` : base;
+}
+
+module.exports = {
+  resolveRunTarget, isRunId, LOOKUP_LIMIT,
+  isStepKey, isAttempt, isBatchId, runArgsError, orchestratePath,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.35.0",
+  "version": "1.35.1",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {