@hone-ai/cli 1.36.0 → 1.37.0

package/hone-cli.js

@@ -42,6 +42,14 @@ const { collectIncludePaths } = require('./lib/include-paths');
 const { runArgsError, orchestratePath } = require('./lib/run-target'); // HC-GF-270-followup-1
 const program = new Command();
 
+// HC-GF-331: spawnSync's default stdout/stderr buffer is 1 MiB. A verification suite over that
+// (this repo's own `make ci`) overflowed it, spawnSync returned status: null with error.code
+// ENOBUFS, and verdictFromRun/classifyGateRun read that null status as a plain test failure —
+// not as "the output could not be captured." Generous relative to any suite measured so far
+// (`make ci` prints low hundreds of KB; 64 MiB is two orders of magnitude of headroom) without
+// holding an unbounded amount of memory for a runaway command.
+const VERIFY_MAX_BUFFER = 64 * 1024 * 1024;
+
 // ── Config resolution ─────────────────────────────────────────────────────────
 const RC_PATH = path.join(os.homedir(), '.honerc');
 
@@ -6165,6 +6173,8 @@ program
   .option('--kill', 'Kill a run: pass a run ID, or a story ID for that story\'s latest run in this repository')
   .option('--axes <axes>', 'Comma-separated classifier axes for this run (e.g. shared-chokepoint) — composition input (HC-COMM-010 C0)')
   .option('--approve <step>', 'Approve a paused gate (e.g., --approve step_0) on a run ID, or on a story ID\'s latest run in this repository. Exit codes: 2 = paused at a human gate, 3 = parked for your editor (execution.mode: editor)')
+  .option('--reject <step>', 'HC-GF-323: send a paused gate BACK for a re-run instead of approving it or killing the whole run (e.g., --reject step_4). Requires --reason. Steps before it are left approved; only this step re-runs, with the reason in its context.')
+  .option('--reason <text>', 'With --reject: why this attempt is being sent back. Required, and reaches the re-run as feedback the same way a code-reviewer\'s FAIL verdict does.')
   .option('--no-verify', 'HC-GF-064: do not run verify-patch automatically when the run pauses at step_4')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .option('--poll-interval <s>', 'Poll interval in seconds', '5')
@@ -6479,6 +6489,7 @@ program
           console.log('');
           console.log(`Awaiting approval at ${data.currentStep}.`);
           console.log(`Approve: hone run-story ${data.runId} --approve ${data.currentStep}`);
+          console.log(`Reject:  hone run-story ${data.runId} --reject ${data.currentStep} --reason "<why>"`);
         }
         console.log('');
         // HC-GF-016: at a TERMINAL state, print the report unasked. The whole
@@ -6548,6 +6559,37 @@ program
       return;
     }
 
+    // Reject mode (HC-GF-323)
+    if (opts.reject) {
+      if (!opts.reason || !String(opts.reason).trim()) {
+        console.error('--reject requires --reason <text>');
+        process.exit(1);
+      }
+      let rejectId;
+      try {
+        rejectId = await existingRunId(`--reject ${opts.reject}`);
+        await client.post(orchestratePath([rejectId, 'reject']),
+          { stepKey: opts.reject, reason: opts.reason });
+        console.log(`Gate ${opts.reject} rejected. Re-running with the reason. Workflow resuming.`);
+      } catch (e) {
+        console.error(`Failed: ${e.response?.data?.error || e.message}`);
+        process.exit(1);
+      }
+      // HC-GF-070: same FOLLOW behaviour as --approve — a caller told to poll does not.
+      if (opts.follow === false) {
+        console.log(`Poll: hone run-story ${rejectId} --status`);
+        return;
+      }
+      try {
+        await pollUntilDecision(rejectId);
+      } catch (e) {
+        console.error(`Rejected, but following the run failed: ${e.message}`);
+        console.error(`Poll: hone run-story ${rejectId} --status`);
+        process.exit(1);
+      }
+      return;
+    }
+
     // Start workflow (storyId required, runId not accepted for starting)
     if (isUuid) {
       console.error('Cannot start workflow with a runId. Use a story ID like HC-042.');
@@ -7881,7 +7923,11 @@ program
       verifiedAttempt = r.data?.attempt != null ? Number(r.data.attempt) : undefined;
       // best-effort: pull the run's ci_local_command for the default
       try {
-        const runR = await client.get(orchestratePath([workflowId]));
+        // HC-GF-302-followup-1: on a connection of its own. This GET follows the step GET at once, and
+        // on the socket that one pooled a server closing it idle resets the request - a failed config
+        // read, so the provenance gate below refused a trusted run (exit 9). Nothing is retried: a read
+        // that fails on its own connection still refuses.
+        const runR = await client.get(orchestratePath([workflowId]), require('./lib/fresh-connection').freshConnection());
         // HC-GF-270 (security review BLOCKER-1): the id is ENCODED above, so a crafted
         // `<uuid>/step/step_4?` cannot turn this into a fetch of some other endpoint that answers
         // 200 with no config. And a body that is not THIS run is not this run's config.
@@ -8185,9 +8231,10 @@ program
           cwd: wt, shell: true, encoding: 'utf8',
           timeout: timeoutMs, env: verifyCommandEnv(gitEnv()),
           stdio: ['ignore', 'pipe', 'pipe'],
+          maxBuffer: VERIFY_MAX_BUFFER, // HC-GF-331: a >1 MiB suite (this repo's own `make ci`) must not ENOBUFS
         });
         const timedOut = run.error && run.error.code === 'ETIMEDOUT';
-        const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource, replaced: commandReplaced }, provAll);
+        const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource, replaced: commandReplaced, error: run.error }, provAll);
         // HC-GF-077: nothing was applied when HEAD already held the step — say what the command actually ran on.
         if (alreadyInHead && v.verdict === 'pass') v.detail = "tests passed on HEAD, which already contains the step's files";
         const sym = v.verdict === 'pass' ? '✓' : v.verdict === 'pass_narrowed' ? '⚠' : v.verdict === 'timeout' ? '⏱' : v.verdict === 'unresolved' ? '○' : '✗';
@@ -8243,6 +8290,7 @@ program
               cwd: wt, shell: true, encoding: 'utf8',
               timeout: timeoutMs, env: verifyCommandEnv(gitEnv()),
               stdio: ['ignore', 'pipe', 'pipe'],
+              maxBuffer: VERIFY_MAX_BUFFER, // HC-GF-331: shares the shape at :8184 — same fix
             });
             const c = classifyGateRun({
               code: gr.status, error: gr.error,
@@ -8523,7 +8571,8 @@ program
       output = r.data?.output;
       stepAttempt = Number.isInteger(r.data?.attempt) ? r.data.attempt : null;
       try {
-        const runR = await client.get(orchestratePath([workflowId]));
+        // HC-GF-302-followup-1: its own connection, as verify-patch's (see there).
+        const runR = await client.get(orchestratePath([workflowId]), require('./lib/fresh-connection').freshConnection());
         // HC-GF-270 (security review BLOCKER-1): see verify-patch — encoded id, and a body that
         // is not THIS run does not count as its config.
         if (runR.data?.runId && !sameRun(runR.data.runId)) throw new Error('run id mismatch');
@@ -8738,9 +8787,10 @@ program
             cwd: wt, shell: true, encoding: 'utf8',
             timeout: timeoutMs, env: verifyCommandEnv(gitEnv()),
             stdio: ['ignore', 'pipe', 'pipe'],
+            maxBuffer: VERIFY_MAX_BUFFER, // HC-GF-331: emit-pr's verify shares verify-patch's spawnSync shape
           });
           const timedOut = run.error && run.error.code === 'ETIMEDOUT';
-          const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource, replaced: commandReplaced }, provAll);
+          const v = verdictFromRun({ code: run.status, timedOut, stdout: run.stdout, stderr: run.stderr, command, source: commandSource, replaced: commandReplaced, error: run.error }, provAll);
           // HC-GF-223: the mapping lives in cli/lib/emit-pr.js so it is testable. Before it, a
           // narrowed verdict fell into the else below, which printed "verify failed, no branch
           // emitted" and then exited with that verdict's own exit code — zero. A failure path that

package/lib/bundle-mount-follow.js

@@ -0,0 +1,118 @@
+'use strict';
+/**
+ * bundle-mount-follow.js — HC-GF-325.
+ *
+ * `cli/lib/bundle-paths.js` bundles only paths the story NAMES — it has no mount, prefix or
+ * import following. step_2 (API test writer) then has no way to know a router file's routes are
+ * served under a prefix, because nothing in the bundle says so. Measured live: step_2 wrote 7
+ * tests against `/properties` for an app that mounts every router under `/api/v1`
+ * (`app.include_router(properties.router, prefix=settings.api_prefix)`); all 7 failed on a 404.
+ *
+ * This module answers one question given a bundled file's path and content: "if this file
+ * defines routes, which OTHER tracked file mounts it, and which existing test already exercises
+ * a router mounted the same way?" Both answers are returned as extra paths for the caller to
+ * bundle alongside the file the story named — it does not read the filesystem itself, so it stays
+ * as pure/testable as the rest of `cli/lib`.
+ */
+
+const path = require('path');
+
+// A file DEFINES routes when it either builds a router object (FastAPI's `APIRouter()`, Express's
+// `Router()`) or decorates/registers at least one HTTP verb against one (`@router.get(...)`,
+// `router.get(...)`) — the object alone (an empty router) is not enough to justify following it.
+const DEFINES_ROUTER_OBJECT = /\bAPIRouter\s*\(|\b(?:express\.)?Router\s*\(\s*\)/;
+const REGISTERS_A_ROUTE = /@\w+\.(get|post|put|delete|patch)\s*\(|\b\w+\.(get|post|put|delete|patch)\s*\(\s*['"`]/i;
+
+function definesRoutes(content) {
+  const text = String(content || '');
+  return DEFINES_ROUTER_OBJECT.test(text) && REGISTERS_A_ROUTE.test(text);
+}
+
+// Where an app typically registers its routers/routes — bounded, so following a mount never
+// means reading every tracked file's content. FastAPI/Flask/Express conventions only; a repo
+// using neither simply gets no mount file, same as today.
+const ENTRYPOINT_NAME_RE = /(^|\/)(main|app|asgi|wsgi|server|index|__init__)\.(py|js|mjs|cjs|ts)$/i;
+
+// `app.include_router(...)` (FastAPI/Starlette) or `app.use(...)` (Express) — the call that
+// registers a router built elsewhere. Requires the SAME file to also reference the router
+// file's module name, so a coincidental `app.use(` for an unrelated router does not match.
+const MOUNT_CALL_RE = /\b\w+\.include_router\s*\(|\b\w+\.use\s*\(/;
+
+function baseModuleName(filePath) {
+  return path.posix.basename(String(filePath || ''), path.posix.extname(String(filePath || '')));
+}
+
+function mentionsModule(content, moduleName) {
+  if (!moduleName) return false;
+  const re = new RegExp(`\\b${moduleName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
+  return re.test(String(content || ''));
+}
+
+/**
+ * @param {object} o
+ * @param {string} o.routeFilePath   the bundled file being checked
+ * @param {string} o.routeFileContent
+ * @param {string[]} o.repoFiles     every tracked path (the caller's git ls-files list)
+ * @param {(p:string)=>string} o.readFile  reads a candidate mount file; the caller's disk I/O
+ * @returns {string|null} the path of the file that mounts routeFilePath's router, or null
+ */
+function findMountFile({ routeFilePath, routeFileContent, repoFiles, readFile }) {
+  if (!definesRoutes(routeFileContent)) return null;
+  const moduleName = baseModuleName(routeFilePath);
+  const candidates = (Array.isArray(repoFiles) ? repoFiles : [])
+    .filter((p) => p !== routeFilePath && ENTRYPOINT_NAME_RE.test(p));
+  for (const candidate of candidates) {
+    let content;
+    try { content = readFile(candidate); } catch { continue; }
+    if (MOUNT_CALL_RE.test(content) && mentionsModule(content, moduleName)) return candidate;
+  }
+  return null;
+}
+
+// The same directory-prefix + name convention `cli/lib/layout-detect.js` uses for a test root —
+// kept independent (not imported) because this module's job is narrower: ONE existing file to
+// show the test writer the mounted-prefix convention, not a directory computation.
+const TEST_PATH_RE = /(^|\/)(tests?|__tests__|spec|specs|e2e)(\/|$)|\.(test|spec)\.[a-z]+$/i;
+// A test that actually drives an HTTP client — the convention worth copying — over one that
+// merely lives in a test directory (a fixtures or conftest file, say).
+const API_TEST_SIGNAL_RE = /\bTestClient\s*\(|\bsupertest\s*\(|\brequest\s*\(\s*app\s*\)|\bclient\.(get|post|put|delete|patch)\s*\(/;
+
+function topLevelDir(filePath) {
+  const norm = String(filePath || '').replace(/^\.\//, '');
+  return norm.includes('/') ? norm.split('/')[0] : '';
+}
+
+/**
+ * @param {object} o
+ * @param {string} o.routeFilePath
+ * @param {string[]} o.repoFiles
+ * @param {(p:string)=>string} o.readFile
+ * @returns {string|null} an existing test file demonstrating the same kind of route testing
+ */
+function findExistingApiTest({ routeFilePath, repoFiles, readFile }) {
+  const dir = topLevelDir(routeFilePath);
+  const candidates = (Array.isArray(repoFiles) ? repoFiles : [])
+    .filter((p) => p !== routeFilePath && (!dir || p.startsWith(dir + '/')) && TEST_PATH_RE.test(p));
+  for (const candidate of candidates) {
+    let content;
+    try { content = readFile(candidate); } catch { continue; }
+    if (API_TEST_SIGNAL_RE.test(content)) return candidate;
+  }
+  return null;
+}
+
+/**
+ * The one entry point `run-context.js` calls per already-bundled ("present") file.
+ * @returns {string[]} zero, one or two extra paths to bundle (mount file, existing API test)
+ */
+function followRouterMount({ routeFilePath, routeFileContent, repoFiles, readFile }) {
+  if (!definesRoutes(routeFileContent)) return [];
+  const extra = [];
+  const mountFile = findMountFile({ routeFilePath, routeFileContent, repoFiles, readFile });
+  if (mountFile) extra.push(mountFile);
+  const testFile = findExistingApiTest({ routeFilePath, repoFiles, readFile });
+  if (testFile) extra.push(testFile);
+  return extra;
+}
+
+module.exports = { definesRoutes, findMountFile, findExistingApiTest, followRouterMount };

package/lib/bundle-paths.js

@@ -464,8 +464,19 @@ function planFileExcerpt({ content, cap, line = null, lines = null, storyText =
     // The radius is sized before any window exists, so it prices the marker at its widest:
     // the longest label among the sites, with line numbers at the file's own width.
     const widest = { startLine: totalLines, endLine: totalLines, totalLines };
+    // HC-GF-334: the footer repeats `filePath` in EVERY kept window (see `footer` above), so
+    // sizing `radius` off its real length made window boundaries — and therefore which sites
+    // and collapsed hits are reachable — depend on how long the file's path happens to be.
+    // Measured: with real files and roadmap rows, a fake path fixed at length 80 or 90 dropped
+    // a hit that lengths 10-70 and 100-200 all kept, for the SAME content and story — a path a
+    // few characters different flips whether a window's char-radius snaps past a line boundary.
+    // Reserve a fixed, generous footer cost for SIZING the radius instead of the real one, so
+    // the estimate — and the windows it produces — no longer shift with path length. `costOf`
+    // and `budget()` below still charge the REAL footer length, so the cap is still never
+    // exceeded even for a path longer than this reserve; it only stops falling short of it.
+    const FOOTER_SIZING_RESERVE_CHARS = 300;
     const markerCost = Math.max(...chosen.map((s) => header(widest, s.anchor, totalLines).length))
-      + footer.length + 1;
+      + Math.max(footer.length, FOOTER_SIZING_RESERVE_CHARS) + 1;
     // HC-GF-288: the 800 covers ONE window's marker, and every further window brings its
     // own. Sized from `limit - 800` alone, n windows overran the cap from n = 3 — so the
     // LAST region was always dropped however much room the rest left. Measured on

package/lib/layout-detect.js

@@ -20,6 +20,14 @@ const EXCLUDE = /(^|\/)(node_modules|dist|build|coverage|\.git|\.next|vendor|__p
 const SOURCE_EXT = /\.(js|mjs|cjs|jsx|ts|tsx|py|java|kt|rb|go|rs|php|cs|scala|swift|cls|trigger|apex)$/i;
 const TEST_HINT = /(^|\/)(tests?|__tests__|spec|specs|e2e)(\/|$)|\.(test|spec)\.[a-z]+$/i;
 
+// HC-GF-020-followup-1: a documentation directory routinely carries a handful of genuinely
+// source-extension files (Sphinx's conf.py, a docs-site build script) that clear MIN_FILES on
+// extension count alone — measured live: a docs/ of mostly .html/.svg pages qualified as a
+// source dir because it also held two .py files. Extension MIX, not source-extension COUNT, is
+// what tells a docs directory apart from a package: if a top-level dir's tracked files are more
+// documentation than source, it is documentation, however many stray source-ext files it holds.
+const DOC_EXT = /\.(md|mdx|rst|adoc|txt|html?|svg|png|jpe?g|gif|ico|pdf)$/i;
+
 // Directories whose NAME means "this is where the code is". A repo that puts code directly at the
 // root of a package still gets that package dir, via the manifest-dir fallback below.
 const SOURCE_DIR_NAMES = /^(src|lib|app|source|server|client|api|packages|apps|core)$/i;
@@ -61,6 +69,27 @@ function detectLayout({ root, trackedPaths, minFiles = 2 } = {}) {
   const srcFiles = paths.filter(p => SOURCE_EXT.test(p) && !TEST_HINT.test(p));
   const testFiles = paths.filter(p => SOURCE_EXT.test(p) && TEST_HINT.test(p));
 
+  // Extension mix per top-level dir, over EVERY tracked path (not just the source-ext-filtered
+  // srcFiles/testFiles) — a docs/ directory's defining feature is the files roll() never looks
+  // at otherwise (its .html/.svg pages), so the doc-vs-source comparison needs the full list.
+  const extCountsByTop = new Map();
+  for (const p of paths) {
+    const top = p.includes('/') ? p.split('/')[0] : '.';
+    if (!extCountsByTop.has(top)) extCountsByTop.set(top, { doc: 0, src: 0 });
+    const c = extCountsByTop.get(top);
+    if (DOC_EXT.test(p)) c.doc += 1;
+    else if (SOURCE_EXT.test(p)) c.src += 1;
+  }
+  function isDocumentationOnly(top) {
+    // A dotdir (.github, .storybook, .devcontainer, ...) is tooling/config by convention, never
+    // a published-docs directory, even when it holds far more Markdown records (pipeline history,
+    // learnings) than source-ext scripts — hone-server's OWN .github/scripts/ is real code that
+    // must stay visible (HC-DF-005) alongside .github/pipeline/'s hundreds of Markdown records.
+    if (top.startsWith('.')) return false;
+    const c = extCountsByTop.get(top);
+    return !!c && c.doc > c.src;
+  }
+
   function roll(files, nameRe = SOURCE_DIR_NAMES) {
     const byTop = new Map();
     for (const f of files) {
@@ -71,6 +100,7 @@ function detectLayout({ root, trackedPaths, minFiles = 2 } = {}) {
     const out = [];
     for (const [top, list] of byTop) {
       if (top === '.') continue; // root-level scripts are not a source ROOT
+      if (isDocumentationOnly(top)) continue; // docs/ with a stray conf.py is still docs/
       const qualifies = nameRe.test(top) || manifestDirs.has(top) || list.length >= minFiles;
       if (!qualifies) continue;
       // Descend one level when this is a container of packages, or when a conventional source
@@ -83,14 +113,23 @@ function detectLayout({ root, trackedPaths, minFiles = 2 } = {}) {
       // Files sitting DIRECTLY in this dir (cli/hone-cli.js). If any exist, the dir itself is
       // the source root — descending would silently drop them, which is how an early cut of this
       // rule emitted `cli/lib` and lost cli/hone-cli.js (5.8k lines, the whole CLI surface).
-      // Descend ONLY into a package container (packages/, apps/). Anywhere else, prefer the
-      // PARENT: a wider scope is the safe error for grounding, a narrower one hides real files.
-      // An earlier rule descended into conventional children and emitted `server/src`, which
-      // dropped `server/scripts/` — the exact residual the followup-42 dogfood run hit, where the
-      // planner could not see the agent prompts and proposed inventing them elsewhere.
       const direct = list.filter(f => f.split('/').length === 2).length;
       const container = /^(packages|apps|services|modules)$/i.test(top);
-      if (container && kids.size > 0 && direct === 0) { out.push(...[...kids.keys()]); continue; }
+      // HC-GF-020-followup-1: TEST dirs alone also descend into a sole, unambiguous child (a repo's
+      // real test dir was reported as `backend` because every test sat under `backend/tests`, a name
+      // this rule never recognized). Deliberately NOT extended to source dirs: an earlier rule
+      // descended into ANY conventional child regardless of ambiguity and emitted `server/src`,
+      // which dropped `server/scripts/` — the exact residual the followup-42 dogfood run hit, where
+      // the planner could not see the agent prompts and proposed inventing them elsewhere. `server/`
+      // has both `server/src` and `server/scripts` (2 kids) so it is unaffected either way, but a
+      // repo where `server/` holds ONLY `server/src` must still stay at `server` for source dirs —
+      // measured by this file's own regression pins — so the single-kid case is test-dirs-only.
+      // ...and only when `top` itself is NOT already a conventionally-named test root: a `tests/`
+      // dir with a single `tests/integration` child is intentionally left at `tests` — descending
+      // would report a narrower, equally-arbitrary name in place of the convention that already
+      // says exactly what this directory is.
+      const soleUnambiguousTestChild = nameRe === TEST_DIR_NAMES && !nameRe.test(top) && kids.size === 1 && direct === 0;
+      if ((container || soleUnambiguousTestChild) && kids.size > 0 && direct === 0) { out.push(...[...kids.keys()]); continue; }
       out.push(top);
     }
     return [...new Set(out)].sort();

package/lib/run-context.js

@@ -30,6 +30,7 @@ const {
   extractPathRefs, extractBareRefs, resolveBareName, alreadyCovered, planFileExcerpt,
 } = require('./bundle-paths');
 const { selectBundle, auditLines } = require('./bundle-context');
+const { followRouterMount } = require('./bundle-mount-follow');
 const { parseIncludePaths, partitionIncludeTargets, statedAnchorsFor, anchorWarnings } = require('./include-paths');
 const { buildRepoTree, allDirs, MAX_TRANSPORT_PATHS, MAX_TRANSPORT_DIRS } = require('./repo-tree');
 const { classifyStory } = require('./story-classifier');
@@ -497,7 +498,24 @@ async function resolveStoryContext(io, repoCtx, storyId, opts = {}) {
       // HC-GF-073: what exists, what is pending, plus repo-level signal files and existing
       // neighbours of the pending paths. Order is priority order: the char cap cuts from the end.
       const selection = selectBundle({ named: [...candidates], repoFiles: repoCtx.repoFiles, exists: io.exists });
-      const ordered = [...selection.present, ...selection.signal, ...selection.siblings];
+      // HC-GF-325: a present file that DEFINES routes says nothing about where they are MOUNTED —
+      // step_2 wrote 7 tests against `/properties` for an app that serves every router under
+      // `/api/v1`. Right after `present`, so a mount file and an existing API test of the same
+      // kind get priority over signal files and siblings within the char budget, same as a path
+      // the story named directly would.
+      const alreadySelected = new Set([...selection.present, ...selection.signal, ...selection.siblings]);
+      const mountFollowed = [];
+      for (const p of selection.present) {
+        let content;
+        try { content = io.readFile(p); } catch { continue; }
+        for (const extra of followRouterMount({ routeFilePath: p, routeFileContent: content, repoFiles: repoCtx.repoFiles, readFile: io.readFile })) {
+          if (alreadySelected.has(extra)) continue;
+          alreadySelected.add(extra);
+          mountFollowed.push(extra);
+          pre.push(info(`  → bundled ${extra} — mounts/tests the router in ${p} (HC-GF-325)`));
+        }
+      }
+      const ordered = [...selection.present, ...mountFollowed, ...selection.signal, ...selection.siblings];
       const codebaseFiles = [];
       let totalChars = 0;
       let budgetSpent = false; // HC-GF-288: so a not-bundled warning can say WHY

package/lib/verify-patch.js

@@ -196,7 +196,7 @@ function verifyCommandEnv(base = process.env) {
  * Pass the `command` that ran and the resolver's `source` for it: without them an absent command is
  * indistinguishable from a failing one (HC-GF-008), and the CLI's two executors both do.
  *
- * @param {{ code: number|null, timedOut: boolean, stdout?: string, stderr?: string, command?: string, source?: string }} run
+ * @param {{ code: number|null, timedOut: boolean, stdout?: string, stderr?: string, command?: string, source?: string, error?: { code?: string } }} run
  * @returns {{ verdict: 'pass'|'fail'|'timeout'|'unresolved', exitCode: number, detail: string }}
  */
 function verdictFromRun(run, provisioning = null) {
@@ -216,6 +216,18 @@ function verdictFromRun(run, provisioning = null) {
   if (run.timedOut) {
     return { verdict: 'timeout', exitCode: EXIT.TIMEOUT, detail: 'test command exceeded the timeout' };
   }
+  // HC-GF-331: spawnSync kills the child and reports status: null with error.code ENOBUFS when
+  // its stdout/stderr exceed maxBuffer. A null status otherwise falls through to the generic
+  // "tests failed (exit null)" path below — the suite may have passed; nothing conclusive was
+  // observed about it either way, so this is its own outcome, never a reported failure.
+  if (run.error && run.error.code === 'ENOBUFS') {
+    return {
+      verdict: 'unresolved',
+      exitCode: EXIT.UNRESOLVED,
+      detail: 'test output exceeded the capture buffer (ENOBUFS) — nothing conclusive was observed '
+        + 'about this change; raise maxBuffer or have the command print less',
+    };
+  }
   if (run.code === 0) {
     // HC-GF-223: a pass under an operator-supplied command is evidence about a SUBSET. Measured on
     // run `437246a7`: `--command "node --test <3 files>"` reported `pass` to the server and the same
@@ -401,6 +413,11 @@ function classifyGateRun(run) {
     return { verdict: 'unavailable', detail: 'command not found — gate NOT run' };
   }
   if (run.timedOut) return { verdict: 'unavailable', detail: 'timed out — gate NOT run to completion' };
+  // HC-GF-331: shares verdictFromRun's shape — a null status from an ENOBUFS overflow is not a
+  // finding, it is the gate not having run to a readable conclusion.
+  if (run.error && run.error.code === 'ENOBUFS') {
+    return { verdict: 'unavailable', detail: 'output exceeded the capture buffer (ENOBUFS) — gate NOT run to completion' };
+  }
   if (run.code === 0) return { verdict: 'pass', detail: 'clean' };
   const sum = summarizeFailure(run, { maxLines: 6 });
   // A linter prints its findings from the TOP, so unlike a test runner the most

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {