@hone-ai/cli 1.38.0 → 1.38.1

package/hone-cli.js

@@ -23,7 +23,7 @@ const fs           = require('fs');
 const path         = require('path');
 const os           = require('os');
 const crypto       = require('crypto');
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 
 // HC-GF-144: verdictEnv lives in cli/lib so it is importable and can be tested by BEHAVIOUR.
 // A source-regex asserting the variable name matched this very comment and passed while the
@@ -39,7 +39,7 @@ const { parseReviewJSON } = require('./lib/parse-review-json');
 const { resolveBaseRef, getMaxDiffChars } = require('./lib/release-review-config');
 const { gitEnv } = require('./lib/git-env');
 const { collectIncludePaths } = require('./lib/include-paths');
-const { runArgsError, orchestratePath, apiPath } = require('./lib/run-target'); // HC-GF-270-followup-1, -2
+const { runArgsError, orchestratePath, apiPath, storyDir: storyDirIn, isGitRev } = require('./lib/run-target'); // HC-GF-270-followup-1, -2, -3
 const { normalizeQuestion, questionLines, gateQuestionLines, countPhrase } = require('./lib/operator-question'); // HC-GF-234
 const program = new Command();
 
@@ -217,8 +217,8 @@ program
   .option('--category <category>', 'Probe category (adversarial|faithfulness|safety|boundary|stateful)', 'adversarial')
   .option('--target <name>', 'Run against a specific agent target (default: all configured)')
   .option('--output <format>', 'Output format (text|json)', 'text')
-  .option('--judge', 'Add the free NLI judge layer (faithfulness only): claims are checked for entailment against the probe context')
-  .option('--provider <name>', 'Judge provider: gh-models (free, default) | claude (paid Sonnet)', 'gh-models')
+  .option('--judge', 'Add the NLI judge layer (faithfulness only): claims are checked for entailment against the probe context. Needs --provider claude (paid)')
+  .option('--provider <name>', 'Judge provider: claude (paid Sonnet, needs ANTHROPIC_API_KEY). gh-models was retired 2026-07-30; there is no default')
   .option('--report', 'Report the agent-eval verdict to the run (advisory) — needs --workflow-id')
   .option('--workflow-id <id>', 'The run id to report the verdict against (for --report)')
   .option('--timeout <s>', 'Seconds to allow each probe (default 5 — raise it for packs that need a real generation)', '5')
@@ -922,11 +922,14 @@ program
       console.log('    to switch to local-mode (real safety net at $0 CI cost).');
     }
 
-    const flags = [
-      `--source "${path.join(tmpDir, 'enterprise-github')}"`,
-      opts.dryRun      ? '--dry-run'         : '',
-      isNonInteractive ? '--non-interactive'  : '',
-    ].filter(Boolean).join(' ');
+    // HC-GF-270-followup-3: an argument list, not a shell string — the script path and the source directory
+    // reach bash as the arguments they are, whatever characters a temp path holds.
+    const setupArgs = [
+      scriptPath,
+      '--source', path.join(tmpDir, 'enterprise-github'),
+      ...(opts.dryRun ? ['--dry-run'] : []),
+      ...(isNonInteractive ? ['--non-interactive'] : []),
+    ];
 
     // HC-RC-004 pass-1 (HIGH-1): when source==='auto-detect', LEAVE
     // CI_GATE unset so the bash script's existing detected_ci_default
@@ -941,7 +944,7 @@ program
     // after detection (apply_stack_override) and refuses an unsupported value.
     if (opts.stack) setupEnv.HONE_STACK_OVERRIDE = String(opts.stack).toLowerCase();
     try {
-      execSync(`bash "${scriptPath}" ${flags}`, {
+      execFileSync('bash', setupArgs, {
         stdio: 'inherit',
         cwd: process.cwd(),
         env: setupEnv,
@@ -1332,7 +1335,12 @@ async function installTestFramework(repoRoot, opts) {
     return installPythonTestFramework(repoRoot, detected, pkgs, opts);
   }
 
-  const installCmd = detected.pkgMgr === 'yarn' ? 'yarn add -D' : detected.pkgMgr === 'pnpm' ? 'pnpm add -D' : 'npm install -D';
+  // HC-GF-270-followup-3: the installer and its arguments as a list, run without a shell. npm, yarn and pnpm
+  // are `.cmd` shims on Windows, which Node will only spawn through a shell — so these two calls (constant
+  // arguments only) take one there and nowhere else. No `env`: an install keeps the ambient toolchain (HC-GF-144).
+  const INSTALL_ARGV = { yarn: ['yarn', 'add', '-D'], pnpm: ['pnpm', 'add', '-D'], npm: ['npm', 'install', '-D'] };
+  const [installBin, ...installPre] = INSTALL_ARGV[detected.pkgMgr] || INSTALL_ARGV.npm;
+  const installShell = process.platform === 'win32';
 
   // ── Unit test framework ────────────────────────────────
   if (detected.testFw) {
@@ -1340,7 +1348,7 @@ async function installTestFramework(repoRoot, opts) {
   } else {
     console.log(`  Stack: ${detected.stack} → Installing: ${pkgs.unit.join(', ')}`);
     try {
-      execSync(`${installCmd} ${pkgs.unit.join(' ')}`, { stdio: 'inherit', cwd: repoRoot });
+      execFileSync(installBin, [...installPre, ...pkgs.unit], { stdio: 'inherit', cwd: repoRoot, shell: installShell });
       console.log(`  ✓ Unit test framework installed`);
     } catch (e) {
       console.error(`  ✗ Install failed: ${e.message}`);
@@ -1422,7 +1430,7 @@ async function installTestFramework(repoRoot, opts) {
     } else {
       console.log(`  Installing Playwright...`);
       try {
-        execSync(`${installCmd} @playwright/test`, { stdio: 'inherit', cwd: repoRoot });
+        execFileSync(installBin, [...installPre, '@playwright/test'], { stdio: 'inherit', cwd: repoRoot, shell: installShell });
         console.log(`  ✓ @playwright/test installed`);
         console.log(`  Installing Chromium browser...`);
         execSync('npx playwright install chromium', { stdio: 'inherit', cwd: repoRoot });
@@ -3228,6 +3236,7 @@ program
   .option('--max-files <n>',   'Max source files for derive (default: 15)', '15')
   .option('--skip-derive',     'Skip the derive step (setup + sync only)')
   .action(async (opts) => {
+    refuseBadRunArgs([{ label: '--max-files', kind: 'count', value: opts.maxFiles }]); // HC-GF-270-followup-3
     const startTime = Date.now();
 
     console.log('');
@@ -3248,10 +3257,8 @@ program
       if (opts.e2e !== false)  setupArgs.push('--e2e');
       if (opts.noE2e)          setupArgs.push('--no-e2e');
 
-      const { execSync: ex } = require('child_process');
-      const cliPath = __filename;
-      const setupCmd = `node "${cliPath}" ${setupArgs.join(' ')}`;
-      ex(setupCmd, { stdio: 'inherit', cwd: process.cwd(), env: process.env });
+      // HC-GF-270-followup-3: this CLI re-run by the node running it, with an argument list — no shell.
+      execFileSync(process.execPath, [__filename, ...setupArgs], { stdio: 'inherit', cwd: process.cwd(), env: process.env });
     } catch (e) {
       console.error('Setup failed:', e.message);
       process.exit(1);
@@ -3263,10 +3270,10 @@ program
       console.log('━━━ Step 2/3: Derive Domain Skills ━━━━━━━━━━━━');
       console.log('');
       try {
-        const { execSync: ex } = require('child_process');
-        const cliPath = __filename;
-        const deriveCmd = `node "${cliPath}" derive --max-files ${opts.maxFiles}`;
-        ex(deriveCmd, { stdio: 'inherit', cwd: process.cwd(), env: process.env, timeout: 600_000 });
+        // HC-GF-270-followup-3: `--max-files` was pasted into a shell string, so `--max-files '15;touch x'`
+        // ran `touch x`. It is checked as a count when adopt starts, and reaches derive as one argument.
+        execFileSync(process.execPath, [__filename, 'derive', '--max-files', String(opts.maxFiles)],
+          { stdio: 'inherit', cwd: process.cwd(), env: process.env, timeout: 600_000 });
       } catch (e) {
         console.warn('');
         console.warn('⚠ Derive failed (non-fatal):', e.message?.slice(0, 100));
@@ -3283,9 +3290,7 @@ program
     console.log('━━━ Step 3/3: Sync Prompts ━━━━━━━━━━━━━━━━━━━━');
     console.log('');
     try {
-      const { execSync: ex } = require('child_process');
-      const cliPath = __filename;
-      ex(`node "${cliPath}" sync`, { stdio: 'inherit', cwd: process.cwd(), env: process.env });
+      execFileSync(process.execPath, [__filename, 'sync'], { stdio: 'inherit', cwd: process.cwd(), env: process.env });
     } catch (e) {
       console.warn('⚠ Sync failed:', e.message);
     }
@@ -3295,12 +3300,10 @@ program
     // mismatches surface immediately instead of silently breaking
     // Gate 3 / Pizza Tracker on the first PR.
     try {
-      const { execSync: ex } = require('child_process');
-      const cliPath = __filename;
       console.log('');
       console.log('━━━ Pattern detection (H-018) ━━━━━━━━━━━━━━━━━━');
       console.log('');
-      ex(`node "${cliPath}" check-patterns`, { stdio: 'inherit', cwd: process.cwd(), env: process.env });
+      execFileSync(process.execPath, [__filename, 'check-patterns'], { stdio: 'inherit', cwd: process.cwd(), env: process.env });
     } catch (e) {
       // Exit 1 from check-patterns means drift detected — the user
       // already saw the table, so just note that adoption succeeded
@@ -4176,6 +4179,8 @@ metricsCmd
   .description('Bootstrap .github/metrics/<STORY-ID>.yml from pipeline metadata + git + gh')
   .option('--force', 'Overwrite an existing scorecard (default: preserve)')
   .action(async (storyIdArg, opts) => {
+    // HC-GF-270-followup-3: the id names a directory this reads and a file it writes; `../` must not leave them.
+    refuseBadRunArgs([{ label: '<storyId>', kind: 'storyId', value: storyIdArg, optional: true }]);
     const ps = require('./lib/pipeline-status');
     const mc = require('./lib/metrics-collect');
     const repoRoot = process.cwd();
@@ -4198,8 +4203,11 @@ metricsCmd
         process.exit(1);
       }
     }
+    // HC-GF-270-followup-3: an id read from the branch name gets the check a typed one got — the branch
+    // pattern has no length cap, so storyDir would otherwise throw a stack trace instead of refusing.
+    refuseBadRunArgs([{ label: 'the story id read from the branch name', kind: 'storyId', value: storyId }]);
 
-    const storyDir = path.join(pipelineRoot, storyId);
+    const storyDir = storyDirIn(pipelineRoot, storyId);
     const metaPath = path.join(storyDir, 'metadata.yml');
     if (!fs.existsSync(metaPath)) {
       console.error(`No pipeline metadata for ${storyId} — checked ${metaPath}`);
@@ -4222,7 +4230,7 @@ metricsCmd
 
     // Idempotency: preserve existing scorecard unless --force
     fs.mkdirSync(metricsRoot, { recursive: true });
-    const outPath = path.join(metricsRoot, `${storyId}.yml`);
+    const outPath = `${storyDirIn(metricsRoot, storyId)}.yml`;
     if (fs.existsSync(outPath) && !opts.force) {
       console.error(`${outPath} already exists. Re-run with --force to overwrite.`);
       console.error('(Default behavior: preserve any hand-written or agent-appended fields.)');
@@ -4236,17 +4244,28 @@ metricsCmd
     } catch { /* leave undefined */ }
 
     // Files changed — best-effort
+    // HC-GF-270-followup-3: the base comes from metadata.yml — repository content — and reaches git as one
+    // argument. A base git would read as an option (`--output=…` writes a file) is skipped, not run.
     let filesChanged = [];
-    try {
-      const diff = execSync(`git diff --name-only ${parsed.base || 'develop'}...HEAD`, { encoding: 'utf8' });
-      filesChanged = diff.split('\n').map(s => s.trim()).filter(Boolean);
-    } catch { /* leave empty */ }
+    const base = String(parsed.base || 'develop');
+    if (isGitRev(base)) {
+      try {
+        const diff = execFileSync('git', ['diff', '--name-only', `${base}...HEAD`], { encoding: 'utf8' });
+        filesChanged = diff.split('\n').map(s => s.trim()).filter(Boolean);
+      } catch { /* leave empty */ }
+    } else {
+      console.error(`  ⚠ metadata.yml base ${JSON.stringify(base)} is not a git revision; files_changed left empty`);
+    }
 
     // PR info — best-effort, gh may be missing or no PR yet (E4/E5 graceful)
     let prInfo = {};
     try {
       const branch = execSync('git symbolic-ref --short HEAD', { encoding: 'utf8' }).trim();
-      const pr = execSync(`gh pr list --head ${branch} --json number --jq '.[0].number' 2>/dev/null`, { encoding: 'utf8' }).trim();
+      // HC-GF-270-followup-3: `--head=<branch>` is one argument whatever the branch name holds (`;`, `$(` and `(`
+      // are legal in one); stderr is dropped by stdio rather than by a shell redirect.
+      // A network call: bounded like classify-story's gh call, so a hung gh leaves pr_number unset instead of hanging.
+      const pr = execFileSync('gh', ['pr', 'list', `--head=${branch}`, '--json', 'number', '--jq', '.[0].number'],
+        { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 30_000 }).trim();
       if (pr && /^\d+$/.test(pr)) prInfo = { pr_number: parseInt(pr, 10) };
     } catch { /* leave empty — graceful */ }
 
@@ -5389,12 +5408,26 @@ program
   .option('--artifact-dir <dir>', 'write the artifact here instead of .github/pipeline/<STORY-ID>/ (a CI gate must not leave files in the checkout)')
   .option('--story-id <id>', 'override story id (defaults to extraction from current branch name)')
   .action(async (cmdOpts) => {
+    // HC-GF-270-followup-3: the story id names the artifact directory and the learnings file; the base reaches
+    // git. Refused before anything runs — with exit 1 ("could not run"), because 2 here means a BLOCKER fired
+    // (STEP_5B_BLOCKED) and verify-pr and the skill-audit gate read it that way.
+    const badArg = runArgsError([
+      { label: '--story-id', kind: 'storyId', value: cmdOpts.storyId, optional: true },
+      { label: '--base', kind: 'gitRev', value: cmdOpts.base || 'develop' },
+    ]);
+    if (badArg) {
+      console.error(`step-5b: ${badArg}`);
+      process.exit(1);
+    }
     const { runAssertions } = require('./lib/skill-assertions');
     const { renderStep5bArtifact } = require('./lib/skill-audit-render');
     const { extractStoryIdFromBranch } = require('./lib/pipeline-status');
     const { parseLearningsFile } = require('./lib/learnings-parse');
-    const { execSync } = require('node:child_process');
+    const { execSync, execFileSync } = require('node:child_process');
     const repoRoot = process.cwd();
+    // HC-GF-270-followup-3: git reads with an argument list — the base is one argument, never shell text.
+    const gitRead = (args) => execFileSync('git', args,
+      { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 });
 
     // 1. Resolve story id (CLI flag wins; else parse branch name)
     let branchName = '';
@@ -5407,18 +5440,22 @@ program
       console.error(`step-5b: cannot determine story id from branch "${branchName}". Pass --story-id explicitly. Skipping audit.`);
       process.exit(0);  // exit 0 — informational
     }
+    // HC-GF-270-followup-3: an id read from the branch name gets the check --story-id got (the pattern has no length cap).
+    const derivedIdError = runArgsError([{ label: 'the story id read from the branch name', kind: 'storyId', value: storyId }]);
+    if (derivedIdError) {
+      console.error(`step-5b: ${derivedIdError}. Pass --story-id explicitly.`);
+      process.exit(1);
+    }
 
     // 2. Capture PR diff (defensive — empty diff → no findings)
     const baseBranch = cmdOpts.base || 'develop';
     let diff = '';
     try {
-      diff = execSync(`git diff origin/${baseBranch}...HEAD`,
-        { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 });
+      diff = gitRead(['diff', `origin/${baseBranch}...HEAD`]);
     } catch {
       // Fallback: no remote tracking — try local base
       try {
-        diff = execSync(`git diff ${baseBranch}...HEAD`,
-          { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 });
+        diff = gitRead(['diff', `${baseBranch}...HEAD`]);
       } catch { /* leave empty */ }
     }
 
@@ -5427,8 +5464,7 @@ program
     let commitMessages;
     for (const range of [`origin/${baseBranch}..HEAD`, `${baseBranch}..HEAD`]) {
       try {
-        commitMessages = execSync(`git log --format=%B ${range}`,
-          { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 32 * 1024 * 1024 });
+        commitMessages = gitRead(['log', '--format=%B', range]);
         break;
       } catch { /* try the next range */ }
     }
@@ -5482,7 +5518,9 @@ program
       baseBranch,
       referencedSkills,
     });
-    const outDir = cmdOpts.artifactDir ? path.resolve(repoRoot, cmdOpts.artifactDir) : path.join(repoRoot, '.github/pipeline', storyId);
+    // `--artifact-dir` is the deliberate escape hatch (a CI gate writes outside the checkout); the default is
+    // the story's own directory, which a story id cannot leave (HC-GF-270-followup-3).
+    const outDir = cmdOpts.artifactDir ? path.resolve(repoRoot, cmdOpts.artifactDir) : storyDirIn(path.join(repoRoot, '.github/pipeline'), storyId);
     fs.mkdirSync(outDir, { recursive: true });
     const outPath = path.join(outDir, 'step-5b-skill-audit.md');
     fs.writeFileSync(outPath, artifact);
@@ -5566,8 +5604,8 @@ program
   .option('--contracts', 'Run contract validation between pipeline agents')
   .option('--snapshot', 'Save current eval + contract results as regression baseline')
   .option('--regression', 'Compare current results against saved baseline (detect drift)')
-  .option('--judge', 'Run LLM-as-judge scenarios (default provider: free gh-models via GITHUB_TOKEN)')
-  .option('--provider <name>', 'LLM-judge provider: gh-models (free, default) | claude (paid Sonnet)', 'gh-models')
+  .option('--judge', 'Run LLM-as-judge scenarios. Needs --provider claude (paid); the free gh-models default was retired 2026-07-30')
+  .option('--provider <name>', 'LLM-judge provider: claude (paid Sonnet, needs ANTHROPIC_API_KEY). There is no default')
   .option('--evidence-mode <mode>', 'HC-RC-001 editor-LLM evidence transfer: "local" writes .hone/eval-evidence.json (signed); "off" disables (default)')
   .action(async (opts) => {
     const path = require('path');
@@ -5650,14 +5688,11 @@ program
         process.exit(0);
       }
 
-      // HC-019n-followup-33 (pipeline-standards G6): the LLM-judge lane must have a
-      // ZERO-COST path (feedback_pipeline_llm_cost_reduction — every LLM-cost gate
-      // needs a free/near-free route so adopters aren't double-billed). DEFAULT to
-      // GH Models (free inference via GITHUB_TOKEN); paid Claude Sonnet is opt-in
-      // via `--provider claude`. Mirrors `hone skill-eval`'s provider convention.
-      // HC-COMM-011-followup-3: provider wiring extracted to lib/judge-provider.js
-      // (shared with `hone agent-eval --judge`). Same zero-cost default (gh-models)
-      // + Sonnet-not-Opus paid path; the retired dated Sonnet id must not appear
+      // HC-019n-followup-33 gave the judge lane a free default (GitHub Models). HC-GF-340: GitHub
+      // retired it on 2026-07-30, so there is no default now and no free path; the operator names
+      // `--provider claude` (paid Sonnet) or gets one sentence saying why.
+      // HC-COMM-011-followup-3: provider wiring lives in lib/judge-provider.js (shared with
+      // `hone agent-eval --judge`); the retired dated Sonnet id must not appear
       // (pinned by opus-4-8-upgrade.test.js).
       const { buildJudgeCallLLM } = require('./lib/judge-provider');
       const built = buildJudgeCallLLM(opts.provider, { axios });
@@ -5761,13 +5796,13 @@ program
 // expected_output_format heuristics. Two systems, two different
 // questions; coexist.
 //
-// Provider defaults to gh-models (free GH PAT inference) per the
-// [Pipeline LLM Cost Reduction] memory — adopters must not be
-// double-billed for what their pipeline already invoked.
+// HC-GF-340: there is no default provider. It used to be gh-models (free GH PAT inference), which
+// GitHub retired on 2026-07-30; the only one that works now is paid, and an adopter must not be
+// billed by a default they never chose. `--no-llm` (the dry run) needs none.
 program
   .command('skill-eval <skillName>')
   .description('Run derived-skill eval scenarios against an LLM (HC-010d-followup-1)')
-  .option('--provider <name>', 'LLM provider: gh-models (default, $0) | claude-haiku (paid)', 'gh-models')
+  .option('--provider <name>', 'LLM provider: claude-haiku (paid, needs ANTHROPIC_API_KEY). gh-models was retired 2026-07-30; there is no default')
   .option('--scenario <id>', 'Run a single scenario by id (e.g., SF-DEV-EVAL-001)')
   .option('--tag <tag>', 'Filter scenarios by HC-010c rule-id tag (e.g., SF-SEC-001)')
   .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
@@ -5836,62 +5871,26 @@ program
       process.exit(0);
     }
 
-    // Provider wiring — gh-models default. Inline + per-provider so a
-    // future provider addition lives in one switch.
+    // Provider wiring. Inline + per-provider so a future provider addition lives in one switch.
     const axios = require('axios');
-    // Pass-2 review caught the original 32000-char slice collided with
-    // GH Models' documented 8000-token request-body cap (see
-    // `cli/lib/release-review-config.js:49-68`). A real adopter
-    // SKILL.md after years of derivations is plausibly 20-40K chars;
-    // 32K leaves zero budget for scenario.input + JSON envelope, so
-    // GH Models returns HTTP 400 and every scenario errors. 8000
-    // chars ≈ ~2000 tokens for the system slot, leaving ~6000 tokens
-    // for scenario.input + envelope — comfortable under GH Models'
-    // cap while still preserving enough of the skill body to evaluate
-    // adopter patterns.
+    // 8000 chars (~2000 tokens) for the system slot leaves the rest of the request for
+    // scenario.input + the JSON envelope. The cap was sized for GitHub Models' 8000-token
+    // request-body limit (see `cli/lib/release-review-config.js`); it is kept so a skill body
+    // that grew large cannot crowd out the scenario now that claude-haiku is the only provider.
     const MAX_SKILL_PROMPT_CHARS = 8000;
     let apiKey, modelLabel, callLLM;
-    if (opts.provider === 'gh-models') {
-      apiKey = process.env.GITHUB_TOKEN;
-      if (!apiKey) {
-        console.error('✗ GITHUB_TOKEN not set. Required for --provider gh-models.');
-        console.error('  In CI: GITHUB_TOKEN is auto-injected. Locally: export GITHUB_TOKEN=<your PAT>.');
-        // Exit 2 — operator config error, NOT a skill regression.
-        // Pass-2 review caught: exit 1 collided with the CI-gate exit
-        // code for eval failures, so a missing secret was reported
-        // as "skill regression" by the CI gate. The convention from
-        // the regression at line 172-188 is exit 2 for operator
-        // errors, exit 1 for eval failures.
-        process.exit(2);
-      }
-      modelLabel = 'openai/gpt-4.1';
-      callLLM = async (systemPrompt, userPrompt) => {
-        const { data } = await axios.post(
-          'https://models.github.ai/inference/chat/completions',
-          {
-            model: modelLabel,
-            messages: [
-              { role: 'system', content: systemPrompt.slice(0, MAX_SKILL_PROMPT_CHARS) },
-              { role: 'user',   content: userPrompt },
-            ],
-            max_tokens: 2048,
-          },
-          {
-            headers: {
-              'Authorization': `Bearer ${apiKey}`,
-              'Content-Type': 'application/json',
-            },
-            timeout: 120000,
-          }
-        );
-        return data.choices?.[0]?.message?.content || '';
-      };
+    if (opts.provider === undefined || opts.provider === 'gh-models') {
+      // HC-GF-340: refuse before any request. Exit 2 — operator config error, NOT a skill
+      // regression (exit 1 is the CI-gate code for eval failures).
+      console.error(`✗ ${require('./lib/judge-provider').providerRequiredMessage('--provider claude-haiku')}`);
+      process.exit(2);
     } else if (opts.provider === 'claude-haiku') {
       apiKey = process.env.ANTHROPIC_API_KEY;
       if (!apiKey) {
         console.error('✗ ANTHROPIC_API_KEY not set. Required for --provider claude-haiku.');
         console.error('  Set: export ANTHROPIC_API_KEY=sk-ant-...');
-        // Exit 2 — operator config error (see gh-models branch).
+        // Exit 2 — operator config error, NOT a skill regression (exit 1 is the CI-gate code
+        // for eval failures).
         process.exit(2);
       }
       modelLabel = 'claude-haiku-4-5-20251001';
@@ -5909,10 +5908,16 @@ program
           },
           timeout: 120000,
         });
-        return data.content?.[0]?.text || '';
+        const text = data.content?.[0]?.text;
+        // An empty answer is a provider failure the runner records as an error, not a scenario
+        // that failed its assertions.
+        if (typeof text !== 'string' || !text.trim()) {
+          throw new Error(`claude-haiku returned no text (stop_reason: ${data.stop_reason || 'unknown'})`);
+        }
+        return text;
       };
     } else {
-      console.error(`✗ Invalid --provider: ${opts.provider}. Use 'gh-models' or 'claude-haiku'.`);
+      console.error(`✗ Invalid --provider: ${opts.provider}. Use 'claude-haiku'.`);
       process.exit(2);
     }
 
@@ -5945,10 +5950,9 @@ program
 
     console.log(formatResults(summary, opts.format));
 
-    // Exit 1 on any non-pass so CI (HC-019f-style gate) can wire this
-    // as a required check. Per the [Pipeline LLM Cost Reduction]
-    // memory, this gate can run in CI on the gh-models default with
-    // zero adopter cost.
+    // Exit 1 on any non-pass so CI (HC-019f-style gate) can wire this as a required check. It is
+    // paid now (HC-GF-340: the free gh-models default was retired), so a CI gate needs an
+    // ANTHROPIC_API_KEY secret and a decision to spend.
     process.exit(summary.failed + summary.errors > 0 ? 1 : 0);
   });
 
@@ -5997,6 +6001,7 @@ program
   .description('Fetch the editor-mode instruction for a run parked awaiting_editor (HC-COMM-010 B3)')
   .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
   .action(async (runId, opts) => {
+    refuseBadRunArgs([{ label: '<runId>', kind: 'runId', value: runId }]); // HC-GF-270-followup-3
     const config = getConfig();
     const client = api(config);
     try {
@@ -6028,6 +6033,10 @@ program
   .option('--contract <version>', 'Instruction contract version (from step-instruction)', '1')
   .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
   .action(async (runId, stepKey, opts) => {
+    refuseBadRunArgs([ // HC-GF-270-followup-3: both become path segments of the submission
+      { label: '<runId>', kind: 'runId', value: runId },
+      { label: '<stepKey>', kind: 'stepKey', value: stepKey },
+    ]);
     const config = getConfig();
     const client = api(config);
     try {
@@ -6082,6 +6091,19 @@ function runContextIo(apiConfig) {
     const abs = path.resolve(cwd, rel);
     return abs.startsWith(cwd + path.sep) ? abs : null;
   };
+  // HC-GF-283: where this checkout's issues live — host, owner, repo — resolved ONCE and shared by
+  // both gh calls, so the text and the trust cannot come from different hosts. An SSH alias is
+  // resolved with `ssh -G` (prints config, never connects). A failure rejects both calls: nothing is
+  // fetched rather than gh falling back to its default host.
+  let issueRepoP = null;
+  const issueRepo = () => issueRepoP || (issueRepoP = (async () => {
+    const { resolveRemote } = require('./lib/git-remote');
+    const remoteUrl = execSync('git remote get-url origin', { encoding: 'utf8', timeout: 10_000 }).trim();
+    const { execFile } = require('child_process');
+    return resolveRemote(remoteUrl, {
+      sshConfig: async (alias) => (await require('util').promisify(execFile)('ssh', ['-G', alias], { encoding: 'utf8', timeout: 10_000 })).stdout,
+    });
+  })());
   return {
     // Every subprocess this adapter starts carries a timeout: a hung git or gh must fail open with a
     // message, not stall the command (node-developer hard rule 5). The module turns each failure into
@@ -6110,15 +6132,15 @@ function runContextIo(apiConfig) {
       return fs.readFileSync(abs, 'utf8');
     },
     // Async (execFile, no shell) so queue-stories can resolve several issues at once.
+    // HC-GF-283: `--repo HOST/OWNER/REPO`. Without the host gh used its default one, so a GitHub
+    // Enterprise remote behind an SSH alias read the issue from github.com.
     fetchIssue: async (issueNumber) => {
-      const remoteUrl = execSync('git remote get-url origin', { encoding: 'utf8', timeout: 10_000 }).trim();
-      const m = remoteUrl.match(/[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
-      if (!m) throw new Error(`could not parse owner/repo from remote: ${remoteUrl}`);
+      const { host, owner, repo } = await issueRepo();
       const { execFile } = require('child_process');
       let stdout;
       try {
         ({ stdout } = await require('util').promisify(execFile)('gh',
-          ['issue', 'view', String(issueNumber), '--repo', `${m[1]}/${m[2]}`, '--json', 'title,body,url'],
+          ['issue', 'view', String(issueNumber), '--repo', `${host}/${owner}/${repo}`, '--json', 'title,body,url'],
           { encoding: 'utf8', timeout: 30_000 }));
       } catch (e) {
         // execFile keeps gh's stderr on the error — its first line is the actionable part ("gh auth
@@ -6132,14 +6154,12 @@ function runContextIo(apiConfig) {
     // HC-GF-270: who wrote the issue. run-context.js classifies a failure and story-provenance.js
     // decides trust; this only fetches. execFile, not a shell string: owner/repo come from the remote.
     fetchIssueProvenance: async (issueNumber) => {
-      const remoteUrl = execSync('git remote get-url origin', { encoding: 'utf8', timeout: 10_000 }).trim();
-      const m = remoteUrl.match(/[/:]([^/]+)\/([^/]+?)(?:\.git)?$/);
-      if (!m) throw new Error(`could not parse owner/repo from remote: ${remoteUrl}`);
-      const where = { owner: m[1], repo: m[2], remoteUrl };
+      const { host, owner, repo, remoteUrl } = await issueRepo();
+      const where = { owner, repo, remoteUrl, host };
       try {
         const { execFile } = require('child_process');
         const { stdout } = await require('util').promisify(execFile)('gh',
-          ['api', `repos/${m[1]}/${m[2]}/issues/${issueNumber}`],
+          ['api', `repos/${owner}/${repo}/issues/${issueNumber}`, '--hostname', host],
           { encoding: 'utf8', timeout: 20_000 });
         return { ...where, issue: JSON.parse(stdout) };
       } catch (e) {
@@ -7208,12 +7228,12 @@ program
 
 program
   .command('release-review')
-  .description('Holistic code review of all changed files before deployment (default: GH Models, $0)')
+  .description('Holistic code review of all changed files before deployment (needs --provider opus, paid; the free GH Models default was retired 2026-07-30)')
   .option('--base <branch>', 'Base branch to diff against', 'main')
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .option('--dry-run', 'Show what would be reviewed without calling the LLM', false)
   .option('--max-files <n>', 'Max source files to include in review', '40')
-  .option('--provider <name>', 'LLM provider: gh-models (default, $0) | opus (legacy, paid)', 'gh-models')
+  .option('--provider <name>', 'LLM provider: opus (paid, needs ANTHROPIC_API_KEY). gh-models was retired 2026-07-30; there is no default')
   .option('--cache <mode>', 'HC-RC-002-followup-1 content-hash cache: on | off (default on)', 'on')
   .action(async (opts) => {
     const { execSync } = require('child_process');
@@ -7251,12 +7271,23 @@ program
     // CI step passes `--base origin/main` and the previous code prefixed
     // again → `origin/origin/main` → git rejected → silent fallback to
     // `HEAD~10`. Both lanes reviewed the wrong diff in PR #313 first run.
+    // HC-GF-270-followup-3: the base gets the check step-5b and verify-pr give theirs. resolveBaseRef prefixes
+    // `origin/`, so an option-shaped base cannot reach git as an option — but git would fail on it and the
+    // review would fall back to HEAD~10 without saying so.
+    const badBase = runArgsError([{ label: '--base', kind: 'gitRev', value: opts.base }]);
+    if (badBase) {
+      console.error(badBase);
+      emitStatusEnvelope('refused', { error: badBase });
+      process.exit(2);
+    }
     const baseRef = resolveBaseRef(opts.base);
 
     // 1. Get changed files
     let changedFiles;
     try {
-      const raw = execSync(`git diff --name-only ${baseRef}...HEAD`, { encoding: 'utf8', cwd: repoRoot, env: gitEnv() });
+      // HC-GF-270-followup-3: argument lists, no shell. baseRef always starts `origin/` (resolveBaseRef), so it
+      // cannot be read as an option.
+      const raw = execFileSync('git', ['diff', '--name-only', `${baseRef}...HEAD`], { encoding: 'utf8', cwd: repoRoot, env: gitEnv() });
       changedFiles = raw.trim().split('\n').filter(Boolean);
     } catch {
       try {
@@ -7299,34 +7330,32 @@ program
     }
 
     // 3. Provider validation + credential check
-    if (opts.provider !== 'opus' && opts.provider !== 'gh-models') {
-      console.error(`Invalid --provider: ${opts.provider}. Use 'opus' or 'gh-models'.`);
+    // HC-GF-340: gh-models (the old default) is retired, and no provider is a default now, so an
+    // unnamed or retired one is refused with the cause instead of calling an endpoint that
+    // answers "OK" and reporting "empty response ... content filter, quota or model name".
+    if (opts.provider === undefined || opts.provider === 'gh-models') {
+      console.error(require('./lib/judge-provider').providerRequiredMessage('--provider opus'));
+      process.exit(1);
+    }
+    if (opts.provider !== 'opus') {
+      console.error(`Invalid --provider: ${opts.provider}. Use 'opus'.`);
       process.exit(1);
     }
 
-    let apiKey, providerLabel;
-    if (opts.provider === 'gh-models') {
-      apiKey = process.env.GITHUB_TOKEN;
-      providerLabel = 'GitHub Models (openai/gpt-4.1)';
-      if (!apiKey) {
-        console.error('GITHUB_TOKEN not set. Required for --provider gh-models.');
-        console.error('In CI: GITHUB_TOKEN is auto-injected. Locally: export GITHUB_TOKEN=<your PAT>.');
-        process.exit(1);
-      }
-    } else {
-      apiKey = process.env.ANTHROPIC_API_KEY;
-      providerLabel = 'Anthropic Opus (claude-opus-4-8)';
-      if (!apiKey) {
-        console.error('ANTHROPIC_API_KEY not set. Required for --provider opus.');
-        console.error('Set it: export ANTHROPIC_API_KEY=sk-ant-...');
-        process.exit(1);
-      }
+    const apiKey = process.env.ANTHROPIC_API_KEY;
+    const providerLabel = 'Anthropic Opus (claude-opus-4-8)';
+    if (!apiKey) {
+      console.error('ANTHROPIC_API_KEY not set. Required for --provider opus.');
+      console.error('Set it: export ANTHROPIC_API_KEY=sk-ant-...');
+      process.exit(1);
     }
 
     // 4. Build the diff content (truncated per-file to stay within context)
     let diffContent;
     try {
-      diffContent = execSync(`git diff ${baseRef}...HEAD -- ${filesToReview.map(f => `'${f}'`).join(' ')}`, {
+      // HC-GF-270-followup-3: each changed file is ONE argument after `--`. They were wrapped in single quotes
+      // inside a shell string, so a file a PR author named with a `'` in it ran as a command.
+      diffContent = execFileSync('git', ['diff', `${baseRef}...HEAD`, '--', ...filesToReview], {
         encoding: 'utf8', cwd: repoRoot, env: gitEnv(), maxBuffer: 10 * 1024 * 1024,
       });
     } catch {
@@ -7338,9 +7367,7 @@ program
       }
     }
 
-    // Provider-specific truncation. GH Models GPT-4.1 has an 8K-token
-    // request-body cap via models.github.ai/inference — 100K chars overflows.
-    // See cli/lib/release-review-config.js for the budget math.
+    // Provider-specific truncation; see cli/lib/release-review-config.js for the budget math.
     const MAX_DIFF_CHARS = getMaxDiffChars(opts.provider);
     if (diffContent.length > MAX_DIFF_CHARS) {
       diffContent = diffContent.slice(0, MAX_DIFF_CHARS) +
@@ -7423,9 +7450,7 @@ program
       normalizeCacheFlag,
     } = require('./lib/release-review-cache');
     const cacheEnabled = normalizeCacheFlag(opts.cache);
-    const modelForCache = opts.provider === 'gh-models'
-      ? 'openai/gpt-4.1'
-      : 'claude-opus-4-8';
+    const modelForCache = 'claude-opus-4-8';
     let cacheContentHash = null;
     if (cacheEnabled) {
       try {
@@ -7488,59 +7513,30 @@ program
     }
 
     // 6. Call LLM (provider-branched, HC-080a-spike)
-    // max_tokens is held SYMMETRIC across providers so the HC-080a-spike
-    // comparison measures model capability, not output budget. 4096 is the
-    // safe ceiling for openai/gpt-4.1 via GH Models; Opus supports more but
-    // running it with 4096 keeps the comparison apples-to-apples.
+    // max_tokens stays at 4096, the value the HC-080a-spike comparison with GPT-4.1 held constant,
+    // so a review's output budget has not changed now that Opus is the only provider.
     const MAX_OUTPUT_TOKENS = 4096;
     const startedAt = Date.now();
     try {
       let responseText, inputTokens, outputTokens, modelLabel;
 
-      if (opts.provider === 'gh-models') {
-        // GitHub Models — free LLM inference using GITHUB_TOKEN. Mirrors the
-        // path used by server/scripts/ai-reviewer.js for per-PR review.
-        const { data } = await axios.post(
-          'https://models.github.ai/inference/chat/completions',
-          {
-            model: 'openai/gpt-4.1',
-            messages: [
-              { role: 'system', content: systemPrompt },
-              { role: 'user',   content: userPrompt },
-            ],
-            max_tokens: MAX_OUTPUT_TOKENS,
-          },
-          {
-            headers: {
-              'Authorization': `Bearer ${apiKey}`,
-              'Content-Type': 'application/json',
-            },
-            timeout: 120000,
-          }
-        );
-        responseText = data.choices?.[0]?.message?.content || '';
-        inputTokens  = data.usage?.prompt_tokens || 0;
-        outputTokens = data.usage?.completion_tokens || 0;
-        modelLabel   = 'openai/gpt-4.1';
-      } else {
-        const { data } = await axios.post('https://api.anthropic.com/v1/messages', {
-          model: 'claude-opus-4-8',
-          max_tokens: MAX_OUTPUT_TOKENS,
-          system: systemPrompt,
-          messages: [{ role: 'user', content: userPrompt }],
-        }, {
-          headers: {
-            'x-api-key': apiKey,
-            'anthropic-version': '2023-06-01',
-            'content-type': 'application/json',
-          },
-          timeout: 120000,
-        });
-        responseText = data.content?.[0]?.text || '';
-        inputTokens  = data.usage?.input_tokens || 0;
-        outputTokens = data.usage?.output_tokens || 0;
-        modelLabel   = 'claude-opus-4-8';
-      }
+      const { data } = await axios.post('https://api.anthropic.com/v1/messages', {
+        model: 'claude-opus-4-8',
+        max_tokens: MAX_OUTPUT_TOKENS,
+        system: systemPrompt,
+        messages: [{ role: 'user', content: userPrompt }],
+      }, {
+        headers: {
+          'x-api-key': apiKey,
+          'anthropic-version': '2023-06-01',
+          'content-type': 'application/json',
+        },
+        timeout: 120000,
+      });
+      responseText = data.content?.[0]?.text || '';
+      inputTokens  = data.usage?.input_tokens || 0;
+      outputTokens = data.usage?.output_tokens || 0;
+      modelLabel   = 'claude-opus-4-8';
 
       const elapsedMs = Date.now() - startedAt;
 
@@ -8447,6 +8443,13 @@ program
   .option('--repo <name>', 'Repository name the batch was queued under (default: this directory\'s name)')
   .action(async (batchId, opts) => {
     const { followBatch, EXIT } = require('./lib/batch-follow');
+    // HC-GF-270-followup-3: refused before the preflight git/gh calls and the config read — with EXIT.FATAL (1),
+    // because 2 is EXIT.NEEDS_YOU, which a caller reads as "the batch needs a human".
+    const badBatch = runArgsError([{ label: '<batchId>', kind: 'batchId', value: batchId }]);
+    if (badBatch) {
+      console.error(badBatch);
+      process.exit(EXIT.FATAL);
+    }
     const { spawn, spawnSync } = require('child_process');
     const positive = (raw, flag, unit) => {
       const n = Number(raw);
@@ -8947,7 +8950,13 @@ program
   .option('--format <fmt>', 'pretty or json', 'pretty')
   .action(async (prOrBranch, opts) => {
     // HC-GF-270-followup-1: a --workflow-id is checked before any gh call or CI command runs.
-    refuseBadRunArgs([{ label: '--workflow-id', kind: 'runId', value: opts.workflowId, optional: true }]);
+    // HC-GF-270-followup-3: so are the story id, which names the directory step-5c-ci.md is written to, and the
+    // base, which reaches git through step-5b.
+    refuseBadRunArgs([
+      { label: '--workflow-id', kind: 'runId', value: opts.workflowId, optional: true },
+      { label: '--story-id', kind: 'storyId', value: opts.storyId, optional: true },
+      { label: '--base', kind: 'gitRev', value: opts.base || 'develop' },
+    ]);
     const { execFileSync, spawnSync } = require('child_process');
     // HC-GF-200: refuse a mistyped bound HERE, naming the flag. Left to node,
     // a NaN becomes `RangeError: ... It must be an integer. Received NaN` from
@@ -8974,6 +8983,9 @@ program
     let branch = '';
     try { branch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: repoRoot, env: gitEnv(), encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { /* */ }
     const storyId = opts.storyId || extractStoryIdFromBranch(branch) || extractStoryIdFromBranch(prOrBranch) || 'unknown-story';
+    // HC-GF-270-followup-3: an id read from the branch or the ref gets the check --story-id got (the pattern has no
+    // length cap) — before the CI command runs, and so the artifact write below cannot throw.
+    refuseBadRunArgs([{ label: 'the story id read from the branch name', kind: 'storyId', value: storyId }]);
 
     // 2. CI gate mode: --mode > ci.gate config > github.
     let configGate = 'github';
@@ -9030,12 +9042,16 @@ program
 
     const verdict = ciGateVerdict({ mode, gh, local });
 
-    // 5. Write the real step-5c-ci.md artifact.
+    // 5. Write the real step-5c-ci.md artifact. Best-effort, but the report below names the file only if it was
+    //    written (HC-GF-270-followup-3: a failed write used to print the path anyway).
+    let artifactLine = `  → .github/pipeline/${storyId}/step-5c-ci.md`;
     try {
-      const dir = path.join(repoRoot, '.github/pipeline', storyId);
+      const dir = storyDirIn(path.join(repoRoot, '.github/pipeline'), storyId); // HC-GF-270-followup-3
       fs.mkdirSync(dir, { recursive: true });
       fs.writeFileSync(path.join(dir, 'step-5c-ci.md'), renderStep5cArtifact({ storyId, mode, prRef: prOrBranch, gh, local, verdict }));
-    } catch { /* best-effort */ }
+    } catch (e) {
+      artifactLine = `  ⚠ step-5c-ci.md not written: ${e.message}`;
+    }
 
     // 6. Closed loop (HC-019n-followup-36): report the CI-gate verdict to the
     // server. This RECORDS against step_5c — which is a post-PR, CLI-produced
@@ -9072,7 +9088,7 @@ program
       { ok: exitCode === EXIT.PASS, exitCode, storyId, mode, skillAudit, ciGate: verdict, gh, local, reported },
       `${sym} CI gate (${mode}): ${verdict.verdict} — ${verdict.detail}\n` +
       `  skill audit: ${opts.skipSkillAudit ? 'skipped' : skillAudit.blocked ? `✗ BLOCKER finding(s) — ${skillAudit.artifact}` : (skillAudit.artifact || skillAudit.error || 'done')}\n` +
-      `  → .github/pipeline/${storyId}/step-5c-ci.md`);
+      artifactLine);
     process.exit(exitCode);
   });