@hone-ai/cli 1.38.0 → 1.38.1

package/lib/story-provenance.js

@@ -53,11 +53,12 @@ function isIssueShapedId(storyId) {
 /**
  * Is this a HOSTNAME we may compare against `html_url`'s host?
  *
- * Binding decision 2 (operator, step_1 gate of run fa6e00c4): compare hosts ONLY when the
- * remote's host is a dotted domain — the GitHub Enterprise case. An SSH host alias such as
- * `github-work` from `~/.ssh/config` is not a hostname, and treating it as one would make
- * every collaborator's issue untrusted for every operator who uses one. That false
- * fail-closed is the version of this feature that gets reverted.
+ * HC-GF-270's binding decision 2 (operator, step_1 gate of run fa6e00c4) compared hosts ONLY when
+ * the remote's host was a dotted domain, because an SSH alias such as `github-work` is not a
+ * hostname and comparing it would refuse every collaborator's issue for every operator who uses
+ * one. HC-GF-283 removes the reason for the exception: run-story now resolves an alias with
+ * `ssh -G` (cli/lib/git-remote.js) and records the REAL host, so the comparison runs always, and a
+ * recorded host that is still not a hostname is a host nobody established — untrusted.
  */
 function isDottedDomain(host) {
   const h = String(host == null ? '' : host).trim();
@@ -237,13 +238,18 @@ function assessStorySource(source, storyId) {
         + 'or the request redirected to a different repository');
     }
 
-    const remoteHost = source.remoteHost;
-    if (isDottedDomain(remoteHost)) {
-      const rh = String(remoteHost).trim().toLowerCase();
-      if (rh !== url.hostname.toLowerCase()) {
-        return no('issue', `the git remote's host ${rh} is not ${url.hostname.toLowerCase()} — the issue was read `
-          + 'from a different GitHub host than this repository lives on, where someone else can own the same name');
-      }
+    // HC-GF-283: ALWAYS. An unresolved alias left gh on its default host, where the same owner/repo
+    // name can belong to someone else — the case binding decision 2's exception let through.
+    const rh = String(source.remoteHost == null ? '' : source.remoteHost).trim().toLowerCase();
+    if (!isDottedDomain(rh)) {
+      return no('issue', rh
+        ? `the git remote's host was recorded as '${rh}', which is not a hostname — an SSH alias that was never `
+          + `resolved (a run started before HC-GF-283), so which GitHub host issue ${refLabel(source)} was read from cannot be checked`
+        : `no git remote host was recorded for issue ${refLabel(source)}, so which GitHub host it was read from cannot be checked`);
+    }
+    if (rh !== url.hostname.toLowerCase()) {
+      return no('issue', `the git remote's host ${rh} is not ${url.hostname.toLowerCase()} — the issue was read `
+        + 'from a different GitHub host than this repository lives on, where someone else can own the same name');
     }
 
     return yes('issue', `issue ${refLabel(source)} was authored by ${source.author || 'an unknown user'} `
@@ -258,6 +264,7 @@ function assessStorySource(source, storyId) {
 module.exports = {
   assessStorySource,
   remoteHostFromUrl,
+  rawRemoteHost,
   isIssueShapedId,
   isDottedDomain,
   refLabel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hone-ai/cli",
-  "version": "1.38.0",
+  "version": "1.38.1",
   "description": "Hone AI — Enterprise SDLC Pipeline CLI",
   "main": "hone-cli.js",
   "bin": {