@hone-ai/cli 1.40.0 → 1.42.0

package/lib/review-diff-check.js

@@ -0,0 +1,262 @@
+'use strict';
+/**
+ * review-diff-check.js — HC-GF-390-followup-1: does the stored review diff describe HEAD?
+ *
+ * HC-GF-390 stores, beside step_4's artifact, the CLI-reported diff against HEAD of each over-cap file the build
+ * changed, and the reviewers read "a region with no hunk is unchanged from HEAD". The server can vet a section's
+ * post-image against the stored build, but it has no repository, so it cannot vet the pre-image, the hunk offsets or
+ * the context lines. `hone verify-patch` has the clone: this re-derives each stored section from HEAD and reports
+ * whether it holds. The server renders a mismatch as withheld, so a forged region is never shown as "unchanged".
+ *
+ * Per section, stopping at the first failure:
+ *   parse       the strict grammar `git diff --full-index` prints for a text modification, and nothing else
+ *   pre_image   the `index` pre-image id is HEAD's blob for that path
+ *   offset      every hunk's old lines are HEAD's lines at its stated start, and every new start is what git computes
+ *               (`git apply` would accept a hunk at a nearby offset, and a wrong `+c` it never reads)
+ *   apply       the section applies with no fuzz to HEAD, on a private index
+ *   post_image  the result's blob id is the `index` post-image id
+ *
+ * It never throws and never touches the real index or worktree. Exit modes of what it consumes (HC-GF-117):
+ *   stored == null              HANDLED: absent (the server has no review diff for that attempt).
+ *   head sha malformed          HANDLED: unverifiable/invalid_head.
+ *   head not in this clone      HANDLED: unverifiable/head_missing (`cat-file -e` exits 128).
+ *   HEAD moved since submit     HANDLED: unverifiable/head_moved — the diff describes another commit.
+ *   no sections                 HANDLED: unverifiable/no_sections — nothing was checked, so nothing matched.
+ *   git killed / timed out      HANDLED: unverifiable/timeout.  Deadline spent: unverifiable/deadline.
+ *   git spawn / other throw     HANDLED: unverifiable/git_error.
+ *   child killed by SIGINT      HANDLED: the temp dir is removed, then SIGINT is re-raised on this process. The git
+ *                               calls are synchronous, so no JS signal handler could run during them; the child's
+ *                               death is how an operator's Ctrl-C reaches this code.
+ */
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { gitEnv } = require('./git-env');
+
+const SHA_RE = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+const PER_CALL_MS = 15_000;
+const DEADLINE_MS = 60_000;
+const MAX_FILE_CHARS = 300;
+const TMP_PREFIX = 'hone-rdc-';
+// What a check can report. The server keeps only these (server/src/services/review-diff.js CHECK_STEPS/CHECK_REASONS,
+// pinned equal by a regression test). `fetch_failed` and `attempt_mismatch` are set by verify-patch in hone-cli.js.
+const STEPS = Object.freeze(['parse', 'pre_image', 'offset', 'apply', 'post_image']);
+const REASONS = Object.freeze(['ok', 'invalid_head', 'head_missing', 'head_moved', 'no_sections', 'timeout', 'git_error',
+  'fetch_failed', 'attempt_mismatch', 'deadline', 'context_mismatch', 'new_start_mismatch']);
+
+const INDEX_RE = /^index ([0-9a-f]{40}|[0-9a-f]{64})\.\.([0-9a-f]{40}|[0-9a-f]{64})(?: ([0-7]{6}))?$/;
+const HUNK_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?: .*)?$/;
+const NO_NEWLINE = '\';
+
+/** `diff --git a/<rel> b/<rel>` with the same <rel> twice, or null. A quoted path is not a plain path. */
+function relOfDiffGit(line) {
+  const PREFIX = 'diff --git a/';
+  if (!line.startsWith(PREFIX)) return null;
+  const rest = line.slice(PREFIX.length);
+  if ((rest.length - 3) % 2 !== 0 || rest.length < 5) return null;
+  const n = (rest.length - 3) / 2;
+  const a = rest.slice(0, n);
+  if (rest.slice(n, n + 3) !== ' b/' || rest.slice(n + 3) !== a || a.startsWith('"')) return null;
+  return a;
+}
+
+/**
+ * One section of `git diff --full-index` for a text modification. Every line must be accounted for: a mode, rename or
+ * copy header, a line beyond a hunk's counts, or a hunk out of order is a parse error, because `git apply` would read
+ * some of them and a reviewer would read all of them.
+ */
+function parseSection(text) {
+  const lines = text.split('\n');
+  if (lines.length && lines[lines.length - 1] === '') lines.pop();
+  const rel = relOfDiffGit(lines[0] || '');
+  const out = { rel, pre: null, post: null, mode: null, hunks: [], text, error: null };
+  const fail = (why) => ({ ...out, error: why });
+  if (rel === null) return fail('not a plain `diff --git a/<path> b/<path>` line');
+  const idx = INDEX_RE.exec(lines[1] || '');
+  if (!idx) return fail('line 2 is not a full-index `index` line');
+  out.pre = idx[1]; out.post = idx[2]; out.mode = idx[3] || null;
+  // git ends these two lines with a TAB when the path contains a space (diff.c, so a patch tool can find the name).
+  const tab = rel.includes(' ') ? '\t' : '';
+  if (lines[2] !== `--- a/${rel}${tab}`) return fail('line 3 is not `--- a/<path>`');
+  if (lines[3] !== `+++ b/${rel}${tab}`) return fail('line 4 is not `+++ b/<path>`');
+  let i = 4;
+  let prevEnd = 0;
+  while (i < lines.length) {
+    const h = HUNK_RE.exec(lines[i]);
+    if (!h) return fail(`line ${i + 1} is not a hunk header`);
+    const a = Number(h[1]); const b = h[2] === undefined ? 1 : Number(h[2]);
+    const c = Number(h[3]); const d = h[4] === undefined ? 1 : Number(h[4]);
+    if (b === 0 && d === 0) return fail(`line ${i + 1}: an empty hunk`);
+    const oldBegin = b === 0 ? a : a - 1;
+    if (oldBegin < 0 || oldBegin < prevEnd) return fail(`line ${i + 1}: hunks overlap or are out of order`);
+    prevEnd = oldBegin + b;
+    i += 1;
+    const oldLines = []; const newLines = [];
+    let ob = 0; let nd = 0;
+    while (ob < b || nd < d) {
+      const l = lines[i];
+      if (l === undefined) return fail('a hunk ends before its counts');
+      const k = l[0];
+      if (k === ' ') { oldLines.push(l.slice(1)); newLines.push(l.slice(1)); ob += 1; nd += 1; }
+      else if (k === '-') { oldLines.push(l.slice(1)); ob += 1; }
+      else if (k === '+') { newLines.push(l.slice(1)); nd += 1; }
+      else return fail(`line ${i + 1} is not a hunk line`);
+      if (ob > b || nd > d) return fail(`line ${i + 1} is beyond its hunk's counts`);
+      i += 1;
+      if (lines[i] === NO_NEWLINE) {
+        if (k !== '+') oldLines.noNewlineAt = oldLines.length - 1;
+        if (k !== '-') newLines.noNewlineAt = newLines.length - 1;
+        i += 1;
+      }
+    }
+    out.hunks.push({ a, b, c, d, oldBegin, oldLines, newLines });
+  }
+  if (!out.hunks.length) return fail('a section with no hunk');
+  return out;
+}
+
+/** Split a stored review diff on `diff --git`. Text before the first section is a section with an error. */
+function parseSections(text) {
+  const t = String(text || '');
+  if (!t.trim()) return [];
+  const starts = [];
+  for (const m of t.matchAll(/^diff --git /gm)) starts.push(m.index);
+  const sections = [];
+  const head = t.slice(0, starts.length ? starts[0] : t.length);
+  if (head.trim()) {
+    sections.push({ rel: null, pre: null, post: null, mode: null, hunks: [], text: head,
+      error: 'text outside a diff section' });
+  }
+  for (let i = 0; i < starts.length; i++) {
+    sections.push(parseSection(t.slice(starts[i], i + 1 < starts.length ? starts[i + 1] : t.length)));
+  }
+  return sections;
+}
+
+/** HEAD's lines, each with its own newline (the last may lack one). */
+function linesOf(blob) { return String(blob).match(/[^\n]*\n|[^\n]+$/g) || []; }
+
+/**
+ * The offsets git apply does not check. Old lines must be HEAD's lines at the stated start, byte for byte (newline
+ * included), and each new start must be what git computes from the old start and the hunks before it.
+ * @returns {null | 'context_mismatch' | 'new_start_mismatch'}
+ */
+function checkOffsets(section, blob) {
+  const head = linesOf(blob);
+  let delta = 0;
+  for (const h of section.hunks) {
+    if (h.oldBegin + h.b > head.length) return 'context_mismatch';
+    for (let j = 0; j < h.b; j++) {
+      const want = h.oldLines[j] + (h.oldLines.noNewlineAt === j ? '' : '\n');
+      if (head[h.oldBegin + j] !== want) return 'context_mismatch';
+    }
+    const expectC = h.a + delta + (h.b === 0 ? 1 : 0) - (h.d === 0 ? 1 : 0);
+    if (h.c !== expectC) return 'new_start_mismatch';
+    delta += h.d - h.b;
+  }
+  return null;
+}
+
+function defaultRunGit(repoRoot) {
+  return (args, { timeout, input, env } = {}) => execFileSync('git', args, {
+    cwd: repoRoot, env: gitEnv({ ...(env || {}), GIT_NO_LAZY_FETCH: '1' }), input,
+    encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, timeout: Math.max(1, Math.floor(timeout || PER_CALL_MS)),
+    stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+  });
+}
+
+class Stop extends Error {
+  constructor(result) { super(result.reason || result.status); this.result = result; }
+}
+
+/**
+ * @param {{stored: ({headSha: string, diff: string, notes?: string[]}|null), appliedHead: string, repoRoot: string,
+ *          runGit?: Function, now?: () => number, mkTemp?: () => string}} opts
+ * @returns {{status: 'match'|'mismatch'|'unverifiable'|'absent', headSha: (string|null), step: (string|null),
+ *            reason: (string|null), file: (string|null)}}
+ */
+function checkReviewDiff({ stored, appliedHead, repoRoot, runGit, now, mkTemp } = {}) {
+  const clock = now || Date.now;
+  const deadline = clock() + DEADLINE_MS;
+  let git = runGit || defaultRunGit(repoRoot || process.cwd());
+  const headSha = stored && typeof stored.headSha === 'string' && SHA_RE.test(stored.headSha) ? stored.headSha : null;
+  const result = (status, extra = {}) => ({ status, headSha, step: null, reason: null, file: null, ...extra });
+  const unverifiable = (reason) => result('unverifiable', { reason });
+  let tmp = null;
+  let interrupted = false;
+
+  // One git call, returning its stdout: a throw becomes a Stop (timeout, deadline, git_error, SIGINT) unless
+  // `allowExit` lets a non-zero exit through as `null` for the caller to judge.
+  const call = (args, { input, env, allowExit } = {}) => {
+    const left = Math.min(PER_CALL_MS, deadline - clock());
+    if (left <= 0) throw new Stop(unverifiable('deadline'));
+    try {
+      return String(git(args, { timeout: left, input, env }));
+    } catch (e) {
+      if (e && e.signal === 'SIGINT') { interrupted = true; throw new Stop(unverifiable('git_error')); }
+      if (e && (e.killed || e.code === 'ETIMEDOUT')) throw new Stop(unverifiable('timeout'));
+      if (allowExit && e && typeof e.status === 'number' && e.status !== 0) return null;
+      throw new Stop(unverifiable('git_error'));
+    }
+  };
+
+  try {
+    if (stored == null) return result('absent');
+    if (!headSha) return unverifiable('invalid_head');
+    // `git apply` skips a path outside the cwd's prefix and still exits 0, while `rev-parse :<rel>` resolves from the
+    // root: run from a subdirectory, a correct diff would read as a post_image mismatch. Every call uses the toplevel.
+    if (!runGit) git = defaultRunGit(call(['rev-parse', '--show-toplevel']).trim());
+    if (call(['cat-file', '-e', `${headSha}^{commit}`], { allowExit: true }) === null) return unverifiable('head_missing');
+    if (appliedHead !== headSha) return unverifiable('head_moved');
+    const sections = parseSections(stored.diff);
+    if (!sections.length) return unverifiable('no_sections');
+
+    tmp = (mkTemp || (() => fs.mkdtempSync(path.join(os.tmpdir(), TMP_PREFIX))))();
+    const indexEnv = { GIT_INDEX_FILE: path.join(tmp, 'index') };
+    call(['read-tree', headSha], { env: indexEnv });
+
+    for (const s of sections) {
+      const mismatch = (step, reason = null) => result('mismatch', { step, reason, file: s.rel });
+      if (s.error) return mismatch('parse');
+      const pre = call(['rev-parse', '--verify', '--quiet', `${headSha}:${s.rel}`], { allowExit: true });
+      if (pre === null || pre.trim() !== s.pre) return mismatch('pre_image');
+      const blob = call(['cat-file', 'blob', `${headSha}:${s.rel}`]);
+      const off = checkOffsets(s, blob);
+      if (off) return mismatch('offset', off);
+      const applied = call(['-c', 'apply.ignoreWhitespace=no', '-c', 'apply.whitespace=nowarn',
+        'apply', '--cached', '-'], { input: s.text, env: indexEnv, allowExit: true });
+      if (applied === null) return mismatch('apply');
+      const post = call(['rev-parse', '--verify', '--quiet', `:${s.rel}`], { env: indexEnv, allowExit: true });
+      if (post === null || post.trim() !== s.post) return mismatch('post_image');
+    }
+    return result('match', { reason: 'ok' });
+  } catch (e) {
+    return e instanceof Stop ? e.result : unverifiable('git_error');
+  } finally {
+    if (tmp) { try { fs.rmSync(tmp, { recursive: true, force: true }); } catch { /* best effort */ } }
+    if (interrupted) process.kill(process.pid, 'SIGINT');
+  }
+}
+
+/**
+ * Exactly what verify-patch posts as `reviewDiffCheck`: the six keys, `file` bounded. `attempt` is the step_4
+ * attempt whose stored diff was fetched and checked; the server binds the check to it.
+ */
+function toWireCheck(r, attempt) {
+  const c = r || {};
+  return {
+    status: c.status ?? null,
+    headSha: c.headSha ?? null,
+    attempt: Number.isInteger(attempt) ? attempt : null,
+    step: c.step ?? null,
+    reason: c.reason ?? null,
+    file: typeof c.file === 'string' ? c.file.slice(0, MAX_FILE_CHARS) : null,
+  };
+}
+
+module.exports = {
+  parseSections, checkReviewDiff, toWireCheck,
+  _internal: { parseSection, checkOffsets, linesOf, relOfDiffGit, SHA_RE, PER_CALL_MS, DEADLINE_MS, TMP_PREFIX, STEPS, REASONS },
+};

package/lib/review-diff.js

@@ -0,0 +1,188 @@
+'use strict';
+/**
+ * review-diff.js — HC-GF-390: the base diff a reviewer needs beside a whole emitted file.
+ *
+ * In editor mode step_4's artifact carries every changed file whole (tree-artifact.js), while the
+ * reviewers (step_5, 5d, 5e) see the ORIGINAL only through the bundle, which windows a file longer
+ * than BUNDLE_MAX_PER_FILE_CHARS. A change outside those windows was compared with nothing. This
+ * computes, for step_4 only, `git diff HEAD` of each file the render emitted whole whose HEAD version
+ * is over that cap. It is sent beside the artifact as `reviewDiff` and stored apart from it: the
+ * artifact itself is never touched.
+ *
+ * It never fails a submit. Every git call has a timeout; anything it cannot do becomes a one-line
+ * note, and a note means "unverified", exactly as an absent diff did before.
+ *
+ * Exit modes of what it consumes (HC-GF-117):
+ *   rendered.files            HANDLED: the only candidates. A created, deleted, renamed, binary-at-render
+ *                             or over-1 MB file is never in it, so it is never diffed.
+ *   git rev-parse fails       HANDLED: no HEAD → null, nothing sent.
+ *   git diff --name-status    HANDLED: a throw → one note, nothing diffed.
+ *   per-file git calls        HANDLED: a throw (timeout, ENOBUFS, spawn, non-zero) → a note, next file.
+ *   "Binary files … differ"   HANDLED: a note (a text file .gitattributes marks binary).
+ *   empty diff                HANDLED: a note (the file no longer differs from HEAD).
+ *   post-image ≠ rendered     HANDLED: a note. The diff must describe the bytes the reviewer was sent.
+ */
+
+const crypto = require('node:crypto');
+const { execFileSync } = require('node:child_process');
+const { gitEnv } = require('./git-env');
+const { BUNDLE_MAX_PER_FILE_CHARS } = require('./bundle-limits');
+const { pathRefusal } = require('./path-refusal');
+const { FILE_BLOCK_RE } = require('./block-grammar');
+
+const REVIEW_DIFF_MAX_CHARS = 60_000;      // diff text, summed over the files included
+const PER_CALL_MS = 15_000;
+const DEADLINE_MS = 60_000;                // every per-file call gets min(PER_CALL_MS, what is left)
+const MAX_NOTES = 100;
+const MAX_NOTE_CHARS = 300;
+// Kept equal to server/src/services/review-diff.js REVIEW_DIFF_MAX_BYTES (pinned by the HC-GF-390 tests).
+const REVIEW_DIFF_MAX_BYTES = 256 * 1024;
+
+const SHA_RE = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+
+/** The bundle windows a file whose text is longer than the cap (bundle-paths.js `text.length <= limit` is whole). */
+const overCap = (length) => length > BUNDLE_MAX_PER_FILE_CHARS;
+
+/**
+ * The pinned diff. Every option a user's git config could change is given on the command line, as a
+ * flag the `diff` subcommand takes (not a leading `-c`, so a caller can still recognise the call).
+ */
+function diffArgs(headSha, rel) {
+  return ['diff', '--no-color', '--no-ext-diff', '--no-textconv', '--no-renames', '--full-index',
+    '--diff-algorithm=myers', '--no-relative', '--inter-hunk-context=0', '-U3',
+    '--src-prefix=a/', '--dst-prefix=b/', headSha, '--', rel];
+}
+
+function defaultRunGit(repoRoot) {
+  return (args, timeoutMs) => execFileSync('git', args, {
+    cwd: repoRoot, env: gitEnv(), encoding: 'utf8', maxBuffer: 64 * 1024 * 1024,
+    timeout: Math.max(1, Math.floor(timeoutMs)), stdio: ['ignore', 'pipe', 'pipe'],
+  });
+}
+
+/**
+ * The contents of the first `file:` block for `rel` in a rendered artifact, as the server's
+ * carry-forward `blocksOf` reads it (same grammar, same scope, same one-newline strip), or null.
+ */
+function blockContents(text, rel) {
+  const t = String(text || '');
+  const sec = t.search(/^##\s+Changed Files/im);
+  const scope = t.slice(sec === -1 ? 0 : sec);
+  for (const m of scope.matchAll(FILE_BLOCK_RE)) {
+    if (m[2].trim() === rel) return m[3].replace(/\r?\n$/, '');
+  }
+  return null;
+}
+
+/** git's object id of a blob holding `str` as UTF-8, computed in memory (never `hash-object -w`). */
+function gitBlobId(str, algo = 'sha1') {
+  const bytes = Buffer.from(String(str), 'utf8');
+  return crypto.createHash(algo).update(`blob ${bytes.length}\0`).update(bytes).digest('hex');
+}
+
+/** One line, no control characters, at most `max` chars. */
+function oneLine(s, max) {
+  const flat = String(s == null ? '' : s).replace(/[\x00-\x1f\x7f]+/g, ' ').trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+}
+
+/**
+ * @param {object}   opts
+ * @param {string}   opts.repoRoot
+ * @param {{text: string, files: string[]}} opts.rendered  renderFromTree()'s result
+ * @param {(args: string[], timeoutMs: number) => string} [opts.runGit]
+ * @param {() => number} [opts.now]
+ * @param {(line: string) => void} [opts.warn]  why nothing is sent when that is not "no candidate"
+ * @returns {null | { headSha: string, diff: string, notes: string[], stats: object }}
+ *   null when there is nothing to send: no HEAD, no candidate, or a payload over its byte cap.
+ */
+function computeReviewDiff({ repoRoot, rendered, runGit, now = Date.now, warn = () => {} } = {}) {
+  try {
+    const git = runGit || defaultRunGit(repoRoot);
+    const emitted = new Set(rendered && Array.isArray(rendered.files) ? rendered.files : []);
+    if (!emitted.size) return null;
+
+    const deadline = now() + DEADLINE_MS;
+    let headSha;
+    try { headSha = String(git(['rev-parse', '--verify', 'HEAD^{commit}'], PER_CALL_MS)).trim(); } catch { return null; }
+    if (!SHA_RE.test(headSha)) return null;
+    const algo = headSha.length === 64 ? 'sha256' : 'sha1';
+
+    const notes = [];
+    const sections = [];
+    let used = 0;
+    const note = (rel, reason) => notes.push(oneLine(`${JSON.stringify(rel)}: ${reason}`, MAX_NOTE_CHARS));
+
+    let candidates = [];
+    try {
+      const tokens = String(git(['diff', '--name-status', '-z', '--no-renames', headSha], PER_CALL_MS)).split('\0');
+      for (let i = 0; i + 1 < tokens.length; i += 2) {
+        const status = tokens[i]; const rel = tokens[i + 1];
+        if ((status === 'M' || status === 'T') && emitted.has(rel)) candidates.push(rel);
+      }
+      candidates = [...new Set(candidates)].sort();
+    } catch (e) {
+      notes.push(oneLine(`(all files): git failed listing changes against HEAD: ${e && e.message}`, MAX_NOTE_CHARS));
+    }
+
+    for (let i = 0; i < candidates.length; i++) {
+      const rel = candidates[i];
+      const left = () => Math.min(PER_CALL_MS, deadline - now());
+      let t = left();
+      if (t <= 0) { notes.push(`deadline reached; ${candidates.length - i} file(s) not diffed`); break; }
+      try {
+        // The size first: it reads no content, and a file at or under the cap was bundled whole.
+        // UTF-8 bytes >= UTF-16 length, so a size at or under the cap cannot be a length over it.
+        const size = Number(String(git(['cat-file', '-s', `${headSha}:${rel}`], t)).trim());
+        if (!Number.isFinite(size) || !overCap(size)) continue;
+        if (pathRefusal(rel, { mode: 'egress' })) { note(rel, 'secret path; not diffed'); continue; }
+        t = left();
+        if (t <= 0) { notes.push(`deadline reached; ${candidates.length - i} file(s) not diffed`); break; }
+        const head = String(git(['cat-file', 'blob', `${headSha}:${rel}`], t));
+        if (!overCap(head.length)) continue;
+        t = left();
+        if (t <= 0) { notes.push(`deadline reached; ${candidates.length - i} file(s) not diffed`); break; }
+        const out = String(git(diffArgs(headSha, rel), t));
+        if (!out.trim()) { note(rel, 'no longer differs from HEAD; not diffed'); continue; }
+        if (/^Binary files .* differ$/m.test(out) || /^GIT binary patch$/m.test(out)) { note(rel, 'binary to git; not diffed'); continue; }
+        if ((out.match(/^diff --git /gm) || []).length !== 1) { note(rel, 'unexpected diff shape; not included'); continue; }
+        const post = /^index [0-9a-f]+\.\.([0-9a-f]+)(?: [0-7]+)?$/m.exec(out);
+        const contents = blockContents(rendered.text, rel);
+        if (!post || contents === null || post[1] !== gitBlobId(`${contents}\n`, algo)) {
+          note(rel, 'post-image differs from the rendered bytes (an eol or clean filter, no final newline, '
+            + 'non-UTF-8 content, or a change after render); not included');
+          continue;
+        }
+        const section = out.endsWith('\n') ? out : `${out}\n`;
+        if (used + section.length > REVIEW_DIFF_MAX_CHARS) {
+          note(rel, `over the ${REVIEW_DIFF_MAX_CHARS.toLocaleString('en-US')}-char review-diff budget; not included`);
+          continue;
+        }
+        sections.push(section);
+        used += section.length;
+      } catch (e) {
+        note(rel, `git failed: ${oneLine(String((e && e.message) || e).split('\n')[0], 120)}`);
+      }
+    }
+
+    const kept = notes.length > MAX_NOTES
+      ? [...notes.slice(0, MAX_NOTES - 1), `${notes.length - (MAX_NOTES - 1)} more note(s) omitted`]
+      : notes;
+    if (!sections.length && !kept.length) return null;
+    const payload = { headSha, diff: sections.join(''), notes: kept };
+    const bytes = Buffer.byteLength(JSON.stringify(payload), 'utf8');
+    if (bytes > REVIEW_DIFF_MAX_BYTES) { warn(`review diff not sent: ${bytes} bytes is over the ${REVIEW_DIFF_MAX_BYTES}-byte limit`); return null; }
+    return { ...payload, stats: { candidates: candidates.length, files: sections.length, chars: used } };
+  } catch (e) {
+    warn(`review diff not sent: ${oneLine((e && e.message) || e, 200)}`);
+    return null;
+  }
+}
+
+/** Exactly what `hone submit-step` posts as `reviewDiff`: the stats stay CLI-side. One mapper, so a test can post what the CLI posts. */
+function toWire(r) { return { headSha: r.headSha, diff: r.diff, notes: r.notes }; }
+
+module.exports = {
+  computeReviewDiff, blockContents, gitBlobId, toWire,
+  _internal: { overCap, diffArgs, REVIEW_DIFF_MAX_CHARS, PER_CALL_MS, DEADLINE_MS, MAX_NOTES, MAX_NOTE_CHARS, REVIEW_DIFF_MAX_BYTES },
+};

package/lib/run-context.js

@@ -25,7 +25,6 @@
  */
 
 const { composeStoryDescription } = require('./story-compose');
-const { extractStoryIdFromBranch } = require('./pipeline-status');
 const {
   extractPathRefs, extractBareRefs, resolveBareName, alreadyCovered, planFileExcerpt,
 } = require('./bundle-paths');
@@ -37,7 +36,6 @@ const { classifyStory } = require('./story-classifier');
 const {
   extractType, extractSecurityImplications, extractCrossRepoDependency,
 } = require('./story-classifier-extract');
-const { readArchitectConfigFromText } = require('./architect-config');
 const path = require('path');
 
 /**
@@ -49,13 +47,16 @@ const path = require('path');
  */
 const SERVER_OWNED_KEYS = Object.freeze([
   'batchTokenBudget', 'batchFailureThreshold', 'dependsOnRunIds', 'monthlyTokenBudget', 'overnight',
+  // HC-GF-030: whether a story was consulted is what the server's step_0b recorded, never what a
+  // client says. A client that could send these true would skip the consult.
+  'architect_consulted', 'checklist_b_completed', 'architect_consult',
 ]);
 
 // HC-019n-followup-13d: the bundle caps. OptionsFlow #96 hit 49,783 of the old 50,000 with six
 // files, so the next slightly larger story silently dropped one. 30 / 150K / 25K.
 const BUNDLE_MAX_FILES = 30;
 const BUNDLE_MAX_TOTAL_CHARS = 150_000;
-const BUNDLE_MAX_PER_FILE_CHARS = 25_000;
+const { BUNDLE_MAX_PER_FILE_CHARS } = require('./bundle-limits'); // HC-GF-390: shared with review-diff.js
 
 const info = (text) => ({ level: 'info', text });
 const warn = (text) => ({ level: 'warn', text });
@@ -158,7 +159,6 @@ async function issueStorySource(io, issueNumber, issue) {
  * @param {() => string} io.e2eSpecMode
  * @param {() => string} io.verificationGate
  * @param {() => string[]} io.verificationGateSources
- * @param {() => string} io.readPlanText                 EXECUTION_PLAN.yml text, '' when absent
  * @param {{ e2eSpecs?: boolean, skipE2eSpecs?: boolean, treeByteCap?: number }} [opts]  run-story's per-run
  *   flags; `treeByteCap` is queue-stories' byte cap on the tree's path lists (none for run-story)
  */
@@ -295,13 +295,7 @@ function resolveRepoContext(io, opts = {}) {
     config.verification_gate_sources = ['verify-patch'];
   }
 
-  // HC-019b: EXECUTION_PLAN.yml, read once. Each story's architect flags come from it below.
-  let planText = '';
-  try { planText = io.readPlanText() || ''; } catch (e) {
-    notes.push(warn(`  ⚠ EXECUTION_PLAN.yml read failed (non-fatal, architect flags default to {false, false}): ${firstLine(e)}`));
-  }
-
-  return { config, notes, repoFiles, defaultIncludePaths, planText, execution };
+  return { config, notes, repoFiles, defaultIncludePaths, execution };
 }
 
 /**
@@ -324,8 +318,8 @@ function resolveRepoContext(io, opts = {}) {
  * @param {object} repoCtx   resolveRepoContext's result
  * @param {string} storyId   the id as the operator typed it — sent as `storyId`
  * @param {{ explicitText?: string|null, explicitLabel?: string, explicitSource?: {kind: 'file'|'description', label?: string},
- *   includePaths?: string[], axes?: string }} [opts]
- * @returns {Promise<{ storyId: string, resolvedStoryId: string, rawText: string,
+ *   includePaths?: string[], axes?: string, consultArchitect?: boolean }} [opts]
+ * @returns {Promise<{ storyId: string, rawText: string,
  *   textSource: 'explicit'|'issue'|'roadmap'|null, textFailure: {kind:string, detail?:string}|null,
  *   config: object, bundle: {files:number, chars:number}, notes: {pre: object[], post: object[]} }>}
  */
@@ -336,7 +330,6 @@ async function resolveStoryContext(io, repoCtx, storyId, opts = {}) {
   let rawText = '';
   let textSource = null;
   let textFailure = null;
-  let resolvedStoryId = storyId; // canonical id for the architect-config lookup
 
   // ── Story text: explicit → GitHub issue → Hone roadmap ────────────────────────────────────
   // HC-GF-010: an EXPLICIT story source short-circuits both lookups, so the operator can never
@@ -369,17 +362,6 @@ async function resolveStoryContext(io, repoCtx, storyId, opts = {}) {
       const prov = await issueStorySource(io, storyId, issue);
       config.story_source = prov.source;
       pre.push(...prov.notes);
-      // HC-019b-followup-1 F1: the canonical story id from the issue title, or the architect
-      // lookup keys on '104' and silently misses every EXECUTION_PLAN.yml entry.
-      try {
-        const titleId = extractStoryIdFromBranch(issue.title);
-        if (titleId) {
-          resolvedStoryId = titleId;
-          pre.push(info(`  → resolved issue #${storyId} → canonical story id '${titleId}' for architect-config lookup`));
-        } else {
-          pre.push(warn(`  ⚠ could not extract canonical story id from issue title '${issue.title}' — architect-config lookup will use '${storyId}' (likely silent miss)`));
-        }
-      } catch { /* extractor throws → fall back to the numeric id */ }
     } catch (e) {
       textFailure = { kind: 'issue-error', detail: firstLine(e) };
       // HC-GF-270: stated rather than left absent, so the later pause is readable. Classified, not
@@ -392,7 +374,6 @@ async function resolveStoryContext(io, repoCtx, storyId, opts = {}) {
       };
       pre.push(warn(`  ⚠ could not fetch GitHub issue context: ${firstLine(e)}`));
       pre.push(warn('  → proceeding without story_description; step_0 may produce placeholder output'));
-      pre.push(warn(`  ⚠ architect-config lookup will use '${storyId}' (likely silent miss)`));
     }
   } else {
     // HC-019n-followup-18: a roadmap-sourced story. Only the SERVER knows what it says; only the
@@ -540,11 +521,14 @@ async function resolveStoryContext(io, repoCtx, storyId, opts = {}) {
           path: candidate,
         });
         content = excerpt.content;
-        if (excerpt.notice) pre.push(warn(excerpt.notice));
-        for (const w of anchorWarnings(anchors, excerpt.unhonoured)) pre.push(warn(w));
         if (totalChars + content.length > BUNDLE_MAX_TOTAL_CHARS) { budgetSpent = true; break; }
         totalChars += content.length;
         codebaseFiles.push({ path: candidate, content });
+        // Only a file that made the bundle gets the "bundled lines A-B" notice: announced before the
+        // budget check, a dropped file printed it AND the NOT-bundled line below, and the operator
+        // read the first one (seen 2026-10-16 on server/scripts/seed-agent-prompts.js).
+        if (excerpt.notice) pre.push(warn(excerpt.notice));
+        for (const w of anchorWarnings(anchors, excerpt.unhonoured)) pre.push(warn(w));
       }
       // HC-GF-288: an operator-named entry whose file never reached the bundle (the budget ran
       // out first, or it names a directory) vanished as silently as the anchor did. A refused
@@ -597,6 +581,11 @@ async function resolveStoryContext(io, repoCtx, storyId, opts = {}) {
     }
   }
 
+  // ── Architect consult on request (HC-GF-397) ─────────────────────────────────────────────
+  // --consult-architect: the server runs step_0b even on a `not_engaged` grooming. Sent only as `true`; the server reads
+  // nothing else as a request, and no value of it can skip a consult.
+  if (opts.consultArchitect === true) config.consult_architect = true;
+
   // ── Classifier axes (HC-COMM-010) ─────────────────────────────────────────────────────────
   // Explicit --axes wins. Otherwise the DETERMINISTIC axes from the extractors; judgment axes
   // come from the groomer at step_0 and are harvested server-side. Fail-open.
@@ -621,19 +610,7 @@ async function resolveStoryContext(io, repoCtx, storyId, opts = {}) {
     }
   }
 
-  // ── Architect flags (HC-019b) ─────────────────────────────────────────────────────────────
-  // workflow-dag.js's validateStepPreConditions BLOCKS step_1 when architect_consulted is true
-  // and checklist_b_completed is not; without these flags every architect-engaged story
-  // deadlocks. Keyed on the RESOLVED id (HC-019b-followup-1 F1).
-  const arch = readArchitectConfigFromText(repoCtx.planText || '', resolvedStoryId);
-  config.architect_consulted = arch.architect_consulted;
-  config.checklist_b_completed = arch.checklist_b_completed;
-  if (arch.diagnostic) post.push(warn(`  ⚠ ${arch.diagnostic}`));
-  if (arch.architect_consulted) {
-    post.push(info(`  → architect_consulted: true, checklist_b_completed: ${arch.checklist_b_completed}`));
-  }
-
-  return { storyId, resolvedStoryId, rawText, textSource, textFailure, config, bundle, notes: { pre, post } };
+  return { storyId, rawText, textSource, textFailure, config, bundle, notes: { pre, post } };
 }
 
 /**