@hone-ai/cli 1.41.0 → 1.42.0

package/README.md

@@ -16,6 +16,13 @@ hone init --token <YOUR_TOKEN>
 A token is issued when your organization is provisioned. Without one the CLI installs fine but
 every server-backed command will refuse.
 
+The CLI talks to `https://hone-server-production.up.railway.app` unless you point it elsewhere.
+It picks the server from `hone init --api <url>` (saved to `~/.honerc` as `api`), then `HONE_API`,
+then `~/.honerc`, then that default. `hone init` without `--api` keeps the `api` already in
+`~/.honerc`. A value naming the retired default domain or any of its subdomains (it is no longer ours), or
+one that is not an http(s) URL, is refused: `init --api` exits 2, and `HONE_API` or `~/.honerc` is
+ignored with a one-line warning that names only the hostname.
+
 ## The three commands that matter
 
 ```bash

package/hone-cli.js

@@ -29,10 +29,12 @@ const { execSync, execFileSync } = require('child_process');
 // A source-regex asserting the variable name matched this very comment and passed while the
 // scrub was gutted.
 const { verdictEnv } = require('./lib/verdict-env');
+const { DEFAULT_API, resolveApiUrl, apiHostname } = require('./lib/default-api'); // HC-GF-396
 const { parseTimeoutSeconds } = require('./lib/timeout-option.js');
 // HC-GF-143 batch: both mappings were computed inline and asserted by nothing (HC-GF-136).
 const { promotePayload } = require('./lib/promote-payload');
 const { assetFetchList } = require('./lib/asset-fetch-list');
+const { adminRequestOptions, describeAdminRedirect } = require('./lib/admin-request'); // HC-GF-406
 // HC-CI-019-followup-3: no suite asserted a field of either, and this file cannot be required.
 const { detectExistingTestFramework } = require('./lib/detect-test-framework');
 const { classifySpec } = require('./lib/classify-spec');
@@ -43,7 +45,7 @@ const { resolveBaseRef, getMaxDiffChars } = require('./lib/release-review-config
 const { gitEnv } = require('./lib/git-env');
 const { collectIncludePaths } = require('./lib/include-paths');
 const { runArgsError, orchestratePath, apiPath, storyDir: storyDirIn, isGitRev, isStoryId } = require('./lib/run-target'); // HC-GF-270-followup-1, -2, -3, -4
-const { normalizeQuestion, questionLines, gateQuestionLines, countPhrase } = require('./lib/operator-question'); // HC-GF-234
+const { normalizeQuestion, questionLines, gateQuestionLines, countPhrase, scrub } = require('./lib/operator-question'); // HC-GF-234
 const program = new Command();
 
 // HC-GF-331: spawnSync's default stdout/stderr buffer is 1 MiB. A verification suite over that
@@ -110,7 +112,8 @@ function getConfig() {
   // Priority: env var → ~/.honerc → error
   const rc     = readRc();
   const token  = process.env.HONE_TOKEN  || rc.token;
-  const apiUrl = process.env.HONE_API     || rc.api || 'https://api.hone.ai';
+  // HC-GF-396: a retired or invalid HONE_API / rc.api counts as unset, with one stderr warning.
+  const { apiUrl } = resolveApiUrl({ env: process.env.HONE_API, rc: rc.api });
 
   if (!token) {
     console.error('Error: Hone token not found.');
@@ -1993,10 +1996,18 @@ program
   .command('init')
   .description('Save HONE_TOKEN and API URL to ~/.honerc')
   .option('--token <token>', 'Hone API token')
-  .option('--api <url>',     'Hone API base URL (default: https://api.hone.ai)')
+  .option('--api <url>',     `Hone API base URL (default: ${DEFAULT_API})`)
   .action(async (opts) => {
     const token  = opts.token || process.env.HONE_TOKEN;
-    const apiUrl = opts.api   || process.env.HONE_API || 'https://api.hone.ai';
+    // HC-GF-396: a retired or invalid --api exits 2 before anything is sent. Without --api, init
+    // resolves like every other command (HONE_API → ~/.honerc → default), so re-running it keeps a
+    // valid custom rc.api instead of resetting it.
+    const resolved = resolveApiUrl({ flag: opts.api, env: process.env.HONE_API, rc: readRc().api });
+    if (resolved.error) {
+      console.error(`Error: ${resolved.error}`);
+      process.exit(2);
+    }
+    const apiUrl = resolved.apiUrl;
 
     if (!token) {
       console.error('Error: --token is required (or set HONE_TOKEN env var).');
@@ -2025,7 +2036,7 @@ program
     fs.writeFileSync(RC_PATH, JSON.stringify(rc, null, 2), { mode: 0o600 });
 
     console.log(`✓ Config saved to ${RC_PATH}`);
-    console.log(`  API: ${apiUrl}`);
+    console.log(`  API: ${apiHostname(apiUrl)}`);
     console.log('');
     console.log('You can now run "hone setup" in any repository.');
   });
@@ -2493,13 +2504,12 @@ program
   .option('--format <fmt>', 'Output format: pretty | json', 'pretty')
   .action(async (opts) => {
     const rc = readRc();
-    const apiUrl = process.env.HONE_API || rc.api || 'https://api.hone.ai';
+    const { apiUrl } = resolveApiUrl({ env: process.env.HONE_API, rc: rc.api });
     const adminKey = requireAdminKey();
 
     try {
       const { data } = await axios.get(`${apiUrl}/admin/usage`, {
-        headers: { 'x-admin-key': adminKey, 'User-Agent': `@hone-ai/cli/${pkg.version}` },
-        timeout: 15000,
+        ...adminRequestOptions(adminKey, `@hone-ai/cli/${pkg.version}`),
       });
 
       if (opts.format === 'json') {
@@ -2544,7 +2554,10 @@ program
 
       console.log('');
     } catch (e) {
-      if (e.response?.status === 401) {
+      const redirect = describeAdminRedirect(e);
+      if (redirect) {
+        console.error(redirect);
+      } else if (e.response?.status === 401) {
         console.error('Invalid admin key. Check HONE_ADMIN_KEY or ~/.honerc admin_key.');
       } else {
         console.error(`Failed to fetch admin dashboard: ${e.message}`);
@@ -3102,9 +3115,9 @@ program
     }
 
     const adminKey = requireAdminKey();
-    // `getConfig()` already resolves the base (HONE_API -> ~/.honerc -> default) and exits with a
-    // usable message when no token is configured. Re-deriving it here would have added a TENTH
-    // copy of the `api.hone.ai` literal that [[HC-GF-236]] is trying to reduce to one.
+    // `getConfig()` already resolves the base through `resolveApiUrl()` (HONE_API -> ~/.honerc ->
+    // default, HC-GF-396) and exits with a usable message when no token is configured. Re-deriving
+    // it here would bypass the retired-host guard in cli/lib/default-api.js.
     const config = getConfig();
     const apiUrl = config.apiUrl;
 
@@ -3120,8 +3133,7 @@ program
       const { data } = await axios.post(`${apiUrl}/admin/learnings/absorb`, {
         orgId, ids: wanted, repo: opts.repo, absorbedIn: destination,
       }, {
-        headers: { 'x-admin-key': adminKey, 'User-Agent': `@hone-ai/cli/${pkg.version}` },
-        timeout: 15000,
+        ...adminRequestOptions(adminKey, `@hone-ai/cli/${pkg.version}`),
       });
 
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
@@ -3141,7 +3153,9 @@ program
       if (data.skipped.length) process.exitCode = 1;
     } catch (e) {
       const status = e.response?.status;
-      if (status === 401)      console.error('Invalid admin key. Check HONE_ADMIN_KEY or ~/.honerc admin_key.');
+      const redirect = describeAdminRedirect(e);
+      if (redirect)            console.error(redirect);
+      else if (status === 401) console.error('Invalid admin key. Check HONE_ADMIN_KEY or ~/.honerc admin_key.');
       else if (status === 429) console.error('Too many failed admin-auth attempts from this address. Wait for the window to pass.');
       else if (status === 503) console.error(`Server cannot absorb right now: ${e.response?.data?.error || 'unavailable'}`);
       else                     console.error(`Absorb failed: ${e.response?.data?.error || e.message}`);
@@ -3951,7 +3965,9 @@ function bundleDirectory(dir, root, files, maxFiles, currentCount) {
 
       if (entry.isDirectory()) {
         bundleDirectory(fullPath, root, files, maxFiles, Object.keys(files).length);
-      } else if (EXTENSIONS.test(entry.name)) {
+      } else if (EXTENSIONS.test(entry.name) && !pathRefusal(relPath, { mode: 'egress' })) {
+        // HC-GF-398: `config/secrets.yml` and `secrets.json` pass the extension filter; derive sends them to the
+        // server whole, so the egress refusal applies here as it does to every other whole-content send.
         try {
           const content = fs.readFileSync(fullPath, 'utf8');
           if (content.length < 50_000) { // skip very large files
@@ -3974,6 +3990,7 @@ function sleep(ms) {
 // `require('../hone-cli.js')` — making require.main the bin wrapper,
 // not hone-cli.js, so the gate never fired and parse never ran.)
 const { splicePreserveRepoSpecific } = require('./lib/splice-repo-specific');
+const { pathRefusal } = require('./lib/path-refusal');
 
 // ── STATUS command (H-009) ────────────────────────────────────────────────────
 // Show pipeline state for a story (or use --all for every in-flight story).
@@ -5994,14 +6011,19 @@ program
     try {
       // HC-GF-092: advertise what this CLI can honour. The server serves the highest it also
       // knows, so an older CLI — which sends nothing — keeps being served contract 1.
-      const { data } = await client.get(orchestratePath([runId, 'step-instruction'], { contracts: '1,2' }));
+      // HC-GF-399: contract 3 anchors edits on HEAD, so only a checkout with a commit advertises it; a
+      // repository with no commit is served 2, as before. A git timeout fails here rather than guessing.
+      const { editorContractsFor } = require('./lib/tree-artifact');
+      const { data } = await client.get(orchestratePath([runId, 'step-instruction'], { contracts: editorContractsFor(process.cwd()) }));
       if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
       console.log(`Step:      ${data.stepKey} (${data.agent})`);
       console.log(`Contract:  ${data.contractVersion}`);
       console.log('─'.repeat(60));
       console.log(data.instruction);
       console.log('─'.repeat(60));
-      console.log(`Submit with: hone submit-step ${runId} ${data.stepKey} --file <output.txt>`);
+      // HC-GF-399: the submit command the SERVED contract asks for — `--file` only under contract 1.
+      const how = String(data.contractVersion) === '1' ? '--file <output.txt>' : `--from-tree --contract ${data.contractVersion}`;
+      console.log(`Submit with: hone submit-step ${runId} ${data.stepKey} ${how}`);
     } catch (e) {
       const st = e.response?.status;
       if (st === 409) console.error(`No step awaiting the editor: ${e.response.data?.error || ''} (run status: ${e.response.data?.runStatus || '?'})`);
@@ -6035,6 +6057,11 @@ program
         console.error('Contract 2 is the from-tree contract: the instruction told the agent to write the files with its own tools. Re-run with --from-tree, or fetch a contract 1 instruction if you really did assemble the output by hand.');
         process.exit(1);
       }
+      // HC-GF-399: contract 3 sends region edits proven against HEAD, which only a render from the tree can do.
+      if (String(opts.contract) === '3' && !opts.fromTree) {
+        console.error('Contract 3 is a from-tree contract: it sends region edits proven against HEAD from what you wrote. Re-run with --from-tree.');
+        process.exit(1);
+      }
       if (!opts.file && !opts.fromTree) { console.error('Provide the output via --file <path> (the text your editor produced), or --from-tree to render it from the working tree.'); process.exit(1); }
       const fs = require('fs');
       let output;
@@ -6042,12 +6069,17 @@ program
       let warned = false;
       if (opts.fromTree) {
         const { renderFromTree } = require('./lib/tree-artifact');
-        const rendered = renderFromTree({ repoRoot: process.cwd(), testReport: opts.testReport });
+        const rendered = renderFromTree({ repoRoot: process.cwd(), testReport: opts.testReport, contract: String(opts.contract), stepKey });
         output = rendered.text;
         // Say what was left out BEFORE the submission, not after: a file the tree has and the
         // artifact does not is a decision the operator has to be able to see.
         for (const s2 of rendered.skipped) console.error(`not included: ${s2.path} — ${s2.reason}`);
         console.error(`from-tree: ${rendered.files.length} file(s), ${rendered.deletes.length} deletion(s), ${rendered.skipped.length} skipped`);
+        // HC-GF-399: under contract 3, what went as region edits and every file that fell back to whole, with why.
+        if (rendered.edited.length || rendered.fallbacks.length) {
+          console.error(`from-tree: ${rendered.edited.length} file(s) sent as region edits against ${rendered.headSha.slice(0, 12)}`);
+          for (const f of rendered.fallbacks) console.error(`whole: ${f.path} (${f.reason})`);
+        }
         // HC-GF-390: for a build, the base diff of each file emitted whole whose original the reviewers saw only in
         // windows. Sent beside the artifact, stored apart from it, and never a reason this submit fails.
         if (stepKey === 'step_4') {
@@ -6056,6 +6088,13 @@ program
             reviewDiff = computeReviewDiff({ repoRoot: process.cwd(), rendered,
               warn: (line) => { warned = true; console.error(line); } });
           } catch (e) { reviewDiff = null; warned = true; console.error(`review diff not sent: ${e.message}`); }
+          // HC-GF-399: review-diff.js resolves HEAD itself. If that is not the commit the render was taken against,
+          // HEAD moved during the submit, and the diff would describe a different base — drop it, and say so.
+          if (reviewDiff && !require('./lib/tree-artifact').reviewDiffBaseMatches(reviewDiff, rendered)) {
+            warned = true;
+            console.error(`review diff not sent: computed against ${reviewDiff.headSha.slice(0, 12)}, the render against ${rendered.headSha.slice(0, 12)} (HEAD moved during submit)`);
+            reviewDiff = null;
+          }
           if (reviewDiff) {
             console.error(`review diff: ${reviewDiff.stats.files} file(s), ${reviewDiff.notes.length} note(s), against ${reviewDiff.headSha.slice(0, 12)}`);
             for (const n of reviewDiff.notes) console.error(`  review diff note: ${n}`);
@@ -7244,7 +7283,7 @@ program
   .option('--dry-run', 'Show what would be reviewed without calling the LLM', false)
   .option('--max-files <n>', 'Max source files to include in review', '40')
   .option('--provider <name>', 'LLM provider: opus (paid, needs ANTHROPIC_API_KEY). gh-models was retired 2026-07-30; there is no default')
-  .option('--cache <mode>', 'HC-RC-002-followup-1 content-hash cache: on | off (default on)', 'on')
+  .option('--cache <mode>', 'content-hash cache: on stores the review at the Hone API (14 days) and replays it for the same diff; off sends nothing (default on)', 'on')
   .action(async (opts) => {
     const { execSync } = require('child_process');
     const fs = require('fs');
@@ -7478,10 +7517,34 @@ program
         banner(`Cache disabled: contentHash computation failed: ${e.message}`);
       }
     }
+    // Exit code — defense in depth:
+    //   (a) structured check against the parsed JSON, then
+    //   (b) loose substring check on the raw response (catches LLMs that
+    //       emit markdown-formatted CRITICAL findings without strict JSON).
+    // HC-GF-407: one decision for a fresh review and a replayed one, so a cached CRITICAL still blocks.
+    const blocksDeploy = (parsed, responseText) => {
+      let hasCritical = false, doNotDeploy = false;
+      if (parsed) {
+        hasCritical = (parsed.summary?.critical || 0) > 0 ||
+                      (Array.isArray(parsed.findings) &&
+                       parsed.findings.some(f => String(f.severity).toUpperCase() === 'CRITICAL'));
+        doNotDeploy = parsed.recommendation === 'DO_NOT_DEPLOY';
+      }
+      if (!hasCritical) {
+        // Loose match — case-insensitive, no quote requirement. False-positive
+        // tolerance is acceptable here because the cost of a false-positive is
+        // "CI shows yellow, human looks at the report"; the cost of a false-
+        // negative is "real CRITICAL bug ships to prod undetected".
+        hasCritical = /\bCRITICAL\b/.test(responseText);
+      }
+      if (!doNotDeploy) {
+        doNotDeploy = /\bDO_NOT_DEPLOY\b/.test(responseText);
+      }
+      return hasCritical || doNotDeploy;
+    };
     if (cacheEnabled && cacheContentHash) {
-      const config = getConfig();
-      const apiBase = (config && config.apiBase) || process.env.HONE_API_BASE;
-      const token = (config && config.token) || process.env.HONE_TOKEN;
+      // HC-GF-407: the cache goes to the API every other command uses, with the same token.
+      const { apiUrl: apiBase, token } = getConfig();
       const cached = await lookupReviewCache({
         axios,
         apiBase,
@@ -7523,6 +7586,15 @@ program
             ? cached.response
             : JSON.stringify(cached.response, null, 2));
         }
+        // The store keeps the parsed review, or `{ raw }` when the model wrote no JSON; either way the
+        // serialised replay carries the text the loose check reads.
+        const replay = cached.response;
+        const replayParsed = replay && typeof replay === 'object' ? replay : null;
+        if (blocksDeploy(replayParsed, typeof replay === 'string' ? replay : JSON.stringify(replay))) {
+          banner('');
+          banner('CRITICAL issues found. Fix before deploying.');
+          process.exit(1);
+        }
         process.exit(0);
       }
     }
@@ -7634,9 +7706,8 @@ program
       // Total tokens billed for this run = inputTokens + outputTokens —
       // those are the tokens a future hit would save.
       if (cacheEnabled && cacheContentHash) {
-        const config = getConfig();
-        const apiBase = (config && config.apiBase) || process.env.HONE_API_BASE;
-        const token = (config && config.token) || process.env.HONE_TOKEN;
+        // HC-GF-407: the cache goes to the API every other command uses, with the same token.
+        const { apiUrl: apiBase, token } = getConfig();
         // Cache the parsed JSON when available (cleaner replay), otherwise
         // wrap the raw text in { raw } so the cache always stores an object.
         const responseForCache = parsed && typeof parsed === 'object'
@@ -7657,28 +7728,8 @@ program
         }).catch(() => { /* logged inside helper */ });
       }
 
-      // 8. Exit code — defense in depth:
-      //   (a) structured check against the parsed JSON, then
-      //   (b) loose substring check on the raw response (catches LLMs that
-      //       emit markdown-formatted CRITICAL findings without strict JSON).
-      let hasCritical = false, doNotDeploy = false;
-      if (parsed) {
-        hasCritical = (parsed.summary?.critical || 0) > 0 ||
-                      (Array.isArray(parsed.findings) &&
-                       parsed.findings.some(f => String(f.severity).toUpperCase() === 'CRITICAL'));
-        doNotDeploy = parsed.recommendation === 'DO_NOT_DEPLOY';
-      }
-      if (!hasCritical) {
-        // Loose match — case-insensitive, no quote requirement. False-positive
-        // tolerance is acceptable here because the cost of a false-positive is
-        // "CI shows yellow, human looks at the report"; the cost of a false-
-        // negative is "real CRITICAL bug ships to prod undetected".
-        hasCritical = /\bCRITICAL\b/.test(responseText);
-      }
-      if (!doNotDeploy) {
-        doNotDeploy = /\bDO_NOT_DEPLOY\b/.test(responseText);
-      }
-      if (hasCritical || doNotDeploy) {
+      // 8. Exit code (blocksDeploy, above).
+      if (blocksDeploy(parsed, responseText)) {
         banner('');
         banner('CRITICAL issues found. Fix before deploying.');
         process.exit(1);
@@ -7715,7 +7766,7 @@ program
 const showCmd = program.command('show').description('Inspect orchestrator step output (HC-019n-followup-6)');
 showCmd
   .command('step <workflowId> <stepKey>')
-  .description('Print the actual LLM output of an orchestrator step (latest attempt by default)')
+  .description('Print a step\'s model output (the latest attempt; for step_0b, every attempt, newest first)')
   .option('--attempt <n>', 'Specific attempt number (default: latest)')
   .option('--prompt', 'Also print the exact prompt this step sent to the model (HC-GF-055)')
   .action(async (workflowId, stepKey, opts) => {
@@ -7774,6 +7825,38 @@ showCmd
       console.log(`── output (the LLM's actual response) ──────────────────`);
       console.log(s.output || '(no output recorded — step may not have completed)');
       console.log(`────────────────────────────────────────────────────────`);
+      // HC-GF-379-followup-1: step_0b lists every consult attempt, newest first. Only when no --attempt/--prompt was given
+      // and the latest attempt is a safe integer > 1 (1e300 is an integer and `n--` never moves it); capped, because
+      // isSafeInteger still admits 2^53. Every past attempt's error is caught HERE: the exit(1) below is for the latest.
+      // The step response carries no failure_record (orchestrate.js SELECT), so no past attempt claims a verdict.
+      const latest = s.attempt;
+      if (stepKey === 'step_0b' && opts.attempt === undefined && !opts.prompt && Number.isSafeInteger(latest) && latest > 1) {
+        const MAX_PAST_ATTEMPTS = 50;
+        const oldest = Math.max(1, latest - MAX_PAST_ATTEMPTS);
+        const findingLines = (text) => {
+          const ls = String(text == null ? '' : text).split('\n');
+          const at = ls.findIndex((l) => /^##\s+Findings\b/i.test(l));
+          if (at < 0) return null;
+          const end = ls.findIndex((l, i) => i > at && /^##\s/.test(l));
+          return ls.slice(at + 1, end < 0 ? ls.length : end).map((l) => scrub(l).trim()).filter(Boolean);
+        };
+        console.log('');
+        console.log('── earlier step_0b attempts, newest first ──────────────');
+        for (let n = latest - 1; n >= oldest; n--) {
+          try {
+            const past = (await client.get(orchestratePath([workflowId, 'step', stepKey], { attempt: String(n) }))).data || {};
+            console.log(`── attempt ${n} · ${scrub(past.status || 'unknown')} · verdict not recorded ──`);
+            const f = findingLines(past.output);
+            if (f === null) console.log('  (no Findings section)');
+            else for (const l of f) console.log(`  ${l}`);
+          } catch (e) {
+            const err = e.response?.data?.error ?? e.message;
+            const code = e.response?.status ? ` (HTTP ${e.response.status})` : '';
+            console.log(`── attempt ${n} · could not be fetched${code}: ${scrub(typeof err === 'string' ? err : JSON.stringify(err))}`);
+          }
+        }
+        if (oldest > 1) console.log(`  ${oldest - 1} older attempt(s) not shown — use --attempt <n>`);
+      }
     } catch (e) {
       const msg = e.response?.data?.error || e.message;
       console.error(`hone show step failed: ${msg}`);
@@ -7969,6 +8052,8 @@ program
     // fail-open this gate exists to close.
     let runStoryId = null;
     let runFetchFailed = false;
+    // HC-GF-390-followup-1: undefined = the server sent no `reviewDiff` key; `{stored}` or `{reason}` otherwise.
+    let reviewDiffFetch;
     try {
       const url = orchestratePath([workflowId, 'step', opts.stepKey], { attempt: opts.attempt });
       const r = await client.get(url);
@@ -7992,6 +8077,22 @@ program
         runConfig = runR.data?.config || {};
         runStoryId = runR.data?.storyId || runR.data?.story_id || null;
       } catch (e) { runConfig = {}; runFetchFailed = e && e.message === 'run id mismatch' ? 'mismatch' : true; }
+      // HC-GF-390-followup-1: the base diff the reviewers will be shown for this build. Fetched on its own
+      // connection, for step_4 only; a server that does not know `?reviewDiff=1` omits the key and nothing is sent.
+      // HC-GF-390-followup-2: and only under --report — the check exists to gate what reviewers are shown, and only
+      // a posted check does that. Without it the fetch, the git work and a NEEDS YOU nobody hears about are skipped.
+      if (opts.stepKey === 'step_4' && opts.report) {
+        try {
+          const rdR = await client.get(
+            orchestratePath([workflowId, 'step', 'step_4'], { attempt: verifiedAttempt, reviewDiff: '1' }),
+            require('./lib/fresh-connection').freshConnection());
+          if (rdR.data && Object.prototype.hasOwnProperty.call(rdR.data, 'reviewDiff')) {
+            if (rdR.data.runId && !sameRun(rdR.data.runId)) reviewDiffFetch = { reason: 'fetch_failed' };
+            else if (rdR.data.attempt == null || Number(rdR.data.attempt) !== verifiedAttempt) reviewDiffFetch = { reason: 'attempt_mismatch' };
+            else reviewDiffFetch = { stored: rdR.data.reviewDiff };
+          }
+        } catch { reviewDiffFetch = { reason: 'fetch_failed' }; }
+      }
     } catch (e) {
       const msg = e.response?.data?.error || e.message;
       emit({ ok: false, reason: 'fetch_failed', detail: msg },
@@ -8106,6 +8207,21 @@ program
     let sandboxTeardown = [];
     const ciCfg = require('./lib/pipeline-config').readCIConfigDetails(process.cwd());
     try { headSha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: process.cwd(), env: gitEnv(), encoding: 'utf8' }).trim(); } catch { /* best-effort */ }
+    // HC-GF-390-followup-1: does the stored base diff match THIS repo's HEAD? Reported with the verdict, read only by
+    // the reviewers' context. It never changes this command's verdict or exit code.
+    let reviewDiffCheck;
+    if (reviewDiffFetch) {
+      const { checkReviewDiff, toWireCheck } = require('./lib/review-diff-check');
+      const r = reviewDiffFetch.reason
+        ? { status: 'unverifiable', headSha: null, step: null, reason: reviewDiffFetch.reason, file: null }
+        : checkReviewDiff({ stored: reviewDiffFetch.stored, appliedHead: headSha, repoRoot: process.cwd() });
+      reviewDiffCheck = toWireCheck(r, verifiedAttempt);
+      if (reviewDiffCheck.status === 'mismatch' && opts.format !== 'json') {
+        console.log(`  NEEDS YOU: the base diff stored for the reviewers does not match HEAD ${headSha || 'unknown'} `
+          + `(${reviewDiffCheck.step || 'unknown step'}${reviewDiffCheck.file ? `, ${JSON.stringify(require('./lib/operator-question').scrub(reviewDiffCheck.file))}` : ''}); `
+          + 'the reviewers will not be shown it.');
+      }
+    }
     try {
       execFileSync('git', ['worktree', 'add', '--detach', wt, 'HEAD'],
         { cwd: process.cwd(), env: gitEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
@@ -8325,7 +8441,9 @@ program
 
         emit(
           { ok: v.verdict === 'pass', verdict: v.verdict, command, detail: v.detail,
-            failureCount: v.failure ? v.failure.count : undefined, logPath: logPath || undefined },
+            failureCount: v.failure ? v.failure.count : undefined, logPath: logPath || undefined,
+            // HC-GF-390-followup-2: null, not absent, when no check ran, so the JSON shape does not depend on --report.
+            reviewDiffCheck: reviewDiffCheck ?? null },
           pretty);
         exitCode = v.exitCode;
         reportVerdict = v.verdict; reportDetail = v.detail;
@@ -8412,6 +8530,7 @@ program
           attempt: opts.attempt ? Number(opts.attempt) : verifiedAttempt,
           headSha,
           gates: reportGates.length ? reportGates : undefined,
+          reviewDiffCheck,
         }, require('./lib/fresh-connection').freshConnection());
         if (opts.format !== 'json') {
           // HC-GF-070: name the gate that is actually configured. This said "(advisory)"

package/lib/admin-request.js

@@ -0,0 +1,49 @@
+'use strict';
+/**
+ * admin-request.js — HC-GF-406. Request options for calls that carry the admin key.
+ *
+ * axios follows redirects through follow-redirects, which drops `Authorization`
+ * on a cross-host hop but forwards every custom header. `x-admin-key` is a
+ * custom header, so a host that answers 302/307 to another origin received the
+ * key (measured on b8c8008d, axios 1.20.0: GET and POST, both statuses).
+ *
+ * The admin routes never redirect, so following one is never needed: refuse
+ * every redirect, same-origin included, and tell the operator where it pointed
+ * so they can configure the final host. `server/src/workers/derive-worker.js`
+ * does the same for its authenticated fetch.
+ */
+
+const ADMIN_TIMEOUT_MS = 15000;
+
+function adminRequestOptions(adminKey, userAgent) {
+  return {
+    headers: { 'x-admin-key': adminKey, 'User-Agent': userAgent },
+    timeout: ADMIN_TIMEOUT_MS,
+    maxRedirects: 0, // never forward x-admin-key to wherever a redirect points
+    // Pinned so a 3xx always rejects into the caller's catch, even if axios's default changes.
+    validateStatus: (s) => s >= 200 && s < 300,
+  };
+}
+
+/**
+ * For an axios error caused by a refused redirect, a message naming the status
+ * and the target ORIGIN only (a path or query could carry anything); else null.
+ */
+function describeAdminRedirect(err) {
+  const status = err?.response?.status;
+  if (!(status >= 300 && status < 400)) return null;
+  const location = err.response.headers?.location;
+  let target = 'an unnamed location';
+  if (location) {
+    try {
+      const base = err.config?.url || undefined;
+      target = new URL(location, base).origin;
+    } catch {
+      target = 'an unparseable location';
+    }
+  }
+  return `The server answered ${status}, redirecting to ${target}. The admin key was not sent there. ` +
+    'Point HONE_API (or `api` in ~/.honerc) at the final host and run the command again.';
+}
+
+module.exports = { adminRequestOptions, describeAdminRedirect, ADMIN_TIMEOUT_MS };

package/lib/block-grammar.js

@@ -167,6 +167,39 @@ const EDIT_SPLIT_RE = /^<{3,}[ \t]*OLD[ \t]*\r?\n([\s\S]*?)\r?\n={3,}[ \t]*\r?\n
 /** A `DELETE: <path>` line. */
 const DELETE_RE = /^[ \t]*DELETE:[ \t]*(\S.*?)[ \t]*$/gim;
 
+/**
+ * HC-GF-404: the [from, to) of every `file:` block FILE_BLOCK_RE matches, rejected or duplicate
+ * paths included, in ascending order. A whole file's content is data: a line-start `edit:` opener
+ * or `DELETE:` line inside one is an example the file holds, never a block of its own.
+ */
+function fileBlockSpans(text) {
+  const spans = [];
+  for (const m of String(text == null ? '' : text).matchAll(FILE_BLOCK_RE)) {
+    spans.push({ from: m.index, to: m.index + m[0].length });
+  }
+  return spans;
+}
+
+/**
+ * HC-GF-404: every match of `re` over `text` that does not start inside one of `spans`
+ * (fileBlockSpans() of the same text). A match that starts inside a span is not dropped after the
+ * fact: the scan resumes at that span's end, because a phantom match can run past the span (a nested
+ * edit with a fence wider than the file's) and swallow a real block after it. `re` is cloned, so the
+ * shared /g regexes above are never advanced.
+ */
+function* matchesOutside(re, text, spans) {
+  const r = new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);
+  const s = String(text == null ? '' : text);
+  let i = 0;
+  let m;
+  while ((m = r.exec(s)) !== null) {
+    while (i < spans.length && spans[i].to <= m.index) i++;
+    if (i < spans.length && m.index >= spans[i].from) { r.lastIndex = spans[i].to; continue; }
+    if (m[0].length === 0) r.lastIndex++;
+    yield m;
+  }
+}
+
 module.exports = {
   fenceWidth,
   closesFence,
@@ -178,4 +211,6 @@ module.exports = {
   EDIT_OPEN_RE,
   EDIT_SPLIT_RE,
   DELETE_RE,
+  fileBlockSpans,
+  matchesOutside,
 };

package/lib/bundle-context.js

@@ -35,6 +35,7 @@
  */
 
 const path = require('path');
+const { pathRefusal } = require('./path-refusal');
 
 /**
  * Repo-level files worth bundling regardless of what the story says. Deliberately
@@ -50,18 +51,12 @@ const SIGNAL_FILES = Object.freeze([
 ]);
 
 /**
- * A path that must never reach an agent prompt. Matched on the BASENAME so a nested
- * `config/.env` is caught too. The `.example`/`.sample`/`.template` suffixes are the
- * documented exception and are handled by testing them first.
+ * Is this path a credential file that must never be sent as whole content? `.env.example` is not;
+ * `.env.production` and `keys/deploy.key` are. HC-GF-398: the patterns live in `./path-refusal`
+ * (egress mode); this name stays for the callers that still use it.
  */
-const SECRET_BASENAMES = [/^\.env($|\.)/i, /^secrets?\./i, /\.pem$/i, /\.p12$/i, /(^|[._-])id_(rsa|dsa|ecdsa|ed25519)$/i];
-const SECRET_EXEMPT = /\.(example|sample|template|dist)$/i;
-
-/** Is this path a credential file? `.env.example` is not; `.env.production` is. */
 function isSecretPath(p) {
-  const base = path.posix.basename(String(p || '').replace(/\\/g, '/'));
-  if (SECRET_EXEMPT.test(base)) return false;
-  return SECRET_BASENAMES.some((re) => re.test(base));
+  return pathRefusal(p, { mode: 'egress' }) !== null;
 }
 
 /**
@@ -146,7 +141,7 @@ function nearestPopulatedAncestor(pendingPath, repoFiles) {
 function selectBundle({ named = [], repoFiles = [], exists = () => false, maxSiblings = 6 } = {}) {
   const present = [], pending = [], refused = [];
   for (const p of named) {
-    if (isSecretPath(p)) { refused.push(p); continue; }
+    if (pathRefusal(p, { mode: 'egress' })) { refused.push(p); continue; }
     (exists(p) ? present : pending).push(p);
   }
 
@@ -168,7 +163,7 @@ function selectBundle({ named = [], repoFiles = [], exists = () => false, maxSib
       (path.posix.extname(b) === ext) - (path.posix.extname(a) === ext));
     for (const k of ranked) {
       if (siblings.length >= maxSiblings) break;
-      if (taken.has(k) || isSecretPath(k) || isGeneratedPath(k)) continue;
+      if (taken.has(k) || pathRefusal(k, { mode: 'egress' }) || isGeneratedPath(k)) continue;
       taken.add(k); siblings.push(k);
     }
   }

package/lib/call-sites.js

@@ -17,7 +17,7 @@
  *  - A search that did not run is 'not_searched', never zero callers. `git grep` exits 1 for "no match" and 128
  *    for a fatal error; only the first is an answer. A timeout, a missing git and an output overflow are
  *    classified failures, not empty results.
- *  - A line from a hidden or credential-looking path is never sent (cli/lib/context-reserve.js contentRefusal,
+ *  - A line from a hidden or credential-looking path is never sent (cli/lib/path-refusal.js in content mode,
  *    the rule a re-serve uses); it is counted, so the planner knows callers exist that it cannot see. The check
  *    is made on the disk as it is now: `git grep` follows a DIRECTORY that was replaced by a symlink after the
  *    commit (measured with git 2.50.1: a tracked `d/secret.txt` read from outside the checkout), so a path that
@@ -65,7 +65,8 @@
 const { execFile } = require('node:child_process');
 const path = require('node:path');
 const { gitEnv } = require('./git-env');
-const { contentRefusal, repoRealPath } = require('./context-reserve');
+const { repoRealPath } = require('./context-reserve');
+const { pathRefusal } = require('./path-refusal');
 
 const CALL_SITES_VERSION = 1;
 /** The only scope id today; the server writes its own description of it. */
@@ -387,7 +388,7 @@ function classifyPath(rel, realPath) {
   const ext = path.posix.extname(rel).slice(1).toLowerCase();
   if (PROSE_EXTENSIONS.includes(ext)) return 'prose';
   if (rel.length > MAX_PATH_CHARS || /[\x00-\x1f\x7f]/.test(rel)) return 'withheld';
-  if (contentRefusal(rel)) return 'withheld';
+  if (pathRefusal(rel, { mode: 'content' })) return 'withheld';
   // A directory above the file may have been replaced by a link since the commit; git reads through it.
   let real = null;
   try { real = realPath(rel); } catch { real = null; }