@hone-ai/cli 1.9.0 → 1.11.0

package/hone-cli.js

@@ -25,6 +25,8 @@ const crypto       = require('crypto');
 const { execSync } = require('child_process');
 
 const pkg     = require('./package.json');
+const { parseReviewJSON } = require('./lib/parse-review-json');
+const { resolveBaseRef, getMaxDiffChars } = require('./lib/release-review-config');
 const program = new Command();
 
 // ── Config resolution ─────────────────────────────────────────────────────────
@@ -385,7 +387,12 @@ program
       process.exit(1);
     }
 
-    // ── Phase 1b: Install Claude Code files (CLAUDE.md + .claude/agents/) ────
+    // ── Phase 1b: Install CLAUDE.md ──────────────────────────────────────────
+    // HC-019y: removed the install-time .github/agents/ -> .claude/agents/
+    // mirror. The bash setup script now writes agents directly to
+    // .claude/agents/ (the path Claude Code actually reads). Pre-fix the
+    // mirror ran only at install time, so post-install edits to
+    // .github/agents/ were silently dropped (OptionsFlow E34-A: 6+ PRs).
     const repoRoot = process.cwd();
     const claudeMdSrc = path.join(tmpDir, 'CLAUDE.md');
     const claudeMdDst = path.join(repoRoot, 'CLAUDE.md');
@@ -400,20 +407,6 @@ program
       }
     }
 
-    // Create .claude/agents/ with symlinks or copies of .github/agents/
-    const ghAgentsDir = path.join(repoRoot, '.github', 'agents');
-    const claudeAgentsDir = path.join(repoRoot, '.claude', 'agents');
-    if (fs.existsSync(ghAgentsDir)) {
-      fs.mkdirSync(claudeAgentsDir, { recursive: true });
-      const agentFiles = fs.readdirSync(ghAgentsDir).filter(f => f.endsWith('.agent.md'));
-      for (const file of agentFiles) {
-        const src = path.join(ghAgentsDir, file);
-        const dst = path.join(claudeAgentsDir, file);
-        fs.copyFileSync(src, dst);
-      }
-      console.log(`  ✓ .claude/agents/ created (${agentFiles.length} agents mirrored from .github/agents/)`);
-    }
-
     // ── Phase 1c: Platform grounding (HC-013b-setup) ──────────────────────
     //    Runs AFTER bash script writes .pipeline-config.yml.
     //    Discovers metadata types, detects MCP, selects doc registry URLs,
@@ -1503,7 +1496,12 @@ program
       }
     }
 
-    // ── 2. Sync agent prompts into .github/agents/*.agent.md ───────────────
+    // ── 2. Sync agent prompts into .claude/agents/*.agent.md ───────────────
+    // HC-019y: writes directly to .claude/agents/ (the path Claude Code
+    // actually reads). Pre-fix `hone sync` wrote to .github/agents/ and
+    // mirrored to .claude/agents/, but the dual-directory layout caused
+    // OptionsFlow E34-A's silent-drop trap when adopters edited the wrong
+    // path. Mirror eliminated; .github/agents/ is now legacy.
     if (!opts.skillsOnly) {
       const agents = [
         'story-groomer',
@@ -1518,9 +1516,16 @@ program
       ];
 
       console.log('\nSyncing agent prompts...');
-      const agentsDir = path.join(process.cwd(), '.github', 'agents');
+      const agentsDir = path.join(process.cwd(), '.claude', 'agents');
       fs.mkdirSync(agentsDir, { recursive: true });
 
+      // Legacy-path migration warning (one-time, non-destructive).
+      const legacyGhAgents = path.join(process.cwd(), '.github', 'agents');
+      if (fs.existsSync(legacyGhAgents)) {
+        console.log('  ⚠ Legacy .github/agents/ detected — Claude Code reads .claude/agents/');
+        console.log('    Migrate any REPO-SPECIFIC edits then `rm -rf .github/agents/`');
+      }
+
       let synced = 0;
       for (const agent of agents) {
         try {
@@ -1529,7 +1534,7 @@ program
             headers: { Accept: 'text/markdown' },
           });
           const dest = path.join(agentsDir, `${agent}.agent.md`);
-          const rel = `agents/${agent}.agent.md`;
+          const rel = `.claude/agents/${agent}.agent.md`;
           const result = safeWrite(dest, rel, r.data);
           if (result !== 'skipped') {
             console.log(`  ✓ ${rel}`);
@@ -1537,28 +1542,13 @@ program
           }
         } catch (e) {
           if (e.response?.status === 404) {
-            console.log(`  ⚠ agents/${agent}.agent.md — prompt not seeded yet (run seed-agent-prompts.js)`);
+            console.log(`  ⚠ .claude/agents/${agent}.agent.md — prompt not seeded yet (run seed-agent-prompts.js)`);
           } else {
-            console.log(`  ⚠ agents/${agent}.agent.md — ${e.message}`);
+            console.log(`  ⚠ .claude/agents/${agent}.agent.md — ${e.message}`);
           }
         }
       }
       if (synced > 0) console.log(`\nSynced ${synced} agent prompts.`);
-
-      // Mirror to .claude/agents/ for Claude Code. This mirror is a derived
-      // copy of .github/agents/, so it's safe to overwrite — local edits
-      // belong in the source-of-truth dir. We still respect skipped files:
-      // if the source was skipped, don't overwrite the mirror either.
-      const claudeAgentsDir = path.join(process.cwd(), '.claude', 'agents');
-      const ghAgentsDir = path.join(process.cwd(), '.github', 'agents');
-      if (fs.existsSync(ghAgentsDir)) {
-        fs.mkdirSync(claudeAgentsDir, { recursive: true });
-        const files = fs.readdirSync(ghAgentsDir).filter(f => f.endsWith('.agent.md'));
-        for (const f of files) {
-          fs.copyFileSync(path.join(ghAgentsDir, f), path.join(claudeAgentsDir, f));
-        }
-        console.log(`  ✓ .claude/agents/ mirrored (${files.length} agents)`);
-      }
     }
 
     // ── 3. Sync copilot-instructions.md from server ──────────────────────
@@ -2027,7 +2017,7 @@ program
     console.log('╚══════════════════════════════════════════════╝');
     console.log('');
     console.log('  Your repo now has:');
-    console.log('    • 9 agents (.github/agents/ + .claude/agents/)');
+    console.log('    • 9 agents (.claude/agents/)');
     console.log('    • 11 enterprise skills + domain skills');
     console.log('    • CI workflow (ai-review.yml)');
     console.log('    • CLAUDE.md + copilot-instructions.md');
@@ -4156,8 +4146,8 @@ program
     const fs = require('fs');
     const yaml = require('js-yaml');
 
-    // Load agent prompts from seed-agent-prompts.js
-    const seedPath = path.resolve(__dirname, '..', 'scripts', 'seed-agent-prompts.js');
+    // Load agent prompts from seed-agent-prompts.js (HC-019n-hotfix: moved into /server/)
+    const seedPath = path.resolve(__dirname, '..', 'server', 'scripts', 'seed-agent-prompts.js');
     const { AGENT_PROMPTS } = require(seedPath);
     const evalDir = opts.evalsDir || path.resolve(__dirname, '..', 'evals');
 
@@ -4513,7 +4503,379 @@ process.on('SIGINT', () => {
   process.exit(0);
 });
 
+// ── HC-053: Batch story queue (Epic 6 — Autonomous Mode) ─────────────────────
+//
+// Fire-and-forget submission of N stories. Each story runs as an autonomous
+// workflow in 'batch' mode (auto-approves early gates per workflow-dag).
+// One failure does NOT halt siblings.
+//
+//   hone queue-stories --file stories.txt
+//   hone queue-stories --status <batchId>
+//   hone queue-stories --list
+program
+  .command('queue-stories')
+  .description('Queue a batch of stories for autonomous (overnight) execution')
+  .option('--file <path>', 'Text file with one story ID per line (cap: 50 lines, 16KB)')
+  .option('--repo <name>', 'Repository name applied to every story (default: directory name)')
+  .option('--branch <name>', 'Git branch applied to every story (default: current branch)')
+  .option('--status <batchId>', 'Show status of a previously submitted batch')
+  .option('--report <batchId>', 'Fetch the morning report for a batch (markdown by default)')
+  .option('--save <path>', 'When used with --report, save markdown to a file instead of stdout')
+  .option('--list', 'List recent batches for this org')
+  .option('--limit <n>', 'Number of batches to list (default 20, max 100)', '20')
+  .option('--format <fmt>', 'Output format: pretty or json (with --report, also: md)', 'pretty')
+  // HC-054: Night Shift mode. Conditional auto-approve at step_4/step_5
+  // when the agent output passes isCleanOutput's positive allowlist +
+  // inverse blocklist. Extended LLM timeout (480s), orchestrator watchdog
+  // (900s/step), default token budget of 400K × story_count when none
+  // explicitly set. Cap of 25 stories per overnight batch.
+  .option('--overnight', 'Enable Night Shift mode (conditional auto-approve, longer timeouts, max 25 stories)', false)
+  .action(async (opts) => {
+    const config = getConfig();
+    const client = api(config);
+
+    // Enforce mutually-exclusive modes — combining e.g. --list with --report
+    // would silently drop one. Explicit error is friendlier than 'silently
+    // did nothing' or 'silently did the wrong thing'.
+    const modes = [];
+    if (opts.list)   modes.push('--list');
+    if (opts.status) modes.push('--status');
+    if (opts.report) modes.push('--report');
+    if (opts.file)   modes.push('--file');
+    if (modes.length > 1) {
+      console.error(`These flags are mutually exclusive: ${modes.join(', ')}`);
+      console.error('Specify only one of --file, --status, --report, --list.');
+      process.exit(1);
+    }
+
+    // ── --list ────────────────────────────────────────────────
+    if (opts.list) {
+      try {
+        const { data } = await client.get(`/orchestrate/batch`, { params: { limit: opts.limit } });
+        if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+        if (!data.batches || data.batches.length === 0) {
+          console.log('No batches found.');
+          return;
+        }
+        console.log('');
+        console.log('Recent batches:');
+        for (const b of data.batches) {
+          console.log(`  ${b.batchId}  status=${b.status}  stories=${b.storyCount}  created=${b.createdAt}`);
+        }
+        console.log('');
+      } catch (e) {
+        console.error(`Failed: ${e.response?.data?.error || e.message}`);
+        process.exit(1);
+      }
+      return;
+    }
+
+    // ── --report <batchId> (HC-055) ──────────────────────────
+    if (opts.report) {
+      try {
+        const format = opts.format === 'json' ? 'json' : 'md';
+        const { data, headers } = await client.get(
+          `/orchestrate/batch/${opts.report}/report`,
+          { params: { format }, responseType: 'text', transformResponse: [(d) => d] }
+        );
+        if (format === 'json') {
+          // JSON path — parse and pretty-print, or save raw.
+          if (opts.save) {
+            fs.writeFileSync(opts.save, data, 'utf8');
+            console.log(`Saved JSON report to ${opts.save}`);
+          } else {
+            try { console.log(JSON.stringify(JSON.parse(data), null, 2)); }
+            catch { console.log(data); }
+          }
+        } else {
+          // Markdown path.
+          if (opts.save) {
+            fs.writeFileSync(opts.save, data, 'utf8');
+            const cached = headers['x-report-cached'] === 'true' ? ' (cached)' : '';
+            console.log(`Saved markdown report${cached} to ${opts.save}`);
+          } else {
+            // Guard: axios with responseType:'text' is expected to return a
+            // string, but a server regression or unusual proxy could send
+            // an empty/undefined body. Don't crash trying to print it.
+            const text = typeof data === 'string' ? data : (data == null ? '' : String(data));
+            process.stdout.write(text);
+            if (!text.endsWith('\n')) process.stdout.write('\n');
+          }
+        }
+      } catch (e) {
+        if (e.response?.status === 404) {
+          console.error('Batch not found.');
+        } else {
+          // responseType:'text' keeps the body as a raw string even for JSON
+          // error responses, so e.response.data is the unparsed `{"error":...}`
+          // and `.error` would be undefined. Parse string bodies before reading.
+          let serverError;
+          const rawData = e.response?.data;
+          if (typeof rawData === 'string') {
+            try { serverError = JSON.parse(rawData)?.error; } catch { /* not JSON */ }
+          } else {
+            serverError = rawData?.error;
+          }
+          console.error(`Failed: ${serverError || e.message}`);
+        }
+        process.exit(1);
+      }
+      return;
+    }
+
+    // ── --status <batchId> ────────────────────────────────────
+    if (opts.status) {
+      try {
+        const { data } = await client.get(`/orchestrate/batch/${opts.status}`);
+        if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+        console.log('');
+        console.log(`Batch:    ${data.batchId}`);
+        console.log(`Status:   ${data.status}`);
+        console.log(`Stories:  ${data.storyCount}`);
+        console.log(`Tokens:   ${(data.totalTokens || 0).toLocaleString()}`);
+        const c = data.counts || {};
+        console.log(`Counts:   completed=${c.completed||0}  running=${c.running||0}  paused=${c.paused||0}  queued=${c.queued||0}  failed=${c.failed||0}  killed=${c.killed||0}  stalled=${c.stalled||0}`);
+        console.log('');
+        console.log('Runs:');
+        for (const r of (data.runs || [])) {
+          const icon = r.status === 'completed' ? '✓'
+                     : r.status === 'running'   ? '⏳'
+                     : r.status === 'paused'    ? '⏸'
+                     : r.status === 'failed'    ? '✗'
+                     : r.status === 'killed'    ? '☠'
+                     : r.status === 'stalled'   ? '⚠'
+                     : '⬜';
+          const step = r.currentStep ? `  @${r.currentStep}` : '';
+          const err = r.errorMessage ? `  err=${r.errorMessage}` : '';
+          console.log(`  ${icon} ${r.storyId}  (${r.repoName})  ${r.status}${step}${err}`);
+        }
+        console.log('');
+      } catch (e) {
+        if (e.response?.status === 404) console.error('Batch not found.');
+        else console.error(`Failed: ${e.response?.data?.error || e.message}`);
+        process.exit(1);
+      }
+      return;
+    }
+
+    // ── Submit a new batch from --file ─────────────────────────
+    if (!opts.file) {
+      console.error('Specify --file <path>, --status <batchId>, --report <batchId>, or --list.');
+      console.error('Example: hone queue-stories --file stories.txt');
+      process.exit(1);
+    }
+
+    let storyIds;
+    try {
+      const stat = fs.statSync(opts.file);
+      if (stat.size > 16 * 1024) {
+        console.error(`File too large: ${stat.size} bytes (max 16KB).`);
+        process.exit(1);
+      }
+      // Strip UTF-8 BOM (U+FEFF) that Windows editors prepend; trim()
+      // does not remove it, so without this the first storyId becomes
+      // an invisible-prefixed string that fails downstream lookups.
+      const raw = fs.readFileSync(opts.file, 'utf8').replace(/^\uFEFF/, '');
+      // HC-059: each non-comment line is `STORY-ID` OR
+      // `STORY-ID depends:DEP1,DEP2`. Whitespace tolerant. Empty lines and
+      // lines starting with # are ignored.
+      storyIds = raw.split(/\r?\n/)
+        .map(l => l.trim())
+        .filter(l => l && !l.startsWith('#'));
+    } catch (e) {
+      console.error(`Cannot read --file: ${e.message}`);
+      process.exit(1);
+    }
+    if (storyIds.length === 0) {
+      console.error('No story IDs found in file.');
+      process.exit(1);
+    }
+    if (storyIds.length > 50) {
+      console.error(`Too many stories: ${storyIds.length} (max 50 per batch).`);
+      process.exit(1);
+    }
+
+    const repoName = opts.repo || path.basename(process.cwd());
+    let branch = opts.branch;
+    if (!branch) {
+      try { branch = execSync('git symbolic-ref --short HEAD', { encoding: 'utf8' }).trim(); }
+      catch { branch = null; }
+    }
+
+    // HC-059: parse `STORY-A depends:STORY-B,STORY-C` per-line syntax. The
+    // `depends:` token is case-sensitive and must come AFTER the storyId.
+    // Multiple deps separated by commas, whitespace tolerant. Lines without
+    // `depends:` yield no `dependsOn` (server validates absence vs empty).
+    const stories = storyIds.map(line => {
+      const depsMatch = line.match(/^(\S+)\s+depends:(\S+)\s*$/);
+      if (depsMatch) {
+        const [, id, depsCsv] = depsMatch;
+        const dependsOn = depsCsv.split(',').map(s => s.trim()).filter(Boolean);
+        return { storyId: id, repoName, branch, dependsOn };
+      }
+      // Reject ambiguous lines (storyId followed by garbage) \u2014 better than
+      // silently treating `STORY-A something` as just `STORY-A`.
+      if (/\s/.test(line)) {
+        console.error(`Malformed line in --file: "${line}"`);
+        console.error(`  Expected: "STORY-ID"  OR  "STORY-ID depends:STORY-B,STORY-C"`);
+        process.exit(1);
+      }
+      return { storyId: line, repoName, branch };
+    });
+
+    // HC-054: Night Shift opt-in. config.overnight=true plumbs end-to-end
+    // (server validates the 25-story cap + applies default token budget +
+    // denormalizes flag into each child's workflow_runs.config).
+    const body = { stories };
+    if (opts.overnight) {
+      body.config = { overnight: true };
+    }
+
+    try {
+      const { data } = await client.post('/orchestrate/batch', body);
+
+      if (opts.format === 'json') { console.log(JSON.stringify(data, null, 2)); return; }
+
+      console.log('');
+      console.log(`Batch queued: ${data.batchId}`);
+      console.log(`Stories: ${data.storyCount}  Enqueued: ${data.enqueued}` +
+                  (data.enqueueFailed ? `  Enqueue-failed: ${data.enqueueFailed}` : ''));
+      console.log('');
+      console.log('Stories will run autonomously in batch mode (early gates auto-approve).');
+      console.log('Steps that require human approval (step_4, step_5) will pause those runs.');
+      console.log('');
+      console.log(`Check progress: hone queue-stories --status ${data.batchId}`);
+      console.log(`Per-story:      hone run-story <runId> --status`);
+      console.log('');
+    } catch (e) {
+      if (e.response?.status === 429) {
+        console.error(`Org concurrency limit reached: ${e.response.data.error}`);
+      } else if (e.response?.status === 400) {
+        console.error(`Rejected: ${e.response.data.error}`);
+      } else {
+        console.error(`Failed: ${e.response?.data?.error || e.message}`);
+      }
+      process.exit(1);
+    }
+  });
+
+// ── HC-056: Schedule install (GitHub Actions overnight template) ────────────
+//
+// Installs a parameterized .github/workflows/<name>.yml that runs `hone
+// queue-stories` on a cron schedule. workflow_dispatch trigger gives
+// on-demand execution from the GitHub Actions UI or `gh workflow run`.
+//
+//   hone schedule install
+//   hone schedule install --name overnight --cron "0 18 * * 1-5" --file stories.txt
+//
+// Future server-side cron is filed as HC-075. For now the workflow lives
+// in the adopter's repo, which gives them version control on the schedule
+// + free history in the GitHub Actions UI.
+program
+  .command('schedule')
+  .description('Manage overnight batch schedules (GitHub Actions templates)')
+  .argument('<action>', 'Action to perform: install')
+  .option('--name <name>', 'Schedule name (used as workflow filename)', 'overnight')
+  .option('--cron <cron>', 'Cron expression (UTC). Default: weekdays 6pm', '0 18 * * 1-5')
+  .option('--file <path>', 'Default stories file path (relative to repo root)', 'stories.txt')
+  .option('--out <dir>', 'Output directory for the workflow file', '.github/workflows')
+  .option('--force', 'Overwrite existing workflow file', false)
+  .action(async (action, opts) => {
+    if (action !== 'install') {
+      console.error(`Unknown schedule action: ${action}. Supported: install`);
+      console.error('(Server-side scheduling is filed as HC-075.)');
+      process.exit(1);
+    }
+
+    // Basic cron validation — five whitespace-separated fields.
+    // Catches the most common mistakes (six fields, single token, etc.)
+    // without trying to validate semantics.
+    const fields = String(opts.cron).trim().split(/\s+/);
+    if (fields.length !== 5) {
+      console.error(`Invalid cron expression: "${opts.cron}"`);
+      console.error('Expected 5 fields: minute hour day-of-month month day-of-week.');
+      console.error('GitHub Actions does NOT support aliases like @daily / @hourly — use the 5-field form.');
+      console.error('Test with https://crontab.guru');
+      process.exit(1);
+    }
+
+    // Name → workflow filename. Reject path traversal / slashes.
+    if (!/^[a-z0-9][a-z0-9_-]{0,40}$/i.test(opts.name)) {
+      console.error(`Invalid --name "${opts.name}". Use letters, digits, hyphens, underscores (max 41 chars).`);
+      process.exit(1);
+    }
+
+    const config = getConfig();
+    const client = api(config);
+
+    // 1. Fetch the template from the server.
+    let template;
+    try {
+      const { data } = await client.get('/scripts/overnight-schedule-template', {
+        responseType: 'text', transformResponse: [(d) => d],
+      });
+      template = data;
+    } catch (e) {
+      // responseType:'text' keeps JSON error bodies as raw strings — parse
+      // before reading .error so the user sees the server's actual message
+      // (e.g. "overnight-schedule.yml not bundled") instead of axios's
+      // generic "Request failed with status code 503".
+      let serverError;
+      const rawData = e.response?.data;
+      if (typeof rawData === 'string') {
+        try { serverError = JSON.parse(rawData)?.error; } catch { /* not JSON */ }
+      } else {
+        serverError = rawData?.error;
+      }
+      console.error(`Failed to fetch template: ${e.response?.status || ''} ${serverError || e.message}`);
+      process.exit(1);
+    }
+
+    // 2. Substitute placeholders. Use replace-all so any future template
+    // additions referencing the same placeholder are handled.
+    const populated = template
+      .replace(/\{\{NAME\}\}/g, opts.name)
+      .replace(/\{\{CRON\}\}/g, opts.cron)
+      .replace(/\{\{STORIES_FILE\}\}/g, opts.file);
+
+    // 3. Decide output path. Default writes to `.github/workflows/<name>.yml`.
+    const outDir = path.resolve(process.cwd(), opts.out);
+    const outFile = path.join(outDir, `${opts.name}.yml`);
+
+    if (fs.existsSync(outFile) && !opts.force) {
+      console.error(`File already exists: ${outFile}`);
+      console.error('Use --force to overwrite, or pick a different --name.');
+      process.exit(1);
+    }
+
+    // 4. Ensure output dir exists.
+    fs.mkdirSync(outDir, { recursive: true });
+
+    // 5. Write the file.
+    fs.writeFileSync(outFile, populated, 'utf8');
+
+    console.log('');
+    console.log(`✓ Installed schedule: ${path.relative(process.cwd(), outFile)}`);
+    console.log('');
+    console.log('  Schedule: ' + opts.cron + ' (UTC)');
+    console.log('  Stories:  ' + opts.file);
+    console.log('');
+    console.log('Next steps:');
+    console.log('  1. Ensure repo secret HONE_TOKEN is set');
+    console.log('     (Settings → Secrets and variables → Actions → New repository secret)');
+    console.log('  2. Commit and push the workflow file:');
+    console.log(`     git add ${path.relative(process.cwd(), outFile)} && git commit -m "feat: nightly Hone batch" && git push`);
+    console.log(`  3. Test on-demand: gh workflow run ${opts.name}.yml --field dry_run=true`);
+    console.log(`     Or: GitHub Actions UI → "${opts.name}" → Run workflow`);
+    console.log('');
+    console.log('Test the cron expression at https://crontab.guru');
+    console.log('');
+  });
+
 // ── Release Review (pre-deployment holistic review) ──────────────────────────
+// parseReviewJSON is extracted to cli/lib/parse-review-json.js for unit
+// coverage. See that file's docstring for the three-shape extraction strategy.
+
 program
   .command('release-review')
   .description('Holistic code review of all changed files before deployment (runs Opus)')
@@ -4521,15 +4883,49 @@ program
   .option('--format <fmt>', 'Output format: pretty or json', 'pretty')
   .option('--dry-run', 'Show what would be reviewed without calling the LLM', false)
   .option('--max-files <n>', 'Max source files to include in review', '40')
+  .option('--provider <name>', 'LLM provider: opus | gh-models (HC-080a-spike)', 'opus')
   .action(async (opts) => {
     const { execSync } = require('child_process');
     const fs = require('fs');
     const repoRoot = process.cwd();
 
+    // When emitting JSON to stdout, route banner/status output to stderr so
+    // `tee file.json` in CI captures pure JSON. Otherwise the artifact ends
+    // up with `Hone AI — Production Review\n=====\n...` mixed in front of
+    // the JSON envelope, breaking JSON.parse. (HC-080a-spike PR #313 data
+    // point 1 found this — both lanes' artifacts were unparseable.)
+    //
+    // Normalize the format value defensively — `--format JSON` or
+    // `--format=json ` (trailing space) would otherwise silently fall into
+    // pretty-mode and re-pollute the artifact.
+    const isJsonOut = String(opts.format || '').trim().toLowerCase() === 'json';
+    const banner = (line) => (isJsonOut ? console.error(line) : console.log(line));
+
+    // emitStatusEnvelope is for non-success exit paths in JSON mode (no
+    // changes, auth failure, rate limit, empty response). Ensures the
+    // artifact is ALWAYS valid JSON, never zero-byte. The status field
+    // tells compare-reviews.js to treat this row as a known non-finding
+    // outcome rather than an unparseable file.
+    const emitStatusEnvelope = (status, extra = {}) => {
+      if (!isJsonOut) return;
+      console.log(JSON.stringify({
+        status,
+        base: opts.base,           // raw user input — preserved for audit
+        provider: opts.provider,
+        ...extra,
+      }, null, 2));
+    };
+
+    // Normalize the base ref to avoid the double-`origin/` prefix bug. The
+    // CI step passes `--base origin/main` and the previous code prefixed
+    // again → `origin/origin/main` → git rejected → silent fallback to
+    // `HEAD~10`. Both lanes reviewed the wrong diff in PR #313 first run.
+    const baseRef = resolveBaseRef(opts.base);
+
     // 1. Get changed files
     let changedFiles;
     try {
-      const raw = execSync(`git diff --name-only origin/${opts.base}...HEAD`, { encoding: 'utf8', cwd: repoRoot });
+      const raw = execSync(`git diff --name-only ${baseRef}...HEAD`, { encoding: 'utf8', cwd: repoRoot });
       changedFiles = raw.trim().split('\n').filter(Boolean);
     } catch {
       try {
@@ -4542,7 +4938,8 @@ program
     }
 
     if (changedFiles.length === 0) {
-      console.log('No changed files found. Nothing to review.');
+      banner('No changed files found. Nothing to review.');
+      emitStatusEnvelope('no_changes', { resolvedBase: baseRef });
       process.exit(0);
     }
 
@@ -4556,32 +4953,49 @@ program
     const maxFiles = parseInt(opts.maxFiles, 10) || 40;
     const filesToReview = sourceFiles.slice(0, maxFiles);
 
-    console.log('');
-    console.log('Hone AI — Production Review');
-    console.log('================================');
-    console.log(`Base: ${opts.base}`);
-    console.log(`Changed files: ${changedFiles.length} total, ${sourceFiles.length} source, ${filesToReview.length} to review`);
-    console.log('');
+    banner('');
+    banner('Hone AI — Production Review');
+    banner('================================');
+    banner(`Base: ${baseRef}`);
+    banner(`Changed files: ${changedFiles.length} total, ${sourceFiles.length} source, ${filesToReview.length} to review`);
+    banner('');
 
     if (opts.dryRun) {
-      console.log('Source files that would be reviewed:');
-      for (const f of filesToReview) console.log(`  ${f}`);
-      if (sourceFiles.length > maxFiles) console.log(`  ... and ${sourceFiles.length - maxFiles} more (increase --max-files)`);
+      banner('Source files that would be reviewed:');
+      for (const f of filesToReview) banner(`  ${f}`);
+      if (sourceFiles.length > maxFiles) banner(`  ... and ${sourceFiles.length - maxFiles} more (increase --max-files)`);
       process.exit(0);
     }
 
-    // 3. Check for API key
-    const apiKey = process.env.ANTHROPIC_API_KEY;
-    if (!apiKey) {
-      console.error('ANTHROPIC_API_KEY not set. Required for production review (Opus model).');
-      console.error('Set it: export ANTHROPIC_API_KEY=sk-ant-...');
+    // 3. Provider validation + credential check
+    if (opts.provider !== 'opus' && opts.provider !== 'gh-models') {
+      console.error(`Invalid --provider: ${opts.provider}. Use 'opus' or 'gh-models'.`);
       process.exit(1);
     }
 
+    let apiKey, providerLabel;
+    if (opts.provider === 'gh-models') {
+      apiKey = process.env.GITHUB_TOKEN;
+      providerLabel = 'GitHub Models (openai/gpt-4.1)';
+      if (!apiKey) {
+        console.error('GITHUB_TOKEN not set. Required for --provider gh-models.');
+        console.error('In CI: GITHUB_TOKEN is auto-injected. Locally: export GITHUB_TOKEN=<your PAT>.');
+        process.exit(1);
+      }
+    } else {
+      apiKey = process.env.ANTHROPIC_API_KEY;
+      providerLabel = 'Anthropic Opus (claude-opus-4-20250514)';
+      if (!apiKey) {
+        console.error('ANTHROPIC_API_KEY not set. Required for --provider opus.');
+        console.error('Set it: export ANTHROPIC_API_KEY=sk-ant-...');
+        process.exit(1);
+      }
+    }
+
     // 4. Build the diff content (truncated per-file to stay within context)
     let diffContent;
     try {
-      diffContent = execSync(`git diff origin/${opts.base}...HEAD -- ${filesToReview.map(f => `'${f}'`).join(' ')}`, {
+      diffContent = execSync(`git diff ${baseRef}...HEAD -- ${filesToReview.map(f => `'${f}'`).join(' ')}`, {
         encoding: 'utf8', cwd: repoRoot, maxBuffer: 10 * 1024 * 1024,
       });
     } catch {
@@ -4593,10 +5007,13 @@ program
       }
     }
 
-    // Truncate if over 100k chars (~25k tokens) to stay within budget
-    const MAX_DIFF_CHARS = 100000;
+    // Provider-specific truncation. GH Models GPT-4.1 has an 8K-token
+    // request-body cap via models.github.ai/inference — 100K chars overflows.
+    // See cli/lib/release-review-config.js for the budget math.
+    const MAX_DIFF_CHARS = getMaxDiffChars(opts.provider);
     if (diffContent.length > MAX_DIFF_CHARS) {
-      diffContent = diffContent.slice(0, MAX_DIFF_CHARS) + '\n\n[... diff truncated at 100k chars ...]';
+      diffContent = diffContent.slice(0, MAX_DIFF_CHARS) +
+        `\n\n[... diff truncated at ${MAX_DIFF_CHARS} chars for --provider ${opts.provider} ...]`;
     }
 
     // 5. Build the prompt
@@ -4653,72 +5070,166 @@ program
       'Review ALL files holistically. Return findings as JSON.',
     ].join('\n');
 
-    console.log('Calling Anthropic API (claude-opus-4-20250514)...');
-    console.log('');
+    banner(`Calling ${providerLabel}...`);
+    banner('');
 
-    // 6. Call Anthropic Messages API
+    // 6. Call LLM (provider-branched, HC-080a-spike)
+    // max_tokens is held SYMMETRIC across providers so the HC-080a-spike
+    // comparison measures model capability, not output budget. 4096 is the
+    // safe ceiling for openai/gpt-4.1 via GH Models; Opus supports more but
+    // running it with 4096 keeps the comparison apples-to-apples.
+    const MAX_OUTPUT_TOKENS = 4096;
+    const startedAt = Date.now();
     try {
-      const { data } = await axios.post('https://api.anthropic.com/v1/messages', {
-        model: 'claude-opus-4-20250514',
-        max_tokens: 8192,
-        system: systemPrompt,
-        messages: [{ role: 'user', content: userPrompt }],
-      }, {
-        headers: {
-          'x-api-key': apiKey,
-          'anthropic-version': '2023-06-01',
-          'content-type': 'application/json',
-        },
-        timeout: 120000,
-      });
+      let responseText, inputTokens, outputTokens, modelLabel;
+
+      if (opts.provider === 'gh-models') {
+        // GitHub Models — free LLM inference using GITHUB_TOKEN. Mirrors the
+        // path used by server/scripts/ai-reviewer.js for per-PR review.
+        const { data } = await axios.post(
+          'https://models.github.ai/inference/chat/completions',
+          {
+            model: 'openai/gpt-4.1',
+            messages: [
+              { role: 'system', content: systemPrompt },
+              { role: 'user',   content: userPrompt },
+            ],
+            max_tokens: MAX_OUTPUT_TOKENS,
+          },
+          {
+            headers: {
+              'Authorization': `Bearer ${apiKey}`,
+              'Content-Type': 'application/json',
+            },
+            timeout: 120000,
+          }
+        );
+        responseText = data.choices?.[0]?.message?.content || '';
+        inputTokens  = data.usage?.prompt_tokens || 0;
+        outputTokens = data.usage?.completion_tokens || 0;
+        modelLabel   = 'openai/gpt-4.1';
+      } else {
+        const { data } = await axios.post('https://api.anthropic.com/v1/messages', {
+          model: 'claude-opus-4-20250514',
+          max_tokens: MAX_OUTPUT_TOKENS,
+          system: systemPrompt,
+          messages: [{ role: 'user', content: userPrompt }],
+        }, {
+          headers: {
+            'x-api-key': apiKey,
+            'anthropic-version': '2023-06-01',
+            'content-type': 'application/json',
+          },
+          timeout: 120000,
+        });
+        responseText = data.content?.[0]?.text || '';
+        inputTokens  = data.usage?.input_tokens || 0;
+        outputTokens = data.usage?.output_tokens || 0;
+        modelLabel   = 'claude-opus-4-20250514';
+      }
 
-      const responseText = data.content?.[0]?.text || '';
+      const elapsedMs = Date.now() - startedAt;
+
+      // Empty-response detection: some providers return HTTP 200 with empty
+      // choices/content (content-filter trip, soft quota limit, model alias
+      // typo). Without this guard the CLI would silently exit 0 and the CI
+      // artifact would look like a clean pass — a false-negative on the
+      // entire review.
+      if (!responseText || responseText.trim().length === 0) {
+        console.error(`Empty response from --provider ${opts.provider}. ` +
+                      `Possible causes: content filter, quota exhausted, or model name rejected.`);
+        emitStatusEnvelope('empty_response', {
+          resolvedBase: baseRef,
+          model: modelLabel,
+          inputTokens,
+          outputTokens,
+          elapsedMs: Date.now() - startedAt,
+        });
+        process.exit(1);
+      }
 
-      // 7. Parse and display results
-      if (opts.format === 'json') {
-        // Try to extract JSON from response
-        const jsonMatch = responseText.match(/\{[\s\S]*\}/);
-        if (jsonMatch) {
-          try {
-            const parsed = JSON.parse(jsonMatch[0]);
-            console.log(JSON.stringify({
-              base: opts.base,
-              totalFiles: changedFiles.length,
-              sourceFiles: sourceFiles.length,
-              reviewedFiles: filesToReview.length,
-              model: 'claude-opus-4-20250514',
-              inputTokens: data.usage?.input_tokens || 0,
-              outputTokens: data.usage?.output_tokens || 0,
-              ...parsed,
-            }, null, 2));
-          } catch {
-            console.log(JSON.stringify({ raw: responseText }, null, 2));
-          }
+      // Parse the response once, robustly. Try the full string first (the
+      // happy path when the LLM emits clean JSON), then fall back to greedy
+      // brace extraction. A failed parse leaves parsed = null and downstream
+      // code uses raw.
+      const parsed = parseReviewJSON(responseText);
+
+      // 7. Output envelope + content. Envelope fields are spread LAST so an
+      // LLM cannot rewrite audit fields (provider, model, inputTokens, etc.)
+      // via prompt injection in the diff content.
+      //
+      // base (raw user input) is preserved alongside resolvedBase (the actual
+      // git revision that was diffed) so audit trails are complete and
+      // comparison tooling can distinguish "the operator passed `main`" from
+      // "the operator passed `origin/main`."
+      if (isJsonOut) {
+        const envelope = {
+          status: 'reviewed',
+          base: opts.base,
+          resolvedBase: baseRef,
+          provider: opts.provider,
+          totalFiles: changedFiles.length,
+          sourceFiles: sourceFiles.length,
+          reviewedFiles: filesToReview.length,
+          model: modelLabel,
+          inputTokens,
+          outputTokens,
+          elapsedMs,
+        };
+        if (parsed) {
+          console.log(JSON.stringify({ ...parsed, ...envelope }, null, 2));
         } else {
-          console.log(JSON.stringify({ raw: responseText }, null, 2));
+          console.log(JSON.stringify({ ...envelope, raw: responseText }, null, 2));
         }
       } else {
         console.log(responseText);
       }
 
-      // 8. Exit code based on findings
-      const hasCritical = responseText.includes('"CRITICAL"') || responseText.includes('"critical"');
-      const recommendation = responseText.includes('DO_NOT_DEPLOY');
-      if (hasCritical || recommendation) {
-        console.log('');
-        console.log('CRITICAL issues found. Fix before deploying.');
+      // 8. Exit code — defense in depth:
+      //   (a) structured check against the parsed JSON, then
+      //   (b) loose substring check on the raw response (catches LLMs that
+      //       emit markdown-formatted CRITICAL findings without strict JSON).
+      let hasCritical = false, doNotDeploy = false;
+      if (parsed) {
+        hasCritical = (parsed.summary?.critical || 0) > 0 ||
+                      (Array.isArray(parsed.findings) &&
+                       parsed.findings.some(f => String(f.severity).toUpperCase() === 'CRITICAL'));
+        doNotDeploy = parsed.recommendation === 'DO_NOT_DEPLOY';
+      }
+      if (!hasCritical) {
+        // Loose match — case-insensitive, no quote requirement. False-positive
+        // tolerance is acceptable here because the cost of a false-positive is
+        // "CI shows yellow, human looks at the report"; the cost of a false-
+        // negative is "real CRITICAL bug ships to prod undetected".
+        hasCritical = /\bCRITICAL\b/.test(responseText);
+      }
+      if (!doNotDeploy) {
+        doNotDeploy = /\bDO_NOT_DEPLOY\b/.test(responseText);
+      }
+      if (hasCritical || doNotDeploy) {
+        banner('');
+        banner('CRITICAL issues found. Fix before deploying.');
         process.exit(1);
       }
     } catch (e) {
       const status = e.response?.status;
       const msg = e.response?.data?.error?.message || e.message;
-      if (status === 401) {
-        console.error('Invalid ANTHROPIC_API_KEY. Check your key and try again.');
+      let kind = 'http_error';
+      if (status === 401 || status === 403) {
+        console.error(`Invalid auth for --provider ${opts.provider}. Check credential and try again.`);
+        kind = 'auth_error';
       } else if (status === 429) {
-        console.error('Rate limited by Anthropic API. Try again shortly.');
+        console.error(`Rate limited by ${opts.provider}. Try again shortly.`);
+        kind = 'rate_limited';
       } else {
-        console.error(`Production review failed: ${msg}`);
+        console.error(`Production review failed (${opts.provider}): ${msg}`);
       }
+      emitStatusEnvelope(kind, {
+        resolvedBase: baseRef,
+        httpStatus: status || null,
+        errorMessage: msg,
+        elapsedMs: Date.now() - startedAt,
+      });
       process.exit(1);
     }
   });