@holdyourvoice/hyv 2.8.7 → 2.8.9

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 All notable CLI changes. Also mirrored to [holdyourvoice.com/changelog](https://holdyourvoice.com/changelog) for user-facing releases.
 
+## [2.8.9] — 2026-06-12
+
+### Improved
+- `hyv fix --in-place` matches batch/watch safeguards: interactive `[y/N]` or `--yes` + `.bak` backup
+- `hyv watch --command fix` ignores self-triggered saves after writing fixes
+- `hyv doctor` checks auth.json permissions, stale `hyv.md` vs `hyv.mdc`, and MCP stdio health
+- Shared `resolveCliEntry()` for MCP setup and stdio probes
+- Auth refresh + destructive-write unit tests
+
+### Changed
+- `dist/` built at publish/prepare — no longer committed to git
+
+## [2.8.8] — 2026-06-12
+
+### Security
+- OAuth browser flow verifies server `state` on callback (CSRF protection)
+- Automatic token refresh via `getValidToken()` before API calls
+- `HYV_API_URL` host allowlist; `assertSafeOpenUrl` for checkout/OAuth redirects
+- Profile name path traversal blocked; MCP file reads symlink-safe with `isError` responses
+- Sensitive `~/.hyv` files and dirs use `0o600`/`0o700` permissions
+
+### Fixed
+- `hyv doctor --fix-agents` uses correct postinstall-lib path
+- `hyv import` registered; `--fail-on-hit` exits code 2 (scan + batch)
+- Queue sync sends `original_text` / `accepted_text` for learning reinforce
+- Postinstall: Claude Desktop MCP merge with backup, Cursor `alwaysApply` rule, absolute MCP command path
+
+### Improved
+- `hyv mcp --test` spawns stdio subprocess and validates JSON-RPC `tools/list`
+- `hyv batch --fix --in-place` and `hyv watch --command fix` require `--yes` (`.bak` backups)
+- Stale duplicate agent/skill markdown removed from `assets/` (canonical copies in `agents/` + `skills/`)
+
 ## [2.8.6] — 2026-06-12
 
 ### Changed

package/README.md

@@ -17,7 +17,7 @@ npx @holdyourvoice/hyv scan draft.md
 npm i -g @holdyourvoice/hyv
 ```
 
-postinstall auto-configures MCP for claude desktop, cursor, windsurf, and claude code when those apps are present.
+postinstall copies agent rules and configures MCP for claude desktop and cursor (plus claude code, windsurf, codex, command code skills when detected). set `HYV_AUTO_CONFIGURE_AGENTS=0` to skip.
 
 ## free vs paid
 
@@ -73,7 +73,7 @@ hyv mcp --test     # health check (tools, demo pipeline, profile)
 hyv mcp            # start server (stdio)
 ```
 
-postinstall copies agent rules to `~/.cursor/rules/hyv.md`, `~/.claude/commands/hyv.md`, etc. re-run anytime:
+postinstall copies agent rules to `~/.cursor/rules/hyv.mdc`, `~/.claude/commands/hyv.md`, etc. re-run anytime:
 
 ```bash
 hyv doctor --fix-agents
@@ -112,6 +112,27 @@ github actions:
 - run: npx @holdyourvoice/hyv@latest scan content/ --fail-on-hit
 ```
 
+`--fail-on-hit` exits with code **2** when issues are found (exit 0 = clean). use in CI to block merges on AI-slop.
+
+### destructive in-place writes
+
+`fix`, `batch`, and `watch` can rewrite files on disk. they create a `.bak` backup sibling before writing.
+
+| command | safeguard |
+|---------|-----------|
+| `hyv fix <file> --in-place` | prompts `[y/N]` locally; use `--yes` in CI |
+| `hyv batch <glob> --fix --in-place` | same — one prompt for the whole batch |
+| `hyv watch <file> --command fix` | same — confirms once at startup |
+
+```bash
+# interactive (local)
+hyv fix draft.md --in-place
+
+# non-interactive (CI/scripts)
+hyv fix draft.md --in-place --yes
+hyv batch "posts/**/*.md" --fix --in-place --yes
+```
+
 ## commands
 
 | command | description |
@@ -119,7 +140,9 @@ github actions:
 | `hyv` | condensed welcome (no args) |
 | `hyv welcome` / `hyv free` | free demo + capability tour |
 | `hyv scan <file>` | scan text for AI patterns |
-| `hyv fix <file>` | auto-swap fixable patterns |
+| `hyv fix <file>` | auto-swap fixable patterns (`--in-place --yes` for CI) |
+| `hyv batch <glob>` | scan/fix many files (`--fail-on-hit` exits 2) |
+| `hyv watch <file>` | re-scan on save (`--command fix --yes` to auto-fix) |
 | `hyv check <text>` | quick pass/fail check |
 | `hyv init` | authenticate with hold your voice |
 | `hyv new <name>` | create a voice profile |

package/agents/cursor.md

@@ -1,6 +1,6 @@
 # Hold Your Voice
 
-The user has a voice profile. Use HYV MCP tools for all writing tasks.
+Use HYV MCP tools for all writing tasks. If no profile exists yet, call `hyv_welcome` or `hyv_profiles` first — free local scan works without a profile.
 
 ## When to use
 - Any email, post, doc, or content creation