@holdyourvoice/hyv 2.9.27 → 3.0.0

package/dist/pipeline.js

@@ -0,0 +1,64 @@
+import { analyzeAiEditor } from './ai-editor.js';
+import { analyzeVoiceDna } from './voice-dna.js';
+import { words } from './text.js';
+export function analyze(text, profile) {
+    const voiceDna = analyzeVoiceDna(text, profile);
+    const aiEditor = analyzeAiEditor(text);
+    return { version: '2', voiceDna, aiEditor, passed: voiceDna.passed && aiEditor.passed };
+}
+function formatFindings(findings) {
+    return findings.map((finding) => `- Sentence ${finding.sentence} [${finding.engine}/${finding.id}]: ${finding.reason} Repair: ${finding.suggestion}`);
+}
+export function rewritePrompt(draft, profile) {
+    const result = analyze(draft, profile);
+    const allFindings = [...result.voiceDna.findings, ...result.aiEditor.findings];
+    const redFindings = allFindings.filter((finding) => finding.severity === 'red');
+    const yellowFindings = allFindings.filter((finding) => finding.severity === 'yellow');
+    const metrics = profile.metrics;
+    return [
+        '# Tier 0 — non-negotiable preservation',
+        'Preserve facts, names, numbers, claims, and every unflagged sentence exactly. Do not add claims, examples, sections, hooks, or CTAs.',
+        '',
+        '# Tier 1 — release blockers',
+        `VoiceDNA: ${result.voiceDna.score}/100 (${result.voiceDna.passed ? 'pass' : 'fail'}).`,
+        `AI Editor: ${result.aiEditor.score}/100 (${result.aiEditor.passed ? 'pass' : 'fail'}).`,
+        ...profile.avoid.map((phrase) => `- Never use: ${phrase}`),
+        ...(redFindings.length ? formatFindings(redFindings) : ['- None.']),
+        '',
+        '# Tier 2 — VoiceDNA fidelity',
+        `- Sentence length: ${metrics.sentenceLength}; sentence variation: ${metrics.sentenceVariation}; sentence structure: ${metrics.sentenceStructure.join(', ') || 'none recorded'}; rhythm: ${metrics.rhythm}.`,
+        `- Paragraph length: ${metrics.paragraphLength}; lexical density: ${metrics.lexicalDensity}; point of view: ${metrics.pointOfView}; punctuation: ${Object.entries(metrics.punctuation).map(([mark, count]) => `${mark} ${count}`).join(', ')}; case style: ${metrics.caseStyle}; question rate: ${metrics.questionRate}.`,
+        `- Openings: ${metrics.openingMoves.join(', ') || 'none recorded'}.`,
+        `- Vocabulary: ${metrics.vocabulary.join(', ') || 'none recorded'}.`,
+        `- Transitions: ${metrics.transitions.join(', ') || 'none recorded'}.`,
+        '',
+        '# Tier 3 — AI Editor improvements',
+        ...(yellowFindings.length ? formatFindings(yellowFindings) : ['- None.']),
+        '',
+        '# Tier 4 — output contract',
+        'Return only replacement sentences keyed by sentence number. Do not rewrite clean sentences. The candidate will be checked again by both engines.',
+        '',
+        '# Draft',
+        draft,
+    ].join('\n');
+}
+function preservationScore(original, candidate) {
+    const baseline = new Set(words(original.toLowerCase()).filter((word) => word.length > 4));
+    const rewritten = new Set(words(candidate.toLowerCase()));
+    return baseline.size ? Math.round([...baseline].filter((word) => rewritten.has(word)).length / baseline.size * 100) : 100;
+}
+export function verify(original, candidate, profile) {
+    const baseline = analyze(original, profile);
+    const checked = analyze(candidate, profile);
+    const known = new Set([...baseline.voiceDna.findings, ...baseline.aiEditor.findings].map((finding) => `${finding.engine}:${finding.id}:${finding.sentence}`));
+    const regressions = [...checked.voiceDna.findings, ...checked.aiEditor.findings].filter((finding) => !known.has(`${finding.engine}:${finding.id}:${finding.sentence}`));
+    const preservation = preservationScore(original, candidate);
+    return {
+        version: '2',
+        original: baseline,
+        candidate: checked,
+        preservationScore: preservation,
+        regressions,
+        passed: checked.passed && !regressions.some((finding) => finding.severity === 'red') && preservation >= 70,
+    };
+}

package/dist/pipeline.test.js

@@ -0,0 +1,36 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { analyze, rewritePrompt, verify } from './pipeline.js';
+import { buildProfile } from './voice-dna.js';
+const profile = buildProfile([
+    'I ship clear ideas. The details stay concrete. I explain the mechanism without fuss.',
+    'I write short sentences. Then I explain the mechanism. My work stays plain and specific.',
+], ['leverage']);
+test('keeps the two engine scores independent', () => {
+    const result = analyze('Firstly, we leverage a holistic strategy.', profile);
+    assert.equal(result.aiEditor.passed, false);
+    assert.equal(typeof result.voiceDna.score, 'number');
+});
+test('builds all thirteen VoiceDNA measurements', () => {
+    assert.deepEqual(Object.keys(profile.metrics), ['sentenceLength', 'sentenceVariation', 'sentenceStructure', 'rhythm', 'paragraphLength', 'openingMoves', 'vocabulary', 'lexicalDensity', 'pointOfView', 'punctuation', 'caseStyle', 'questionRate', 'transitions']);
+});
+test('orders rewrite instructions by importance tier', () => {
+    const prompt = rewritePrompt('Firstly, we leverage a holistic strategy.', profile);
+    assert.ok(prompt.indexOf('# Tier 0') < prompt.indexOf('# Tier 1'));
+    assert.ok(prompt.indexOf('# Tier 1') < prompt.indexOf('# Tier 2'));
+    assert.ok(prompt.indexOf('# Tier 2') < prompt.indexOf('# Tier 3'));
+    assert.ok(prompt.indexOf('# Tier 3') < prompt.indexOf('# Tier 4'));
+});
+test('post gate reports a new AI regression', () => {
+    const result = verify('I ship clear ideas.', 'I ship clear ideas — a game-changer.', profile);
+    assert.equal(result.passed, false);
+    assert.ok(result.regressions.length > 0);
+    assert.equal(result.original.aiEditor.passed, true);
+    assert.equal(result.candidate.aiEditor.passed, false);
+});
+test('puts all thirteen VoiceDNA elements in the rewrite brief', () => {
+    const prompt = rewritePrompt('I ship clear ideas.', profile);
+    for (const element of ['Sentence length', 'sentence variation', 'sentence structure', 'rhythm', 'Paragraph length', 'lexical density', 'point of view', 'punctuation', 'case style', 'question rate', 'Openings', 'Vocabulary', 'Transitions']) {
+        assert.match(prompt, new RegExp(element));
+    }
+});

package/dist/release-audit.test.js

@@ -0,0 +1,29 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { execFileSync, spawnSync } from 'node:child_process';
+import test from 'node:test';
+const audit = new URL('../scripts/release-audit.mjs', import.meta.url).pathname;
+function fixture(files) {
+    const directory = mkdtempSync(join(tmpdir(), 'holdyourvoice-audit-'));
+    execFileSync('git', ['init', '--quiet'], { cwd: directory });
+    for (const [file, text] of Object.entries(files)) {
+        const path = join(directory, file);
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, text);
+    }
+    execFileSync('git', ['add', 'README.md'], { cwd: directory });
+    return directory;
+}
+test('rejects unquoted credentials in an untracked source file', () => {
+    const directory = fixture({ 'README.md': '# public', 'src/unsafe.ts': ['const ', 'API_KEY', '=topsecret;'].join('') });
+    try {
+        const result = spawnSync(process.execPath, [audit], { cwd: directory, encoding: 'utf8' });
+        assert.notEqual(result.status, 0);
+        assert.match(result.stderr, /credential marker: src\/unsafe\.ts/);
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+});

package/dist/text.js

@@ -0,0 +1,42 @@
+export const words = (text) => text.match(/\p{L}[\p{L}\p{M}'’-]*/gu) ?? [];
+export const mean = (values) => values.length ? values.reduce((total, value) => total + value, 0) / values.length : 0;
+export const deviation = (values, average = mean(values)) => values.length ? Math.sqrt(mean(values.map((value) => (value - average) ** 2))) : 0;
+export function sentences(text) {
+    const output = [];
+    const abbreviations = new Set(['dr', 'mr', 'mrs', 'ms', 'prof', 'sr', 'jr', 'vs', 'etc', 'fig', 'no', 'inc', 'ltd', 'co', 'jan', 'feb', 'mar', 'apr', 'jun', 'jul', 'aug', 'sep', 'sept', 'oct', 'nov', 'dec']);
+    let start = 0;
+    const add = (end) => {
+        const raw = text.slice(start, end);
+        const value = raw.trim();
+        if (!words(value).length)
+            return;
+        const offset = start + raw.indexOf(value);
+        output.push({ index: output.length + 1, start: offset, end: offset + value.length, text: value });
+    };
+    for (let index = 0; index < text.length; index += 1) {
+        const character = text[index];
+        if (character === '\n') {
+            add(index);
+            start = index + 1;
+            continue;
+        }
+        if (!'.!?'.includes(character))
+            continue;
+        if (character === '.') {
+            const previous = text[index - 1] ?? '';
+            const next = text[index + 1] ?? '';
+            const previousWord = text.slice(start, index).match(/(\p{L}+)$/u)?.[1]?.toLowerCase();
+            if ((/\d/.test(previous) && /\d/.test(next)) || /\p{L}/u.test(next) || (previousWord && abbreviations.has(previousWord)))
+                continue;
+        }
+        let end = index + 1;
+        while (end < text.length && '.!?'.includes(text[end]))
+            end += 1;
+        add(end);
+        start = end;
+        index = end - 1;
+    }
+    add(text.length);
+    return output;
+}
+export const paragraphs = (text) => text.split(/\n\s*\n/).map((part) => part.trim()).filter(Boolean);

package/dist/text.test.js

@@ -0,0 +1,16 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { sentences, words } from './text.js';
+test('keeps decimals and common abbreviations inside a sentence', () => {
+    assert.deepEqual(sentences('Dr. Shah raised $3.5m. It funded the work.').map((sentence) => sentence.text), ['Dr. Shah raised $3.5m.', 'It funded the work.']);
+});
+test('records exact sentence offsets across newlines', () => {
+    const text = 'First line\nSecond line.';
+    assert.deepEqual(sentences(text), [
+        { index: 1, start: 0, end: 10, text: 'First line' },
+        { index: 2, start: 11, end: 23, text: 'Second line.' },
+    ]);
+});
+test('counts Unicode writing as words', () => {
+    assert.deepEqual(words('café नमस्ते दुनिया'), ['café', 'नमस्ते', 'दुनिया']);
+});

package/dist/voice-dna.js

@@ -0,0 +1,77 @@
+import { deviation, mean, paragraphs, sentences, words } from './text.js';
+const STOP_WORDS = new Set(['the', 'and', 'that', 'with', 'this', 'from', 'your', 'have', 'were', 'they', 'will', 'into', 'about', 'what', 'when', 'where']);
+const TRANSITIONS = ['but', 'because', 'instead', 'then', 'still', 'so', 'yet', 'therefore'];
+function top(items, limit) {
+    const counts = new Map();
+    for (const item of items.filter(Boolean))
+        counts.set(item, (counts.get(item) ?? 0) + 1);
+    return [...counts].sort((left, right) => right[1] - left[1]).slice(0, limit).map(([item]) => item);
+}
+function profileMetrics(text) {
+    const draftSentences = sentences(text);
+    const draftWords = words(text);
+    const lengths = draftSentences.map((sentence) => words(sentence.text).length);
+    const starters = draftSentences.map((sentence) => words(sentence.text)[0]?.toLowerCase() ?? '');
+    const structures = draftSentences.map((sentence) => words(sentence.text).slice(0, 3).map((word) => word.toLowerCase()).join(' '));
+    const lowerWords = draftWords.map((word) => word.toLowerCase());
+    const nonStop = lowerWords.filter((word) => word.length > 3 && !STOP_WORDS.has(word));
+    const first = lowerWords.filter((word) => ['i', 'we', 'my', 'our', 'us'].includes(word)).length;
+    const second = lowerWords.filter((word) => ['you', 'your', 'yours'].includes(word)).length;
+    const third = lowerWords.filter((word) => ['he', 'she', 'they', 'their', 'them'].includes(word)).length;
+    const pov = first > second && first > third ? 'first_person' : second > first && second > third ? 'second_person' : third > first && third > second ? 'third_person' : 'mixed';
+    const paragraphSizes = paragraphs(text).map((paragraph) => sentences(paragraph).length);
+    const punctuation = Object.fromEntries(['!', '?', ';', ':', '—'].map((mark) => [mark, (text.match(new RegExp(mark.replace(/[?*+^$.[\]\\(){}|-]/g, '\\$&'), 'g')) ?? []).length]));
+    const sentenceLength = mean(lengths);
+    const sentenceVariation = deviation(lengths, sentenceLength);
+    const rhythm = lengths.length > 1 ? mean(lengths.slice(1).map((length, index) => Math.abs(length - lengths[index]))) : 0;
+    const uppercaseStarts = draftSentences.filter((sentence) => /^\p{Lu}/u.test(sentence.text)).length;
+    const caseStyle = uppercaseStarts / Math.max(1, draftSentences.length) > 0.8 ? 'standard' : uppercaseStarts === 0 ? 'lowercase' : 'mixed';
+    return {
+        sentenceLength: Number(sentenceLength.toFixed(2)),
+        sentenceVariation: Number(sentenceVariation.toFixed(2)),
+        sentenceStructure: top(structures, 8),
+        rhythm: Number(rhythm.toFixed(2)),
+        paragraphLength: Number(mean(paragraphSizes).toFixed(2)),
+        openingMoves: top(starters, 8),
+        vocabulary: top(nonStop, 20),
+        lexicalDensity: Number((nonStop.length / Math.max(1, lowerWords.length)).toFixed(3)),
+        pointOfView: pov,
+        punctuation,
+        caseStyle,
+        questionRate: Number((draftSentences.filter((sentence) => sentence.text.endsWith('?')).length / Math.max(1, draftSentences.length)).toFixed(3)),
+        transitions: top(lowerWords.filter((word) => TRANSITIONS.includes(word)), 8),
+    };
+}
+export function buildProfile(samples, avoid = []) {
+    if (samples.length < 2)
+        throw new Error('Provide at least two local writing samples.');
+    if (samples.some((sample) => !words(sample).length))
+        throw new Error('Every local writing sample must contain writing.');
+    return { version: '2', sampleCount: samples.length, metrics: profileMetrics(samples.join('\n\n')), avoid };
+}
+function finding(id, severity, sentence, excerpt, reason, suggestion) {
+    return { engine: 'voice_dna', id, severity, sentence, excerpt, reason, suggestion };
+}
+export function analyzeVoiceDna(text, profile) {
+    const metrics = profileMetrics(text);
+    const findings = [];
+    const tolerance = Math.max(8, profile.metrics.sentenceVariation * 2.2);
+    for (const sentence of sentences(text)) {
+        const count = words(sentence.text).length;
+        if (Math.abs(count - profile.metrics.sentenceLength) > tolerance)
+            findings.push(finding('dna.sentence-length', 'yellow', sentence.index, sentence.text, `Sentence length (${count}) is outside the profile band around ${profile.metrics.sentenceLength}.`, 'Restore the writer’s usual sentence length where it improves clarity.'));
+        for (const banned of profile.avoid)
+            if (sentence.text.toLowerCase().includes(banned.toLowerCase()))
+                findings.push(finding('dna.avoid-list', 'red', sentence.index, sentence.text, `Uses profile avoid-list phrase: ${banned}.`, 'Replace it with the writer’s natural language.'));
+    }
+    if (Math.abs(metrics.questionRate - profile.metrics.questionRate) > 0.25)
+        findings.push(finding('dna.question-rate', 'yellow', 1, text.slice(0, 160), 'Question frequency differs materially from the profile.', 'Match the writer’s usual use of questions.'));
+    if (metrics.caseStyle !== profile.metrics.caseStyle)
+        findings.push(finding('dna.case-style', 'yellow', 1, text.slice(0, 160), `Draft uses ${metrics.caseStyle} casing; profile uses ${profile.metrics.caseStyle}.`, 'Use the profile’s normal casing.'));
+    if (metrics.pointOfView !== profile.metrics.pointOfView && profile.metrics.pointOfView !== 'mixed')
+        findings.push(finding('dna.point-of-view', 'yellow', 1, text.slice(0, 160), `Draft point of view is ${metrics.pointOfView}; profile is ${profile.metrics.pointOfView}.`, 'Restore the writer’s normal narrative distance.'));
+    const red = findings.filter((item) => item.severity === 'red').length;
+    const yellow = findings.length - red;
+    const score = Math.max(0, 100 - red * 25 - yellow * 7);
+    return { engine: 'voice_dna', version: '2', score, passed: red === 0, findings };
+}

package/dist/voice-dna.test.js

@@ -0,0 +1,32 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { analyzeVoiceDna, buildProfile } from './voice-dna.js';
+test('requires two local samples before creating a profile', () => {
+    assert.throws(() => buildProfile(['One sample is not enough.']), /at least two local writing samples/);
+});
+test('requires every local sample to contain writing', () => {
+    assert.throws(() => buildProfile(['', '   ']), /must contain writing/);
+});
+test('reports local avoid-list matches as red sentence findings', () => {
+    const profile = buildProfile(['i write plainly. i name the work.', 'i keep the mechanism clear. i avoid filler.'], ['unlock']);
+    const report = analyzeVoiceDna('i unlock the answer. i name the work.', profile);
+    assert.deepEqual(report.findings.filter((finding) => finding.id === 'dna.avoid-list').map((finding) => [finding.severity, finding.sentence]), [['red', 1]]);
+    assert.equal(report.passed, false);
+});
+test('keeps a case-style mismatch as a yellow review cue', () => {
+    const profile = buildProfile(['i write plainly. i name the work.', 'i keep the mechanism clear. i avoid filler.']);
+    const report = analyzeVoiceDna('This sentence starts in standard case.', profile);
+    assert.ok(report.findings.some((finding) => finding.id === 'dna.case-style' && finding.severity === 'yellow'));
+    assert.equal(report.passed, true);
+});
+test('keeps the documented VoiceDNA review checks as yellow findings', () => {
+    const profile = buildProfile([
+        'i write short sentences. i ask no questions. i name the mechanism.',
+        'i keep the language plain. i explain the work. i use first person.',
+    ]);
+    const report = analyzeVoiceDna('You explain a much longer sentence with several extra words so the reader can follow the full mechanism in detail. Do you agree?', profile);
+    for (const id of ['dna.sentence-length', 'dna.question-rate', 'dna.point-of-view']) {
+        assert.ok(report.findings.some((finding) => finding.id === id && finding.severity === 'yellow'), id);
+    }
+    assert.equal(report.passed, true);
+});

package/package.json

@@ -1,77 +1,17 @@
 {
   "name": "@holdyourvoice/hyv",
-  "version": "2.9.27",
-  "description": "Free local AI writing scan for cursor & claude. MCP server, 220+ pattern detection, voice profiles. npx @holdyourvoice/hyv welcome",
-  "main": "dist/index.js",
-  "bin": {
-    "hyv": "dist/index.js",
-    "hyvoice": "dist/index.js"
-  },
-  "scripts": {
-    "build": "esbuild src/index.ts --bundle --platform=node --target=node18 --outfile=dist/index.js --format=cjs --external:canvas --banner:js='#!/usr/bin/env node'",
-    "build:debug": "esbuild src/index.ts --bundle --platform=node --target=node18 --outfile=dist/index.js --format=cjs --sourcemap --banner:js='#!/usr/bin/env node'",
-    "dev": "npm run build && node dist/index.js",
-    "validate:publish": "npm run build && node scripts/validate-publish.js",
-    "prepublishOnly": "npm run validate:publish",
-    "postinstall": "node scripts/postinstall.js",
-    "prepare": "npm run build",
-    "test": "npm run build && vitest run",
-    "test:smoke": "npm run build && bash scripts/smoke-test.sh",
-    "test:watch": "vitest",
-    "release:patch": "npm version patch && npm publish --access public",
-    "release:minor": "npm version minor && npm publish --access public",
-    "release:major": "npm version major && npm publish --access public"
-  },
-  "keywords": [
-    "voice",
-    "writing",
-    "ai",
-    "cli",
-    "brand-voice",
-    "content-gate",
-    "hyv",
-    "cursor",
-    "claude",
-    "mcp",
-    "ai-agent",
-    "ai-writing",
-    "voice-profile"
-  ],
-  "author": "Hold Your Voice",
-  "license": "UNLICENSED",
-  "private": false,
-  "dependencies": {
-    "canvas": "^3.2.3",
-    "chalk": "^4.1.2",
-    "commander": "^12.1.0",
-    "glob": "^13.0.6",
-    "open": "^8.4.2"
-  },
-  "devDependencies": {
-    "@types/node": "^20.19.42",
-    "esbuild": "^0.20.0",
-    "typescript": "^5.3.3",
-    "vitest": "^2.0.0"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "files": [
-    "dist/",
-    "scripts/postinstall.js",
-    "scripts/postinstall-lib.js",
-    "scripts/install.sh",
-    "scripts/install.ps1",
-    "scripts/check-no-duplicates.js",
-    "assets/",
-    "skills/",
-    "agents/",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/shashank-sn/hold-your-voice-app.git"
-  }
+  "version": "3.0.0",
+  "description": "A local-first dual-engine writing gate that protects voice and catches generic AI patterns.",
+  "type": "module",
+  "bin": { "hyv": "dist/cli.js" },
+  "files": ["dist", "Readme.md", "LICENSE"],
+  "scripts": { "build": "tsc -p tsconfig.json", "test": "npm run build && node --test dist/**/*.test.js", "check:release": "node scripts/release-audit.mjs", "prepack": "npm run check:release && npm test" },
+  "engines": { "node": ">=20" },
+  "license": "MIT",
+  "keywords": ["ai-writing", "cli", "editing", "voice", "writing"],
+  "repository": { "type": "git", "url": "git+https://github.com/shashank-sn/holdyourvoice.git" },
+  "bugs": { "url": "https://github.com/shashank-sn/holdyourvoice/issues" },
+  "homepage": "https://github.com/shashank-sn/holdyourvoice#readme",
+  "publishConfig": { "access": "public" },
+  "devDependencies": { "@types/node": "^22.0.0", "typescript": "^5.7.0" }
 }

package/CHANGELOG.md

@@ -1,235 +0,0 @@
-# Changelog — @holdyourvoice/hyv
-
-All notable CLI changes. Also mirrored to [holdyourvoice.com/changelog](https://holdyourvoice.com/changelog) for user-facing releases.
-
-## [2.9.27] — 2026-07-15
-
-### Fixed
-- **MCP scan hang** — `hyv_scan`, `hyv_fix`, `hyv_check`, `hyv_score`, `hyv_diff`, and `hyv_validate` no longer block on account profile sync; they use local `~/.hyv` cache immediately (matching `hyv scan` CLI) and hydrate profiles in the background
-
-## [2.9.26] — 2026-07-09
-
-### Improved
-- **Tier 1 structural detection** — cross-sentence binary reframes (`this is not X. it is Y.`), sermon anaphora, and founder-carousel metaphors now sort first in scan output and rewrite prompts
-- **Rewrite prompts** split tier 1 structural hits vs other patterns so the model fixes architecture before vocabulary slop
-- **18 new structural cousin rules** synced in local scan engine (`scan.ts`, `tier-one.ts`)
-
-## [2.9.25] — 2026-07-04
-
-### Fixed
-- **MCP stdio pollution** — `hyv mcp` no longer prints setup banners to stdout when spawned by Cursor/Claude/ChatGPT (fixes "Unexpected token … is not valid JSON" toast spam on app open)
-- Auto-detects piped stdout (`!isTTY`) or explicit `--stdio` flag; MCP configs now use `mcp --stdio`
-- Interactive terminal runs still show setup on stderr before the JSON-RPC server starts
-
-## [2.9.15] — 2026-06-18
-
-### Added
-- `mcp-profile-hydrate` — syncs voice profile into MCP agent configs after setup
-- `mcp-integrate` — writes MCP server entries for cursor, claude, codex, windsurf, and more
-- Postinstall detects installed agents and suggests `hyv mcp --setup`
-
-### Fixed
-- `hyv mcp --test` validates 13 setup checks including ChatGPT actions
-- Agent docs updated for one-command MCP setup across all supported editors
-
-## [2.9.11] — 2026-06-12
-
-### Fixed
-- Data safety: preserve profiles with voice anchors, learned patterns, or dashboard-edited markdown
-- Welcome sync accepts `force: true` to intentionally overwrite preserved server profiles
-- `hyv sync` keeps newer local profiles (uses `updated_at` metadata); `--force` overwrites
-- JSON profile cache (`.hyv/cache/profiles/*.json`) backs up before overwrite; skips stale server snapshots
-- `~/.hyv/auth.json` backed up to `.hyv.bak` before each write
-- Web login: fixed email `body` ReferenceError in strict mode; Google sign-in warms `/ready` and retries on 503
-- Legacy `dashboard.html` email login fixed (`user` response, OTP `code` field, cold-start retries)
-- Static copy/sitemap: `holdyourvoice.com/dashboard` → `/app`
-
-## [2.9.10] — 2026-06-12
-
-### Fixed
-- **Data safety** — welcome profile sync no longer overwrites enriched dashboard profiles (keywords, signature, rules, flashcard onboarding)
-- Local profile cache backs up to `.hyv.bak` before overwrite; refuses empty content replacing real data
-- `hyv sync` skips empty server profile payloads instead of wiping local cache
-
-## [2.9.9] — 2026-06-12
-
-### Fixed
-- Welcome step 4 failure copy — says `hyv welcome` retry, not `hyv sync` (sync requires paid plan)
-- CLI plan/init/export/api messages point to `/app` and `/app/billing`, not `/dashboard`
-- Rewrite prompts no longer silently pick a cached profile when none is passed (generic rules as intended)
-- Web auth forgot-password and session check retry on cold-start 503s
-- Marketing email links point to `/app` not `/dashboard`
-
-## [2.9.7] — 2026-06-12
-
-### Fixed
-- `hyv sync` — profiles with spaces or missing slugs (e.g. "Say About Us") no longer crash with "Invalid profile name"
-- Welcome step 4 — clearer sync failure messages (HTTP status / server error)
-
-## [2.9.6] — 2026-06-12
-
-### Fixed
-- Welcome profile sync — server accepts `content` markdown from step 4 (upsert, no duplicate-profile 403)
-- Dashboard handoff — opens `/app/billing` with session cookie; falls back to billing URL if handoff fails
-- Edge worker handles `/cli/auth/web-handoff` (no container lag)
-
-### Changed
-- `hyv open dashboard` and paid-feature copy point to `/app` not `/dashboard`
-
-## [2.9.5] — 2026-06-12
-
-### Fixed
-- Post-signup browser opens `/app/billing` (live dashboard) instead of `/dashboard` (404)
-- Worker redirects `/dashboard` → `/app` for old links
-
-## [2.9.4] — 2026-06-12
-
-### Fixed
-- Welcome step 4 — one sign-in only; opens dashboard billing tab (no second Google login on marketing site)
-- `hyv plan --upgrade` opens authenticated dashboard billing instead of public pricing page
-
-### Changed
-- Step 4 copy tightened; spinners while account + profile sync run
-
-## [2.9.3] — 2026-06-12
-
-### Fixed
-- Browser signup OAuth — clearer error when Google denies; server fix for `redirect_uri_mismatch` (requires API deploy)
-
-## [2.9.2] — 2026-06-12
-
-### Changed
-- Welcome step 4 copy — warmer signup pitch, highlights $1 first month and what paid unlocks
-
-## [2.9.1] — 2026-06-12
-
-### Added
-- Welcome step 3 is skippable (Enter or `s`)
-- Multiline draft paste for testing (no more single-line shell chaos)
-- Document extraction for samples and scans: `.md`, `.txt`, `.html`, `.docx`, `.pdf`, `.skill`
-- Recursive folder scan; single files (including `.skill` archives) work in step 2
-- Minimal terminal spinners while reading, saving, and scanning
-
-### Fixed
-- Step 3 crash when scanning pasted text (`Cannot read properties of undefined (reading 'match')`) — profile now loads correctly
-- `ENOTDIR` when pointing at a file instead of a folder
-
-## [2.9.0] — 2026-06-12
-
-### Changed
-- `hyv welcome` — profile-first flow: name → samples (paste/folder/link/chat) → test draft → signup
-- Keeps tagline; drops install/init/mcp step list from welcome
-- MCP `hyv_welcome` supports `step`, `mode=extract_prompt`, and `profile` for agent-led onboarding
-- Postinstall points to `hyv welcome` instead of `hyv init`
-
-## [2.8.10] — 2026-06-12
-
-### Fixed
-- `hyv init` browser login opens Google OAuth again (`assertSafeOAuthUrl` allows `accounts.google.com`)
-
-## [2.8.9] — 2026-06-12
-
-### Improved
-- `hyv fix --in-place` matches batch/watch safeguards: interactive `[y/N]` or `--yes` + `.bak` backup
-- `hyv watch --command fix` ignores self-triggered saves after writing fixes
-- `hyv doctor` checks auth.json permissions, stale `hyv.md` vs `hyv.mdc`, and MCP stdio health
-- Shared `resolveCliEntry()` for MCP setup and stdio probes
-- Auth refresh + destructive-write unit tests
-
-### Changed
-- `dist/` built at publish/prepare — no longer committed to git
-
-## [2.8.8] — 2026-06-12
-
-### Security
-- OAuth browser flow verifies server `state` on callback (CSRF protection)
-- Automatic token refresh via `getValidToken()` before API calls
-- `HYV_API_URL` host allowlist; `assertSafeOpenUrl` for checkout/OAuth redirects
-- Profile name path traversal blocked; MCP file reads symlink-safe with `isError` responses
-- Sensitive `~/.hyv` files and dirs use `0o600`/`0o700` permissions
-
-### Fixed
-- `hyv doctor --fix-agents` uses correct postinstall-lib path
-- `hyv import` registered; `--fail-on-hit` exits code 2 (scan + batch)
-- Queue sync sends `original_text` / `accepted_text` for learning reinforce
-- Postinstall: Claude Desktop MCP merge with backup, Cursor `alwaysApply` rule, absolute MCP command path
-
-### Improved
-- `hyv mcp --test` spawns stdio subprocess and validates JSON-RPC `tools/list`
-- `hyv batch --fix --in-place` and `hyv watch --command fix` require `--yes` (`.bak` backups)
-- Stale duplicate agent/skill markdown removed from `assets/` (canonical copies in `agents/` + `skills/`)
-
-## [2.8.6] — 2026-06-12
-
-### Changed
-- `hyv welcome` — short onboarding: 4 steps, one-line demo, subscribe prompt (full lists moved to `hyv free`)
-- Shorter postinstall message before auto-welcome
-
-## [2.8.5] — 2026-06-12
-
-### Changed
-- `hyv welcome` slimmed down (superseded by 2.8.6 — use `npm i -g @holdyourvoice/hyv@2.8.6`)
-
-## [2.8.4] — 2026-06-12
-
-### Fixed
-- Postinstall only auto-runs welcome when npm shows script output; otherwise first bare `hyv` shows full onboarding (fixes silent global installs)
-
-## [2.8.3] — 2026-06-12
-
-### Fixed
-- `npm i -g` runs `hyv welcome` onboarding automatically on first install (no y/N prompt)
-- First bare `hyv` shows full onboarding when npm hid postinstall output
-- Upgraded `glob` to v13 — removes deprecated glob@11 warning during install
-
-## [2.8.2] — 2026-06-12
-
-### Added
-- Phase 5 marketing: `hyv content` (blog outlines, CI snippets, share templates)
-- `hyv plan --free` — canonical free vs paid matrix in terminal
-- `cli/assets/FREE-PAID.md` — shipped free/paid reference
-- Scan funnel hints + `scan_complete` / `init_success` telemetry events
-- Landing + npm README: npx-first install, free CLI section, SEO keywords
-
-### Improved
-- Postinstall, welcome, plan, and init flows promote npx + free local tier
-- npm package description optimized for cursor/claude/MCP discovery
-
-## [2.8.1] — 2026-06-12
-
-### Fixed
-- `postinstall-lib.js` now included in published tarball — `npm install` no longer fails on postinstall
-
-## [2.8.0] — 2026-06-12
-
-### Added
-- Full Phase 1–4 product plan: free local engine, hybrid analysis, MCP `hyv_analyze` / `hyv_clean`, learning loop UX, packaging hardening
-- `npm run test:smoke` — 28+ CLI regression checks
-- `npm run validate:publish` — prepublish tarball verification
-- Golden prompt tests, postinstall idempotency tests, edge-case suite
-
-### Fixed
-- `hyv check ""` no longer reports false clean — rejects empty input
-- Bundled CLI resolves correct package + rules version from `dist/`
-- Smoke tests avoid SIGPIPE false failures when piping CLI output
-
-## [2.7.1] — 2026-06-12
-
-### Added
-- `hyv upgrade` — check and install latest global CLI
-- `hyv mcp --setup` and `hyv mcp --test` — agent setup + health check
-- MCP tools: `hyv_analyze` (hybrid server+local), `hyv_clean` (scan→fix→validate pipeline)
-- `hyv reinforce --last` — learn from last fix/rewrite session
-- Free-first local engine: scan, fix, check, score, diff work offline without subscription
-- `hyv welcome` / `hyv free` — onboarding with live demo
-- Profile-aware local pipeline: never-list, learned patterns, anchors, cadence
-- Opt-in telemetry: `HYV_TELEMETRY=1`
-
-### Improved
-- Postinstall upgrades agent instructions via `~/.hyv/agents-version.json`
-- `hyv status` shows engine/rules version, drift, evolution summary
-- `hyv doctor` reports full engine label + `--fix-agents`
-- Published package excludes Python dev scripts and `src/`
-
-### Fixed
-- Bundled CLI reads correct `package.json` version from `dist/`