novahiz 0.11.8 → 0.11.9

package/CHANGELOG.md

@@ -5,6 +5,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.11.9] - 2026-10-24
+
+### Fixed
+
+- **Serveurs MCP `dart` et `playwright` déclarés en échec au démarrage** - les
+  deux entrées générées dans `opencode.jsonc` n'avaient aucun `timeout`, donc le
+  harnais appliquait son défaut (~30 s). Le MCP `dart` mesure 4 à 30 s de
+  démarrage à froid (bundle `dart_mcp_server`), et `playwright` passe par `npx`
+  qui peut télécharger le paquet au premier lancement : les deux étaient coupés
+  en pleine connexion et rapportés `mcp connect failed: Request timed out`.
+  `novahiz-docs` reçoit aussi un `timeout` explicite par cohérence.
+- **Pin Playwright désaligné** - `catalog/providers.json` et l'installateur
+  épinglaient `@playwright/mcp@0.0.82` alors que le paquet publié et installé
+  est `0.0.83`. Les deux sources pointent maintenant sur `0.0.83`.
+- **Texte de gate faux sur l'exemption shell read-only** - l'injection annonçait
+  que les commandes shell read-only sont exemptées, sans dire que tout `|`,
+  `;`, `&`, `>`, backtick, retour ligne ou `$(...)` annule l'exemption. Un agent
+  qui enchaînait `Get-ChildItem | Select-Object` se croyait face à un bug alors
+  que la règle est délibérément conservatrice (`src/readonly.ts`). Le texte
+  décrit maintenant la règle réelle : une seule commande, sans métacaractère,
+  sinon on découpe en appels séparés.
+- **`## [Unreleased]` dupliqué dans le CHANGELOG** - un second titre vide
+  subsistait au milieu de l'historique 0.8.x et cassait le repérage de la
+  section courante.
+
 ## [0.11.8] - 2026-10-23
 
 ### Removed
@@ -689,8 +714,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `--sync` forces that behaviour back under npm as an escape hatch.
   Regression tests: `tests/install-defer.test.ts`.
 
-## [Unreleased]
-
 ## [0.8.1] - 2026-10-10
 
 Patch: `novahiz upgrade` always reported "up to date" on the npm channel.

package/README.md

@@ -4,7 +4,7 @@
 
 17 catégories, 94 skills, 13 gate rules, 8 MCP providers — tout déterministe, tout local, tout JSON.
 
-> **Version 0.11.7** — `npm install -g novahiz` pose le CLI, et le premier `novahiz` lancé termine l'installation (core puis extras). `CHANGELOG.md` et `scripts/` sont dans le tarball.
+> **Version 0.11.9** - `npm install -g novahiz` pose le CLI, et le premier `novahiz` lancé termine l'installation (core puis extras). `CHANGELOG.md` et `scripts/` sont dans le tarball.
 
 ```
 ┌──────────────────────────────────────────────────────────────────────────┐

package/adapters/opencode/novahiz-plugin.ts

@@ -1707,7 +1707,7 @@ async function setup(ctx: Context): Promise<Cleanup> {
           await log("warn", "Ledger state is invalid JSON, enforcement injected without the task summary");
         }
       }
-      lines.push("The gate blocks edit/write/patch/apply_patch/bash/shell until the required skills are loaded via skill({id:\"...\"}). Read-only shell commands (status/log/diff/ls/Get-Content/...) are exempt.");
+      lines.push("The gate blocks edit/write/patch/apply_patch/bash/shell until the required skills are loaded via skill({id:\"...\"}). A shell command is exempt only when it is provably read-only: one command (status/log/diff/ls/Get-Content/...) and no pipe, ';', '&', '>', backtick, newline or $(...) - split a chained command into separate calls instead of joining it.");
       lines.push("The gate is content-aware: novahiz-humanizer, ui-slop-remover and ui-craft-rules are required only on frontend design tasks (R13), and impeccable on the same design selectors (R14).");
       lines.push("Config edited = opencode restart required (config read at import).");
       lines.push("Memory lives in project-memory/ under the project root (cwd): index.json + fixed-size slots (8000 chars / 200 lines) with compact → archive → new-slot rotation. Use the MCP memory_* tools: memory_search to find relevant slots first, then memory_get to read, memory_write to append, memory_update to correct, memory_archive to retire.");

package/catalog/providers.json

@@ -3,7 +3,7 @@
     "id": "playwright",
     "label": "Playwright MCP",
     "kind": "mcp",
-    "command": ["npx", "-y", "@playwright/mcp@0.0.82"],
+    "command": ["npx", "-y", "@playwright/mcp@0.0.83"],
     "source": "https://github.com/microsoft/playwright-mcp",
     "license": "Apache-2.0",
     "categories": ["browser", "design-ui"]

package/install/install.mjs

@@ -604,9 +604,9 @@ async function main() {
       const entry = providers.find((provider) => provider.id === "playwright");
       const command = Array.isArray(entry?.command) ? entry.command : [];
       const pin = command.find((token) => typeof token === "string" && token.includes("@playwright/mcp"));
-      return typeof pin === "string" ? pin : "@playwright/mcp@0.0.82";
+      return typeof pin === "string" ? pin : "@playwright/mcp@0.0.83";
     } catch {
-      return "@playwright/mcp@0.0.82";
+      return "@playwright/mcp@0.0.83";
     }
   })();
   const mcpServers = [
@@ -772,6 +772,7 @@ async function main() {
         "novahiz-docs": {
           "type": "local",
           "command": [nodeBin, join(home, "mcp", "novahiz-docs", "index.mjs")],
+          "timeout": 120000,
           "environment": mcpEnv,
           "enabled": true
         },
@@ -794,7 +795,9 @@ async function main() {
         "playwright": {
           "type": "local",
           // See playwrightBrowserFlag() in lib.mjs for the platform rule.
-          "command": ["npx", "-y", "@playwright/mcp@0.0.82", playwrightBrowserFlag()],
+          // timeout 180s : npx telecharge le paquet au premier lancement.
+          "command": ["npx", "-y", "@playwright/mcp@0.0.83", playwrightBrowserFlag()],
+          "timeout": 180000,
           "environment": mcpEnv,
           "enabled": true
         },
@@ -832,6 +835,10 @@ async function main() {
         mcp["dart"] = {
           "type": "local",
           "command": ["dart", "mcp-server"],
+          // Mesure 2026-10-24 : demarrage a froid 4-30 s (bundle
+          // dart_mcp_server 1.2.1) ; sans timeout explicite le harness coupe
+          // vers 30 s et le serveur est declare en echec.
+          "timeout": 180000,
           "environment": mcpEnv,
           "enabled": true
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "novahiz",
-  "version": "0.11.8",
+  "version": "0.11.9",
   "description": "Enforce AI agent skills before every file edit: prompt classifier, skill catalog, and pre-edit gate.",
   "type": "module",
   "license": "Apache-2.0",