novahiz 0.2.5 → 0.3.2

package/adapters/opencode/novahiz.ts

@@ -8,9 +8,119 @@ import { join, relative, resolve } from "node:path";
 // ~/.config/opencode/plugins/ and cannot resolve ../../src/*.
 type RewriteResult = { original: string; rewritten: string; sourceLanguage: string; wasRewritten: boolean };
 
+function fold(value: string): string {
+  return value.toLowerCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "");
+}
+
+function rx(words: string, flags: string): RegExp {
+  return new RegExp(`(?<![\\p{L}\\p{N}])(?:${words})(?![\\p{L}\\p{N}])`, flags);
+}
+
+function marker(words: string): RegExp {
+  return rx(words, "iu");
+}
+
+function word(words: string): RegExp {
+  return rx(words, "giu");
+}
+
+const DETECT_MIN_SCORE = 3;
+const LANG_ORDER = ["fr", "es", "de", "pt"];
+
+const LANG_PATTERNS: Record<string, Array<[RegExp, number]>> = {
+  fr: [
+    [marker("corriger|corrige"), 3], [marker("ajouter|ajoute|ajoutez"), 3],
+    [marker("supprimer|supprime|supprimez"), 3], [marker("creer|creez|creation"), 3],
+    [marker("developper|developpe"), 3], [marker("implementer|implemente"), 3],
+    [marker("refactoriser|refactorise"), 3], [marker("configurer"), 3],
+    [marker("installer"), 3], [marker("ameliorer|amelioration"), 3],
+    [marker("optimiser"), 3], [marker("verifier|verifie"), 3],
+    [marker("expliquer|explique"), 3], [marker("pourquoi"), 3],
+    [marker("comment faire"), 3],
+    [marker("dans"), 2], [marker("avec"), 2], [marker("pour"), 2], [marker("vous"), 2],
+    [marker("nous"), 2], [marker("votre|notre"), 2], [marker("fonction|fonctions"), 2],
+    [marker("classe|classes"), 2], [marker("fichier|fichiers"), 2],
+    [marker("probleme|problemes"), 2], [marker("erreur|erreurs"), 2],
+    [marker("serveur"), 2], [marker("donnees"), 2], [marker("utilisateur|utilisateurs"), 2],
+    [marker("ecran"), 2], [marker("bouton"), 2], [marker("formulaire"), 2],
+    [marker("securite"), 2], [marker("reseau"), 2], [marker("requete"), 2],
+    [marker("besoin"), 2], [marker("faites|fait"), 2],
+    [marker("le"), 1], [marker("la"), 1], [marker("les"), 1], [marker("des"), 1],
+    [marker("du"), 1], [marker("de"), 1], [marker("un"), 1], [marker("une"), 1],
+    [marker("est"), 1], [marker("ne"), 1], [marker("pas"), 1],
+  ],
+  es: [
+    [marker("hacer"), 3], [marker("crear|cree"), 3], [marker("anadir"), 3],
+    [marker("borrar"), 3], [marker("arreglar"), 3], [marker("corregir"), 3],
+    [marker("explicar"), 3], [marker("necesito"), 3], [marker("quiero"), 3],
+    [marker("tengo"), 3], [marker("base de datos"), 3], [marker("inicio de sesion"), 3],
+    [marker("para"), 2], [marker("con"), 2], [marker("pero"), 2], [marker("muy"), 2],
+    [marker("tambien"), 2], [marker("pagina|paginas"), 2], [marker("servidor"), 2],
+    [marker("usuario|usuarios"), 2], [marker("archivo|archivos"), 2], [marker("codigo"), 2],
+    [marker("pantalla"), 2], [marker("mensaje"), 2], [marker("conexion"), 2],
+    [marker("datos"), 2], [marker("diseno"), 2], [marker("aplicacion"), 2],
+    [marker("de"), 1], [marker("la"), 1], [marker("el"), 1], [marker("los"), 1],
+    [marker("las"), 1], [marker("un"), 1], [marker("una"), 1], [marker("es"), 1],
+    [marker("en"), 1], [marker("por"), 1], [marker("que"), 1], [marker("se"), 1],
+    [marker("al"), 1], [marker("lo"), 1],
+  ],
+  de: [
+    [marker("bitte"), 3], [marker("machen"), 3], [marker("erstellen|erstelle"), 3],
+    [marker("hinzufugen"), 3], [marker("loschen"), 3], [marker("beheben|behebt"), 3],
+    [marker("debuggen"), 3], [marker("testen"), 3], [marker("erklaren|erklare"), 3],
+    [marker("warum"), 3], [marker("nicht"), 3], [marker("muss"), 3], [marker("soll"), 3],
+    [marker("funktion|funktionen"), 2], [marker("klasse"), 2], [marker("datei|dateien"), 2],
+    [marker("fehler"), 2], [marker("seite|seiten"), 2], [marker("datenbank"), 2],
+    [marker("anwendung|anwendungen"), 2], [marker("benutzer"), 2], [marker("anmelden"), 2],
+    [marker("einloggen"), 2], [marker("variablen"), 2], [marker("speichern"), 2],
+    [marker("anzeigen"), 2], [marker("verbessern"), 2], [marker("optimieren"), 2],
+    [marker("implementieren"), 2], [marker("schreiben"), 2], [marker("suchen"), 2],
+    [marker("starten"), 2],
+    [marker("der"), 1], [marker("die"), 1], [marker("das"), 1], [marker("den"), 1],
+    [marker("dem"), 1], [marker("ein"), 1], [marker("eine"), 1], [marker("ist"), 1],
+    [marker("mit"), 1], [marker("fur"), 1], [marker("und"), 1], [marker("auf"), 1],
+    [marker("zu"), 1],
+  ],
+  pt: [
+    [marker("criar|crie"), 3], [marker("fazer"), 3], [marker("adicionar"), 3],
+    [marker("corrigir"), 3], [marker("preciso"), 3], [marker("quero"), 3],
+    [marker("banco de dados"), 3],
+    [marker("pagina|paginas"), 2], [marker("usuario|usuarios"), 2],
+    [marker("arquivo|arquivos"), 2], [marker("codigo"), 2], [marker("mensagem"), 2],
+    [marker("tela"), 2], [marker("configurar"), 2], [marker("instalar"), 2],
+    [marker("melhorar"), 2], [marker("conectar"), 2], [marker("senha"), 2],
+    [marker("rede"), 2], [marker("funcao"), 2], [marker("nao"), 2], [marker("tambem"), 2],
+    [marker("uma"), 1], [marker("um"), 1], [marker("para"), 1], [marker("com"), 1],
+    [marker("que"), 1], [marker("na"), 1], [marker("os"), 1], [marker("as"), 1],
+    [marker("ao"), 1], [marker("mais"), 1],
+  ],
+};
+
 function detectLanguage(prompt: string): string {
   if (/[\u0600-\u06FF]/.test(prompt)) return "ar";
-  return "en";
+  const folded = fold(prompt);
+  let bestLang = "en";
+  let bestScore = 0;
+  let bestStrong = false;
+  for (const lang of LANG_ORDER) {
+    let score = 0;
+    let strong = false;
+    for (const [pattern, weight] of LANG_PATTERNS[lang]) {
+      if (pattern.test(folded)) {
+        score += weight;
+        if (weight >= 3) strong = true;
+      }
+    }
+    if (score < DETECT_MIN_SCORE) continue;
+    const wins =
+      bestScore === 0 ? true : strong !== bestStrong ? strong : score > bestScore;
+    if (wins) {
+      bestLang = lang;
+      bestScore = score;
+      bestStrong = strong;
+    }
+  }
+  return bestLang;
 }
 
 const AR_EN: Array<[RegExp, string]> = [
@@ -33,22 +143,75 @@ const AR_EN: Array<[RegExp, string]> = [
   [/تسجيل الدخول/g, "login"], [/خطأ/g, "bug"], [/اداء/g, "performance"], [/امان/g, "security"],
 ];
 
-function rewritePrompt(prompt: string): RewriteResult {
-  const sourceLanguage = detectLanguage(prompt);
-  if (sourceLanguage === "en") {
-    let r = prompt.trim().replace(/^I\s+want\s+to\s+/i, "").replace(/^I\s+need\s+to\s+/i, "")
-      .replace(/^Can\s+you\s+/i, "").replace(/^Could\s+you\s+/i, "").replace(/^Please\s+/i, "")
-      .replace(/^I\s+would\s+like\s+to\s+/i, "").replace(/^It\s+would\s+be\s+great\s+if\s+you\s+could\s+/i, "")
-      .replace(/[.!?]+$/, "").trim();
-    return { original: prompt, rewritten: r, sourceLanguage, wasRewritten: r !== prompt };
-  }
+const FR_EN: Array<[RegExp, string]> = [
+  [word("base de donnees|base de données"), "database"],
+  [word("page d'accueil|page daccueil|page d accueil"), "homepage"],
+  [word("mot de passe"), "password"],
+  [word("site web"), "website"],
+  [word("mise a jour|mise à jour"), "update"],
+  [word("tableau de bord"), "dashboard"],
+  [word("code source"), "source code"],
+  [word("en temps reel|en temps réel"), "realtime"],
+  [word("formulaire de contact"), "contact form"],
+  [word("point d'entree|point d entree|point d'entrée"), "entry point"],
+  [word("se deconnecter|se déconnecter"), "logout"],
+  [word("se connecter"), "login"],
+  [word("corriger|corrige"), "fix"], [word("ajouter|ajoute|ajoutez"), "add"],
+  [word("supprimer|supprime|supprimez|effacer|enlever"), "remove"],
+  [word("creer|créer|creez|créez"), "create"], [word("developper|développer"), "develop"],
+  [word("implementer|implémenter"), "implement"], [word("refactoriser|refactorer"), "refactor"],
+  [word("configurer"), "configure"], [word("installer"), "install"], [word("migrer"), "migrate"],
+  [word("ameliorer|améliorer"), "improve"], [word("amelioration|amélioration"), "improvement"],
+  [word("optimiser"), "optimize"], [word("verifier|vérifier|verifie"), "verify"],
+  [word("expliquer|explique"), "explain"], [word("afficher|affiche|montrer|montre"), "display"],
+  [word("masquer|cacher"), "hide"], [word("activer"), "enable"],
+  [word("desactiver|désactiver"), "disable"], [word("ecrire|écrire"), "write"],
+  [word("sauvegarder|enregistrer"), "save"], [word("utiliser|utilise"), "use"],
+  [word("remplacer"), "replace"], [word("simplifier"), "simplify"],
+  [word("nettoyer"), "clean up"], [word("tester|teste|testez"), "test"],
+  [word("deboguer|déboguer"), "debug"], [word("compiler"), "compile"],
+  [word("deployer|déployer"), "deploy"], [word("rechercher|chercher"), "search"],
+  [word("telecharger|télécharger"), "download"], [word("envoyer"), "send"],
+  [word("ouvrir"), "open"], [word("fermer"), "close"],
+  [word("fonction|fonctions"), "function"], [word("classe|classes"), "class"],
+  [word("methode|méthode"), "method"], [word("fichier|fichiers"), "file"],
+  [word("probleme|problème|problemes"), "issue"], [word("erreur|erreurs"), "error"],
+  [word("serveur|serveurs"), "server"], [word("donnees|données"), "data"],
+  [word("ecran|écran"), "screen"], [word("bouton|boutons"), "button"],
+  [word("formulaire|formulaires"), "form"], [word("champ|champs"), "field"],
+  [word("lien|liens"), "link"], [word("modele|modèle"), "model"],
+  [word("schema|schéma"), "schema"], [word("reseau|réseau"), "network"],
+  [word("securite|sécurité"), "security"], [word("utilisateur|utilisateurs"), "user"],
+  [word("requete|requête"), "request"], [word("reponse|réponse"), "response"],
+  [word("performances"), "performance"], [word("tableau"), "table"],
+  [word("liste"), "list"], [word("boucle"), "loop"], [word("authentification"), "auth"],
+  [word("inscription"), "register"], [word("connexion"), "login"],
+  [word("dans"), "in"], [word("avec"), "with"], [word("pour"), "for"], [word("sur"), "on"],
+  [word("sans"), "without"], [word("aussi"), "also"], [word("mais"), "but"],
+  [word("pas"), "not"], [word("plus"), "more"], [word("tres|très"), "very"],
+  [word("comment"), "how to"], [word("pourquoi"), "why"], [word("besoin"), "need"],
+];
+
+function translateTerms(prompt: string, lang: string): string {
+  const map = lang === "ar" ? AR_EN : lang === "fr" ? FR_EN : null;
+  if (!map) return prompt;
   let result = prompt;
-  for (const [pattern, replacement] of AR_EN) result = result.replace(pattern, replacement);
-  let r = result.trim().replace(/^I\s+want\s+to\s+/i, "").replace(/^I\s+need\s+to\s+/i, "")
+  for (const [pattern, replacement] of map) result = result.replace(pattern, replacement);
+  return result;
+}
+
+function optimizeEnglish(prompt: string): string {
+  return prompt.trim()
+    .replace(/^I\s+want\s+to\s+/i, "").replace(/^I\s+need\s+to\s+/i, "")
     .replace(/^Can\s+you\s+/i, "").replace(/^Could\s+you\s+/i, "").replace(/^Please\s+/i, "")
     .replace(/^I\s+would\s+like\s+to\s+/i, "").replace(/^It\s+would\s+be\s+great\s+if\s+you\s+could\s+/i, "")
     .replace(/[.!?]+$/, "").trim();
-  return { original: prompt, rewritten: r, sourceLanguage, wasRewritten: true };
+}
+
+function rewritePrompt(prompt: string): RewriteResult {
+  const sourceLanguage = detectLanguage(prompt);
+  const rewritten = optimizeEnglish(translateTerms(prompt, sourceLanguage));
+  return { original: prompt, rewritten, sourceLanguage, wasRewritten: rewritten !== prompt };
 }
 
 // Inlined from src/autodocs.ts — same reason as prompt-rewriter: relative
@@ -229,12 +392,18 @@ const GATE = CONFIG.gate ?? {};
 // redirect the kill-switch to an unrelated variable (e.g. CI=false).
 // Single escape hatch name after brand rename.
 const ESCAPE = (process.env.NOVAHIZ_GATE ?? "").toLowerCase();
-// gate.enabled=false disables the plugin the same way the CLI gate does (see src/commands/gate.ts).
-// gate.mode (block/warn/audit) stays owned by the CLI: the plugin only forwards the gate exit code.
-const DISABLED =
-  ["off", "0", "false", "no", "disabled"].includes(ESCAPE) || GATE.enabled === false;
+// P0-B: gate.enabled=false is no longer honored — a writable config must not
+// silently disable enforcement (same rule as the CLI and the MCP tool).
+// Only the env escape turns the gate off; gate.mode stays owned by the CLI.
+const DISABLED = ["off", "0", "false", "no", "disabled"].includes(ESCAPE);
 const GATE_TOOLS = new Set(
-  (Array.isArray(GATE.tools) && GATE.tools.length > 0 ? GATE.tools : ["edit", "write", "patch", "apply_patch", "bash", "shell"]).map((tool) => tool.toLowerCase())
+  (Array.isArray(GATE.tools) && GATE.tools.length > 0
+    ? GATE.tools
+    // MINEUR#8: cron tools that carry/execute shell commands are gated too —
+    // cron_add_command_task was a bash-gate bypass. Keep in sync with
+    // DEFAULT_CONFIG.gate.tools (src/spec.ts) and novahiz.config.json.
+    : ["edit", "write", "patch", "apply_patch", "bash", "shell", "cron_add_command_task", "cron_update_command_task", "cron_update_task", "cron_run_task_now"]
+  ).map((tool) => tool.toLowerCase())
 );
 
 type RunResult = { status: number; stdout: string; stderr: string; spawnError?: string };
@@ -282,11 +451,78 @@ function isValidSessionId(id: unknown): id is string {
   return typeof id === "string" && id.trim().length > 0;
 }
 
+// Inlined from src/gate-repair.ts — the installed plugin lives in
+// ~/.config/opencode/plugins/ and cannot resolve ../../src/*.
+type GateFailure = {
+  tool: string;
+  missingSkills: string[];
+  reasons: string[];
+  error: string | null;
+};
+
+function parseGateFailure(stdout: string): GateFailure | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed as Record<string, unknown>;
+  const asStringArray = (value: unknown): string[] =>
+    Array.isArray(value)
+      ? value.filter((entry): entry is string => typeof entry === "string")
+      : [];
+  const tool = typeof record.tool === "string" && record.tool.length > 0 ? record.tool : "tool";
+  return {
+    tool,
+    missingSkills: asStringArray(record.missingSkills),
+    reasons: asStringArray(record.reasons),
+    error: typeof record.error === "string" ? record.error : null
+  };
+}
+
+function buildRepairDirective(failure: GateFailure, attempt: number): string {
+  const head = `Novahiz gate blocked ${failure.tool}.`;
+  const missing = failure.missingSkills;
+
+  if (missing.length === 0) {
+    const detail = failure.error ?? failure.reasons.join("; ") ?? "no reason reported";
+    return `${head}\nBlocked by rule, not by a missing skill: ${detail}\nResolve the listed rule, then retry once. Never bypass the gate.`;
+  }
+
+  if (attempt <= 1) {
+    const steps = missing.map((skill, index) => `  ${index + 1}. skill({name:"${skill}"})`).join("\n");
+    return [
+      `${head} Missing skills: ${missing.join(", ")}.`,
+      "AUTO-REPAIR — execute now, do not ask the user, do not stop:",
+      steps,
+      `  ${missing.length + 1}. Retry this exact ${failure.tool} call once, then continue the user's task where it left off.`,
+      "Never bypass the gate: no NOVAHIZ_GATE, no alternate tool, no shell write, no editing around the block."
+    ].join("\n");
+  }
+
+  return [
+    `${head} AUTO-REPAIR FAILED on attempt ${attempt}: still missing ${missing.join(", ")} after skill() loads.`,
+    "The loads did not register — diagnose instead of retrying:",
+    "  1. Confirm the skill is installed and the index matches (`novahiz doctor`).",
+    "  2. Realign the index (`novahiz sync`), then load the named skills again.",
+    "If the skill genuinely does not exist, report that honestly to the user and stop. Never bypass the gate."
+  ].join("\n");
+}
+
 export const NovahizPlugin: Plugin = async ({ client }) => {
   const loadedBySession = new Map<string, Set<string>>();
   const categoriesBySession = new Map<string, string[]>();
   const enforcementBySession = new Map<string, string>();
   const lastSeenBySession = new Map<string, number>();
+  // P0-B: reason of the last failed classify per session — gate tool calls are
+  // refused while set, instead of running with empty categories (fail-open).
+  const classifyFailedBySession = new Map<string, string>();
+  // Auto-repair: denial count per `session|tool|missing set`. A first denial
+  // carries the repair protocol; an identical repeat escalates to diagnosis
+  // instead of looping. Cleared on a successful call of the same tool.
+  const repairAttemptsBySession = new Map<string, number>();
   const SESSION_TTL_MS = 4 * 60 * 60 * 1000;
 
   const log = async (level: "info" | "warn", message: string): Promise<void> => {
@@ -302,6 +538,11 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
     categoriesBySession.delete(sessionID);
     enforcementBySession.delete(sessionID);
     lastSeenBySession.delete(sessionID);
+    classifyFailedBySession.delete(sessionID);
+    // Auto-repair keys are prefixed with the session ID — drop them too.
+    for (const key of repairAttemptsBySession.keys()) {
+      if (key.startsWith(`${sessionID}|`)) repairAttemptsBySession.delete(key);
+    }
   };
 
   // Sessions only vanish from memory on session.deleted, which may never arrive.
@@ -314,8 +555,9 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
     }
   };
 
-  if (DISABLED)
-    await log("info", GATE.enabled === false ? "Gate disabled via config (gate.enabled=false)" : "Gate disabled via environment escape");
+  if (GATE.enabled === false)
+    await log("warn", "gate.enabled=false in config is ignored; enforcement stays active. Use NOVAHIZ_GATE=off to disable the gate.");
+  if (DISABLED) await log("info", "Gate disabled via environment escape");
 
   return {
     config: async (input) => {
@@ -397,9 +639,13 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
           await log("info", `Prompt rewritten: ${rewrite.sourceLanguage} → English ("${classifyText.slice(0, 80)}")`);
         }
 
-        const result = run(["classify", classifyText]);
+        // P0-B: the prompt travels on stdin. On argv it allowed option
+        // injection (--home), broke past the Windows 32k limit, and was
+        // readable in the process list.
+        const result = run(["classify", "--stdin"], classifyText);
         if (result.status !== 0) {
-          await log("warn", `Classify failed (exit ${result.status}), no enforcement injected: ${result.stderr.trim().slice(0, 200)}`);
+          classifyFailedBySession.set(input.sessionID, `classify exit ${result.status}`);
+          await log("warn", `Classify failed (exit ${result.status}), gate tool calls refused for this session: ${result.stderr.trim().slice(0, 200)}`);
           return;
         }
         let parsed: {
@@ -413,15 +659,18 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
         try {
           parsed = JSON.parse(result.stdout) as typeof parsed;
         } catch {
-          await log("warn", "Classify returned invalid JSON, no enforcement injected");
+          classifyFailedBySession.set(input.sessionID, "classify returned invalid JSON");
+          await log("warn", "Classify returned invalid JSON, gate tool calls refused for this session");
           return;
         }
         // M5: the `as` cast is compile-time only — validate the shape at runtime
         // so a malformed classify response cannot silently disable enforcement.
         if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.categories)) {
-          await log("warn", "Classify returned unexpected structure, no enforcement injected");
+          classifyFailedBySession.set(input.sessionID, "classify returned an unexpected structure");
+          await log("warn", "Classify returned unexpected structure, gate tool calls refused for this session");
           return;
         }
+        classifyFailedBySession.delete(input.sessionID);
         const categories = (parsed.categories ?? []).map((entry) => entry.id);
         categoriesBySession.set(input.sessionID, categories);
         const primary = parsed.primary ?? categories[0] ?? null;
@@ -434,7 +683,7 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
           "[Novahiz enforcement]",
           `Categories detected: ${categories.join(", ") || "none"}${primary ? ` (primary: ${primary})` : ""}`
         ];
-        if (rewrite.wasRewritten) {
+        if (rewrite.sourceLanguage !== "en") {
           lines.push(`User language: ${rewrite.sourceLanguage} — respond in this language, not English.`);
         }
         if (roadmap) {
@@ -457,12 +706,13 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
           }
         }
         lines.push("The gate blocks edit/write/patch/apply_patch/bash/shell until the required skills are loaded via skill({name:\"...\"}).");
-        lines.push("The gate is content-aware: novahiz-humanizer, ui-slop-remover and ui-craft-rules are required only on frontend design tasks (R13).");
+        lines.push("The gate is content-aware: novahiz-humanizer, ui-slop-remover and ui-craft-rules are required only on frontend design tasks (R13), and impeccable on the same design selectors (R14).");
         lines.push("Config edited = opencode restart required (config read at import).");
         lines.push("Memory lives in project-memory/ under the project root (cwd): index.json + fixed-size slots (8000 chars / 200 lines) with compact → archive → new-slot rotation. Use the MCP memory_* tools to read and append.");
         enforcementBySession.set(input.sessionID, lines.join("\n"));
       } catch (error) {
-        await log("warn", `chat.message hook failed, no enforcement injected: ${String(error).slice(0, 200)}`);
+        classifyFailedBySession.set(input.sessionID, "chat.message hook error");
+        await log("warn", `chat.message hook failed, gate tool calls refused for this session: ${String(error).slice(0, 200)}`);
         return;
       }
     },
@@ -481,29 +731,57 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
 
     "tool.execute.before": async (input, output) => {
       try {
-        // H-Plugin: validate session ID before using it — prevents undefined/null
-        // from being passed to spawnSync env (throws on Windows).
-        if (!isValidSessionId(input.sessionID)) return;
+        const tool = input.tool.toLowerCase();
+        const gated = !DISABLED && GATE_TOOLS.has(tool);
+        // P0-B: an invalid session ID must not bypass the gate. Gate tools and
+        // skill loads are refused; tools that need no enforcement still pass.
+        if (!isValidSessionId(input.sessionID)) {
+          if (gated || (!DISABLED && tool === "skill")) {
+            throw new Error(
+              `Novahiz gate blocked ${input.tool}: invalid session ID — loaded skills cannot be tracked. Fix the session or set NOVAHIZ_GATE=off to disable.`
+            );
+          }
+          return;
+        }
         touch(input.sessionID);
         if (!loadedBySession.has(input.sessionID)) loadedBySession.set(input.sessionID, new Set());
         const loaded = loadedBySession.get(input.sessionID)!;
 
-        if (input.tool.toLowerCase() === "skill") {
-          const args = output.args as { name?: string; skill?: string } | undefined;
-          const name = args?.name ?? args?.skill;
-          if (name) {
-            loaded.add(String(name));
-            // H3: surface session-load failures — otherwise the gate blocks later
-            // with no trace of why the skill was never recorded.
-            const loadResult = run(["session-load", "--session", input.sessionID, "--skill", String(name)]);
+        if (tool === "skill") {
+          const args = output.args as { name?: unknown; skill?: unknown } | undefined;
+          const raw = args?.name ?? args?.skill;
+          if (raw !== undefined && raw !== null && typeof raw !== "string") {
+            throw new Error("Novahiz gate blocked the skill load: the skill name must be a string.");
+          }
+          const name = typeof raw === "string" ? raw.trim() : "";
+          // P0-B: no commas or spaces — the gate re-splits --loaded on commas,
+          // so a loose name could inject extra "loaded" skills.
+          if (name.length > 0 && !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(name)) {
+            throw new Error(`Novahiz gate blocked the skill load: invalid skill name "${name.slice(0, 64)}".`);
+          }
+          if (name.length > 0) {
+            // P0-B: record only after session-load validated the name against
+            // the installed index — an unverified name never counts as loaded.
+            // H3 stays: failures are surfaced in the log instead of vanishing.
+            const loadResult = run(["session-load", "--session", input.sessionID, "--skill", name]);
             if (loadResult.status !== 0) {
-              await log("warn", `session-load failed for skill ${name}: ${(loadResult.stderr || "").trim().slice(0, 200)}`);
+              await log("warn", `session-load failed for skill ${name}, not recorded: ${(loadResult.stderr || loadResult.stdout || "").trim().slice(0, 200)}`);
+            } else {
+              loaded.add(name);
             }
           }
           return;
         }
 
-        if (DISABLED || !GATE_TOOLS.has(input.tool.toLowerCase())) return;
+        if (!gated) return;
+        // P0-B: a failed classify would empty the session categories and
+        // neutralize the prompt-scoped rules — refuse instead of failing open.
+        const classifyFailure = classifyFailedBySession.get(input.sessionID);
+        if (classifyFailure) {
+          throw new Error(
+            `Novahiz gate blocked ${input.tool}: prompt classification failed (${classifyFailure}). Fix the install (run "novahiz sync", check catalog/) and send a new message, or set NOVAHIZ_GATE=off to disable.`
+          );
+        }
 
         const categories = categoriesBySession.get(input.sessionID) ?? [];
         const result = run(
@@ -537,6 +815,18 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
           );
         }
         if (result.status === 2) {
+          // Auto-repair: a structured denial becomes an executable directive
+          // (load the named skills, retry the same call, resume the task).
+          // Counting identical denials turns a failed repair into a diagnosis
+          // instead of an infinite retry loop. The denial itself still stands
+          // until the gate CLI sees the skills — nothing is granted here.
+          const failure = parseGateFailure(result.stdout);
+          if (failure) {
+            const key = `${input.sessionID}|${failure.tool}|${[...failure.missingSkills].sort().join(",")}`;
+            const attempt = (repairAttemptsBySession.get(key) ?? 0) + 1;
+            repairAttemptsBySession.set(key, attempt);
+            throw new Error(buildRepairDirective(failure, attempt));
+          }
           throw new Error(`Novahiz gate blocked ${input.tool}.\n${result.stdout}`);
         }
         if (result.status !== 0) {
@@ -544,6 +834,12 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
             `Novahiz gate unavailable (exit ${result.status}). Fix the install (run sync, check catalog/) or set the escape variable to disable.\n${result.stderr}`
           );
         }
+        // The call is allowed: the repair converged — drop this session's
+        // denial counters so the next task starts a fresh cycle.
+        const allowedPrefix = `${input.sessionID}|${input.tool.toLowerCase()}|`;
+        for (const key of repairAttemptsBySession.keys()) {
+          if (key.startsWith(allowedPrefix)) repairAttemptsBySession.delete(key);
+        }
       } catch (error) {
         if (error instanceof Error && error.message.startsWith("Novahiz gate")) throw error;
         // H2: fail-closed — unknown gate errors deny, they never bypass.