novahiz 0.2.5 → 0.3.2

package/skills/novahiz-task/SKILL.md

@@ -74,7 +74,7 @@ Split again when the work runs past one focused sitting, when the criteria overf
 
 ## Categories that require this step
 
-`code`, `browser`, `design-ui`, and `planning`.
+`code`, `flutter`, `expo`, `browser`, `design-ui`, and `planning`.
 
 ## Discipline
 

package/skills/prompt-rewriter/SKILL.md

@@ -1,9 +1,10 @@
 ---
 name: prompt-rewriter
 description: |
-  prompt-rewriter translates non-English prompts into optimized English before classification.
-  The agent always responds in the user's original language. No external dependencies.
-  Built into the plugin adapter.
+  prompt-rewriter detects the source language of every prompt (AR, FR, ES, DE, PT, EN),
+  translates it into optimized English before classification where term maps exist
+  (Arabic, French), and forces the reply back into the user's language. No external
+  dependencies. Built into the plugin adapter.
 license: Apache-2.0
 compatibility: |
   Implemented in src/prompt-rewriter.ts and inlined in adapters/opencode/novahiz.ts;
@@ -11,7 +12,7 @@ compatibility: |
 metadata:
   author: Novahiz
   organization: Novahiz
-  version: "2.0.0"
+  version: "2.1.0"
 ---
 
 # prompt-rewriter
@@ -20,8 +21,8 @@ metadata:
 
 Every user message is intercepted before classification and rewritten into optimized English:
 
-1. Detect the source language (FR, AR, ES, DE, PT, or EN).
-2. Translate task terms into English equivalents.
+1. Detect the source language (FR, AR, ES, DE, PT, or EN) with weighted pattern scoring.
+2. Translate task terms into English equivalents where a term map exists (AR, FR).
 3. Tighten the English prompt into imperative mood and drop filler.
 4. Classify the English version for tier and skill assignment.
 5. Respond in the user's original language.
@@ -36,11 +37,11 @@ The rewriter sits in `src/prompt-rewriter.ts` and is wired into the plugin adapt
 
 ### Language detection
 
-Heuristic scoring: each language has weighted patterns of common words, technical terms, and multi-word phrases. The highest score wins. No external dependency is involved.
+Heuristic scoring over a folded (lowercase, accent-stripped) copy of the prompt: each language in `LANG_PATTERNS` (FR, ES, DE, PT) has weighted patterns of common words, technical terms, and multi-word phrases. A language needs a minimum score to qualify; a weight-3 marker (task verbs, question words) beats a pile of weight-1 function words. Arabic is detected by its script range. Ties fall back to a fixed order (FR, ES, DE, PT). English cognates (test, design, page, interface, code...) are deliberately excluded from the marker lists so clean English stays `en`. No external dependency is involved.
 
 ### Term translation
 
-French and Arabic have dedicated term maps of forty and thirty patterns. Examples:
+Arabic and French have dedicated term maps of 55 and 86 patterns respectively. Examples:
 
 | FR term | EN equivalent |
 |---------|---------------|
@@ -51,6 +52,8 @@ French and Arabic have dedicated term maps of forty and thirty patterns. Example
 | migrer | migrate |
 | optimiser | optimize |
 
+**Known limitation:** Spanish, German, and Portuguese prompts are detected but not translated — classification on the raw text relies on the shared technical vocabulary (refactor, login, servidor, Datenbank...). Add an `XX_EN` map below to extend coverage.
+
 ### English optimization
 
 Politeness markers are stripped and the prompt becomes imperative:
@@ -61,18 +64,20 @@ Politeness markers are stripped and the prompt becomes imperative:
 
 ## Integration
 
-The plugin adapter calls `rewritePrompt(text)` before `classify`. When a rewrite happens:
+The plugin adapter calls `rewritePrompt(text)` before `classify`:
+
+1. Classification runs on the rewritten English version.
+2. When the detected source language is not English, the enforcement block carries the response-language instruction (see below).
+3. When the text actually changed (`wasRewritten`), a log entry records the rewrite.
 
-1. The enforcement block carries `User language: XX, respond in this language`.
-2. A log entry records the rewrite.
-3. Classification runs on the English version.
+Covered by `tests/prompt.rewriter.test.ts`.
 
 ## Response language
 
 The agent MUST respond in the user's original language. The enforcement block includes:
 
 ```
-User language: fr, respond in this language, not English.
+User language: fr — respond in this language, not English.
 ```
 
 That line overrides any default to English.

package/src/cli.ts

@@ -2,7 +2,7 @@ import { readFileSync, existsSync } from "node:fs";
 import { join, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
-import { parse, print } from "./commands/context.ts";
+import { parse, print, flagOn, type Parsed } from "./commands/context.ts";
 import { expandHome } from "./spec.ts";
 
 import { commandCheck, commandSync, commandClassify, commandSkills, commandCategories, commandRules, commandSessionLoad, commandSessionState, commandCatalog, commandRoadmap, commandStep, commandProviders, commandDeps, commandDispatch } from "./commands/inspect.ts";
@@ -105,15 +105,35 @@ function runInit(): void {
   process.stdout.write("\nDone! Restart opencode to activate Novahiz.\n");
 }
 
-function runUpgrade(): void {
+function runUpgrade(parsed: Parsed): void {
   const home = homeDir();
   if (!existsSync(join(home, ".git"))) {
     process.stderr.write("Not a git repository. Install from source first.\n");
     process.exitCode = 1;
     return;
   }
+  // P2-C (LOW): `git pull` rewrote the running code (hooks included) with no
+  // preview. Default to a dry run; `--apply` is required to actually pull.
+  if (!flagOn(parsed, "apply")) {
+    const dry = spawnSync("git", ["pull", "--dry-run"], { cwd: home, encoding: "utf8" });
+    const preview = `${dry.stdout ?? ""}${dry.stderr ?? ""}`.trim();
+    if (preview) process.stdout.write(preview + "\n");
+    if (dry.status !== 0) {
+      process.stderr.write("Dry run failed; fix git first.\n");
+      process.exitCode = 1;
+      return;
+    }
+    process.stdout.write("Dry run only. Re-run `novahiz upgrade --apply` to pull and rebuild.\n");
+    process.exitCode = 1;
+    return;
+  }
   process.stdout.write("Pulling latest changes...\n");
-  spawnSync("git", ["pull"], { cwd: home, stdio: "inherit" });
+  const pull = spawnSync("git", ["pull", "--ff-only"], { cwd: home, stdio: "inherit" });
+  if (pull.status !== 0) {
+    process.stderr.write("Pull failed; nothing rebuilt.\n");
+    process.exitCode = 1;
+    return;
+  }
   process.stdout.write("\nRebuilding skill catalog...\n");
   runSync();
   process.stdout.write("\nUpgraded! Restart opencode to apply changes.\n");
@@ -151,7 +171,7 @@ function main(argv: string[]): void {
       return commandClean(parsed);
     case "upgrade":
     case "update":
-      return runUpgrade();
+      return runUpgrade(parsed);
     case "version":
     case "-v":
     case "--version":

package/src/commands/context.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, chmodSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, chmodSync, readSync } from "node:fs";
 import { resolve as resolvePath, join } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
@@ -78,10 +78,37 @@ export function emit(parsed: Parsed, value: unknown, textFn: () => string): void
   }
 }
 
+// P2-C (LOW): stdin.read() returns null on a TTY (stream not in flowing
+// mode), which made every confirmation silently answer "no". Read a line
+// from fd 0 directly instead; parse stays pure so tests cover it without a
+// terminal.
+export function parseAnswer(line: string): boolean {
+  const answer = line.trim().toLowerCase();
+  return answer === "y" || answer === "yes" || answer === "o" || answer === "oui";
+}
+
+const MAX_ANSWER_BYTES = 1024;
+
+function readAnswerLine(): string {
+  const buffer = Buffer.alloc(MAX_ANSWER_BYTES);
+  let total = 0;
+  try {
+    while (total < MAX_ANSWER_BYTES) {
+      const read = readSync(0, buffer, total, 1, null);
+      if (read <= 0) break;
+      const byte = buffer[total];
+      total += 1;
+      if (byte === 0x0a) break; // \n — consume the whole line, stop at newline
+    }
+  } catch {
+    // stdin unavailable (closed pipe, no console): treat as empty answer
+  }
+  return buffer.toString("utf8", 0, total);
+}
+
 export function confirm(question: string): boolean {
   process.stdout.write(question + " [y/N] ");
-  const answer = process.stdin.read()?.toString().trim().toLowerCase();
-  return answer === "y" || answer === "yes" || answer === "o";
+  return parseAnswer(readAnswerLine());
 }
 
 // The name promises safety: malformed input returns [] instead of throwing.
@@ -98,11 +125,23 @@ export function dbPathFor(root: string, spec: Spec): string {
   return resolvePath(root, spec.config.dbPath);
 }
 
+const MAX_STDIN_BYTES = 1024 * 1024; // 1 MiB: JSON payloads never need more
+
 export function readStdin(): string {
   // A single synchronous stdin read races with pipe delivery and can return null even when input was provided.
   if (process.stdin.isTTY) return "";
   try {
-    return readFileSync(0, 'utf8');
+    // P2-C (LOW): bounded read — readFileSync(0) had no size limit, so a huge
+    // pipe reached JSON.parse in full. Stop at the cap; oversized input gets
+    // truncated (and then fails to parse) instead of being loaded whole.
+    const buffer = Buffer.alloc(MAX_STDIN_BYTES);
+    let total = 0;
+    while (total < MAX_STDIN_BYTES) {
+      const read = readSync(0, buffer, total, MAX_STDIN_BYTES - total, null);
+      if (read <= 0) break;
+      total += read;
+    }
+    return buffer.toString("utf8", 0, total);
   } catch {
     return "";
   }

package/src/commands/doctor.ts

@@ -33,7 +33,10 @@ function referencedSkills(spec: ReturnType<typeof loadSpec>): string[] {
     }
   }
   for (const rule of spec.rules) for (const skill of rule.require) ids.add(skill);
-  for (const provider of spec.providers) if (provider.kind === "skill") ids.add(provider.id);
+  // Skill packs (kind: "skill") are delivery mechanisms, not index entries:
+  // their id ("flutter-skills", "expo-skills") never matches a SKILL.md name,
+  // so adding it made this check permanently red. Pack skills land in the
+  // index individually and are referenced through categories and rules above.
   return [...ids].sort();
 }
 
@@ -86,22 +89,37 @@ export function commandDoctor(parsed: Parsed): void {
     blocking: missingCli.length > 0
   });
 
-  const probe = evaluateGate({
+  // Two probes, one per live enforcement layer, both deterministic against the
+  // current ruleset (the old single probe fed README.md with empty categories,
+  // which matches no rule since the prose content rules were removed):
+  // - path probe: R13/R14 match a style file through pathGlobs alone.
+  // - category probe: R6 matches a classified code prompt; tier is set
+  //   explicitly because probe text is file content, not a prompt, and
+  //   determineTier would call it trivial and skip R6.
+  const probeInput = {
     tool: "edit",
-    filePath: "README.md",
-    content: "This README paragraph is long enough prose for the content rules to match and demand a loaded skill.",
-    categories: [],
-    loadedSkills: [],
+    content: "",
+    categories: [] as string[],
+    loadedSkills: [] as string[],
     installedSkills: index.skills,
     installedIndexAvailable: index.available,
     spec
+  };
+  const pathProbe = evaluateGate({ ...probeInput, filePath: "src/hero.css" });
+  const classProbe = evaluateGate({
+    ...probeInput,
+    filePath: "README.md",
+    categories: ["code"],
+    tier: "full"
   });
-  const gateOk = spec.rules.length === 0 || (probe.allow === false && probe.missingSkills.length > 0);
+  const blocked = (r: typeof pathProbe) => r.allow === false && r.missingSkills.length > 0;
+  const gateOk = spec.rules.length === 0 || (blocked(pathProbe) && blocked(classProbe));
+  const probeSkills = [...new Set([...pathProbe.missingSkills, ...classProbe.missingSkills])];
   checks.push({
     id: "gate",
     label: "Operational gate",
     ok: gateOk,
-    detail: gateOk ? `blocks a write without a loaded skill (${probe.missingSkills.join(", ")})` : "did not block a write without a loaded skill",
+    detail: gateOk ? `blocks a write without a loaded skill (${probeSkills.join(", ")})` : "did not block a write without a loaded skill",
     blocking: true
   });
 

package/src/commands/gate.ts

@@ -4,10 +4,8 @@ import { loadSpec, NovahizHome } from "../spec.ts";
 import { openDb } from "../db.ts";
 import { loadInstalledSkills } from "../catalog.ts";
 import { changeText } from "../content.ts";
-import { evaluateGate } from "../gate.ts";
+import { enforceLedgerChecks, evaluateGate } from "../gate.ts";
 import { extractTargetPaths } from "../targets.ts";
-import { activeTask, recordEdit, reviewBlockReason, reviewDue, traceCheck } from "../ledger.ts";
-import { autoCommit } from "../graft.ts";
 
 export function commandGate(parsed: Parsed): void {
   const root = NovahizHome();
@@ -25,7 +23,10 @@ export function commandGate(parsed: Parsed): void {
     return;
   }
   const gateConfig = spec.config.gate;
-  const tool = asString(parsed.flags.tool) || "edit";
+  // MINEUR#5: normalize case — the plugin lowercases tool names (adapters
+  // novahiz.ts), so a case-sensitive check here would treat "EDIT" as
+  // un-gated and silently allow the call.
+  const tool = (asString(parsed.flags.tool) || "edit").toLowerCase();
   const categories = splitList(parsed.flags.categories);
   let loaded = splitList(parsed.flags.loaded);
   const session = asString(parsed.flags.session);
@@ -45,9 +46,13 @@ export function commandGate(parsed: Parsed): void {
     }
   }
 
+  // C2: a project-writable config must not silently switch enforcement off.
+  // enabled:false is ignored on purpose; the only kill-switch is the external
+  // env var NOVAHIZ_GATE (same philosophy as the hardcoded envEscape, H3/C5).
   if (gateConfig.enabled === false) {
-    print({ allow: true, disabled: true, tool });
-    return;
+    process.stderr.write(
+      'novahiz: gate.enabled=false in novahiz.config.json is ignored; enforcement stays active. Use NOVAHIZ_GATE=off to disable the gate.\n'
+    );
   }
   // H3: always use NOVAHIZ_GATE (legacy: NOVAHIZ_GATE) — ignore configurable
   // envEscape to prevent a writable config from redirecting the kill-switch.
@@ -65,6 +70,8 @@ export function commandGate(parsed: Parsed): void {
 
   const single = asString(parsed.flags.file);
   let content = asString(parsed.flags.content);
+  // C1: the prompt that triggered the edit drives the complexity tier.
+  const prompt = asString(parsed.flags.prompt);
   let paths: string[];
   if (single.length > 0) {
     paths = [single];
@@ -88,38 +95,45 @@ export function commandGate(parsed: Parsed): void {
     return;
   }
 
-  if (paths.length === 0) {
+  const pathless = paths.length === 0;
+  if (pathless) {
     const writeTools = ["edit", "write", "patch", "apply_patch"];
     if (writeTools.includes(tool)) {
+      // MINEUR#6: warn/audit never exit non-zero — report the pass with a
+      // wouldBlock marker instead of a contradictory allow:false + exit 0.
+      const enforced = gateConfig.mode === "block";
       print({
-        allow: false,
+        allow: !enforced,
+        ...(enforced ? {} : { wouldBlock: true }),
         tool,
         targets: [],
         requiredSkills: [],
         missingSkills: [],
         reasons: ["no target path for a write tool"]
       });
-      if (gateConfig.mode === "block") process.exitCode = 2;
+      if (enforced) process.exitCode = 2;
       return;
     }
-    print({ allow: true, tool, targets: [], requiredSkills: [], missingSkills: [], reason: "no target path" });
-    return;
+    // MAJEUR l.135: bash/shell/cron with no target path no longer pass
+    // unconditionally — they fall through to a pathless evaluation so
+    // prompt-scoped rules (supabase, browser, security, ...) still apply
+    // to commands like `python -e`, `curl -o` or `git apply`.
   }
 
   const index = loadInstalledSkills(spec);
-  const results = paths.map((filePath) => ({
-    path: filePath,
-    ...evaluateGate({
-      tool,
-      filePath,
-      content,
-      categories,
-      loadedSkills: loaded,
-      installedSkills: index.skills,
-      installedIndexAvailable: index.available,
-      spec
-    })
-  }));
+  const evalInput = {
+    tool,
+    content,
+    prompt,
+    categories,
+    loadedSkills: loaded,
+    installedSkills: index.skills,
+    installedIndexAvailable: index.available,
+    spec
+  };
+  const results = pathless
+    ? [{ path: "", ...evaluateGate({ ...evalInput, filePath: "", pathless: true }) }]
+    : paths.map((filePath) => ({ path: filePath, ...evaluateGate({ ...evalInput, filePath }) }));
 
   const reasons: string[] = [];
   let reviewWarning = "";
@@ -130,77 +144,37 @@ export function commandGate(parsed: Parsed): void {
 
   // H4: single DB connection for trace, ledger checks, AND enforcement logging
   let db: ReturnType<typeof openDb> | null = null;
+  let dbFailure = "";
   try {
     db = openDb(dbPathFor(root, spec));
   } catch (error) {
-    process.stderr.write(`novahiz: DB open failed: ${String(error).slice(0, 200)}\n`);
-    print({ allow: false, error: `DB open failed`, tool, missingSkills: [], reasons: [`DB open failed`] });
-    process.exitCode = 2;
-    return;
+    dbFailure = String(error).slice(0, 200);
+    process.stderr.write(`novahiz: DB open failed: ${dbFailure}\n`);
+    if (gateConfig.mode === "block") {
+      // block mode keeps fail-closed behaviour: no enforcement trace, no edits.
+      print({ allow: false, error: `DB open failed`, tool, missingSkills: [], reasons: [`DB open failed`] });
+      process.exitCode = 2;
+      return;
+    }
+    // MINEUR#7: warn/audit are advisory — degrade gracefully instead of
+    // locking every gated tool out; ledger checks are skipped and reported.
   }
   try {
-    const traceConfig = gateConfig.trace;
-    const traceRequired =
-      traceConfig?.enabled === true &&
-      session.length > 0 &&
-      categories.some((category) => traceConfig.categories.includes(category));
-    if (traceRequired) {
-      for (const entry of results) {
-        const trace = traceCheck(db, { sessionId: session, filePath: entry.path, required: true });
-        if (!trace.ok) {
-          entry.allow = false;
-          reasons.push(trace.reason);
-        }
-      }
-    }
-
-    const ledgerConfig = spec.config.ledger;
-    if (ledgerConfig?.enabled !== false) {
-      const task = activeTask(db, session || undefined);
-      if (task) {
-        if (["edit", "write", "patch", "apply_patch"].includes(tool)) recordEdit(db, task.id);
-        // Targeted review: block only paths owned by an open todo with an owner
-        // pattern. A due review no longer freezes every target.
-        for (const entry of results) {
-          const reason = reviewBlockReason(db, task.id, entry.path, ledgerConfig.review);
-          if (reason && !entry.ignored) {
-            entry.allow = false;
-            entry.reasons.push(reason);
-          }
-        }
-        if (results.some((entry) => entry.reasons.some((reason) => reason.startsWith("plan review due")))) {
-          reasons.push(reviewDue(db, task.id, ledgerConfig.review).reason);
-        } else if (reviewDue(db, task.id, ledgerConfig.review).due) {
-          reviewWarning = reviewDue(db, task.id, ledgerConfig.review).reason;
-        }
-      }
-    }
-
-    const currentAllow = results.every((entry) => entry.allow);
-    if (session.length > 0) {
-      db.prepare(
-        "INSERT INTO enforcement_log (session_id, tool, file_path, file_class, decision, missing, matched_rules, logged_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
-      ).run(
-        session,
-        tool,
-        paths.join(","),
-        results[0]?.fileClass ?? "other",
-        currentAllow ? "allow" : gateConfig.mode === "block" ? "block" : gateConfig.mode,
-        JSON.stringify(missingSkills),
-        JSON.stringify(results.flatMap((entry) => entry.matchedRules)),
-        new Date().toISOString()
-      );
-      try {
-        autoCommit("enforcement", `${currentAllow ? "allow" : "block"} ${tool}`);
-      } catch {
-        // autoCommit failures are non-critical; the enforcement is logged regardless
-      }
+    if (db) {
+      // Shared with the MCP novahiz_gate tool (src/gate.ts enforceLedgerChecks)
+      // so the two entry points enforce trace + ledger + the log identically.
+      const enforced = enforceLedgerChecks(db, { session, tool, paths, categories, results, spec, gateConfig });
+      reasons.push(...enforced.reasons);
+      reviewWarning = enforced.reviewWarning;
     }
   } finally {
     db?.close();
   }
 
   const warnings: string[] = [];
+  if (dbFailure.length > 0 && gateConfig.mode !== "block") {
+    warnings.push(`enforcement trace unavailable (DB open failed): continuing without ledger checks in ${gateConfig.mode} mode.`);
+  }
   if (reviewWarning.length > 0) warnings.push(reviewWarning);
   if (unmatchedRequired.length > 0) {
     warnings.push(
@@ -211,9 +185,15 @@ export function commandGate(parsed: Parsed): void {
     warnings.push("skills index unreadable: all required skills are enforced.");
   }
 
-  const allow = results.every((entry) => entry.allow);
+  const blocked = results.some((entry) => !entry.allow);
+  const enforced = gateConfig.mode === "block";
+  // MINEUR#6: allow mirrors the exit contract — warn/audit never block, so a
+  // failing evaluation is reported as allow:true + wouldBlock:true (exit 0)
+  // instead of a contradictory allow:false + exit 0.
+  const allow = !blocked || !enforced;
   print({
     allow,
+    ...(blocked && !enforced ? { wouldBlock: true } : {}),
     tool,
     mode: gateConfig.mode,
     indexMissing,
@@ -225,6 +205,7 @@ export function commandGate(parsed: Parsed): void {
     targets: results.map((entry) => ({
       path: entry.path,
       fileClass: entry.fileClass,
+      tier: entry.tier,
       ignored: entry.ignored,
       roadmap: entry.roadmap,
       requiredSkills: entry.requiredSkills,

package/src/commands/graft.ts

@@ -26,8 +26,8 @@ Usage:
   novahiz graft log [N]          Show last N commits (default: 20)
   novahiz graft diff             Diff current ledger vs last commit
   novahiz graft status           Show graft status
-  novahiz graft restore <hash>   Restore ledger to a revision
-  novahiz graft export <hash> <path>  Export snapshot as .sqlite file
+  novahiz graft restore <hash> [--force]  Restore ledger to a revision (--force required; a backup is written first)
+  novahiz graft export <hash> <path> [--force]  Export snapshot as .sqlite (path must stay in the workspace; --force to overwrite)
   novahiz graft commit -m MSG   Manual commit with message
   novahiz graft help             Show this help
 `;
@@ -99,11 +99,13 @@ export function graftCommand(argv: string[]): void {
       if (!isGraftInitialized()) {
         fail("graft not initialized. Run: novahiz graft init");
       }
-      const rev = argv[1];
+      const force = argv.slice(1).includes("--force");
+      const rev = argv.slice(1).find((a) => a !== "--force");
       if (!rev) {
-        fail("usage: novahiz graft restore <revision>");
+        fail("usage: novahiz graft restore <revision> [--force]");
+        return;
       }
-      const result = restoreGraft(rev);
+      const result = restoreGraft(rev, { force });
       if (result.success) {
         console.log(`ok: ${result.message}`);
       } else {
@@ -116,12 +118,15 @@ export function graftCommand(argv: string[]): void {
       if (!isGraftInitialized()) {
         fail("graft not initialized. Run: novahiz graft init");
       }
-      const rev = argv[1];
-      const outPath = argv[2];
+      const rest = argv.slice(1).filter((a) => a !== "--force");
+      const force = argv.slice(1).includes("--force");
+      const rev = rest[0];
+      const outPath = rest[1];
       if (!rev || !outPath) {
-        fail("usage: novahiz graft export <revision> <output-path>");
+        fail("usage: novahiz graft export <revision> <output-path> [--force]");
+        return;
       }
-      const result = exportGraft(rev, outPath);
+      const result = exportGraft(rev, outPath, { force });
       if (result.success) {
         console.log(`ok: ${result.message}`);
       } else {

package/src/commands/inspect.ts

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { asString, dbPathFor, numberFlag, print, safeJsonArray, type Parsed } from "./context.ts";
+import { asString, dbPathFor, flagOn, numberFlag, print, readStdin, safeJsonArray, type Parsed } from "./context.ts";
 import { loadSpec, NovahizHome } from "../spec.ts";
 import { getMeta, openDb, setMeta } from "../db.ts";
 import { loadCatalog, loadInstalledSkills, persistCatalog, scanSkills, writeCatalog, writeSkillIndex } from "../catalog.ts";
@@ -48,7 +48,13 @@ export function commandSync(): void {
 export function commandClassify(parsed: Parsed): void {
   const root = NovahizHome();
   const spec = loadSpec(root);
-  const text = (parsed.positionals.slice(1).join(" ") || asString(parsed.flags.text)).trim();
+  // P0-B: --stdin keeps the prompt off argv — argv allowed option injection
+  // (--home), broke past the Windows 32k limit, and leaked the prompt into
+  // the process list. The slice bounds a hostile stdin (full fix in P2-C).
+  const raw = flagOn(parsed, "stdin")
+    ? readStdin().slice(0, 200_000)
+    : parsed.positionals.slice(1).join(" ") || asString(parsed.flags.text);
+  const text = raw.trim();
   if (text.length === 0) {
     throw new Error("classify needs a prompt: pass it as an argument or with --text");
   }
@@ -111,6 +117,22 @@ export function commandSessionLoad(parsed: Parsed): void {
     process.exitCode = 1;
     return;
   }
+  // P0-B: the plugin joins recorded names with commas and the gate re-splits
+  // them — a loose name could inject extra "loaded" skills.
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(skill)) {
+    print({ error: `invalid skill name format: "${skill.slice(0, 64)}"` });
+    process.exitCode = 1;
+    return;
+  }
+  // P0-B: only skills present in the installed index may count as loaded.
+  // An unreadable index cannot verify anything — accept the record (the gate
+  // degrades on its own side via indexMissing).
+  const installed = loadInstalledSkills(spec);
+  if (installed.available && !installed.skills.has(skill)) {
+    print({ error: `unknown skill "${skill}" — not in the installed index. Run "novahiz sync" to rebuild it.` });
+    process.exitCode = 1;
+    return;
+  }
   const db = openDb(dbPathFor(root, spec));
   // H5: ensure session exists for FK compliance
   const ts = new Date().toISOString();
@@ -197,6 +219,10 @@ export function commandStep(parsed: Parsed): void {
   }
   const db = openDb(dbPathFor(root, spec));
   if (done.length > 0) {
+    const ts = new Date().toISOString();
+    // roadmap_progress.session_id has a foreign key to sessions(id):
+    // ensure the session row exists before recording a step.
+    db.prepare("INSERT OR IGNORE INTO sessions (id, categories, required_skills, updated_at) VALUES (?, '[]', '[]', ?)").run(session, ts);
     db.prepare(
       "INSERT INTO roadmap_progress (session_id, step_id, status, updated_at) VALUES (?, ?, 'done', ?) ON CONFLICT(session_id, step_id) DO UPDATE SET status = 'done', updated_at = excluded.updated_at"
     ).run(session, done, new Date().toISOString());