novahiz 0.3.7 → 0.3.8

package/adapters/opencode/agent/novahiz.md

@@ -29,4 +29,4 @@ Rules:
 - Load the Supabase skills for any Supabase work.
 - Be honest. Avoid false good ideas. Keep a critical stance. Zero simulation: never pretend to have run, tested, or verified something you did not.
 - Criticize the request when it is inconsistent, ambiguous, risky, or suboptimal, and propose an alternative.
-- Gate auto-repair: when a call fails with "Novahiz gate blocked", do not stop and do not ask the user. Execute the AUTO-REPAIR block from the error verbatim: load every skill it names with `skill({ name: "..." })`, then retry the exact same call once and continue the user's task where it left off. If the identical skills are reported missing again, the loads did not register — run `novahiz doctor`, report honestly to the user, and stop. Never bypass the gate with a shell write, an alternate tool, or NOVAHIZ_GATE.
+- Gate reload: when a call fails with "Novahiz gate blocked", do not stop and do not ask the user. Execute the GATE RELOAD block from the error verbatim: load every skill it names with `skill({ name: "..." })`, then retry the exact same call once and continue the user's task where it left off. If the identical skills are reported missing again, the loads did not register — run `novahiz doctor`, report honestly to the user, and stop. Never bypass the gate with a shell write, an alternate tool, or NOVAHIZ_GATE.

package/adapters/opencode/novahiz.ts

@@ -506,7 +506,7 @@ function buildRepairDirective(failure: GateFailure, attempt: number): string {
     const steps = loads.map((skill, index) => `  ${index + 1}. skill({name:"${skill}"})`).join("\n");
     return [
       `${head} Missing skills: ${missing.join(", ")}.`,
-      "AUTO-REPAIR — execute now, do not ask the user, do not stop:",
+      "GATE RELOAD — execute now, do not ask the user, do not stop:",
       steps,
       `  ${loads.length + 1}. Retry this exact ${failure.tool} call once, then continue the user's task where it left off.`,
       "Never bypass the gate: no NOVAHIZ_GATE, no alternate tool, no shell write, no editing around the block."
@@ -514,7 +514,7 @@ function buildRepairDirective(failure: GateFailure, attempt: number): string {
   }
 
   return [
-    `${head} AUTO-REPAIR FAILED on attempt ${attempt}: still missing ${missing.join(", ")} after skill() loads.`,
+    `${head} GATE RELOAD FAILED on attempt ${attempt}: still missing ${missing.join(", ")} after skill() loads.`,
     "The loads did not register — diagnose instead of retrying:",
     "  1. Confirm the skill is installed and the index matches (`novahiz doctor`).",
     "  2. Realign the index (`novahiz sync`), then load the named skills again.",
@@ -530,8 +530,8 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
   // P0-B: reason of the last failed classify per session — gate tool calls are
   // refused while set, instead of running with empty categories (fail-open).
   const classifyFailedBySession = new Map<string, string>();
-  // Auto-repair: denial count per `session|tool|missing set`. A first denial
-  // carries the repair protocol; an identical repeat escalates to diagnosis
+  // Gate reload: denial count per `session|tool|missing set`. A first denial
+  // carries the reload protocol; an identical repeat escalates to diagnosis
   // instead of looping. Cleared on a successful call of the same tool.
   const repairAttemptsBySession = new Map<string, number>();
   const SESSION_TTL_MS = 4 * 60 * 60 * 1000;
@@ -550,7 +550,7 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
     enforcementBySession.delete(sessionID);
     lastSeenBySession.delete(sessionID);
     classifyFailedBySession.delete(sessionID);
-    // Auto-repair keys are prefixed with the session ID — drop them too.
+    // Gate reload keys are prefixed with the session ID — drop them too.
     for (const key of repairAttemptsBySession.keys()) {
       if (key.startsWith(`${sessionID}|`)) repairAttemptsBySession.delete(key);
     }
@@ -836,9 +836,9 @@ export const NovahizPlugin: Plugin = async ({ client }) => {
           );
         }
         if (result.status === 2) {
-          // Auto-repair: a structured denial becomes an executable directive
+          // Gate reload: a structured denial becomes an executable directive
           // (load the named skills, retry the same call, resume the task).
-          // Counting identical denials turns a failed repair into a diagnosis
+          // Counting identical denials turns a failed reload into a diagnosis
           // instead of an infinite retry loop. The denial itself still stands
           // until the gate CLI sees the skills — nothing is granted here.
           const failure = parseGateFailure(result.stdout);

package/dist/commands/graft.js

@@ -4,7 +4,7 @@
  * Subcommands: init, log, diff, status, restore, export, commit
  */
 import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, writeSync } from "node:fs";
 import { resolve } from "node:path";
 import { NovahizHome } from "../spec.js";
 import { isGraftAvailable, isGraftInitialized, initGraft, commitGraft, getGraftLog, getGraftDiff, getGraftStatus, restoreGraft, exportGraft, } from "../graft.js";
@@ -21,8 +21,12 @@ Usage:
   novahiz graft help             Show this help
 `;
 function fail(msg) {
-    console.error(`error: ${msg}`);
-    process.exitCode = 1;
+    // WS3: exit immediately — a fail() that only sets exitCode let the switch
+    // keep running (usage-fail then commitGraft(""), "graft not found" then a
+    // spawn anyway). writeSync(2, ...) so the message survives the exit on a
+    // piped stderr (console.error is async on pipes).
+    writeSync(2, `error: ${msg}\n`);
+    process.exit(1);
 }
 export function graftCommand(argv) {
     const sub = argv[0] ?? "help";

package/dist/commands/hook.js

@@ -18,8 +18,8 @@ function emitDeny(harness, event, reason) {
     }
     process.stdout.write(`Novahiz advisory: ${reason}\n`);
 }
-// AUTO-REPAIR attempt tracking: how many consecutive denials for this
-// session+tool since the last allow. attempt 1 = first block (repair
+// GATE RELOAD attempt tracking: how many consecutive denials for this
+// session+tool since the last allow. attempt 1 = first block (reload
 // directive), attempt 2+ = loads did not register (escalation). Computed
 // BEFORE enforceLedgerChecks logs the current row.
 function repairAttempt(db, session, tool) {
@@ -62,7 +62,14 @@ function recordSkillLoad(spec, db, session, skill) {
     db.prepare("INSERT OR IGNORE INTO skill_invocations (session_id, skill, invoked_at) VALUES (?, ?, ?)").run(session, skill, new Date().toISOString());
 }
 export function commandHook(parsed) {
-    const harness = (asString(parsed.flags.harness) || "claude");
+    const harnessFlag = asString(parsed.flags.harness) || "claude";
+    const harness = harnessFlag === "claude" || harnessFlag === "codex" ? harnessFlag : "claude";
+    if (harness !== harnessFlag) {
+        // WS3: an unvalidated cast let a typo ("claudee") silently downgrade the
+        // PreToolUse deny to an advisory line = fail-open. Unknown values now
+        // fail toward the strictest format (claude deny) with a warning.
+        process.stderr.write(`novahiz: unknown harness "${harnessFlag.slice(0, 32)}" — treating as "claude".\n`);
+    }
     const event = asString(parsed.flags.event) || "PreToolUse";
     const root = NovahizHome();
     const raw = readStdin().trim();

package/dist/commands/inspect.js

@@ -7,7 +7,7 @@ import { rankSkills } from "../relevance.js";
 import { buildMcpEntries, enabledProviders, installCommands } from "../providers.js";
 import { bootstrapFor, checkDependencies, missingPrerequisites } from "../deps.js";
 import { classify } from "../classify.js";
-import { runCommand, runScript } from "../exec.js";
+import { runScript } from "../exec.js";
 import { activeTask, buildWorkPackets, getTask } from "../ledger.js";
 export function commandCheck() {
     const root = NovahizHome();
@@ -187,6 +187,13 @@ export function commandStep(parsed) {
         process.exitCode = 1;
         return;
     }
+    // WS3: the step id follows the roadmap naming pattern (plan, write,
+    // impeccable-critique) — reject anything else before it reaches the database.
+    if (done.length > 0 && !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(done)) {
+        print({ error: `invalid step id format: "${done}" (expected alphanumeric, hyphens, underscores, dots)` });
+        process.exitCode = 1;
+        return;
+    }
     const db = openDb(dbPathFor(root, spec));
     if (done.length > 0) {
         const ts = new Date().toISOString();
@@ -206,13 +213,26 @@ export function commandProviders(parsed) {
         return;
     }
     if (parsed.flags.install) {
+        const entries = installCommands(spec);
+        if (!flagOn(parsed, "yes")) {
+            // Dry run by default: the catalog is not signed, so the plan is shown
+            // and nothing executes until --yes is passed explicitly.
+            print({
+                plan: entries.map((entry) => ({ id: entry.id, kind: entry.kind, command: entry.command.join(" "), source: entry.source })),
+                note: "dry run: pass --yes to execute"
+            });
+            return;
+        }
         const results = [];
-        for (const entry of installCommands(spec)) {
-            const [command, ...args] = entry.command;
-            const result = runCommand(command, args);
+        for (const entry of entries) {
+            // runScript applies the binary allowlist and the code-runner guard:
+            // catalog argv may only start a known packager/interpreter.
+            const result = runScript(entry.command);
             process.stdout.write(`${result.ok ? "ok  " : "fail"} ${entry.id} (${entry.kind}) ${entry.command.join(" ")}\n`);
             if (!result.ok && result.stderr)
                 process.stderr.write(result.stderr);
+            if (result.error)
+                process.stderr.write(`${result.error}\n`);
             results.push({ id: entry.id, kind: entry.kind, source: entry.source, command: entry.command.join(" "), ok: result.ok, error: result.error ?? null });
         }
         print(results);
@@ -247,9 +267,26 @@ export function commandDeps(parsed) {
         print({ node: process.version, platform: process.platform, dependencies: status });
         return;
     }
-    const run = (command, label) => {
-        const [bin, ...args] = command;
-        const result = runCommand(bin, args);
+    if (!flagOn(parsed, "yes")) {
+        // Dry run by default: show what would run (bootstrap + install) without
+        // touching the machine; --yes opts into execution explicitly.
+        const plan = [];
+        for (const entry of missingPrerequisites(spec)) {
+            const bootstrap = bootstrapFor(entry.provider);
+            plan.push(bootstrap && bootstrap.length > 0
+                ? { provider: entry.provider.id, step: "bootstrap", command: bootstrap.join(" ") }
+                : { provider: entry.provider.id, step: "bootstrap", note: `missing ${entry.missing.join(", ")}` });
+        }
+        for (const entry of installCommands(spec)) {
+            plan.push({ provider: entry.id, step: "install", command: entry.command.join(" ") });
+        }
+        print({ plan, note: "dry run: pass --yes to execute" });
+        return;
+    }
+    const run = (argv, label) => {
+        // runScript applies the binary allowlist and the code-runner guard:
+        // catalog argv may only start a known packager/interpreter.
+        const result = runScript(argv);
         process.stdout.write(`${result.ok ? "ok  " : "fail"} ${label}\n`);
         if (!result.ok && result.stderr)
             process.stderr.write(result.stderr);

package/dist/commands/task.js

@@ -171,7 +171,18 @@ function taskInsert(parsed, db, session, spec) {
         maxIterations: numberFlag(parsed, "max-iterations", { min: 1, integer: true }) || undefined
     });
     const positionRaw = asString(parsed.flags.position);
-    const position = positionRaw === "" ? "end" : /^\d+$/.test(positionRaw) ? Number(positionRaw) : positionRaw;
+    let position = "end";
+    if (positionRaw !== "") {
+        if (/^\d+$/.test(positionRaw))
+            position = Number(positionRaw);
+        else if (positionRaw === "start" || positionRaw === "end")
+            position = positionRaw;
+        else {
+            print({ error: `invalid position: ${positionRaw} (expected a number, "start" or "end")` });
+            process.exitCode = 1;
+            return;
+        }
+    }
     print({ todo: insertTodo(db, taskId, item, position), task: getTask(db, taskId) });
     return;
 }
@@ -348,7 +359,9 @@ function taskNew(parsed, db, session, spec) {
         return;
     }
     const id = asString(parsed.flags.id) || undefined;
-    const task = createTask(db, { title, id, sessionId: session || undefined });
+    // F: the shell's cwd is the project this plan belongs to — record it so the
+    // ledger only counts and blocks edits inside that project.
+    const task = createTask(db, { title, id, sessionId: session || undefined, projectRoot: process.cwd() });
     print({ task, todos: [] });
     return;
 }

package/dist/db.js

@@ -159,12 +159,16 @@ function ensureColumn(db, table, column, definition) {
         return;
     db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition};`);
 }
-export const SCHEMA_VERSION = 1;
+export const SCHEMA_VERSION = 2;
 function migrate(db) {
     ensureColumn(db, "tasks", "revision", "INTEGER NOT NULL DEFAULT 0");
     ensureColumn(db, "tasks", "reviewed_at", "TEXT");
     ensureColumn(db, "tasks", "edits_since_review", "INTEGER NOT NULL DEFAULT 0");
     ensureColumn(db, "tasks", "todos_since_review", "INTEGER NOT NULL DEFAULT 0");
+    // F: the project a task belongs to — ledger edits are filtered against it so
+    // one project's plan never counts or blocks another project's files. NULL on
+    // legacy tasks keeps the previous unscoped owner behaviour.
+    ensureColumn(db, "tasks", "project_root", "TEXT");
     db.exec(`PRAGMA user_version = ${SCHEMA_VERSION};`);
 }
 export function setMeta(db, key, value) {

package/dist/gate-repair.js

@@ -1,4 +1,4 @@
-// Auto-repair for gate FAIL results.
+// Gate reload for gate FAIL results.
 //
 // When the gate denies a tool call because required skills are not loaded,
 // the denial must be actionable: parse the structured FAIL payload and build
@@ -43,7 +43,7 @@ export function parseGateFailure(stdout) {
 /**
  * Build the actionable denial for a gate failure.
  *
- * attempt 1  — missing skills: the repair protocol (load, retry, resume).
+ * attempt 1  — missing skills: the gate reload protocol (load, retry, resume).
  * attempt 2+ — the same skills are still missing: the loads did not take
  *              effect, so the directive escalates to diagnosis and stops
  *              the loop instead of repeating itself.
@@ -63,14 +63,14 @@ export function buildRepairDirective(failure, attempt) {
         const steps = loads.map((skill, index) => `  ${index + 1}. skill({name:"${skill}"})`).join("\n");
         return [
             `${head} Missing skills: ${missing.join(", ")}.`,
-            "AUTO-REPAIR — execute now, do not ask the user, do not stop:",
+            "GATE RELOAD — execute now, do not ask the user, do not stop:",
             steps,
             `  ${loads.length + 1}. Retry this exact ${failure.tool} call once, then continue the user's task where it left off.`,
             "Never bypass the gate: no NOVAHIZ_GATE, no alternate tool, no shell write, no editing around the block."
         ].join("\n");
     }
     return [
-        `${head} AUTO-REPAIR FAILED on attempt ${attempt}: still missing ${missing.join(", ")} after skill() loads.`,
+        `${head} GATE RELOAD FAILED on attempt ${attempt}: still missing ${missing.join(", ")} after skill() loads.`,
         "The loads did not register — diagnose instead of retrying:",
         "  1. Confirm the skill is installed and the index matches (`novahiz doctor`).",
         "  2. Realign the index (`novahiz sync`), then load the named skills again.",

package/dist/gate.js

@@ -1,8 +1,9 @@
+import { isAbsolute, relative, resolve } from "node:path";
 import { hasPlaceholder, hasProse, hasStyle, isTrivial } from "./content.js";
 import { determineTier } from "./complexity.js";
 // Shared ledger enforcement (audit P1-D/M1): the CLI command and the MCP
 // novahiz_gate tool both run these checks so their verdicts cannot diverge.
-import { activeTask, recordEdit, reviewBlockReason, reviewDue, traceCheck } from "./ledger.js";
+import { activeTask, ownedByOpenTodo, recordEdit, reviewBlockReason, reviewDue, traceCheck } from "./ledger.js";
 import { autoCommit } from "./graft.js";
 const CLASS_BY_EXTENSION = {
     css: "design",
@@ -455,7 +456,22 @@ export function enforceLedgerChecks(db, input) {
     if (ledgerConfig?.enabled !== false) {
         const task = activeTask(db, session || undefined);
         if (task) {
-            if (["edit", "write", "patch", "apply_patch"].includes(tool))
+            // F: a task bound to a project only ever owns paths inside that project —
+            // another project's edits never advance or block it. Legacy tasks without
+            // project_root keep the owner-only behaviour. Relative paths resolve
+            // against the caller's cwd; absolute paths (plugin flow) stand as-is.
+            const inProject = (filePath) => {
+                if (!task.project_root)
+                    return true;
+                const abs = isAbsolute(filePath) ? resolve(filePath) : resolve(process.cwd(), filePath);
+                const rel = relative(task.project_root, abs);
+                return rel.length === 0 || (!rel.startsWith("..") && !isAbsolute(rel));
+            };
+            // Cadence counts only edits an open todo actually owns (owner-scoped
+            // review): a session or project touching unrelated paths must never
+            // advance this plan toward its review block.
+            const ownedTarget = results.some((entry) => entry.path.length > 0 && inProject(entry.path) && ownedByOpenTodo(db, task.id, entry.path));
+            if (["edit", "write", "patch", "apply_patch"].includes(tool) && ownedTarget)
                 recordEdit(db, task.id);
             // Targeted review: block only paths owned by an open todo with an owner
             // pattern. A due review no longer freezes every target.
@@ -464,6 +480,9 @@ export function enforceLedgerChecks(db, input) {
                 // pathless command must not be blocked by a file-ownership check.
                 if (entry.path.length === 0)
                     continue;
+                // F: outside the task's project nothing in this ledger applies to it.
+                if (!inProject(entry.path))
+                    continue;
                 const reason = reviewBlockReason(db, task.id, entry.path, ledgerConfig.review);
                 if (reason && !entry.ignored) {
                     entry.allow = false;

package/dist/ledger.js

@@ -1,3 +1,4 @@
+import { resolve } from "node:path";
 import { globToRegExp, isSafeRegexPattern } from "./gate.js";
 import { autoCommit } from "./graft.js";
 export const DEFAULT_MAX_ITERATIONS = 12;
@@ -45,7 +46,11 @@ export function createTask(db, options) {
     if (options.sessionId) {
         db.prepare("INSERT OR IGNORE INTO sessions (id, categories, required_skills, updated_at) VALUES (?, '[]', '[]', ?)").run(options.sessionId, ts);
     }
-    db.prepare("INSERT INTO tasks (id, title, status, session_id, created_at, updated_at) VALUES (?, ?, 'active', ?, ?, ?)").run(taskId, options.title, options.sessionId ?? null, ts, ts);
+    // F: remember which project the plan belongs to so the ledger can filter its
+    // edits to that project. Callers that cannot know it (legacy MCP flows) pass
+    // nothing and get NULL = unscoped, the behaviour before this column existed.
+    const projectRoot = options.projectRoot && options.projectRoot.trim().length > 0 ? resolve(options.projectRoot) : null;
+    db.prepare("INSERT INTO tasks (id, title, status, session_id, created_at, updated_at, project_root) VALUES (?, ?, 'active', ?, ?, ?, ?)").run(taskId, options.title, options.sessionId ?? null, ts, ts, projectRoot);
     autoCommit("task-created", options.title);
     return getTask(db, taskId);
 }
@@ -62,9 +67,13 @@ function requireTask(db, id) {
     return task;
 }
 export function activeTask(db, sessionId) {
+    // G2: two worlds, never mixed. A caller with a session only ever sees its own
+    // tasks; a sessionless caller only sees unbound tasks (session_id NULL) — a
+    // session-bound plan can no longer be grabbed (counted, blocked) by a foreign
+    // sessionless gate run, and the newest active task is no longer a free-for-all.
     const row = sessionId
         ? db.prepare("SELECT * FROM tasks WHERE status = 'active' AND session_id = ? ORDER BY created_at DESC LIMIT 1").get(sessionId)
-        : db.prepare("SELECT * FROM tasks WHERE status = 'active' ORDER BY created_at DESC LIMIT 1").get();
+        : db.prepare("SELECT * FROM tasks WHERE status = 'active' AND session_id IS NULL ORDER BY created_at DESC LIMIT 1").get();
     return row ?? null;
 }
 export function getTodo(db, id) {
@@ -315,6 +324,19 @@ export function reviewDue(db, taskId, policy = { edits: DEFAULT_REVIEW_EDITS, to
         : "";
     return { due, edits: task.edits_since_review, todos: task.todos_since_review, policy, reason };
 }
+/**
+ * Does an open todo of this task own filePath through a non-empty owner
+ * pattern? Blank owners own everything (ownedBy semantics) and are excluded
+ * on purpose: review mechanics — cadence and block — stay tied to explicit
+ * ownership, so edits from another session or project never advance this plan.
+ */
+export function ownedByOpenTodo(db, taskId, filePath) {
+    if (filePath.length === 0)
+        return false;
+    return listTodos(db, taskId).some((todo) => (todo.status === "pending" || todo.status === "in_progress") &&
+        (todo.owner ?? "").trim().length > 0 &&
+        ownedBy(todo, filePath));
+}
 /**
  * Which gate targets a due plan review should block.
  * Only paths owned by an open todo with a non-empty owner pattern are blocked.
@@ -325,10 +347,7 @@ export function reviewBlockReason(db, taskId, filePath, policy) {
     const due = reviewDue(db, taskId, policy);
     if (!due.due)
         return null;
-    const openOwned = listTodos(db, taskId).filter((todo) => (todo.status === "pending" || todo.status === "in_progress") && (todo.owner ?? "").trim().length > 0);
-    if (openOwned.length === 0)
-        return null;
-    return openOwned.some((todo) => ownedBy(todo, filePath)) ? due.reason : null;
+    return ownedByOpenTodo(db, taskId, filePath) ? due.reason : null;
 }
 export function revisionSignals(db, taskId) {
     const todos = listTodos(db, taskId);

package/docs/PROVIDERS.md

@@ -98,12 +98,14 @@ Control it in `novahiz.config.json`:
 Run the install commands on demand:
 
 ```
-node src/cli.ts providers --install
+node src/cli.ts providers --install --yes
 node install/install.mjs --install-providers
 ```
 
 Installation is opt-in on purpose. The commands download third-party packages, including a large Rust binary for `narsil`, so `autoInstall` defaults to `false`. Enabling it means you trust each upstream listed in `source`.
 
+`providers --install` and `deps --install` print the plan and execute nothing until `--yes` is passed. Whatever runs then goes through a binary allowlist (`node`, `npm`, `npx`, `uv`, `uvx`, `python`, `py`) — the same one bootstrap uses — so a tampered `providers.json` cannot execute an arbitrary program.
+
 ## Dependencies
 
 Each provider declares its prerequisites in `requires` (the executable it needs) and, when it can be bootstrapped, a per-platform `bootstrap` command. No provider currently declares a `bootstrap`; `Novahiz deps --install` supports the field for future entries.
@@ -111,7 +113,7 @@ Each provider declares its prerequisites in `requires` (the executable it needs)
 - `npx` based providers need `npx`, which ships with Node.
 - `dart` needs the Dart SDK on `PATH` (`dart --version`). Flutter installs ship it.
 
-`Novahiz deps` checks every prerequisite and reports what is missing. `Novahiz deps --install` first bootstraps a missing prerequisite through its official installer, then runs each provider's install command. The installer runs the check on every install and, when `providers.autoInstall` is true or `--install-providers` is passed, runs the installs too.
+`Novahiz deps` checks every prerequisite and reports what is missing. `Novahiz deps --install` prints the plan (bootstrap and install steps) and runs nothing; with `--yes` it first bootstraps a missing prerequisite through its official installer, then runs each provider's install command. The installer runs the check on every install and, when `providers.autoInstall` is true or `--install-providers` is passed, runs the installs with `--yes` too.
 
 ## Troubleshooting
 
@@ -137,7 +139,7 @@ Confirm the tool count with `narsil-mcp tools list` afterwards, then rerun `Nova
 
 - `Novahiz providers` lists providers, optionally by `--category` or a query.
 - `Novahiz providers --mcp-json` prints the MCP entry map.
-- `Novahiz providers --install` runs the official install commands.
-- `Novahiz deps [--install]` checks prerequisites and bootstraps or installs missing ones.
+- `Novahiz providers --install [--yes]` plans the official install commands; `--yes` executes them.
+- `Novahiz deps [--install] [--yes]` checks prerequisites and plans or runs the bootstrap/install commands.
 - MCP `novahiz_providers` and `novahiz_deps` expose the list and the dependency status over stdio.
 - `Novahiz report` lists the provider ids.

package/install/bootstrap.mjs

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { nodeVersionOk, opencodeConfigDir, NovahizHome } from "./lib.mjs";
+import { nodeVersionOk, opencodeConfigDir, NovahizHome, unsafeHostToken } from "./lib.mjs";
 
 const REPO_URL = "https://github.com/novahiz/novahiz.git";
 // Was hardcoded to ~/.config/novahiz, ignoring NOVAHIZ_HOME/NOVAHIZ_HOME.
@@ -21,19 +21,34 @@ function error(msg) {
 }
 
 // npm/npx are .cmd shims on Windows: spawning them without a shell throws
-// ENOENT (post-CVE-2024-* Node refuses to run .cmd via CreateProcess). Node
-// deprecates args arrays with shell:true (DEP0190), which wants a single
-// string — tokens are static (catalog package names), so joining is safe.
+// ENOENT (post-CVE-2024-* Node refuses to run .cmd via CreateProcess). The
+// line handed to cmd.exe only contains tokens accepted by unsafeHostToken
+// (lib.mjs — the install-side mirror of src/exec.ts SAFE_TOKEN, widened by
+// "*" for the literal flutter-skills glob); a refused token fails the run
+// loudly instead of being reinterpreted by cmd.exe. Same explicit cmd.exe
+// spelling as src/exec.ts resolveSpawn — argv form, no deprecated shell flag
+// (DEP0190).
 const HOST_CMDS = new Set(["npm", "npx"]);
 function hostInvocation(cmd, args) {
   if (process.platform === "win32" && HOST_CMDS.has(cmd)) {
-    return { command: [cmd, ...args].join(" "), spawnArgs: undefined, opts: { shell: true } };
+    const bad = unsafeHostToken([cmd, ...args]);
+    if (bad !== null) return { refused: bad };
+    const shell = process.env.ComSpec ?? "cmd.exe";
+    return { command: shell, spawnArgs: ["/d", "/s", "/c", [cmd, ...args].join(" ")], opts: {} };
   }
   return { command: cmd, spawnArgs: args, opts: {} };
 }
 
+function refusedResult(token) {
+  return { ok: false, status: 1, stdout: "", stderr: `refused unsafe token: ${token}\n` };
+}
+
 function run(cmd, args, opts = {}) {
   const inv = hostInvocation(cmd, args);
+  if (inv.refused !== undefined) {
+    error(`refused unsafe token in spawn: ${inv.refused}`);
+    return false;
+  }
   const result = spawnSync(inv.command, inv.spawnArgs, {
     encoding: "utf8",
     stdio: "inherit",
@@ -45,6 +60,7 @@ function run(cmd, args, opts = {}) {
 
 function runCapture(cmd, args, opts = {}) {
   const inv = hostInvocation(cmd, args);
+  if (inv.refused !== undefined) return refusedResult(inv.refused);
   const result = spawnSync(inv.command, inv.spawnArgs, {
     encoding: "utf8",
     stdio: ["pipe", "pipe", "pipe"],

package/install/install.mjs

@@ -423,7 +423,7 @@ async function main() {
     if (check.stdout) process.stdout.write(check.stdout);
     if (autoInstall) {
       note("Installing dependencies and providers (MCP, skills, commands)");
-      const result = spawnSync(process.execPath, [cli, "deps", "--install"], {
+      const result = spawnSync(process.execPath, [cli, "deps", "--install", "--yes"], {
         encoding: "utf8",
         env: { ...process.env, NOVAHIZ_HOME: home }
       });

package/install/lib.mjs

@@ -190,13 +190,45 @@ export function loadManifest(home) {
   return readJson(join(home, ".novahiz-install.json"), { created: [], backups: [] });
 }
 
-// npm/npx are .cmd shims on Windows: direct spawnSync throws ENOENT, so they
-// need cmd.exe. Node deprecates args arrays with shell:true (DEP0190), which
-// only wants a single string — every token here is static (catalog package
-// names, fixed flags), so joining with spaces is safe.
+// npm/npx are .cmd shims on Windows: direct spawnSync throws ENOENT
+// (post-CVE-2024-* Node refuses to run .cmd via CreateProcess), so they need
+// cmd.exe. The line handed to cmd.exe is built only from tokens that pass
+// SAFE_HOST_TOKEN — the install-side mirror of src/exec.ts SAFE_TOKEN, widened
+// by a single character: "*" (cmd.exe performs no glob expansion, and the
+// flutter-skills `--skill *` argument must reach npx literally). Everything a
+// shell can reinterpret — & | < > ^ % ! ( ) " ' ` ; $ ? whitespace, newlines —
+// stays banned, so the joined line can never grow a second command. Tokens are
+// static today (catalog package names, fixed flags); this check keeps that
+// true for any future argument instead of trusting it. Same cmd.exe spelling
+// as src/exec.ts resolveSpawn — cmd.exe is spawned explicitly with argv, no
+// deprecated shell flag (DEP0190), so the joined line is the only string cmd
+// ever parses.
+const SAFE_HOST_TOKEN = /^[A-Za-z0-9@._+*,/:=~-]+$/;
+
+export function unsafeHostToken(tokens) {
+  for (const token of tokens) {
+    if (token.length === 0) return "";
+    if (!SAFE_HOST_TOKEN.test(token)) return token;
+  }
+  return null;
+}
+
+function refusedHost(token) {
+  return {
+    status: 1,
+    stdout: "",
+    stderr: `refused unsafe token: ${token}\n`,
+    error: new Error(`refused unsafe token: ${token}`),
+  };
+}
+
 export function spawnHost(cmd, args, opts = {}) {
   if (process.platform === "win32") {
-    return spawnSync([cmd, ...args].join(" "), { ...opts, encoding: "utf8", shell: true });
+    const bad = unsafeHostToken([cmd, ...args]);
+    if (bad !== null) return refusedHost(bad);
+    const shell = process.env.ComSpec ?? "cmd.exe";
+    const line = [cmd, ...args].join(" ");
+    return spawnSync(shell, ["/d", "/s", "/c", line], { ...opts, encoding: "utf8" });
   }
   return spawnSync(cmd, args, { ...opts, encoding: "utf8" });
 }

package/mcp/novahiz-tools/index.mjs

@@ -134,6 +134,7 @@ const TOOLS = [
         id: { type: "string", description: "Task id (new) or todo/task id (start, done, block, drop)." },
         task: { type: "string", description: "Task id. Defaults to the active task." },
         session: { type: "string", description: "Session id used to scope the active task." },
+        projectRoot: { type: "string", description: "Project directory a new task belongs to (action new). Omitted = unscoped legacy task." },
         label: { type: "string", description: "Todo label for action todo." },
         kind: { type: "string", enum: ["read", "edit", "verify", "delegate"], description: "Todo kind." },
         acceptance: { type: "string", description: "Acceptance criterion for the todo." },
@@ -393,36 +394,37 @@ function callTool(name, args) {
     // Same shape as the CLI's results array: path alongside the GateResult,
     // on the same object so enforceLedgerChecks mutates this verdict in place.
     result.path = file;
-    if (session.length > 0) {
-      let mdb = null;
+    // Parity with the CLI: an empty session no longer skips this block. The
+    // sessionless call still enforces unbound tasks (activeTask) and fails
+    // closed on DB errors; it simply writes no enforcement_log row.
+    let mdb = null;
+    try {
+      mdb = openDb(resolve(spec.root, spec.config.dbPath));
+    } catch {
+      mdb = null;
+    }
+    if (mdb) {
       try {
-        mdb = openDb(resolve(spec.root, spec.config.dbPath));
-      } catch {
-        mdb = null;
-      }
-      if (mdb) {
-        try {
-          const enforced = enforceLedgerChecks(mdb, {
-            session,
-            tool: String(args?.tool ?? "edit"),
-            paths: [file],
-            categories,
-            results: [result],
-            spec,
-            gateConfig: spec.config.gate
-          });
-          if (enforced.reasons.length > 0) {
-            result.reasons.push(...enforced.reasons);
-            result.allow = false;
-          }
-          if (enforced.reviewWarning) result.reasons.push(enforced.reviewWarning);
-        } finally {
-          mdb.close();
+        const enforced = enforceLedgerChecks(mdb, {
+          session,
+          tool: String(args?.tool ?? "edit"),
+          paths: [file],
+          categories,
+          results: [result],
+          spec,
+          gateConfig: spec.config.gate
+        });
+        if (enforced.reasons.length > 0) {
+          result.reasons.push(...enforced.reasons);
+          result.allow = false;
         }
-      } else {
-        result.allow = false;
-        result.reasons.push("DB open failed: ledger enforcement unavailable");
+        if (enforced.reviewWarning) result.reasons.push(enforced.reviewWarning);
+      } finally {
+        mdb.close();
       }
+    } else {
+      result.allow = false;
+      result.reasons.push("DB open failed: ledger enforcement unavailable");
     }
     // A gate refusal is a normal verdict, not an execution error.
     return toolResult(result, false);
@@ -466,6 +468,11 @@ function callTool(name, args) {
   if (name === "novahiz_step") {
     const session = String(args?.session ?? "default");
     const done = args?.done ? String(args.done) : "";
+    // WS3: the step id follows the roadmap naming pattern (plan, write,
+    // impeccable-critique) — reject anything else before it reaches the database.
+    if (done.length > 0 && !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(done)) {
+      throw new Error(`Invalid params: step id must match [A-Za-z0-9][A-Za-z0-9._-]{0,127} (got "${done}")`);
+    }
     const db = openDb(resolve(spec.root, spec.config.dbPath));
     try {
       if (done.length > 0) {
@@ -497,7 +504,9 @@ function callTool(name, args) {
     const db = openDb(resolve(spec.root, spec.config.dbPath));
     try {
       if (action === "new") {
-        return toolResult(createTask(db, { title: String(args?.title ?? ""), id: args?.id ? String(args.id) : undefined, sessionId: session }));
+        // F: projectRoot scopes the new task to a project when the caller knows
+        // it; omitted = unscoped legacy task (no path filtering).
+        return toolResult(createTask(db, { title: String(args?.title ?? ""), id: args?.id ? String(args.id) : undefined, sessionId: session, projectRoot: args?.projectRoot ? String(args.projectRoot) : undefined }));
       }
       if (action === "plan") {
         const taskId = args?.task ? String(args.task) : activeTask(db, session)?.id;