novahiz 0.4.0 → 0.5.1

package/CHANGELOG.md

@@ -5,6 +5,90 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.5.1] - 2026-10-05
+
+Fix-forward release: the `v0.5.0` tag was pushed but its CI never reached
+`npm publish`, so no `0.5.0` exists on the registry.
+
+### Fixed
+
+- `tests/memory-robust.test.ts` built the child process's import URL from a
+  hardcoded absolute path (`file:///C:/Users/...`): the two-process lock test
+  only passed on one machine and failed every CI run with "le fils ne s'est
+  jamais signale pret". The URL now derives from `import.meta.url`.
+- `tests/clepsydre-scheduler.test.ts` (lock test) observed the released lock
+  a single `setImmediate` after `release()`, racing a wake armed at delay 0
+  for a past-due schedule: depending on event-loop timing it saw either
+  `busy = []` or the task re-locked by a second execution. The test stops the
+  wake before observing the state, so the lock-release assertion is
+  deterministic. The re-arm it exposes (a past-due schedule on a busy task
+  keeps `arm()` at delay 0) is left to the scheduler, not to this release.
+
+## [0.5.0] - 2026-10-05
+
+### Added
+
+- **Token economy, plugin + skill** (`adapters/opencode/novahiz-token-economy.ts`,
+  `skills/token-economy/SKILL.md`): the plugin trims oversized tool output
+  before it reaches the model - head kept, full text written to
+  `<NOVAHIZ_HOME>/tmp/tool-output/`, footer naming the file to re-read instead
+  of re-running - and `/novahiz-tokens` posts the estimated saving for the
+  session without a model call. Strictly opt-in: nothing happens until
+  `NOVAHIZ_TOKEN_ECONOMY=1`, `read`/`edit`/`write` and skill output are never
+  trimmed, and any plugin error fails open. Budgets: `NOVAHIZ_TE_MAX_LINES`
+  (120), `NOVAHIZ_TE_MAX_BYTES` (16384), `NOVAHIZ_TE_TOOLS`,
+  `NOVAHIZ_TE_DUMP_DIR`. The skill carries the agent-side rules (read the
+  smallest thing, batch calls, delegate exploration, answer in paths).
+- The installer now copies both plugin files into `<config>/plugins/`, the
+  directory opencode actually loads plugins from.
+
+### Fixed
+
+- **Argus vulnerable fixtures are no longer collected by the test runner**:
+  `mcp/argus/src/test/` was renamed to `mcp/argus/src/fixtures/`, so
+  `node --test` (and `node scripts/ci-local.mjs`) stops picking
+  `test_xss.js` - a deliberately vulnerable sample - up as a test file and
+  failing on `require is not defined in ES module scope`. The argus end-to-end
+  suite still reports 30/30.
+- `tests/clepsydre-tools.test.ts` used a one-shot date hardcoded to
+  `2026-10-05T09:00:00Z`, which started failing once the clock passed it; the
+  test now uses a date relative to now.
+
+### Docs
+
+- `docs/TOKENS.md` rewritten around what is implemented (the plugin, the
+  skill, `novahiz tokens`); it now states that the `tokens` block of
+  `novahiz.config.example.json` is read by no code.
+
+## [0.4.1] - 2026-10-05
+
+### Fixed
+
+- **`npm install -g novahiz` works on npm 11.16+**, where install scripts no
+  longer count as approved unless they appear in `allowScripts` and a global
+  install has no `package.json` to record that approval in — npm prints
+  `npm warn allow-scripts novahiz (...)` and, depending on the version, skips
+  the postinstall so nothing gets configured. The recommended command is
+  `npm install -g --allow-scripts=novahiz novahiz`;
+  `npm config set allow-scripts=novahiz --location=user` makes it permanent so
+  plain `npm install -g novahiz` works afterwards.
+- **The published 0.4.0 tarball still carried the dry-run postinstall**
+  (`node install/install.mjs --dry-run`) — the `--yes` republish never reached
+  the registry, so even an allowed postinstall only printed the next step
+  instead of installing. 0.4.1 publishes `postinstall: node install/install.mjs
+  --yes`.
+- **`novahiz` finishes the setup itself when npm skipped the postinstall**: the
+  first run of the CLI finds no `~/.config/novahiz/.novahiz-install.json`
+  manifest and executes `install/install.mjs --yes` once before the command
+  runs. `-v`, `--version`, `--help`, `-h` and `NOVAHIZ_AUTOINSTALL=0` skip the
+  bootstrap; a repo checkout (outside `node_modules`) is never touched.
+
+### Docs
+
+- README quick start rewritten: the one-liner carries `--allow-scripts`, both
+  fallbacks are listed, and the `ENOENT: package.json` trap of running the flag
+  without a package name is called out.
+
 ## [0.4.0] - 2026-10-05
 
 ### Added