novahiz 0.4.1 → 0.5.1

package/CHANGELOG.md

@@ -5,6 +5,61 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.5.1] - 2026-10-05
+
+Fix-forward release: the `v0.5.0` tag was pushed but its CI never reached
+`npm publish`, so no `0.5.0` exists on the registry.
+
+### Fixed
+
+- `tests/memory-robust.test.ts` built the child process's import URL from a
+  hardcoded absolute path (`file:///C:/Users/...`): the two-process lock test
+  only passed on one machine and failed every CI run with "le fils ne s'est
+  jamais signale pret". The URL now derives from `import.meta.url`.
+- `tests/clepsydre-scheduler.test.ts` (lock test) observed the released lock
+  a single `setImmediate` after `release()`, racing a wake armed at delay 0
+  for a past-due schedule: depending on event-loop timing it saw either
+  `busy = []` or the task re-locked by a second execution. The test stops the
+  wake before observing the state, so the lock-release assertion is
+  deterministic. The re-arm it exposes (a past-due schedule on a busy task
+  keeps `arm()` at delay 0) is left to the scheduler, not to this release.
+
+## [0.5.0] - 2026-10-05
+
+### Added
+
+- **Token economy, plugin + skill** (`adapters/opencode/novahiz-token-economy.ts`,
+  `skills/token-economy/SKILL.md`): the plugin trims oversized tool output
+  before it reaches the model - head kept, full text written to
+  `<NOVAHIZ_HOME>/tmp/tool-output/`, footer naming the file to re-read instead
+  of re-running - and `/novahiz-tokens` posts the estimated saving for the
+  session without a model call. Strictly opt-in: nothing happens until
+  `NOVAHIZ_TOKEN_ECONOMY=1`, `read`/`edit`/`write` and skill output are never
+  trimmed, and any plugin error fails open. Budgets: `NOVAHIZ_TE_MAX_LINES`
+  (120), `NOVAHIZ_TE_MAX_BYTES` (16384), `NOVAHIZ_TE_TOOLS`,
+  `NOVAHIZ_TE_DUMP_DIR`. The skill carries the agent-side rules (read the
+  smallest thing, batch calls, delegate exploration, answer in paths).
+- The installer now copies both plugin files into `<config>/plugins/`, the
+  directory opencode actually loads plugins from.
+
+### Fixed
+
+- **Argus vulnerable fixtures are no longer collected by the test runner**:
+  `mcp/argus/src/test/` was renamed to `mcp/argus/src/fixtures/`, so
+  `node --test` (and `node scripts/ci-local.mjs`) stops picking
+  `test_xss.js` - a deliberately vulnerable sample - up as a test file and
+  failing on `require is not defined in ES module scope`. The argus end-to-end
+  suite still reports 30/30.
+- `tests/clepsydre-tools.test.ts` used a one-shot date hardcoded to
+  `2026-10-05T09:00:00Z`, which started failing once the clock passed it; the
+  test now uses a date relative to now.
+
+### Docs
+
+- `docs/TOKENS.md` rewritten around what is implemented (the plugin, the
+  skill, `novahiz tokens`); it now states that the `tokens` block of
+  `novahiz.config.example.json` is read by no code.
+
 ## [0.4.1] - 2026-10-05
 
 ### Fixed