novahiz 0.4.1 → 0.5.2

package/CHANGELOG.md

@@ -5,6 +5,88 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-10-05
+
+Maintenance release closing the three leftovers traced right after `0.5.1`:
+the installer's dead `plugin` config key, the unread `tokens` block of the
+example config, and the scheduler's 0 ms wake loop on a busy task.
+
+### Fixed
+
+- `install/install.mjs` no longer writes a `"plugin"` array of **file paths**
+  into a freshly created `opencode.jsonc`. opencode never read it (the plugins
+  are loaded from `<config>/plugins`, proved in E2E: the key pointed at the
+  repo while the loaded copies came from the plugins directory) and a file
+  entry triggered `configured plugin path must be a directory` at every
+  startup. Existing configs are left untouched.
+- `novahiz.config.example.json` no longer advertises a `tokens` block
+  (`enabled`, `trimOutputs`, `keepHeadLines`, `dedupeReads`, `capOutputTokens`,
+  `trimTools`, …) that no code ever read — a leftover of a layer that was never
+  shipped. The example now carries exactly the keys `defaultConfig()` writes,
+  and `docs/TOKENS.md` states it instead of pointing at a block that should
+  not be there.
+- `mcp/clepsydre/src/scheduler.ts`: `arm()` no longer arms a timer for a task
+  that is already running. A past-due schedule on a busy task used to feed a
+  0 ms `wake → skip → arm` loop (one task-store read per turn) for the whole
+  execution, and a manual trigger could sustain it. The lock release now goes
+  through `release()`, which re-evaluates the calendar once the task is free,
+  so a due occurrence is still caught up exactly once instead of by the spin.
+
+## [0.5.1] - 2026-10-05
+
+Fix-forward release: the `v0.5.0` tag was pushed but its CI never reached
+`npm publish`, so no `0.5.0` exists on the registry.
+
+### Fixed
+
+- `tests/memory-robust.test.ts` built the child process's import URL from a
+  hardcoded absolute path (`file:///C:/Users/...`): the two-process lock test
+  only passed on one machine and failed every CI run with "le fils ne s'est
+  jamais signale pret". The URL now derives from `import.meta.url`.
+- `tests/clepsydre-scheduler.test.ts` (lock test) observed the released lock
+  a single `setImmediate` after `release()`, racing a wake armed at delay 0
+  for a past-due schedule: depending on event-loop timing it saw either
+  `busy = []` or the task re-locked by a second execution. The test stops the
+  wake before observing the state, so the lock-release assertion is
+  deterministic. The re-arm it exposes (a past-due schedule on a busy task
+  keeps `arm()` at delay 0) is left to the scheduler, not to this release.
+
+## [0.5.0] - 2026-10-05
+
+### Added
+
+- **Token economy, plugin + skill** (`adapters/opencode/novahiz-token-economy.ts`,
+  `skills/token-economy/SKILL.md`): the plugin trims oversized tool output
+  before it reaches the model - head kept, full text written to
+  `<NOVAHIZ_HOME>/tmp/tool-output/`, footer naming the file to re-read instead
+  of re-running - and `/novahiz-tokens` posts the estimated saving for the
+  session without a model call. Strictly opt-in: nothing happens until
+  `NOVAHIZ_TOKEN_ECONOMY=1`, `read`/`edit`/`write` and skill output are never
+  trimmed, and any plugin error fails open. Budgets: `NOVAHIZ_TE_MAX_LINES`
+  (120), `NOVAHIZ_TE_MAX_BYTES` (16384), `NOVAHIZ_TE_TOOLS`,
+  `NOVAHIZ_TE_DUMP_DIR`. The skill carries the agent-side rules (read the
+  smallest thing, batch calls, delegate exploration, answer in paths).
+- The installer now copies both plugin files into `<config>/plugins/`, the
+  directory opencode actually loads plugins from.
+
+### Fixed
+
+- **Argus vulnerable fixtures are no longer collected by the test runner**:
+  `mcp/argus/src/test/` was renamed to `mcp/argus/src/fixtures/`, so
+  `node --test` (and `node scripts/ci-local.mjs`) stops picking
+  `test_xss.js` - a deliberately vulnerable sample - up as a test file and
+  failing on `require is not defined in ES module scope`. The argus end-to-end
+  suite still reports 30/30.
+- `tests/clepsydre-tools.test.ts` used a one-shot date hardcoded to
+  `2026-10-05T09:00:00Z`, which started failing once the clock passed it; the
+  test now uses a date relative to now.
+
+### Docs
+
+- `docs/TOKENS.md` rewritten around what is implemented (the plugin, the
+  skill, `novahiz tokens`); it now states that the `tokens` block of
+  `novahiz.config.example.json` is read by no code.
+
 ## [0.4.1] - 2026-10-05
 
 ### Fixed