novahiz 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -5,6 +5,33 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-10-08
+
+Patch release: two installation-level repairs found while cutting 0.7.0 — the
+memory MCP degraded on machines without a home catalog, and the docs reading
+layer collapsed under the SQLite planner of node 22.
+
+### Fixed
+
+- **`packageRoot()` walk-up** (`src/spec.ts`): the community-path assumption
+  (entry script exactly one directory below the package root) held for `bin/`
+  and `src/` but not `mcp/<server>/index.mjs` — two levels down it resolved to
+  `mcp/catalog/` (absent), so on any machine whose home has no catalog yet
+  (CI, fresh `npm install -g novahiz` before the installer ran) every memory
+  call returned `failed: true` « Invalid or missing catalog file ». The
+  resolver now walks up to the nearest `package.json`, preferring
+  `name: "novahiz"`, pinned by a regression test that reproduces the exact CI
+  condition (`tests/memory-p5.test.ts`, `NOVAHIZ_HOME` empty) — red CI on
+  Linux since 0.7.0, dead memory tools on the documented community path.
+- **Docs search plan pinned with CROSS JOIN** (`mcp/novahiz-docs/src/store.ts`):
+  SQLite 3.51.3 (node:sqlite of node 22.23.x) reorders the plain JOIN — it
+  drives from `chunks(library)` and re-evaluates the full FTS MATCH for every
+  chunk of the library (50 × ~6 ms ≈ 315 ms instead of ~14 ms), collapsing
+  the 100 ms reading budget (742-1085 ms observed on CI runners). SQLite
+  never reorders a CROSS JOIN (`optoverview` 7.1.2, `lang_select` 2.2), so
+  the plan is now pinned on every runtime: 315.8 → 13.3 ms on 3.51.3,
+  unchanged 14.1 ms on 3.53.3 — same result set, only the plan changes.
+
 ## [0.7.0] - 2026-10-08
 
 Feature release: the Obsidian vault becomes a first-class citizen of the

package/dist/spec.js

@@ -282,15 +282,40 @@ function readCatalog(path) {
 // gates lifecycle scripts, and the postinstall only previews anyway), so a
 // brand-new machine has no catalog in its home yet — every command used to die
 // with ENOENT right after the documented install. The package ships its own
-// catalog/: fall back to it before failing. The entry script (bin/novahiz.mjs,
-// dist/cli.js or src/cli.ts) always sits exactly one directory below the
-// package root, so dirname(argv[1])/.. resolves in every supported shape.
+// catalog/: fall back to it before failing.
+// Audit 2026-10-08: the old one-level assumption (dirname(argv[1])/..) held for
+// bin/ and src/ but NOT for mcp/<server>/index.mjs — two levels down it pointed
+// at mcp/catalog/ (absent), so on any machine without a home catalog (CI,
+// fresh npm-global) the memory MCP degraded on every call: red CI on Linux,
+// memory_write/search dead for the community path. Walk up instead: the package
+// root is the nearest ancestor carrying a package.json, preferring name
+// "novahiz"; a stray nested manifest is kept only as a last resort.
 // Exported: doctor resolves the shipped skills/ the same way.
 export function packageRoot() {
     const entry = process.argv[1];
     if (!entry || entry.length === 0)
         return null;
-    return join(dirname(resolve(entry)), "..");
+    let dir = dirname(resolve(entry));
+    let loose = null;
+    for (let depth = 0; depth < 6; depth += 1) {
+        const manifest = join(dir, "package.json");
+        if (existsSync(manifest)) {
+            try {
+                const name = JSON.parse(readFileSync(manifest, "utf8")).name;
+                if (name === "novahiz")
+                    return dir;
+                loose ??= dir;
+            }
+            catch {
+                // manifest illisible: on remonte quand meme.
+            }
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return loose;
 }
 // The home copy always wins when present, because that is what the installer
 // refreshes.

package/mcp/novahiz-docs/src/store.ts

@@ -148,10 +148,19 @@ export function search(db: DatabaseSync, query: string, options: SearchOptions =
   if (match === null) return [];
   const limit = Math.min(Math.max(Math.trunc(options.limit ?? 5), 1), 50);
   const filterLibrary = options.library !== undefined && options.library.length > 0;
+  // CROSS JOIN et non JOIN : SQLite ne reordonne JAMAIS les operandes d'un
+  // CROSS JOIN (optoverview 7.1.2 / lang_select 2.2 — le mecanisme documente
+  // pour imposer l'ordre des boucles imbriquees). Avec un JOIN simple, le
+  // planner de SQLite 3.51.3 (node 22.23.x) sort chunks (index library) en
+  // boucle externe et re-evalue le MATCH complet pour chaque chunk : 50 x
+  // ~6 ms = ~315 ms au lieu de ~14 ms — le budget de lecture de 100 ms
+  // s'ecroule, CI rouge sur node 22. Le resultat est identique (jointure
+  // interne), seul le plan change. Bench du 2026-10-08 : 315.8 -> 13.3 ms
+  // sous 3.51.3, 14.0 -> 14.1 ms sous 3.53.3.
   const sql =
     "SELECT c.library, c.version, c.source_url, c.license, c.fetched_at, c.heading_path, c.ord, " +
     "snippet(chunks_fts, 0, '[', ']', '…', 16) AS snippet, bm25(chunks_fts) AS score " +
-    "FROM chunks_fts JOIN chunks c ON c.id = chunks_fts.rowid " +
+    "FROM chunks_fts CROSS JOIN chunks c ON c.id = chunks_fts.rowid " +
     `WHERE chunks_fts MATCH ?${filterLibrary ? " AND c.library = ?" : ""} ` +
     "ORDER BY bm25(chunks_fts) LIMIT ?";
   const params: Array<string | number> = [match];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "novahiz",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Enforce AI agent skills before every file edit: prompt classifier, skill catalog, and pre-edit gate.",
   "type": "module",
   "license": "Apache-2.0",

package/src/spec.ts

@@ -474,14 +474,36 @@ function readCatalog<T>(path: string): T {
 // gates lifecycle scripts, and the postinstall only previews anyway), so a
 // brand-new machine has no catalog in its home yet — every command used to die
 // with ENOENT right after the documented install. The package ships its own
-// catalog/: fall back to it before failing. The entry script (bin/novahiz.mjs,
-// dist/cli.js or src/cli.ts) always sits exactly one directory below the
-// package root, so dirname(argv[1])/.. resolves in every supported shape.
+// catalog/: fall back to it before failing.
+// Audit 2026-10-08: the old one-level assumption (dirname(argv[1])/..) held for
+// bin/ and src/ but NOT for mcp/<server>/index.mjs — two levels down it pointed
+// at mcp/catalog/ (absent), so on any machine without a home catalog (CI,
+// fresh npm-global) the memory MCP degraded on every call: red CI on Linux,
+// memory_write/search dead for the community path. Walk up instead: the package
+// root is the nearest ancestor carrying a package.json, preferring name
+// "novahiz"; a stray nested manifest is kept only as a last resort.
 // Exported: doctor resolves the shipped skills/ the same way.
 export function packageRoot(): string | null {
   const entry = process.argv[1];
   if (!entry || entry.length === 0) return null;
-  return join(dirname(resolve(entry)), "..");
+  let dir = dirname(resolve(entry));
+  let loose: string | null = null;
+  for (let depth = 0; depth < 6; depth += 1) {
+    const manifest = join(dir, "package.json");
+    if (existsSync(manifest)) {
+      try {
+        const name = (JSON.parse(readFileSync(manifest, "utf8")) as { name?: string }).name;
+        if (name === "novahiz") return dir;
+        loose ??= dir;
+      } catch {
+        // manifest illisible: on remonte quand meme.
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return loose;
 }
 
 // The home copy always wins when present, because that is what the installer