novahiz 0.9.1 → 0.9.3

package/CHANGELOG.md

@@ -3,6 +3,61 @@
 All notable changes to Novahiz are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.9.3] - 2026-10-11
+
+### Changed
+
+- **CI verifies the suite and the installer dry-run on Windows and macOS**
+  — the matrix keeps the Ubuntu node grid (22 / 22.18.0 / 24) and adds one
+  node-24 job each on `windows-latest` and `macos-latest` (5 jobs).
+  Previously only Ubuntu ran in CI; Windows rested on local runs and macOS
+  on nothing at all.
+
+### Fixed
+
+- **`install.sh` is executable in the package** — mode moved from 100644
+  to 100755, so `./install/install.sh` no longer fails with permission
+  denied on Linux/macOS.
+- **macOS memory CLI test compares canonical paths** — `$TMPDIR` on macOS
+  is a symlink (`/var` → `/private/var`); the first-ever macOS CI run
+  caught `tests/memory-cli.test.ts` asserting the CLI's resolved root
+  against a raw string. Both sides now go through `realpathSync`.
+
+### Notes
+
+- Cross-platform claims re-checked against primary sources: GitHub docs
+  (matrix `include` adds non-mergeable combinations → 5 jobs, confirmed by
+  the runs), npm docs (`--allow-scripts=novahiz` is the documented way to
+  approve a global install; a package cannot self-authorize), Playwright
+  docs (WebKit runs on all three OSes; Linux needs its system libraries).
+  The README now carries the Linux remedy: `npx playwright install-deps
+  webkit`.
+
+## [0.9.2] - 2026-10-11
+
+### Fixed
+
+- **Memory root lock: no more silent marker loss under contention** — a
+  transient `EPERM`/`EBUSY` when reading `.lock` (Windows filter driver
+  under I/O load) was indistinguishable from "absent", so a waiter could
+  delete the lock of a **live** holder: two critical sections, one
+  read-modify-write clobbered, one marker lost while both writers exited 0.
+  `readLock` is now tri-state (`ok` / `absent` / `unreadable`); a steal
+  requires a confirmed stale lock (dead pid or age) plus an immediate
+  re-read (closes the TOCTOU window); a torn file left by a crash is
+  detected via `mtime > LOCK_STALE_MS` and only then removed.
+- **`acquireRootLock` no longer crashes on transient create errors** — the
+  same `EPERM` on the `wx` create (reproduced: 2 crashes in 40 rounds
+  under 6 CPU burners) now retries with the existing deadline and ends in
+  a loud `E_LOCK` instead of killing the caller.
+
+### Notes
+
+- Proven under load: 60/60 stress rounds clean after the fix (2/40 rounds
+  crashed before). Two new deterministic tests (torn + fresh mtime →
+  `E_LOCK` with the foreign lock intact; torn + old mtime → stolen).
+  Suite 613 tests / 612 pass / 0 fail; CI green on Windows and Linux.
+
 ## [0.9.1] - 2026-10-10
 
 ### Fixed

package/README.md

@@ -63,6 +63,8 @@ npm antérieur à 11.16 exécute les scripts par défaut : `npm install -g novah
 
 > Piège : `npm install -g --allow-scripts=novahiz` **sans** le nom du paquet installe le dossier courant et échoue avec `ENOENT: package.json`. Le nom du paquet est obligatoire : `npm install -g --allow-scripts=novahiz novahiz`.
 
+> Linux : le serveur Playwright MCP s'exécute sous WebKit (règle maison : Chromium interdit). WebKit exige ses dépendances système : si le navigateur ne démarre pas, `npx playwright install-deps webkit` (sudo requis sur Debian/Ubuntu).
+
 Puis vérifiez :
 
 ```bash

package/dist/memory.js

@@ -203,25 +203,57 @@ function isProcessAlive(pid) {
         return error.code === "EPERM";
     }
 }
-function readLockInfo(root) {
+function readLock(root) {
+    let raw;
     try {
-        const raw = readFileSync(lockPath(root), "utf8");
-        const [pidRaw, atRaw] = raw.split("\n");
-        const pid = Number(pidRaw);
-        const at = Number(atRaw);
-        if (!Number.isInteger(pid) || !Number.isFinite(at))
-            return null;
-        return { pid, at };
+        raw = readFileSync(lockPath(root), "utf8");
     }
-    catch {
-        // Absent ou illisible: traite comme un verrou perime.
-        return null;
+    catch (error) {
+        // ENOENT = certitude: pas de verrou. Tout le reste (EPERM/EBUSY/EACCES:
+        // filtre antivirus sous tempete I/O sur Windows, reproduit en stress)
+        // est incertain — une lecture qui echoue ne prouve pas que le detenteur
+        // est mort, et traiter l'incertain comme un verrou perime volait le
+        // verrou d'un processus vivant: deux sections critiques, une ecriture
+        // ecrasee, un marqueur perdu sans erreur.
+        const code = error.code;
+        return code === "ENOENT" ? { state: "absent" } : { state: "unreadable" };
+    }
+    const [pidRaw, atRaw] = raw.split("\n");
+    const pid = Number(pidRaw);
+    const at = Number(atRaw);
+    if (!Number.isInteger(pid) || !Number.isFinite(at))
+        return { state: "unreadable" };
+    return { state: "ok", info: { pid, at } };
+}
+function tryStealLock(root) {
+    const read = readLock(root);
+    if (read.state === "absent")
+        return true;
+    if (read.state === "unreadable") {
+        // Lecture incertaine ou contenu dechire: jamais de vol sur une lecture
+        // qui a echoue. Un fichier dechire abandonne par un crash (write non
+        // atomique) ne se detecte que par son age: mtime au-dela de
+        // LOCK_STALE_MS = detenteur disparu, on peut le retirer.
+        try {
+            if (Date.now() - statSync(lockPath(root)).mtimeMs <= LOCK_STALE_MS)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    else {
+        const { info } = read;
+        if (isProcessAlive(info.pid) && Date.now() - info.at <= LOCK_STALE_MS)
+            return false;
+        // Relecture avant unlink: si le verrou a change de main entre la
+        // decision de vol et la suppression (fenetre TOCTOU), on recule.
+        const again = readLock(root);
+        if (again.state === "unreadable")
+            return false;
+        if (again.state === "ok" && (again.info.pid !== info.pid || again.info.at !== info.at))
+            return false;
     }
-}
-function tryStealLock(root, info) {
-    const stale = info === null || !isProcessAlive(info.pid) || Date.now() - info.at > LOCK_STALE_MS;
-    if (!stale)
-        return false;
     try {
         unlinkSync(lockPath(root));
     }
@@ -252,20 +284,25 @@ export function acquireRootLock(root, waitMs = LOCK_WAIT_DEFAULT_MS) {
             return () => releaseRootLock(root);
         }
         catch (error) {
-            if (error.code !== "EEXIST")
+            const code = error.code;
+            // EEXIST = verrou pris; EPERM/EBUSY/EACCES = transitoire (filtre
+            // antivirus sous charge, EPERM reproduit en stress sur .lock): on
+            // reessaie dans la boucle au lieu de planter l'appelant. Le delai
+            // couvre un blocage durable (alors E_LOCK, bruyant, non corrupteur).
+            if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES")
                 throw error;
         }
-        const info = readLockInfo(root);
-        if (info !== null && info.pid === process.pid && Date.now() - info.at <= LOCK_STALE_MS) {
+        const read = readLock(root);
+        if (read.state === "ok" && read.info.pid === process.pid && Date.now() - read.info.at <= LOCK_STALE_MS) {
             // Notre propre verrou (section interrompue par un crash precedent au
             // meme pid): on le reprend en reentrant.
             lockDepth.set(root, 1);
             return () => releaseRootLock(root);
         }
-        if (tryStealLock(root, info))
+        if (tryStealLock(root))
             continue;
         if (Date.now() >= deadline) {
-            const holder = info === null ? "illisible" : String(info.pid);
+            const holder = read.state === "ok" ? String(read.info.pid) : read.state;
             throw memError("E_LOCK", `verrou memoire occupe (pid ${holder}) sous ${root}`);
         }
         sleepSync(LOCK_RETRY_MS);
@@ -279,11 +316,12 @@ function releaseRootLock(root) {
     }
     lockDepth.delete(root);
     try {
-        const info = readLockInfo(root);
-        if (info === null || info.pid === process.pid)
+        const read = readLock(root);
+        // Lecture incertaine ou absente: on est le detenteur, on libere quand
+        // meme. Un verrou lisible d'un autre pid n'est pas le notre (course
+        // apres peremption): on ne touche pas au fichier d'un tiers.
+        if (read.state !== "ok" || read.info.pid === process.pid)
             unlinkSync(lockPath(root));
-        // Verrou repris par un autre (course apres peremption): on ne touche pas
-        // au fichier d'un tiers.
     }
     catch {
         // Deja libere (ENOENT) ou lecture echouee: rien a faire.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "novahiz",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Enforce AI agent skills before every file edit: prompt classifier, skill catalog, and pre-edit gate.",
   "type": "module",
   "license": "Apache-2.0",

package/src/memory.ts

@@ -295,24 +295,52 @@ function isProcessAlive(pid: number): boolean {
   }
 }
 
-function readLockInfo(root: string): { pid: number; at: number } | null {
+type LockInfo = { pid: number; at: number };
+type LockRead = { state: "ok"; info: LockInfo } | { state: "absent" } | { state: "unreadable" };
+
+function readLock(root: string): LockRead {
+  let raw: string;
   try {
-    const raw = readFileSync(lockPath(root), "utf8");
-    const [pidRaw, atRaw] = raw.split("\n");
-    const pid = Number(pidRaw);
-    const at = Number(atRaw);
-    if (!Number.isInteger(pid) || !Number.isFinite(at)) return null;
-    return { pid, at };
-  } catch {
-    // Absent ou illisible: traite comme un verrou perime.
-    return null;
+    raw = readFileSync(lockPath(root), "utf8");
+  } catch (error) {
+    // ENOENT = certitude: pas de verrou. Tout le reste (EPERM/EBUSY/EACCES:
+    // filtre antivirus sous tempete I/O sur Windows, reproduit en stress)
+    // est incertain — une lecture qui echoue ne prouve pas que le detenteur
+    // est mort, et traiter l'incertain comme un verrou perime volait le
+    // verrou d'un processus vivant: deux sections critiques, une ecriture
+    // ecrasee, un marqueur perdu sans erreur.
+    const code = (error as NodeJS.ErrnoException).code;
+    return code === "ENOENT" ? { state: "absent" } : { state: "unreadable" };
+  }
+  const [pidRaw, atRaw] = raw.split("\n");
+  const pid = Number(pidRaw);
+  const at = Number(atRaw);
+  if (!Number.isInteger(pid) || !Number.isFinite(at)) return { state: "unreadable" };
+  return { state: "ok", info: { pid, at } };
+}
+
+function tryStealLock(root: string): boolean {
+  const read = readLock(root);
+  if (read.state === "absent") return true;
+  if (read.state === "unreadable") {
+    // Lecture incertaine ou contenu dechire: jamais de vol sur une lecture
+    // qui a echoue. Un fichier dechire abandonne par un crash (write non
+    // atomique) ne se detecte que par son age: mtime au-dela de
+    // LOCK_STALE_MS = detenteur disparu, on peut le retirer.
+    try {
+      if (Date.now() - statSync(lockPath(root)).mtimeMs <= LOCK_STALE_MS) return false;
+    } catch {
+      return false;
+    }
+  } else {
+    const { info } = read;
+    if (isProcessAlive(info.pid) && Date.now() - info.at <= LOCK_STALE_MS) return false;
+    // Relecture avant unlink: si le verrou a change de main entre la
+    // decision de vol et la suppression (fenetre TOCTOU), on recule.
+    const again = readLock(root);
+    if (again.state === "unreadable") return false;
+    if (again.state === "ok" && (again.info.pid !== info.pid || again.info.at !== info.at)) return false;
   }
-}
-
-function tryStealLock(root: string, info: { pid: number; at: number } | null): boolean {
-  const stale =
-    info === null || !isProcessAlive(info.pid) || Date.now() - info.at > LOCK_STALE_MS;
-  if (!stale) return false;
   try {
     unlinkSync(lockPath(root));
   } catch (error) {
@@ -342,18 +370,23 @@ export function acquireRootLock(root: string, waitMs = LOCK_WAIT_DEFAULT_MS): ()
       lockDepth.set(root, 1);
       return () => releaseRootLock(root);
     } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      const code = (error as NodeJS.ErrnoException).code;
+      // EEXIST = verrou pris; EPERM/EBUSY/EACCES = transitoire (filtre
+      // antivirus sous charge, EPERM reproduit en stress sur .lock): on
+      // reessaie dans la boucle au lieu de planter l'appelant. Le delai
+      // couvre un blocage durable (alors E_LOCK, bruyant, non corrupteur).
+      if (code !== "EEXIST" && code !== "EPERM" && code !== "EBUSY" && code !== "EACCES") throw error;
     }
-    const info = readLockInfo(root);
-    if (info !== null && info.pid === process.pid && Date.now() - info.at <= LOCK_STALE_MS) {
+    const read = readLock(root);
+    if (read.state === "ok" && read.info.pid === process.pid && Date.now() - read.info.at <= LOCK_STALE_MS) {
       // Notre propre verrou (section interrompue par un crash precedent au
       // meme pid): on le reprend en reentrant.
       lockDepth.set(root, 1);
       return () => releaseRootLock(root);
     }
-    if (tryStealLock(root, info)) continue;
+    if (tryStealLock(root)) continue;
     if (Date.now() >= deadline) {
-      const holder = info === null ? "illisible" : String(info.pid);
+      const holder = read.state === "ok" ? String(read.info.pid) : read.state;
       throw memError("E_LOCK", `verrou memoire occupe (pid ${holder}) sous ${root}`);
     }
     sleepSync(LOCK_RETRY_MS);
@@ -368,10 +401,11 @@ function releaseRootLock(root: string): void {
   }
   lockDepth.delete(root);
   try {
-    const info = readLockInfo(root);
-    if (info === null || info.pid === process.pid) unlinkSync(lockPath(root));
-    // Verrou repris par un autre (course apres peremption): on ne touche pas
-    // au fichier d'un tiers.
+    const read = readLock(root);
+    // Lecture incertaine ou absente: on est le detenteur, on libere quand
+    // meme. Un verrou lisible d'un autre pid n'est pas le notre (course
+    // apres peremption): on ne touche pas au fichier d'un tiers.
+    if (read.state !== "ok" || read.info.pid === process.pid) unlinkSync(lockPath(root));
   } catch {
     // Deja libere (ENOENT) ou lecture echouee: rien a faire.
   }