novahiz 0.9.5 → 0.9.6

package/CHANGELOG.md

@@ -5,6 +5,57 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.6] - 2026-10-15
+
+### Added
+
+- **`PRODUCT.md` and `DESIGN.md`** - the product context and the visual-system
+  record `impeccable` asks for, both written from sources in the repository
+  (`README.md`, `docs/CONSTITUTION.md`, `src/render.ts`) with anything they do
+  not settle marked "not determined" instead of guessed. `novahiz doctor` runs
+  from a project now finds both instead of two `fail` rows; when doctor runs
+  from the Novahiz home both rows are skipped by design
+  (`impeccableChecks` returns early when `cwd === home`).
+
+- **`when.pathExcludes`** - a rule-level *negative* selector, the counterpart of
+  `pathGlobs`. A rule carrying it never applies to a matching path, whatever the
+  other selectors say. With `match: "any"` a prompt category alone fired on any
+  file, so `design-ui` demanded the frontend design skills on unit tests, and
+  inclusion-only selectors could not express "never on tests" (`**/*.tsx` also
+  matches `tests/Foo.test.tsx`). Applied to the five design-scoped rules
+  (R11-accessibility, R13-design-craft, R14-impeccable, R16-stitch-fidelity,
+  R17-wireframe), which now skip `**/tests/**`, `**/__tests__/**`,
+  `**/*.test.*` and `**/*.spec.*`. R9-code-review and R10-security are
+  untouched — a test is still code — and R15-token-economy keeps its own
+  `**/tests/token-economy.test.ts` target.
+
+### Changed
+
+- **The installer states its own limit** - `install.mjs` now prints that
+  `deps --install` is an install-only pass: packs already present are left
+  untouched, and `/novahiz-skills-update` (`deps --install --update`) is what
+  refreshes them. Installation and update stay separate commands by choice — a
+  reinstall must not overwrite local skill edits — but the choice was previously
+  only written down in `docs/PROVIDERS.md`, not shown to the person installing.
+
+### Fixed
+
+- **`doctor` no longer advises a command that cannot help** - the "Referenced
+  skills" row counted every absent non-shipped skill as a pack skill and
+  answered "run /novahiz-skills-update, or novahiz deps --install". Measured on
+  the 0.9.5 install: the 7 skills it named are `eas-app-stores`, `eas-hosting`,
+  `eas-observe`, `eas-simulator`, `eas-update`, `eas-update-insights`,
+  `eas-workflows`, referenced as `defaultSkills` by the `test` and `devops`
+  categories, while `catalog/providers.json` ships four skill packs only
+  (`flutter-skills`, `dart-skills`, `expo-skills`, `impeccable`) and the expo
+  command names 20 `expo-*` skills, no `eas-*`. `deps --install` accordingly
+  returned `install: []` and exited 0 - nothing to install. The row now reads
+  each pack's `install` argv (`--skill` list, or `--skill *` resolved to the
+  repo's leading segment, so `dart-lang/skills` covers `dart-*`), and skills no
+  pack can deliver are named as such instead of being sent after a command that
+  installs nothing. New `tests/doctor-referenced-skills.test.ts` pins the
+  contract - eight cases, none existed before.
+
 ## [0.9.5] - 2026-10-15
 
 > 0.9.4 was prepared on 2026-10-14 but never tagged nor published to npm

package/catalog/rules.json

@@ -94,7 +94,8 @@
     "description": "Load novahiz-wcag-audit on design-ui work and on audit prompts, where accessibility is in scope.",
     "when": {
       "match": "any",
-      "promptCategories": ["design-ui", "audit"]
+      "promptCategories": ["design-ui", "audit"],
+      "pathExcludes": ["**/tests/**", "**/__tests__/**", "**/*.test.*", "**/*.spec.*"]
     },
     "require": ["novahiz-wcag-audit"]
   },
@@ -121,7 +122,8 @@
         "**/*.html",
         "**/*.htm"
       ],
-      "minChange": 200
+      "minChange": 200,
+      "pathExcludes": ["**/tests/**", "**/__tests__/**", "**/*.test.*", "**/*.spec.*"]
     },
     "require": ["novahiz-humanizer", "ui-slop-remover", "ui-craft-rules"]
   },
@@ -139,7 +141,8 @@
         "**/*.html",
         "**/*.htm"
       ],
-      "minChange": 200
+      "minChange": 200,
+      "pathExcludes": ["**/tests/**", "**/__tests__/**", "**/*.test.*", "**/*.spec.*"]
     },
     "require": ["impeccable"]
   },
@@ -172,7 +175,8 @@
         "**/*.scss",
         "**/*.html"
       ],
-      "projectGlobs": ["stitch/**"]
+      "projectGlobs": ["stitch/**"],
+      "pathExcludes": ["**/tests/**", "**/__tests__/**", "**/*.test.*", "**/*.spec.*"]
     },
     "require": ["novahiz-stitch-fidelity"]
   },
@@ -192,7 +196,8 @@
         "**/components/**"
       ],
       "tiers": ["lite", "full"],
-      "minChange": 800
+      "minChange": 800,
+      "pathExcludes": ["**/tests/**", "**/__tests__/**", "**/*.test.*", "**/*.spec.*"]
     },
     "require": ["novahiz-wireframe"]
   },

package/dist/commands/doctor.js

@@ -460,19 +460,72 @@ export function referencedSkillsCheck(spec, indexSkills, packageRootDir) {
         }
     }
     const absentShipped = absent.filter((id) => shipped.has(id));
-    const absentPack = absent.length - absentShipped.length;
+    const absentPack = absent.filter((id) => !shipped.has(id));
+    // Only promise the update command when a pack can actually deliver what is
+    // missing: see packDelivery below.
+    const { exact, prefixes } = packDelivery(spec);
+    const deliverable = (id) => exact.has(id) || prefixes.some((p) => id.startsWith(p));
+    const undeliverable = absentPack.filter((id) => !deliverable(id));
+    const present = referenced.length - absent.length;
+    let detail;
+    if (absent.length === 0)
+        detail = `${present} present`;
+    else if (absentShipped.length > 0)
+        detail = `missing from index: ${absent.join(", ")}`;
+    else {
+        detail = `${present} present, ${absentPack.length} pack skills not installed`;
+        // A skill the catalog references but no pack ships can never be installed —
+        // say so instead of sending the reader after a command that returns nothing.
+        detail +=
+            undeliverable.length > 0
+                ? `; ${undeliverable.join(", ")} referenced by no pack (deps cannot install them)`
+                : " (run /novahiz-skills-update, or novahiz deps --install)";
+    }
     return {
         id: "referenced",
         label: "Referenced skills",
         ok: absentShipped.length === 0,
-        detail: absent.length === 0
-            ? `${referenced.length} present`
-            : absentShipped.length > 0
-                ? `missing from index: ${absent.join(", ")}`
-                : `${referenced.length - absent.length} present, ${absentPack} pack skills not installed (run /novahiz-skills-update, or novahiz deps --install)`,
+        detail,
         blocking: absentShipped.length > 0
     };
 }
+/** Skills a provider pack could really install, read off each pack's `install`
+ *  argv: an explicit `--skill a b c` names them, and `--skill *` delivers the
+ *  whole repo, whose ids start with the repo's leading segment with any hyphen
+ *  suffix dropped (`flutter/skills` -> `flutter-`, `dart-lang/skills` ->
+ *  `dart-`). Measured 2026-10-15: the 7 skills doctor reported as "pack skills
+ *  not installed" are `eas-*`, referenced as `defaultSkills` by the `test` and
+ *  `devops` categories while no provider ships them, so
+ *  "run /novahiz-skills-update, or novahiz deps --install" could not have
+ *  installed a single one. Advice no command can honour is a defect. */
+function packDelivery(spec) {
+    const exact = new Set();
+    const prefixes = [];
+    const disabled = new Set(spec.config.providers.disabled);
+    for (const provider of spec.providers) {
+        if (disabled.has(provider.id))
+            continue;
+        const argv = provider.install;
+        if (!Array.isArray(argv) || argv.length === 0)
+            continue;
+        const at = argv.indexOf("--skill");
+        if (at === -1)
+            continue;
+        const args = argv.slice(at + 1).filter((arg) => !arg.startsWith("-"));
+        if (args.length === 0)
+            continue;
+        if (args.includes("*")) {
+            const repo = String(argv.find((arg) => arg.includes("/")) ?? "");
+            const head = repo.split("/")[0].split("-")[0];
+            if (head.length > 0)
+                prefixes.push(`${head}-`);
+        }
+        for (const id of args)
+            if (id !== "*")
+                exact.add(id);
+    }
+    return { exact, prefixes };
+}
 /** Impeccable design-context checks: PRODUCT.md and DESIGN.md resolution
  *  (root -> .agents/context -> docs/). Rows appear only when the impeccable
  *  skill is installed (opt-in) and are never blocking: a missing record is a

package/dist/gate.js

@@ -301,6 +301,15 @@ function selectorMatches(rule, classification, path, categories, pathless = fals
         checks.push(when.promptCategories.some((category) => categories.includes(category)));
     }
     else {
+        // E1: pathExcludes is the negative counterpart of pathGlobs. A rule that
+        // carries it never applies to an excluded path, whatever the other
+        // selectors say — the only way to express "never on tests" when match is
+        // "any", where a prompt category alone would otherwise fire on any file.
+        if (when.pathExcludes &&
+            when.pathExcludes.length > 0 &&
+            when.pathExcludes.some((glob) => globToRegExp(glob).test(path))) {
+            return false;
+        }
         if (when.fileClasses && when.fileClasses.length > 0)
             checks.push(when.fileClasses.includes(classification));
         if (when.pathGlobs && when.pathGlobs.length > 0)

package/install/install.mjs

@@ -459,6 +459,14 @@ async function main() {
       });
       if (result.stdout) ui.raw(result.stdout);
       if (result.status !== 0 && result.stderr) process.stderr.write(result.stderr);
+      // Arbitrage assumé: installation et mise à jour restent deux commandes.
+      // `deps --install` est idempotent — un pack déjà présent n'est jamais
+      // rafraîchi ici, sinon une réinstallation écraserait les retouches
+      // locales. C'est documenté dans docs/PROVIDERS.md; on le dit aussi à
+      // l'écran plutôt que de laisser le paquet sembler à jour sans l'être.
+      if (autoInstall && result.status === 0) {
+        note("Installs only: skill packs already present are left untouched. Refresh them with /novahiz-skills-update (deps --install --update).");
+      }
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "novahiz",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Enforce AI agent skills before every file edit: prompt classifier, skill catalog, and pre-edit gate.",
   "type": "module",
   "license": "Apache-2.0",

package/src/commands/doctor.ts

@@ -459,21 +459,65 @@ export function referencedSkillsCheck(
     }
   }
   const absentShipped = absent.filter((id) => shipped.has(id));
-  const absentPack = absent.length - absentShipped.length;
+  const absentPack = absent.filter((id) => !shipped.has(id));
+  // Only promise the update command when a pack can actually deliver what is
+  // missing: see packDelivery below.
+  const { exact, prefixes } = packDelivery(spec);
+  const deliverable = (id: string): boolean => exact.has(id) || prefixes.some((p) => id.startsWith(p));
+  const undeliverable = absentPack.filter((id) => !deliverable(id));
+  const present = referenced.length - absent.length;
+  let detail: string;
+  if (absent.length === 0) detail = `${present} present`;
+  else if (absentShipped.length > 0) detail = `missing from index: ${absent.join(", ")}`;
+  else {
+    detail = `${present} present, ${absentPack.length} pack skills not installed`;
+    // A skill the catalog references but no pack ships can never be installed —
+    // say so instead of sending the reader after a command that returns nothing.
+    detail +=
+      undeliverable.length > 0
+        ? `; ${undeliverable.join(", ")} referenced by no pack (deps cannot install them)`
+        : " (run /novahiz-skills-update, or novahiz deps --install)";
+  }
   return {
     id: "referenced",
     label: "Referenced skills",
     ok: absentShipped.length === 0,
-    detail:
-      absent.length === 0
-        ? `${referenced.length} present`
-        : absentShipped.length > 0
-          ? `missing from index: ${absent.join(", ")}`
-          : `${referenced.length - absent.length} present, ${absentPack} pack skills not installed (run /novahiz-skills-update, or novahiz deps --install)`,
+    detail,
     blocking: absentShipped.length > 0
   };
 }
 
+/** Skills a provider pack could really install, read off each pack's `install`
+ *  argv: an explicit `--skill a b c` names them, and `--skill *` delivers the
+ *  whole repo, whose ids start with the repo's leading segment with any hyphen
+ *  suffix dropped (`flutter/skills` -> `flutter-`, `dart-lang/skills` ->
+ *  `dart-`). Measured 2026-10-15: the 7 skills doctor reported as "pack skills
+ *  not installed" are `eas-*`, referenced as `defaultSkills` by the `test` and
+ *  `devops` categories while no provider ships them, so
+ *  "run /novahiz-skills-update, or novahiz deps --install" could not have
+ *  installed a single one. Advice no command can honour is a defect. */
+function packDelivery(spec: ReturnType<typeof loadSpec>): { exact: Set<string>; prefixes: string[] } {
+  const exact = new Set<string>();
+  const prefixes: string[] = [];
+  const disabled = new Set(spec.config.providers.disabled);
+  for (const provider of spec.providers) {
+    if (disabled.has(provider.id)) continue;
+    const argv = provider.install;
+    if (!Array.isArray(argv) || argv.length === 0) continue;
+    const at = argv.indexOf("--skill");
+    if (at === -1) continue;
+    const args = argv.slice(at + 1).filter((arg) => !arg.startsWith("-"));
+    if (args.length === 0) continue;
+    if (args.includes("*")) {
+      const repo = String(argv.find((arg) => arg.includes("/")) ?? "");
+      const head = repo.split("/")[0].split("-")[0];
+      if (head.length > 0) prefixes.push(`${head}-`);
+    }
+    for (const id of args) if (id !== "*") exact.add(id);
+  }
+  return { exact, prefixes };
+}
+
 /** Impeccable design-context checks: PRODUCT.md and DESIGN.md resolution
  *  (root -> .agents/context -> docs/). Rows appear only when the impeccable
  *  skill is installed (opt-in) and are never blocking: a missing record is a

package/src/gate.ts

@@ -291,6 +291,17 @@ function selectorMatches(rule: Rule, classification: FileClass, path: string, ca
     if (!when.promptCategories || when.promptCategories.length === 0) return false;
     checks.push(when.promptCategories.some((category) => categories.includes(category)));
   } else {
+    // E1: pathExcludes is the negative counterpart of pathGlobs. A rule that
+    // carries it never applies to an excluded path, whatever the other
+    // selectors say — the only way to express "never on tests" when match is
+    // "any", where a prompt category alone would otherwise fire on any file.
+    if (
+      when.pathExcludes &&
+      when.pathExcludes.length > 0 &&
+      when.pathExcludes.some((glob) => globToRegExp(glob).test(path))
+    ) {
+      return false;
+    }
     if (when.fileClasses && when.fileClasses.length > 0) checks.push(when.fileClasses.includes(classification));
     if (when.pathGlobs && when.pathGlobs.length > 0) checks.push(when.pathGlobs.some((glob) => globToRegExp(glob).test(path)));
     if (when.promptCategories && when.promptCategories.length > 0) {

package/src/spec.ts

@@ -35,6 +35,12 @@ type RuleWhen = {
   match?: "any" | "all";
   fileClasses?: string[];
   pathGlobs?: string[];
+  /** Negative counterpart of pathGlobs: the rule never applies to a path
+   * matching one of these globs, whatever the other selectors say. This is the
+   * only way to express "never on tests" when match is "any", where a prompt
+   * category on its own would otherwise fire on any file, unit tests included.
+   * Omitted = no exclusion, exactly as before. */
+  pathExcludes?: string[];
   /** Project-scoped selector: the rule applies only when at least one file under
    * the project root (nearest ancestor of the edited file holding .git,
    * package.json or pubspec.yaml) matches one of these globs, written from that