novahiz 0.9.8 → 0.9.9

package/CHANGELOG.md

@@ -5,6 +5,44 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.9] - 2026-10-16
+
+### Changed
+
+- **`novahiz upgrade --apply` now finishes the job it started** - it stopped at
+  `npm install -g novahiz@latest`, which refreshes the global package and
+  nothing else: `~/.config/novahiz`, the plugin copy and the MCP entrypoints
+  stayed on the previous version. It now resyncs the whole installation from
+  the fresh package (`install.mjs --yes --clean`) on both channels, so
+  `novahiz update` behaves exactly the same. If the update or the resync
+  fails, the command stops and reports the error instead of announcing a
+  completed upgrade.
+
+### Added
+
+- **A cleanup of the previous installation, opt-in** - an update used to leave
+  behind whatever it no longer shipped: a renamed skill stayed loadable, a
+  removed plugin stayed registered. `install.mjs --clean` now removes the files
+  a previous install wrote whose source has disappeared. The only proof of
+  ownership is the install manifest (`.novahiz-install.json`, field `created`):
+  a skill or a command placed by a pack is not in it, so it cannot be removed.
+  The rule "absent from the source" was the tempting one and it is wrong here —
+  it would have deleted `impeccable`, which the pack keeps in
+  `~/.agents/skills`. Three guards hold: only files under the four installed
+  roots, never after a failed step, never without `--clean`. A `.novahiz-bak`
+  goes with the file it backed up and never alone. `novahiz.config.json`,
+  `project-memory/` and `novahiz.sqlite` sit outside those roots, untouched by
+  construction.
+
+### Fixed
+
+- **`pruneEmptyDirs` never removed anything** - it called
+  `rmSync(dir, { recursive: false })`, which throws `ERR_FS_EISDIR` on a
+  directory, and the surrounding `catch` swallowed the error. The function
+  looked like it worked and silently left every emptied directory behind, for
+  `novahiz uninstall` as well. It now uses `recursive: true`, which is safe
+  because the directory is already known to be empty.
+
 ## [0.9.8] - 2026-10-15
 
 ### Removed

package/adapters/opencode/commands/novahiz-upgrade.md

@@ -8,6 +8,6 @@ description: Check for a new Novahiz version and update it via npm. Arguments: $
 
 3. If an update is available, report the installed -> latest versions, then ask the user for explicit approval. Never run the update without that approval (skip this confirmation only when `$ARGUMENTS` contains `--yes`).
 
-4. After approval, run `novahiz upgrade --apply` (same CLI used in step 1). This runs `npm install -g novahiz@latest` for npm installs, or `git pull --ff-only` plus a catalog rebuild for source checkouts. Report the exact result, including any npm/git error verbatim — never claim success you did not observe.
+4. After approval, run `novahiz upgrade --apply` (same CLI used in step 1). It installs `novahiz@latest` globally for npm installs, or pulls with `--ff-only` for source checkouts, then resyncs the Novahiz home and the opencode config from the fresh package and cleans what the previous version left behind. The cleanup only removes files the previous install manifest proves Novahiz wrote and whose source no longer exists: pack skills, `novahiz.config.json`, `project-memory/` and the vault are never touched. If the update or the resync fails, the command stops before the cleanup. Report the exact result, including any npm/git error verbatim — never claim success you did not observe.
 
 5. Finish by telling the user to restart OpenCode completely so the new version loads. Offer `novahiz doctor` as the follow-up check.

package/dist/commands/upgrade.js

@@ -82,7 +82,7 @@ export function runNpm(args, stdio) {
         stderr: result.stderr ?? ""
     };
 }
-function npmFlow(parsed, root) {
+function npmFlow(parsed, root, home) {
     const local = readLocalVersion(root);
     const view = runNpm(["view", "novahiz", "version"], "pipe");
     if (view.status !== 0) {
@@ -107,9 +107,48 @@ function npmFlow(parsed, root) {
         process.exitCode = 1;
         return;
     }
-    process.stdout.write(`Updated to ${latest}.\n` +
+    // `npm install -g` ne met a jour QUE le package global : ~/.config/novahiz
+    // reste sur l'ancienne version, plugin et MCP comprises. Sans ce passage le
+    // user croit sa mise a jour faite alors que la moitie du systeme bouge pas.
+    if (!resyncAndClean(home))
+        return;
+    process.stdout.write(`Updated to ${latest}. The installation was resynced from the new package.\n` +
         "Restart OpenCode completely to load the new version, then run `novahiz doctor` if anything looks off.\n");
 }
+/**
+ * Resynchronise le home novahiz depuis le package fraichement mis a jour, puis
+ * efface ce que l'ancienne version laissait derriere elle.
+ *
+ * Deux installations coexistent : le package (node_modules global ou checkout
+ * git) et le home (~/.config/novahiz, plus ses copies dans le dossier de
+ * config opencode). Ce passage est ce qui les remet d'accord. `--clean` ne
+ * retire que des fichiers dont le manifeste d'installation prouve que novahiz
+ * les a ecrits et dont la source a disparu.
+ */
+function resyncAndClean(home) {
+    const installer = join(PKG_ROOT, "install", "install.mjs");
+    if (!existsSync(installer)) {
+        process.stderr.write(`novahiz upgrade: installer not found at ${installer}.\n` +
+            "Run `node install/install.mjs --yes --clean` from the package root to finish the update.\n");
+        process.exitCode = 1;
+        return false;
+    }
+    process.stdout.write("\nResyncing the installation and removing files no longer shipped...\n");
+    const env = { ...process.env, NOVAHIZ_HOME: home };
+    // S'execute-t-on depuis un script npm ? Alors npm_lifecycle_event est encore
+    // present dans l'environnement, et l'installateur bascule en phase differee
+    // (il attend la mort de npm avant de bouger). Ici npm n'a rien en cours :
+    // le defer laisserait la commande renvoyer avant la fin du resync.
+    delete env.npm_lifecycle_event;
+    const result = spawnSync(process.execPath, [installer, "--yes", "--clean"], { stdio: "inherit", env });
+    if (result.status !== 0) {
+        process.stderr.write("novahiz upgrade: resync failed, the previous installation was left as it is.\n" +
+            "Run `node install/install.mjs --yes --clean` from the package root to retry.\n");
+        process.exitCode = 1;
+        return false;
+    }
+    return true;
+}
 /** Flux git historique (install source) : dry-run par defaut, --apply tire. */
 function gitFlow(parsed, home) {
     if (!existsSync(join(home, ".git"))) {
@@ -144,6 +183,11 @@ function gitFlow(parsed, home) {
     if (existsSync(syncCli)) {
         spawnSync(process.execPath, [syncCli, "sync"], { stdio: "inherit", env: { ...process.env, NOVAHIZ_HOME: home } });
     }
+    // Meme resynchronisation que le canal npm : les copies dans le dossier de
+    // config opencode viennent du home, pas du depot, et le nettoyage retire ce
+    // que l'ancienne version laissait.
+    if (!resyncAndClean(home))
+        return;
     process.stdout.write("\nUpgraded! Restart OpenCode to apply changes.\n");
 }
 export function commandUpgrade(parsed) {
@@ -159,7 +203,7 @@ export function commandUpgrade(parsed) {
     // `npm i -g` n'a aucun .git dans ~/.config/novahiz.
     const target = detectTarget(PKG_ROOT, existsSync(join(home, ".git")));
     if (target === "npm") {
-        npmFlow(parsed, PKG_ROOT);
+        npmFlow(parsed, PKG_ROOT, home);
         return;
     }
     if (target === "git") {

package/install/install.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { cpSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join, relative, resolve } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import {
+  cleanupPreviousInstall,
   copyFileWithBackup,
   copyInto,
   defaultConfig,
@@ -45,7 +46,8 @@ const STEPS = [
   "MCP servers",
   "opencode config",
   "Obsidian vault (second-memory)",
-  "Finalize"
+  "Finalize",
+  "Cleanup previous install"
 ];
 
 const CORE_ITEMS = [
@@ -75,6 +77,11 @@ async function main() {
   // jamais dans le dossier de config opencode que le serveur surveille.
   const deferOpencode = deferOpencodePhase(flags);
   const force = Boolean(flags.force);
+  // --clean : efface, a la fin du passage, les fichiers poses par une
+  // installation precedente qui ne sont plus livres. Par defaut inactif : une
+  // premiere installation ne doit pas declencher de suppression. C'est
+  // `novahiz upgrade --apply` qui l'active.
+  const clean = Boolean(flags.clean);
   const withSkills = !flags["no-skills"];
   const root = repoRoot(import.meta.url);
   const home = NovahizHome(flags);
@@ -239,6 +246,10 @@ async function main() {
   const backups = [];
   let coreCopied = false;
   let configCreated = false;
+  // Cause d'arret du nettoyage final. Une exception empeche deja d'atteindre la
+  // fin du script ; ce drapeau couvre le cas qu'une exception ne signale pas :
+  // un sous-processus qui sort sur un code non nul (catalogue, dependances).
+  let stepFailure = null;
 
   const sameRoot = resolve(root) === resolve(home);
   ui.step("Core files");
@@ -420,6 +431,7 @@ async function main() {
       });
       if (result.stdout) ui.raw(result.stdout);
       if (result.status !== 0 && result.stderr) ui.raw(result.stderr);
+      if (result.status !== 0) stepFailure = stepFailure ?? "catalog sync";
     }
   }
 
@@ -810,7 +822,46 @@ async function main() {
         note("Dependencies up to date.");
       }
     }
+
+  }
+
+  // --- Nettoyage de l'installation precedente ------------------------------
+  // Une mise a jour ne peut pas laisser derriere elle des skills renommes, des
+  // plugins retires ou des commandes devenues obsoles : ils restent charges au
+  // prochain demarrage. L'effacement ne s'appuie que sur une preuve de
+  // propriete, le manifeste d'installation precedent ; un fichier pose par un
+  // pack ou par l'utilisateur n'y figure pas et n'est jamais retenu.
+  ui.step("Cleanup previous install");
+  const ownedRoots = [
+    { dest: skillsDir, src: join(home, "skills") },
+    { dest: pluginsDir, src: join(home, "adapters", "opencode") },
+    { dest: join(configDir, "agent"), src: join(home, "adapters", "opencode", "agent") },
+    { dest: join(configDir, "commands"), src: join(home, "adapters", "opencode", "commands") }
+  ];
+  const cleanup = cleanupPreviousInstall({ home, configDir, roots: ownedRoots, clean, dryRun, stepFailure });
+  for (const path of cleanup.removed) note(`  removed: ${relative(home, path)}`);
+  for (const path of cleanup.stale ?? []) note(`  would remove: ${relative(home, path)}`);
+  if (cleanup.removed.length > 0) {
+    // L'index tient encore la liste des skills supprimes : on le rejoue une
+    // fois, sinon le prochain routage classifiera vers un skill parti.
+    const cleanupCli = join(home, "src", "cli.ts");
+    if (existsSync(cleanupCli)) {
+      note("Rebuilding catalog after cleanup (sync)");
+      const rebuild = spawnSync(process.execPath, [cleanupCli, "sync"], {
+        encoding: "utf8",
+        env: { ...process.env, NOVAHIZ_HOME: home }
+      });
+      if (rebuild.stdout) ui.raw(rebuild.stdout);
+      if (rebuild.status !== 0 && rebuild.stderr) ui.raw(rebuild.stderr);
+    }
+  }
+  ui.finishStep(cleanup.status, cleanup.detail);
+
+  if (!dryRun) {
     const summary = [`Novahiz installed in ${home}.`];
+    if (cleanup.removed.length > 0) {
+      summary.push(`${cleanup.removed.length} stale file(s) from a previous install removed.`);
+    }
     if (deferLogPath) summary.push(`opencode config phase: deferred - see ${deferLogPath} (runs once npm exits).`);
     if (configured.length > 0) summary.push("Restart opencode to activate the plugin and MCP server.");
     summary.push("Gate can be disabled with the NOVAHIZ_GATE=off environment variable.");

package/install/lib.d.mts

@@ -30,6 +30,8 @@ export interface NovahizManifest {
   configCreated?: boolean;
   created?: string[];
   backups?: BackupEntry[];
+  /** Horodatage du dernier nettoyage (install.mjs --clean). */
+  cleanedAt?: string;
 }
 
 export interface NovahizConfig {
@@ -74,6 +76,40 @@ export declare function saveManifest(home: string, manifest: NovahizManifest): v
 export declare function mergeCreated(previous?: string[], next?: string[]): string[];
 export declare function mergeBackups(previous?: BackupEntry[], next?: BackupEntry[]): BackupEntry[];
 export declare function pruneEmptyDirs(paths: string[], stops?: string[]): void;
+
+// --- Nettoyage de l'installation precedente -------------------------------
+export interface OwnedRoot {
+  /** Racine de destination : la ou novahiz pose ses fichiers. */
+  dest: string;
+  /** Racine source equivalente, dans le package. */
+  src: string;
+}
+
+export interface CleanupResult {
+  /** Valeur attendue par ui.finishStep : "done" ou "skip". */
+  status: "done" | "skip";
+  /** Phrase expliquant l'issue, affichee telle quelle par l'installateur. */
+  detail: string;
+  /** Chemins reels supprimes ; toujours vide en mode a blanc. */
+  removed: string[];
+  /** Present uniquement en mode a blanc : ce qui partirait. */
+  stale?: string[];
+}
+
+export declare function withinDir(value: string, dir: string): boolean;
+export declare function staleOwnedPaths(
+  created: string[] | undefined,
+  roots: OwnedRoot[],
+  exists?: (path: string) => boolean,
+): string[];
+export declare function cleanupPreviousInstall(options: {
+  home: string;
+  configDir: string;
+  roots: OwnedRoot[];
+  clean: boolean;
+  dryRun?: boolean;
+  stepFailure?: string | null;
+}): CleanupResult;
 export declare function detectedHarnesses(dirs: Record<string, string>, whichFn?: (cmd: string) => boolean): string[];
 export declare function which(cmd: string): boolean;
 export declare function nodeVersionOk(minimum?: [number, number, number]): boolean;

package/install/lib.mjs

@@ -1,6 +1,6 @@
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join, resolve, sep } from "node:path";
+import { dirname, join, relative, resolve, sep } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
@@ -267,6 +267,106 @@ export function mergeBackups(previous = [], next = []) {
   return [...map.values()].sort((a, b) => (a.path < b.path ? -1 : 1));
 }
 
+/** `dir` englobe `value` (egalite comprise), insensible a la casse sous Windows. */
+export function withinDir(value, dir) {
+  const normalize = (item) => (process.platform === "win32" ? item.toLowerCase() : item);
+  const base = normalize(resolve(dir));
+  const target = normalize(resolve(value));
+  return target === base || target.startsWith(base.endsWith(sep) ? base : `${base}${sep}`);
+}
+
+/**
+ * Fichiers que novahiz a poses et qui n'ont plus de source.
+ *
+ * Le manifeste d'installation (.novahiz-install.json, champ `created`) est la
+ * seule preuve de propriete : un fichier ecrit par un pack ou par l'utilisateur
+ * n'y figure pas et n'est donc jamais retenu. Trois gardes, dans l'ordre :
+ *   1. le chemin est sous une racine declaree source -> destination,
+ *   2. sa contrepartie dans la source n'existe plus,
+ *   3. ce n'est ni la config de l'utilisateur ni une sauvegarde seule.
+ * Un `.novahiz-bak` part avec le fichier dont il est la copie : une sauvegarde
+ * dont le fichier d'origine existe toujours reste en place.
+ */
+export function staleOwnedPaths(created, roots, exists = existsSync) {
+  const out = [];
+  for (const item of created ?? []) {
+    if (typeof item !== "string" || item.length === 0) continue;
+    if (item.endsWith("novahiz.config.json")) continue;
+    const root = roots.find((entry) => withinDir(item, entry.dest));
+    if (!root) continue;
+    const rel = relative(root.dest, item);
+    if (!rel || rel.startsWith("..")) continue;
+    if (exists(join(root.src, rel))) continue;
+    // Un manifeste peut nommer un fichier deja parti (supprime a la main).
+    // Il ne compte pas : `removed` doit ne lister que ce qui a vraiment bouge.
+    const backup = `${item}.novahiz-bak`;
+    if (exists(item)) out.push(item);
+    if (exists(backup)) out.push(backup);
+  }
+  return [...new Set(out)];
+}
+
+/**
+ * Decide et applique le nettoyage de l'installation precedente.
+ *
+ * Renvoie `{ status, detail, removed }`, `status` etant la valeur attendue par
+ * ui.finishStep ("done" ou "skip"). Seule preuve de propriete : le manifeste
+ * d'installation precedent, champ `created`, qui liste les chemins ecrits par
+ * novahiz lui-meme. Un fichier de pack ou de l'utilisateur n'y figure pas, il
+ * ne peut donc pas partir. Trois cas de sortie :
+ *   - `--clean` absent, ou echec d'une etape precedente : skip, rien ne bouge ;
+ *   - rien de retire : done ;
+ *   - au moins un fichier retire : done, manifeste mis a jour.
+ *
+ * Vit ici et non dans install.mjs : ce module est sans effet de bord a
+ * l'import, l'installateur execute main() au chargement.
+ */
+export function cleanupPreviousInstall({ home, configDir, roots, clean, dryRun = false, stepFailure = null }) {
+  if (!clean) {
+    return { status: "skip", detail: "pass --clean to remove files from a previous install", removed: [] };
+  }
+  if (stepFailure) {
+    return { status: "skip", detail: `an earlier step failed (${stepFailure}), cleanup aborted`, removed: [] };
+  }
+  const manifest = loadManifest(home);
+  // Deux preuves de propriete, pas une. `created` ne liste que les fichiers
+  // poses pour la premiere fois : sur une installation qui existait deja,
+  // chaque copie renvoyait `created: null` et rien n'etait enregistre, ce qui
+  // rendait le nettoyage inerte. `backups[].path` liste les fichiers ecrases,
+  // donc ecrits par novahiz — c'est la preuve qui manquait.
+  const owned = [
+    ...(manifest.created ?? []),
+    ...(manifest.backups ?? []).map((entry) => (entry && entry.path) || "").filter((path) => path.length > 0)
+  ];
+  const stale = staleOwnedPaths(owned, roots);
+  if (stale.length === 0) {
+    return { status: "done", detail: "no leftover file from a previous install", removed: [] };
+  }
+  if (dryRun) {
+    return {
+      status: "skip",
+      detail: `${stale.length} file(s) would be removed by a real run with --clean`,
+      removed: [],
+      stale
+    };
+  }
+  const removed = [];
+  for (const item of stale) {
+    rmSync(item, { force: true });
+    removed.push(item);
+  }
+  pruneEmptyDirs(removed, [configDir, ...roots.map((entry) => entry.dest)]);
+  saveManifest(home, {
+    ...manifest,
+    created: (manifest.created ?? []).filter((item) => !removed.includes(item)),
+    backups: (manifest.backups ?? []).filter(
+      (entry) => !removed.includes(entry.path) && !removed.includes(entry.backup)
+    ),
+    cleanedAt: new Date().toISOString()
+  });
+  return { status: "done", detail: `${removed.length} file(s) from a previous install removed`, removed };
+}
+
 export function pruneEmptyDirs(paths, stops = []) {
   const stopSet = new Set(stops.map((value) => resolve(value)));
   const candidates = new Set();
@@ -282,7 +382,11 @@ export function pruneEmptyDirs(paths, stops = []) {
       while (current && existsSync(current) && !stopSet.has(resolve(current))) {
         try {
           if (readdirSync(current).length !== 0) break;
-          rmSync(current, { recursive: false });
+          // recursive:false leve ERR_FS_EISDIR sur un repertoire : rm ne
+          // supprime qu'un fichier avec cet option, et le catch ci-dessous
+          // avalait l'erreur en faisant passer la fonction pour silencieuse.
+          // Le repertoire est deja vide ici, recursion sans effet de bord.
+          rmSync(current, { recursive: true });
           removed = true;
           const parent = dirname(current);
           if (parent === current) break;

package/install/uninstall.mjs

@@ -2,7 +2,11 @@
 import { cpSync, existsSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve, sep } from "node:path";
-import { loadManifest, NovahizHome, parseArgs, pruneEmptyDirs, saveManifest } from "./lib.mjs";
+import { loadManifest, NovahizHome, parseArgs, pruneEmptyDirs, saveManifest, withinDir } from "./lib.mjs";
+
+// Partage avec lib.mjs (staleOwnedPaths) ; re-exporte ici pour que l'API
+// publique de ce module ne bouge pas.
+export { withinDir };
 
 export function underHome(value) {
   const root = resolve(homedir());
@@ -13,13 +17,6 @@ export function underHome(value) {
   return candidate === normalize(root) || candidate.startsWith(prefix);
 }
 
-export function withinDir(value, dir) {
-  const normalize = (item) => (process.platform === "win32" ? item.toLowerCase() : item);
-  const base = normalize(resolve(dir));
-  const target = normalize(resolve(value));
-  return target === base || target.startsWith(base.endsWith(sep) ? base : `${base}${sep}`);
-}
-
 function main() {
   const flags = parseArgs(process.argv.slice(2));
   const dryRun = Boolean(flags["dry-run"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "novahiz",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "description": "Enforce AI agent skills before every file edit: prompt classifier, skill catalog, and pre-edit gate.",
   "type": "module",
   "license": "Apache-2.0",

package/src/commands/upgrade.ts

@@ -90,7 +90,7 @@ export function runNpm(args: string[], stdio: "inherit" | "pipe"): { status: num
   };
 }
 
-function npmFlow(parsed: Parsed, root: string): void {
+function npmFlow(parsed: Parsed, root: string, home: string): void {
   const local = readLocalVersion(root);
   const view = runNpm(["view", "novahiz", "version"], "pipe");
   if (view.status !== 0) {
@@ -115,12 +115,55 @@ function npmFlow(parsed: Parsed, root: string): void {
     process.exitCode = 1;
     return;
   }
+  // `npm install -g` ne met a jour QUE le package global : ~/.config/novahiz
+  // reste sur l'ancienne version, plugin et MCP comprises. Sans ce passage le
+  // user croit sa mise a jour faite alors que la moitie du systeme bouge pas.
+  if (!resyncAndClean(home)) return;
   process.stdout.write(
-    `Updated to ${latest}.\n` +
+    `Updated to ${latest}. The installation was resynced from the new package.\n` +
       "Restart OpenCode completely to load the new version, then run `novahiz doctor` if anything looks off.\n"
   );
 }
 
+/**
+ * Resynchronise le home novahiz depuis le package fraichement mis a jour, puis
+ * efface ce que l'ancienne version laissait derriere elle.
+ *
+ * Deux installations coexistent : le package (node_modules global ou checkout
+ * git) et le home (~/.config/novahiz, plus ses copies dans le dossier de
+ * config opencode). Ce passage est ce qui les remet d'accord. `--clean` ne
+ * retire que des fichiers dont le manifeste d'installation prouve que novahiz
+ * les a ecrits et dont la source a disparu.
+ */
+function resyncAndClean(home: string): boolean {
+  const installer = join(PKG_ROOT, "install", "install.mjs");
+  if (!existsSync(installer)) {
+    process.stderr.write(
+      `novahiz upgrade: installer not found at ${installer}.\n` +
+        "Run `node install/install.mjs --yes --clean` from the package root to finish the update.\n"
+    );
+    process.exitCode = 1;
+    return false;
+  }
+  process.stdout.write("\nResyncing the installation and removing files no longer shipped...\n");
+  const env = { ...process.env, NOVAHIZ_HOME: home };
+  // S'execute-t-on depuis un script npm ? Alors npm_lifecycle_event est encore
+  // present dans l'environnement, et l'installateur bascule en phase differee
+  // (il attend la mort de npm avant de bouger). Ici npm n'a rien en cours :
+  // le defer laisserait la commande renvoyer avant la fin du resync.
+  delete (env as Record<string, string | undefined>).npm_lifecycle_event;
+  const result = spawnSync(process.execPath, [installer, "--yes", "--clean"], { stdio: "inherit", env });
+  if (result.status !== 0) {
+    process.stderr.write(
+      "novahiz upgrade: resync failed, the previous installation was left as it is.\n" +
+        "Run `node install/install.mjs --yes --clean` from the package root to retry.\n"
+    );
+    process.exitCode = 1;
+    return false;
+  }
+  return true;
+}
+
 /** Flux git historique (install source) : dry-run par defaut, --apply tire. */
 function gitFlow(parsed: Parsed, home: string): void {
   if (!existsSync(join(home, ".git"))) {
@@ -154,6 +197,10 @@ function gitFlow(parsed: Parsed, home: string): void {
   if (existsSync(syncCli)) {
     spawnSync(process.execPath, [syncCli, "sync"], { stdio: "inherit", env: { ...process.env, NOVAHIZ_HOME: home } });
   }
+  // Meme resynchronisation que le canal npm : les copies dans le dossier de
+  // config opencode viennent du home, pas du depot, et le nettoyage retire ce
+  // que l'ancienne version laissait.
+  if (!resyncAndClean(home)) return;
   process.stdout.write("\nUpgraded! Restart OpenCode to apply changes.\n");
 }
 
@@ -170,7 +217,7 @@ export function commandUpgrade(parsed: Parsed): void {
   // `npm i -g` n'a aucun .git dans ~/.config/novahiz.
   const target = detectTarget(PKG_ROOT, existsSync(join(home, ".git")));
   if (target === "npm") {
-    npmFlow(parsed, PKG_ROOT);
+    npmFlow(parsed, PKG_ROOT, home);
     return;
   }
   if (target === "git") {