sequant 1.11.0 → 1.13.0

package/dist/src/lib/plugin-version-sync.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Plugin version sync utilities
+ *
+ * Ensures plugin.json version stays in sync with package.json version.
+ * Used by CI validation and /release skill.
+ */
+export interface VersionSyncResult {
+    inSync: boolean;
+    packageVersion: string | null;
+    pluginVersion: string | null;
+    error?: string;
+}
+/**
+ * Check if package.json and plugin.json versions are in sync
+ *
+ * @param projectRoot - Root directory of the project
+ * @returns Sync status with version details
+ */
+export declare function checkVersionSync(projectRoot?: string): VersionSyncResult;
+/**
+ * Get a helpful error message for version mismatch
+ *
+ * @param result - Version sync result
+ * @returns Human-readable error message with fix command
+ */
+export declare function getVersionMismatchMessage(result: VersionSyncResult): string;

package/dist/src/lib/plugin-version-sync.js

@@ -0,0 +1,91 @@
+/**
+ * Plugin version sync utilities
+ *
+ * Ensures plugin.json version stays in sync with package.json version.
+ * Used by CI validation and /release skill.
+ */
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+/**
+ * Check if package.json and plugin.json versions are in sync
+ *
+ * @param projectRoot - Root directory of the project
+ * @returns Sync status with version details
+ */
+export function checkVersionSync(projectRoot = process.cwd()) {
+    const packageJsonPath = join(projectRoot, "package.json");
+    const pluginJsonPath = join(projectRoot, ".claude-plugin", "plugin.json");
+    // Check package.json exists
+    if (!existsSync(packageJsonPath)) {
+        return {
+            inSync: false,
+            packageVersion: null,
+            pluginVersion: null,
+            error: "package.json not found",
+        };
+    }
+    // Check plugin.json exists
+    if (!existsSync(pluginJsonPath)) {
+        return {
+            inSync: false,
+            packageVersion: null,
+            pluginVersion: null,
+            error: "plugin.json not found",
+        };
+    }
+    try {
+        const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+        const pluginJson = JSON.parse(readFileSync(pluginJsonPath, "utf8"));
+        const packageVersion = packageJson.version || null;
+        const pluginVersion = pluginJson.version || null;
+        if (!packageVersion) {
+            return {
+                inSync: false,
+                packageVersion: null,
+                pluginVersion,
+                error: "package.json missing version field",
+            };
+        }
+        if (!pluginVersion) {
+            return {
+                inSync: false,
+                packageVersion,
+                pluginVersion: null,
+                error: "plugin.json missing version field",
+            };
+        }
+        return {
+            inSync: packageVersion === pluginVersion,
+            packageVersion,
+            pluginVersion,
+        };
+    }
+    catch (e) {
+        return {
+            inSync: false,
+            packageVersion: null,
+            pluginVersion: null,
+            error: `Failed to parse JSON: ${e instanceof Error ? e.message : String(e)}`,
+        };
+    }
+}
+/**
+ * Get a helpful error message for version mismatch
+ *
+ * @param result - Version sync result
+ * @returns Human-readable error message with fix command
+ */
+export function getVersionMismatchMessage(result) {
+    if (result.inSync) {
+        return `✓ Versions are in sync: ${result.packageVersion}`;
+    }
+    if (result.error) {
+        return `✗ Version sync check failed: ${result.error}`;
+    }
+    return `✗ Version mismatch!
+  package.json: ${result.packageVersion}
+  plugin.json:  ${result.pluginVersion}
+
+Run the following to sync:
+  node -e "const p=require('./.claude-plugin/plugin.json');p.version='${result.packageVersion}';require('fs').writeFileSync('./.claude-plugin/plugin.json',JSON.stringify(p,null,2)+'\\n')"`;
+}

package/dist/src/lib/project-name.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Project name detection utility
+ *
+ * Detects project name from various sources in priority order:
+ * 1. package.json → name field
+ * 2. Cargo.toml → [package] name
+ * 3. pyproject.toml → [project] name OR [tool.poetry] name
+ * 4. go.mod → module path (last segment)
+ * 5. git remote → extract repo name from origin URL
+ * 6. Directory name → basename(cwd) (fallback)
+ */
+/**
+ * Result of project name detection
+ */
+export interface ProjectNameResult {
+    /** The detected project name */
+    name: string;
+    /** The source from which the name was detected */
+    source: "package.json" | "Cargo.toml" | "pyproject.toml" | "go.mod" | "git-remote" | "directory";
+}
+/**
+ * Detect project name from available sources
+ *
+ * Tries sources in priority order:
+ * 1. package.json
+ * 2. Cargo.toml
+ * 3. pyproject.toml
+ * 4. go.mod
+ * 5. git remote
+ * 6. directory name
+ *
+ * @returns The detected project name and its source
+ */
+export declare function detectProjectName(): Promise<ProjectNameResult>;
+/**
+ * Detect project name, returning just the name string
+ *
+ * Convenience function for cases where only the name is needed.
+ */
+export declare function getProjectName(): Promise<string>;

package/dist/src/lib/project-name.js

@@ -0,0 +1,191 @@
+/**
+ * Project name detection utility
+ *
+ * Detects project name from various sources in priority order:
+ * 1. package.json → name field
+ * 2. Cargo.toml → [package] name
+ * 3. pyproject.toml → [project] name OR [tool.poetry] name
+ * 4. go.mod → module path (last segment)
+ * 5. git remote → extract repo name from origin URL
+ * 6. Directory name → basename(cwd) (fallback)
+ */
+import { basename } from "path";
+import { spawnSync } from "child_process";
+import { fileExists, readFile } from "./fs.js";
+/**
+ * Extract project name from package.json
+ */
+async function fromPackageJson() {
+    if (!(await fileExists("package.json"))) {
+        return null;
+    }
+    try {
+        const content = await readFile("package.json");
+        const pkg = JSON.parse(content);
+        if (typeof pkg.name === "string" && pkg.name.trim()) {
+            return pkg.name.trim();
+        }
+    }
+    catch {
+        // Parse error or missing name field
+    }
+    return null;
+}
+/**
+ * Extract project name from Cargo.toml (Rust)
+ */
+async function fromCargoToml() {
+    if (!(await fileExists("Cargo.toml"))) {
+        return null;
+    }
+    try {
+        const content = await readFile("Cargo.toml");
+        // Look for: name = "project-name" in [package] section
+        // Simple regex approach - handles most common formats
+        const match = content.match(/\[package\][\s\S]*?name\s*=\s*["']([^"']+)["']/);
+        if (match && match[1]) {
+            return match[1].trim();
+        }
+    }
+    catch {
+        // Parse error
+    }
+    return null;
+}
+/**
+ * Extract project name from pyproject.toml (Python)
+ */
+async function fromPyprojectToml() {
+    if (!(await fileExists("pyproject.toml"))) {
+        return null;
+    }
+    try {
+        const content = await readFile("pyproject.toml");
+        // Try [project] name first (PEP 621 standard)
+        const projectMatch = content.match(/\[project\][\s\S]*?name\s*=\s*["']([^"']+)["']/);
+        if (projectMatch && projectMatch[1]) {
+            return projectMatch[1].trim();
+        }
+        // Fallback to [tool.poetry] name
+        const poetryMatch = content.match(/\[tool\.poetry\][\s\S]*?name\s*=\s*["']([^"']+)["']/);
+        if (poetryMatch && poetryMatch[1]) {
+            return poetryMatch[1].trim();
+        }
+    }
+    catch {
+        // Parse error
+    }
+    return null;
+}
+/**
+ * Extract project name from go.mod (Go)
+ */
+async function fromGoMod() {
+    if (!(await fileExists("go.mod"))) {
+        return null;
+    }
+    try {
+        const content = await readFile("go.mod");
+        // Look for: module github.com/org/project-name
+        const match = content.match(/^module\s+(.+)$/m);
+        if (match && match[1]) {
+            const modulePath = match[1].trim();
+            // Extract the last segment of the module path
+            const segments = modulePath.split("/");
+            const lastSegment = segments[segments.length - 1];
+            if (lastSegment) {
+                return lastSegment;
+            }
+        }
+    }
+    catch {
+        // Parse error
+    }
+    return null;
+}
+/**
+ * Extract project name from git remote origin URL
+ */
+function fromGitRemote() {
+    try {
+        const result = spawnSync("git", ["remote", "get-url", "origin"], {
+            encoding: "utf-8",
+            timeout: 5000,
+        });
+        if (result.status !== 0 || !result.stdout) {
+            return null;
+        }
+        const url = result.stdout.trim();
+        // Handle SSH format: git@github.com:org/repo.git
+        const sshMatch = url.match(/[:/]([^/]+)\.git$/);
+        if (sshMatch && sshMatch[1]) {
+            return sshMatch[1];
+        }
+        // Handle HTTPS format: https://github.com/org/repo.git or https://github.com/org/repo
+        const httpsMatch = url.match(/\/([^/]+?)(?:\.git)?$/);
+        if (httpsMatch && httpsMatch[1]) {
+            return httpsMatch[1];
+        }
+    }
+    catch {
+        // Git not available or not a git repo
+    }
+    return null;
+}
+/**
+ * Get project name from directory name (fallback)
+ */
+function fromDirectory() {
+    return basename(process.cwd()) || "project";
+}
+/**
+ * Detect project name from available sources
+ *
+ * Tries sources in priority order:
+ * 1. package.json
+ * 2. Cargo.toml
+ * 3. pyproject.toml
+ * 4. go.mod
+ * 5. git remote
+ * 6. directory name
+ *
+ * @returns The detected project name and its source
+ */
+export async function detectProjectName() {
+    // 1. Try package.json
+    const fromPkg = await fromPackageJson();
+    if (fromPkg) {
+        return { name: fromPkg, source: "package.json" };
+    }
+    // 2. Try Cargo.toml
+    const fromCargo = await fromCargoToml();
+    if (fromCargo) {
+        return { name: fromCargo, source: "Cargo.toml" };
+    }
+    // 3. Try pyproject.toml
+    const fromPyproject = await fromPyprojectToml();
+    if (fromPyproject) {
+        return { name: fromPyproject, source: "pyproject.toml" };
+    }
+    // 4. Try go.mod
+    const fromGo = await fromGoMod();
+    if (fromGo) {
+        return { name: fromGo, source: "go.mod" };
+    }
+    // 5. Try git remote
+    const fromRemote = fromGitRemote();
+    if (fromRemote) {
+        return { name: fromRemote, source: "git-remote" };
+    }
+    // 6. Fallback to directory name
+    return { name: fromDirectory(), source: "directory" };
+}
+/**
+ * Detect project name, returning just the name string
+ *
+ * Convenience function for cases where only the name is needed.
+ */
+export async function getProjectName() {
+    const result = await detectProjectName();
+    return result.name;
+}

package/dist/src/lib/semgrep.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Semgrep integration for static analysis
+ *
+ * Provides stack-aware ruleset mapping and execution utilities
+ * for integrating Semgrep into the /qa workflow.
+ */
+/**
+ * Semgrep finding severity levels
+ */
+export type SemgrepSeverity = "error" | "warning" | "info";
+/**
+ * A single Semgrep finding
+ */
+export interface SemgrepFinding {
+    path: string;
+    line: number;
+    column?: number;
+    endLine?: number;
+    endColumn?: number;
+    message: string;
+    ruleId: string;
+    severity: SemgrepSeverity;
+    category?: string;
+}
+/**
+ * Result of a Semgrep scan
+ */
+export interface SemgrepResult {
+    success: boolean;
+    findings: SemgrepFinding[];
+    criticalCount: number;
+    warningCount: number;
+    infoCount: number;
+    error?: string;
+    skipped?: boolean;
+    skipReason?: string;
+}
+/**
+ * Semgrep ruleset configuration
+ */
+export interface SemgrepRuleset {
+    name: string;
+    description: string;
+    rules: string[];
+}
+/**
+ * Stack-to-ruleset mapping
+ *
+ * Maps detected stacks to appropriate Semgrep rulesets.
+ * Uses Semgrep's public rule registry identifiers.
+ */
+export declare const STACK_RULESETS: Record<string, SemgrepRuleset>;
+/**
+ * Get the appropriate Semgrep ruleset for a detected stack
+ *
+ * @param stack - The detected stack name (e.g., "nextjs", "python")
+ * @returns The ruleset configuration for the stack
+ */
+export declare function getRulesForStack(stack: string | null): SemgrepRuleset;
+/**
+ * Path to custom rules file
+ */
+export declare const CUSTOM_RULES_PATH = ".sequant/semgrep-rules.yaml";
+/**
+ * Check if custom rules file exists
+ *
+ * @param projectRoot - Root directory of the project
+ * @returns true if custom rules file exists
+ */
+export declare function hasCustomRules(projectRoot?: string): boolean;
+/**
+ * Get path to custom rules file if it exists
+ *
+ * @param projectRoot - Root directory of the project
+ * @returns Path to custom rules file, or null if it doesn't exist
+ */
+export declare function getCustomRulesPath(projectRoot?: string): string | null;
+/**
+ * Check if Semgrep is available
+ *
+ * Checks for both 'semgrep' command and 'npx semgrep' fallback
+ *
+ * @returns Object with availability info and command to use
+ */
+export declare function checkSemgrepAvailability(): Promise<{
+    available: boolean;
+    command: string;
+    useNpx: boolean;
+}>;
+/**
+ * Parse Semgrep JSON output into findings
+ *
+ * @param output - Raw JSON output from Semgrep
+ * @returns Array of parsed findings
+ */
+export declare function parseSemgrepOutput(output: string): SemgrepFinding[];
+/**
+ * Count findings by severity
+ *
+ * @param findings - Array of Semgrep findings
+ * @returns Object with counts by severity
+ */
+export declare function countFindingsBySeverity(findings: SemgrepFinding[]): {
+    critical: number;
+    warning: number;
+    info: number;
+};
+/**
+ * Run Semgrep scan on specified files or directories
+ *
+ * @param options - Scan options
+ * @returns Scan result with findings
+ */
+export declare function runSemgrepScan(options: {
+    targets: string[];
+    stack?: string | null;
+    projectRoot?: string;
+    useCustomRules?: boolean;
+}): Promise<SemgrepResult>;
+/**
+ * Format findings for display in QA output
+ *
+ * @param findings - Array of findings to format
+ * @returns Formatted markdown string
+ */
+export declare function formatFindingsForDisplay(findings: SemgrepFinding[]): string;
+/**
+ * Generate QA verdict contribution from Semgrep results
+ *
+ * @param result - Semgrep scan result
+ * @returns Verdict contribution (blocking if critical findings)
+ */
+export declare function getSemgrepVerdictContribution(result: SemgrepResult): {
+    blocking: boolean;
+    reason: string;
+};