sequant 2.10.0 → 2.12.0

package/dist/src/lib/locks/lock-manager.js

@@ -18,18 +18,57 @@
  * method is a no-op (no fs touches, no warnings). Mirrors the
  * `OrchestratorRenderer` pattern at `src/lib/cli-ui/run-renderer.ts:244`.
  */
-import { openSync, closeSync, writeSync, readFileSync, existsSync, unlinkSync, mkdirSync, readdirSync, statSync, } from "fs";
-import { join, resolve } from "path";
+import { openSync, closeSync, writeSync, readFileSync, existsSync, unlinkSync, renameSync, linkSync, mkdirSync, readdirSync, statSync, } from "fs";
+import { basename, dirname, join, resolve } from "path";
+import { execFileSync } from "child_process";
 import * as os from "os";
 import { DEFAULT_LOCKS_DIR, DEFAULT_MAX_LOCK_AGE_MS, DEFAULT_SKILL_LOCK_TTL_MS, DEFAULT_STALE_AGE_MS, LockFileSchema, } from "./types.js";
 /** Detect orchestrator mode purely from env (no caching) so tests can mutate. */
 export function isOrchestratorMode() {
     return Boolean(process.env.SEQUANT_ORCHESTRATOR);
 }
-/** Resolve the locks directory honoring `SEQUANT_LOCKS_DIR` for test isolation. */
+/**
+ * Resolve the checkout root shared by the main worktree and every linked
+ * worktree of the same repository (#909). `--git-common-dir` (unlike
+ * `--show-toplevel`) points at the same physical `.git` for all of them, so
+ * a linked worktree lands on the main checkout's `.sequant/locks` instead of
+ * growing its own — matching what `pre-tool.sh`'s checkout guard reads.
+ * Returns `null` outside a git repository (or if `git` is unavailable).
+ *
+ * Deliberately omits `--path-format=absolute` (Git >=2.31, 2021): that flag
+ * failing on an older git would fall into the same `catch` as "not a repo"
+ * and silently re-open the bug this function exists to fix, with no signal
+ * that the cause was an old toolchain rather than a bare directory. Plain
+ * `--git-common-dir` (Git >=2.5, 2015) is resolved by hand instead —
+ * `resolve(cwd, out)` is a no-op when git already returned an absolute path
+ * (the common linked-worktree case) and anchors a relative one (the common
+ * main-checkout case) to `cwd`, so it is correct either way.
+ */
+function resolveGitCheckoutRoot(cwd) {
+    try {
+        const commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
+            cwd,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return commonDir ? dirname(resolve(cwd, commonDir)) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the locks directory. Priority: explicit option > `SEQUANT_LOCKS_DIR`
+ * > the shared git checkout root (#909) > plain cwd-relative (non-git
+ * fallback, preserves pre-#909 behavior).
+ */
 export function resolveLocksDir(explicit) {
     const fromEnv = process.env.SEQUANT_LOCKS_DIR;
-    return resolve(explicit ?? fromEnv ?? DEFAULT_LOCKS_DIR);
+    if (explicit !== undefined || fromEnv !== undefined) {
+        return resolve(explicit ?? fromEnv ?? DEFAULT_LOCKS_DIR);
+    }
+    const gitRoot = resolveGitCheckoutRoot(process.cwd());
+    return resolve(gitRoot ?? process.cwd(), DEFAULT_LOCKS_DIR);
 }
 /**
  * Resolve `SEQUANT_SKILL_LOCK_TTL_MS` (milliseconds) — env override for the
@@ -121,6 +160,184 @@ export function classifyStaleness(args) {
         return "age-exceeded";
     return null;
 }
+/** Read just the identity fields of a lock file. Null if missing/unparseable. */
+function readLockIdentity(lockPath) {
+    if (!existsSync(lockPath))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(lockPath, "utf-8"));
+        if (parsed &&
+            typeof parsed.pid === "number" &&
+            typeof parsed.hostname === "string" &&
+            typeof parsed.startedAt === "string") {
+            return {
+                pid: parsed.pid,
+                hostname: parsed.hostname,
+                startedAt: parsed.startedAt,
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Best-effort unlink for a steal's private `tmp` file. Failure to remove it is
+ * never worth crashing `acquire` over — the orphan sweep below reclaims it.
+ */
+function unlinkBestEffort(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        // Best-effort: swept later by sweepStealOrphans.
+    }
+}
+/**
+ * Age past which a `<lock>.steal.<pid>.<ts>` file cannot be an in-flight steal
+ * (the live window is microseconds) and is reclaimed as an orphan.
+ */
+const STEAL_ORPHAN_TTL_MS = 10 * 60 * 1000;
+/**
+ * Reap aged `*.steal.*` orphans left behind by lost restore races (the
+ * documented EEXIST branch below). Best-effort throughout: steals are the only
+ * producer and the only consumer, `list()` never sees these files, and a
+ * failure here must not affect the steal itself.
+ */
+function sweepStealOrphans(lockPath, now) {
+    const prefix = `${basename(lockPath)}.steal.`;
+    try {
+        const dir = dirname(lockPath);
+        for (const name of readdirSync(dir)) {
+            if (!name.startsWith(prefix))
+                continue;
+            const orphan = join(dir, name);
+            try {
+                if (now - statSync(orphan).mtimeMs > STEAL_ORPHAN_TTL_MS) {
+                    unlinkSync(orphan);
+                }
+            }
+            catch {
+                // Raced away or unreadable — skip it.
+            }
+        }
+    }
+    catch {
+        // Locks dir unreadable — nothing to sweep.
+    }
+}
+/**
+ * Atomically steal a stale lock (#908) — the compare-and-swap replacement for
+ * the old unlink-then-create, shared by both lock classes so they cannot drift
+ * (AC-1, AC-2).
+ *
+ * `unlink(lockPath)` removes whatever inode is at the path — including a fresh
+ * lock a winner created microseconds earlier — so two sessions that both
+ * classified the same lock stale could each destroy the other's fresh lock and
+ * both "win" (two holders, the exact failure the lock exists to prevent). A
+ * bare `rename(lockPath, …)` has the identical flaw: rename moves whatever is
+ * at the path, fresh or not.
+ *
+ * So take possession atomically, THEN check identity:
+ *
+ *   1. `rename(lockPath → tmp)` — atomic on POSIX. Of two racing stealers,
+ *      exactly one moves the current inode; the loser gets `ENOENT`.
+ *   2. Read what we moved. If it is the stale holder we `classified`, discard
+ *      it (`unlink tmp`) — the steal is legitimate and `lockPath` is now free
+ *      for the caller's terminal `openSync(…, "wx")` to claim.
+ *   3. If it is NOT that holder, a fresh lock appeared between our staleness
+ *      read and our rename. We must not destroy it: `link` it back into place
+ *      (never overwrites) and report the steal lost. A third session that
+ *      claimed `lockPath` in the gap is left intact and our copy becomes a
+ *      harmless `*.steal.*` orphan, which `list()` ignores (it matches only
+ *      `.lock`).
+ *
+ * Returns `true` only when this caller legitimately removed the stale lock it
+ * classified. `false` means "lost" — the caller falls through to `writeAtomic`,
+ * whose `O_CREAT|O_EXCL` arbitrates the real holder (accepting the current
+ * occupant on `EEXIST`).
+ *
+ * NOTE ON DEVIATION FROM THE #908 SPEC: the plan prescribed a *plain*
+ * rename-away ("rename, unlink tmp, ENOENT = lost", then fall through). That is
+ * behaviorally identical to the `unlink` it replaces — verified by a
+ * hand-driven interleave: in the issue's own documented ordering
+ * (`A.steal → A.create → B.steal → B.create`) B's rename succeeds on A's fresh
+ * lock and destroys it, two holders, same as today. The identity check in
+ * step 2/3 is what actually makes AC-1 ("loser cannot remove the winner's fresh
+ * lock") hold and makes AC-4's mutation test possible.
+ *
+ * RESIDUAL: the sub-millisecond window at step 3 where a third session's
+ * O_EXCL create races our `link`-back is not fully closed — plain lock files
+ * admit no atomic compare-and-swap on content. It is far narrower than the
+ * original (which failed on a *single* race, every time a stealer's removal
+ * landed on a fresh lock) and never destroys a live lock. Fully closing it is a
+ * larger protocol change (claim file / lease), flagged for follow-up.
+ *
+ * NEVER THROWS. A steal is an opportunistic optimization on the acquire path;
+ * no filesystem error here is worth crashing `acquire` over. Errors degrade to
+ * "lost" (`false`) and the caller's terminal create surfaces any real
+ * environment problem (EACCES etc.) with the same errno the pre-#908 path did.
+ * The one active recovery: if the `link`-back restore fails because the
+ * filesystem refuses hard links (EPERM/ENOTSUP), fall back to renaming `tmp`
+ * back into place — leaving a fresh lock renamed-away IS the two-holder bug,
+ * so restoring it outweighs `link`'s no-overwrite guarantee on such a
+ * filesystem.
+ *
+ * `ops` is a test seam for the link/rename syscalls — production callers omit
+ * it. Injecting a failing `link` is the only way to drive the fallback branch
+ * deterministically (capability errors like ENOTSUP cannot be provoked on a
+ * normal tmpdir).
+ */
+export function stealStaleLock(lockPath, classified, self, ops = {}) {
+    const rename = ops.rename ?? renameSync;
+    const link = ops.link ?? linkSync;
+    const tmp = `${lockPath}.steal.${self.pid}.${self.now}`;
+    sweepStealOrphans(lockPath, self.now);
+    try {
+        rename(lockPath, tmp);
+    }
+    catch {
+        // ENOENT: another stealer moved it first — cleanly lost. Anything else
+        // (EACCES, EROFS, …): nothing was moved, so there is nothing to restore;
+        // report lost and let the terminal create surface the environment problem.
+        return false;
+    }
+    const moved = readLockIdentity(tmp);
+    if (moved &&
+        moved.pid === classified.pid &&
+        moved.hostname === classified.hostname &&
+        moved.startedAt === classified.startedAt) {
+        unlinkBestEffort(tmp);
+        return true;
+    }
+    // A fresh (or corrupt) holder slipped in between our read and our rename.
+    // Put back exactly what we took, without overwriting a newer claim, then
+    // lose the steal.
+    try {
+        link(tmp, lockPath);
+        unlinkBestEffort(tmp);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "EEXIST" && code !== "ENOENT") {
+            // Hard links refused (EPERM/ENOTSUP/…) — restore by rename instead.
+            // The overwrite risk this reintroduces needs a third session's create
+            // to land in this same sub-ms window ON a no-hardlink filesystem;
+            // not restoring at all destroys the fresh lock every time.
+            try {
+                rename(tmp, lockPath);
+            }
+            catch {
+                // Out of options — degrades to pre-#908 behavior on this filesystem.
+            }
+        }
+        // EEXIST: `lockPath` was re-claimed in the gap → leave `tmp` as an orphan
+        // (swept by sweepStealOrphans) rather than clobber the new holder.
+        // ENOENT: `tmp` already gone.
+    }
+    return false;
+}
 export class LockManager {
     locksDir;
     staleAgeMs;
@@ -192,7 +409,15 @@ export class LockManager {
                 isPidAlive: this.isPidAlive,
             });
             if (staleReason) {
-                this.unlinkSafe(lockPath);
+                // Compare-and-swap steal, not a blind unlink (#908): only remove the
+                // stale inode we classified, never a fresh lock a racing winner may
+                // have created at this path in the meantime. Win or lose, fall through
+                // to `writeAtomic` — its `O_CREAT|O_EXCL` arbitrates the real holder.
+                stealStaleLock(lockPath, {
+                    pid: existing.pid,
+                    hostname: existing.hostname,
+                    startedAt: existing.startedAt,
+                }, { pid: this.pid, now: this.now() });
             }
             else {
                 return {

package/dist/src/lib/locks/types.d.ts

@@ -49,6 +49,78 @@ export declare const LockFileSchema: z.ZodObject<{
     skipPidCheck: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type LockFile = z.infer<typeof LockFileSchema>;
+/**
+ * Filename of the checkout-scoped lock (#901), stored alongside the numeric
+ * `<issue>.lock` files. Deliberately non-numeric so `LockManager.list()` —
+ * which parses each filename as an issue number and skips anything else —
+ * ignores it rather than surfacing a bogus `NaN` issue.
+ */
+export declare const CHECKOUT_LOCK_FILENAME = "checkout.lock";
+/**
+ * On-disk payload for the checkout-scoped lock (#901).
+ *
+ * The per-issue lock from #625 is keyed on issue number, so two sessions
+ * working *different* issues take different lock files and never contend —
+ * yet `git checkout`, `reset`, `rebase` and `merge` are global to a working
+ * tree. This lock represents the tree itself.
+ *
+ * Extends `LockFileSchema` with:
+ *  - `issue` — which issue the holder is working on, so a refusal can name it
+ *    (AC-2) and point the loser at the right worktree (AC-3).
+ *  - `sessionId` — Claude Code's per-session id, read from the PreToolUse
+ *    stdin envelope. Optional: it is the *preferred* holder identity because a
+ *    skill shell's PID dies immediately after acquire, but the hook falls back
+ *    to `pid`+`hostname` when the envelope does not carry one, so nothing
+ *    depends on it being present.
+ */
+export declare const CheckoutLockFileSchema: z.ZodObject<{
+    pid: z.ZodNumber;
+    hostname: z.ZodString;
+    startedAt: z.ZodString;
+    command: z.ZodString;
+    skipPidCheck: z.ZodOptional<z.ZodBoolean>;
+    issue: z.ZodNumber;
+    sessionId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type CheckoutLockFile = z.infer<typeof CheckoutLockFileSchema>;
+/** Identity of the session asking for the checkout lock. */
+export interface CheckoutHolderIdentity {
+    /** Claude Code session id, when the caller knows it. */
+    sessionId?: string;
+    /** Falls back to these when `sessionId` is absent on either side. */
+    pid: number;
+    hostname: string;
+    /**
+     * The issue this session is working on (#906).
+     *
+     * Last-resort ownership proxy for `skipPidCheck` locks, whose PID is dead
+     * by the time anything checks it. Optional because a live process releasing
+     * its own lock identifies itself by PID and needs none of this — but a
+     * skill shell that omits it can no longer release, which is deliberate.
+     */
+    issue?: number;
+}
+/** Outcome of `CheckoutLock.acquire()`. */
+export type CheckoutAcquireResult = {
+    acquired: true;
+    lockPath: string;
+    /** True when the caller already held it — re-acquire is idempotent. */
+    reentrant: boolean;
+} | {
+    acquired: false;
+    holder: CheckoutLockFile;
+    lockPath: string;
+    stale: false;
+    staleReason: null;
+};
+/** Listing entry for the checkout lock, mirroring `LockListing`. */
+export interface CheckoutLockListing {
+    holder: CheckoutLockFile;
+    ageMs: number;
+    stale: boolean;
+    staleReason: StaleReason | null;
+    lockPath: string;
+}
 /** Outcome of `LockManager.acquire()`. */
 export type AcquireResult = {
     acquired: true;

package/dist/src/lib/locks/types.js

@@ -45,3 +45,31 @@ export const LockFileSchema = z.object({
      */
     skipPidCheck: z.boolean().optional(),
 });
+/**
+ * Filename of the checkout-scoped lock (#901), stored alongside the numeric
+ * `<issue>.lock` files. Deliberately non-numeric so `LockManager.list()` —
+ * which parses each filename as an issue number and skips anything else —
+ * ignores it rather than surfacing a bogus `NaN` issue.
+ */
+export const CHECKOUT_LOCK_FILENAME = "checkout.lock";
+/**
+ * On-disk payload for the checkout-scoped lock (#901).
+ *
+ * The per-issue lock from #625 is keyed on issue number, so two sessions
+ * working *different* issues take different lock files and never contend —
+ * yet `git checkout`, `reset`, `rebase` and `merge` are global to a working
+ * tree. This lock represents the tree itself.
+ *
+ * Extends `LockFileSchema` with:
+ *  - `issue` — which issue the holder is working on, so a refusal can name it
+ *    (AC-2) and point the loser at the right worktree (AC-3).
+ *  - `sessionId` — Claude Code's per-session id, read from the PreToolUse
+ *    stdin envelope. Optional: it is the *preferred* holder identity because a
+ *    skill shell's PID dies immediately after acquire, but the hook falls back
+ *    to `pid`+`hostname` when the envelope does not carry one, so nothing
+ *    depends on it being present.
+ */
+export const CheckoutLockFileSchema = LockFileSchema.extend({
+    issue: z.number().int().positive(),
+    sessionId: z.string().optional(),
+});

package/dist/src/lib/markdown-fence.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Fenced-code-block tracking for line-oriented markdown scanners.
+ *
+ * Multiple parsers in this codebase scan an issue/PR body line-by-line
+ * looking for patterns (checkbox items, `## Non-Goals` bullets). Without
+ * fence awareness, a markdown-authoring example quoted inside a fence
+ * — showing what the pattern syntax looks like — gets scanned as if it
+ * were real content. See #947 (ac-parser.ts) and its sibling in
+ * scope/analyzer.ts's `parseNonGoals`.
+ */
+/**
+ * Compute, for every line of a split markdown body, whether that line falls
+ * inside a fenced code block (CommonMark rules: matching delimiter
+ * character, closing fence length >= opening fence length; an unclosed
+ * fence runs to EOF). The delimiter lines themselves are marked `true` —
+ * they're fence syntax, not real content, so patterns should skip them too.
+ */
+export declare function computeFenceMask(lines: string[]): boolean[];
+/**
+ * Blank out every line that falls inside a fenced code block, preserving
+ * line count (and therefore `\n`-relative offsets) so callers that locate
+ * sections via newline-anchored regexes on the full body are unaffected.
+ */
+export declare function stripFencedLines(body: string): string;

package/dist/src/lib/markdown-fence.js

@@ -0,0 +1,51 @@
+/**
+ * Fenced-code-block tracking for line-oriented markdown scanners.
+ *
+ * Multiple parsers in this codebase scan an issue/PR body line-by-line
+ * looking for patterns (checkbox items, `## Non-Goals` bullets). Without
+ * fence awareness, a markdown-authoring example quoted inside a fence
+ * — showing what the pattern syntax looks like — gets scanned as if it
+ * were real content. See #947 (ac-parser.ts) and its sibling in
+ * scope/analyzer.ts's `parseNonGoals`.
+ */
+/** Matches a fenced-code-block delimiter line (` ``` ` or `~~~`, 3+ repeats). */
+const FENCE_DELIMITER_RE = /^\s*(`{3,}|~{3,})/;
+/**
+ * Compute, for every line of a split markdown body, whether that line falls
+ * inside a fenced code block (CommonMark rules: matching delimiter
+ * character, closing fence length >= opening fence length; an unclosed
+ * fence runs to EOF). The delimiter lines themselves are marked `true` —
+ * they're fence syntax, not real content, so patterns should skip them too.
+ */
+export function computeFenceMask(lines) {
+    const mask = new Array(lines.length).fill(false);
+    let fenceChar = null;
+    let fenceLen = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const match = lines[i].match(FENCE_DELIMITER_RE);
+        if (fenceChar === null) {
+            if (match) {
+                fenceChar = match[1][0];
+                fenceLen = match[1].length;
+                mask[i] = true;
+            }
+            continue;
+        }
+        mask[i] = true;
+        if (match && match[1][0] === fenceChar && match[1].length >= fenceLen) {
+            fenceChar = null;
+            fenceLen = 0;
+        }
+    }
+    return mask;
+}
+/**
+ * Blank out every line that falls inside a fenced code block, preserving
+ * line count (and therefore `\n`-relative offsets) so callers that locate
+ * sections via newline-anchored regexes on the full body are unaffected.
+ */
+export function stripFencedLines(body) {
+    const lines = body.split("\n");
+    const mask = computeFenceMask(lines);
+    return lines.map((line, i) => (mask[i] ? "" : line)).join("\n");
+}

package/dist/src/lib/mcp-config.d.ts

@@ -4,6 +4,7 @@
  * Detects installed MCP clients (Claude Desktop, Cursor, VS Code)
  * and generates appropriate configuration entries for Sequant MCP server.
  */
+import { type McpServerConfig } from "./system.js";
 /** Path to the project-level MCP config file used by Claude Code */
 export declare const PROJECT_MCP_JSON = ".mcp.json";
 /**
@@ -38,6 +39,29 @@ export declare function getSequantMcpConfig(options?: {
     projectDir?: string;
     clientType?: McpClientType;
 }): Record<string, unknown>;
+/**
+ * Build the MCP server set for an autonomous phase agent (#936).
+ *
+ * Phase agents are a different trust domain from the interactive Claude
+ * Desktop app: they run unattended, and Claude Desktop configs cannot use
+ * `${VAR}` references, so they hold literal secrets that the SDK would
+ * otherwise serialize verbatim into the child process's `--mcp-config`
+ * argv. This builder allowlists instead of passing through — it unions the
+ * project's own `.mcp.json` (secret-free by convention, committed to git)
+ * with a guaranteed sequant server entry, and never reads
+ * `claude_desktop_config.json` **unless** a server name is explicitly
+ * listed in `opts.desktopAllowlist` (from `settings.run.mcpAllowlist`) —
+ * the deliberate per-server opt-in for a desktop-only server. A name not
+ * present in the desktop config is silently ignored.
+ *
+ * @param cwd - Directory to resolve `.mcp.json` from (the phase worktree)
+ * @param opts.desktopAllowlist - Exact `mcpServers` keys to pass through
+ *   from Claude Desktop config, despite the default exclusion
+ * @returns MCP server configurations for the phase agent
+ */
+export declare function getPhaseMcpServersConfig(cwd?: string, opts?: {
+    desktopAllowlist?: string[];
+}): Record<string, McpServerConfig>;
 /**
  * Detect which MCP-compatible clients are installed
  */

package/dist/src/lib/mcp-config.js

@@ -8,6 +8,7 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import { getVersion } from "./version.js";
+import { getMcpServersConfig } from "./system.js";
 /** Path to the project-level MCP config file used by Claude Code */
 export const PROJECT_MCP_JSON = ".mcp.json";
 /**
@@ -59,6 +60,56 @@ export function getSequantMcpConfig(options) {
     }
     return config;
 }
+/**
+ * Build the MCP server set for an autonomous phase agent (#936).
+ *
+ * Phase agents are a different trust domain from the interactive Claude
+ * Desktop app: they run unattended, and Claude Desktop configs cannot use
+ * `${VAR}` references, so they hold literal secrets that the SDK would
+ * otherwise serialize verbatim into the child process's `--mcp-config`
+ * argv. This builder allowlists instead of passing through — it unions the
+ * project's own `.mcp.json` (secret-free by convention, committed to git)
+ * with a guaranteed sequant server entry, and never reads
+ * `claude_desktop_config.json` **unless** a server name is explicitly
+ * listed in `opts.desktopAllowlist` (from `settings.run.mcpAllowlist`) —
+ * the deliberate per-server opt-in for a desktop-only server. A name not
+ * present in the desktop config is silently ignored.
+ *
+ * @param cwd - Directory to resolve `.mcp.json` from (the phase worktree)
+ * @param opts.desktopAllowlist - Exact `mcpServers` keys to pass through
+ *   from Claude Desktop config, despite the default exclusion
+ * @returns MCP server configurations for the phase agent
+ */
+export function getPhaseMcpServersConfig(cwd, opts) {
+    const mcpJsonPath = path.resolve(cwd ?? ".", PROJECT_MCP_JSON);
+    let servers = {};
+    try {
+        const content = fs.readFileSync(mcpJsonPath, "utf-8");
+        const config = JSON.parse(content);
+        if (config.mcpServers &&
+            typeof config.mcpServers === "object" &&
+            !Array.isArray(config.mcpServers)) {
+            servers = config.mcpServers;
+        }
+    }
+    catch {
+        // .mcp.json doesn't exist or is invalid — sequant entry still applies
+    }
+    const allowedDesktopServers = {};
+    if (opts?.desktopAllowlist && opts.desktopAllowlist.length > 0) {
+        const desktopServers = getMcpServersConfig() ?? {};
+        for (const name of opts.desktopAllowlist) {
+            if (desktopServers[name]) {
+                allowedDesktopServers[name] = desktopServers[name];
+            }
+        }
+    }
+    return {
+        ...allowedDesktopServers,
+        ...servers,
+        sequant: getSequantMcpConfig(),
+    };
+}
 /**
  * Detect which MCP-compatible clients are installed
  */

package/dist/src/lib/scope/analyzer.d.ts

@@ -73,6 +73,10 @@ export declare function detectFeatures(criteria: AcceptanceCriterion[], title: s
  *
  * Looks for a "Non-Goals" or "Out of Scope" section with checkbox items.
  *
+ * Fenced code blocks are excluded before matching (#947 sibling) — a
+ * Non-Goals example shown inside a fence (e.g. illustrating checkbox
+ * syntax) must not itself be read as a real non-goal item.
+ *
  * @param issueBody - Full issue body markdown
  * @returns Non-goals extraction result
  */

package/dist/src/lib/scope/analyzer.js

@@ -16,6 +16,7 @@
  * ```
  */
 import { DEFAULT_SCOPE_CONFIG } from "./types.js";
+import { stripFencedLines } from "../markdown-fence.js";
 /**
  * Keywords for clustering AC items by functional area
  */
@@ -247,14 +248,19 @@ export function detectFeatures(criteria, title) {
  *
  * Looks for a "Non-Goals" or "Out of Scope" section with checkbox items.
  *
+ * Fenced code blocks are excluded before matching (#947 sibling) — a
+ * Non-Goals example shown inside a fence (e.g. illustrating checkbox
+ * syntax) must not itself be read as a real non-goal item.
+ *
  * @param issueBody - Full issue body markdown
  * @returns Non-goals extraction result
  */
 export function parseNonGoals(issueBody) {
     const items = [];
+    const strippedBody = stripFencedLines(issueBody);
     // Find Non-Goals section (case-insensitive)
     const sectionPattern = /##\s*(?:Non[- ]?Goals|Out\s+of\s+Scope|Scope\s+Boundaries)\s*\n([\s\S]*?)(?=\n##|\n---|$)/i;
-    const sectionMatch = issueBody.match(sectionPattern);
+    const sectionMatch = strippedBody.match(sectionPattern);
     if (!sectionMatch) {
         return {
             items: [],