sequant 2.6.1 → 2.7.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "sequant",
       "description": "AI coding agent orchestrator for Claude Code — resolve GitHub issues end-to-end with isolated git worktrees, quality gates, and an MCP server. Includes 17 skills, workflow MCP tools, and pre/post-tool hooks.",
-      "version": "2.6.1",
+      "version": "2.7.0",
       "author": {
         "name": "sequant-io",
         "email": "hello@sequant.io"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "sequant",
   "description": "AI coding agent orchestrator for Claude Code — resolve GitHub issues end-to-end with isolated git worktrees and quality gates, through spec → exec → qa phases.",
-  "version": "2.6.1",
+  "version": "2.7.0",
   "author": {
     "name": "sequant-io",
     "email": "hello@sequant.io"

package/README.md

@@ -16,6 +16,10 @@ AI coding agents write code well, but leave you to run the workflow around it
 
 See the [CHANGELOG](CHANGELOG.md) for release notes, or the [migration guide](CHANGELOG.md#migration-from-v1x) if upgrading from v1.x.
 
+### What's new in 2.7
+
+- **Trustworthy `--dry-run` previews for `sync` and `update`** — `sequant sync --dry-run` (`-d`) previews the exact set the apply would write (`new` + `modified` + `local-override`) and mutates nothing. Both `sync --dry-run` and `update --dry-run` now exit non-zero when work is pending, so a CI/automation job can gate on the exit code instead of parsing stdout. (`update` is the interactive command; `sync` is the documented non-interactive/CI surface.)
+
 ### What's new in 2.6
 
 - **Boxed Ink TUI is the default for `sequant run`** — on a TTY, `run` now renders the boxed dashboard by default (matching `sequant ready`). Opt out with `--no-tui` (line renderer) or `-s`/`--quiet` (heartbeat-only); non-TTY output auto-degrades.

package/dist/bin/cli.js

@@ -44,7 +44,7 @@ import { logsCommand } from "../src/commands/logs.js";
 import { statsCommand } from "../src/commands/stats.js";
 import { dashboardCommand } from "../src/commands/dashboard.js";
 import { stateInitCommand, stateRebuildCommand, stateCleanCommand, } from "../src/commands/state.js";
-import { syncCommand, areSkillsOutdated } from "../src/commands/sync.js";
+import { syncCommand, areSkillsOutdated, checkAndWarnSkillsOutdated, } from "../src/commands/sync.js";
 import { mergeCommand } from "../src/commands/merge.js";
 import { readyCommand, } from "../src/commands/ready.js";
 import { conventionsCommand } from "../src/commands/conventions.js";
@@ -128,12 +128,14 @@ program
     .description("Update templates from the Sequant package")
     .option("-d, --dry-run", "Show what would be updated without making changes")
     .option("-f, --force", "Overwrite local modifications")
+    .option("-y, --yes", "Apply updates without prompting (for CI/non-interactive shells)")
     .action(updateCommand);
 program
     .command("sync")
     .description("Sync skills and templates from the Sequant package (non-interactive)")
     .option("-f, --force", "Sync even if versions match")
     .option("-q, --quiet", "Suppress output")
+    .option("-d, --dry-run", "Show what sync would write without making changes (exits non-zero if work is pending)")
     .action(syncCommand);
 program
     .command("doctor")
@@ -399,14 +401,36 @@ locksCmd
 // Projects that manage skills manually (no marker) are not affected.
 program.hook("preAction", async (thisCommand) => {
     const cmd = thisCommand.name();
-    if (cmd === "init" || cmd === "sync")
+    // `update` is excluded alongside `init`/`sync`: it is itself the command that
+    // resolves drift, so the warn-only "run sync/update" pre-flight would be a
+    // circular nag right before it does exactly that.
+    if (cmd === "init" || cmd === "sync" || cmd === "update")
         return;
     const manifest = await getManifest();
     if (!manifest)
         return;
-    const { outdated, currentVersion } = await areSkillsOutdated();
-    if (outdated && currentVersion !== null) {
+    // `cache: true` opts the per-command pre-flight into the stat-only drift
+    // fingerprint cache: the full template scan runs only when something that
+    // affects drift changed, keeping latency off the hot path (AC-5).
+    const status = await areSkillsOutdated({ cache: true });
+    const { outdated, currentVersion, contentDrift } = status;
+    // No version marker → the project manages skills manually; stay silent and
+    // do nothing (unchanged behavior — see the header comment above the hook).
+    if (currentVersion === null)
+        return;
+    if (outdated) {
+        // Version-marker mismatch → stale install: auto-sync (copy) as before.
         await syncCommand({ quiet: true });
+        return;
+    }
+    // Version-current but bundled content drifted in place (#708/#713). AC-3
+    // decision: auto-sync (copy) stays gated on version bumps ONLY — we do NOT
+    // copy here, because that would clobber in-place customizations (#711).
+    // Content-only drift is surfaced as a non-destructive, warn-only signal,
+    // leaving the fix to the user (`sequant sync`/`update`). The helper never
+    // touches process.exitCode, so the command still exits normally.
+    if (contentDrift > 0) {
+        await checkAndWarnSkillsOutdated(status);
     }
 });
 // Parse and execute

package/dist/marketplace/external_plugins/sequant/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "sequant",
   "description": "AI coding agent orchestrator for Claude Code — resolve GitHub issues end-to-end with isolated git worktrees and quality gates, through spec → exec → qa phases.",
-  "version": "2.6.1",
+  "version": "2.7.0",
   "author": {
     "name": "sequant-io",
     "email": "hello@sequant.io"

package/dist/marketplace/external_plugins/sequant/skills/assess/SKILL.md

@@ -13,6 +13,9 @@ allowed-tools:
   - Bash(gh *)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/assess/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/assess` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Unified Issue Assessment & Triage
 
 You are the "Assessment Agent" for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/clean/SKILL.md

@@ -27,6 +27,9 @@ allowed-tools:
   - Grep
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/clean/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/clean` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Repository Cleanup Command
 
 Comprehensive, safe repository cleanup that archives stale files, removes artifacts, and commits changes.

package/dist/marketplace/external_plugins/sequant/skills/docs/SKILL.md

@@ -18,6 +18,9 @@ allowed-tools:
   - Bash(gh pr diff:*)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/docs/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/docs` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Documentation Generator
 
 You are the Phase 4 "Documentation Agent" for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/exec/SKILL.md

@@ -43,6 +43,9 @@ allowed-tools:
   - TodoWrite
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/exec/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/exec` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Implementation Command
 
 You are the Phase 2 "Implementation Agent" for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/fullsolve/SKILL.md

@@ -39,6 +39,9 @@ allowed-tools:
   - Bash(./scripts/list-worktrees.sh:*)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/fullsolve/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/fullsolve` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Full Solve Command
 
 You are the "Full Solve Agent" for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/improve/SKILL.md

@@ -16,6 +16,9 @@ allowed-tools:
   - AskUserQuestion
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/improve/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/improve` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Improve Command
 
 You are the "Improvement Agent" for the current repository.
@@ -665,4 +668,4 @@ Error: Path `src/nonexistent/` not found.
 - [ ] **Recommendations** - Tips for running quick wins vs larger refactors
 
 **DO NOT proceed to issue creation without user selection.**
-**DO NOT respond until all items are verified.**
+**DO NOT respond until all items are verified.**

package/dist/marketplace/external_plugins/sequant/skills/loop/SKILL.md

@@ -25,6 +25,9 @@ allowed-tools:
   - Bash(git status:*)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/loop/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/loop` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Quality Loop Command
 
 You are the "Quality Loop Agent" for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/merger/SKILL.md

@@ -16,6 +16,9 @@ allowed-tools:
   - Glob
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/merger/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/merger` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Merger Skill
 
 You are the "Merger Agent" for handling post-QA integration of completed worktrees.

package/dist/marketplace/external_plugins/sequant/skills/qa/SKILL.md

@@ -24,6 +24,9 @@ allowed-tools:
   - AgentOutputTool
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/qa/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/qa` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # QA & Code Review
 
 You are the Phase 3 "QA & Code Review Agent" for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/reflect/SKILL.md

@@ -12,6 +12,9 @@ allowed-tools:
   - Grep
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/reflect/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/reflect` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Reflection Agent
 
 You are the "Reflection Agent" for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/security-review/SKILL.md

@@ -17,6 +17,9 @@ allowed-tools:
   - Bash(gh issue comment:*)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/security-review/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/security-review` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Security Review Command
 
 You are the Security Review Agent for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/setup/SKILL.md

@@ -30,6 +30,9 @@ allowed-tools:
   - Bash(curl:*)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/setup/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/setup` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Sequant Setup
 
 Initialize Sequant workflow system in your current project.

package/dist/marketplace/external_plugins/sequant/skills/solve/SKILL.md

@@ -13,6 +13,9 @@ allowed-tools:
   - Bash(gh *)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/solve/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/solve` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # /solve — Deprecated Alias for /assess
 
 **This command has been merged into `/assess`.** Use `/assess` instead.

package/dist/marketplace/external_plugins/sequant/skills/spec/SKILL.md

@@ -17,6 +17,9 @@ allowed-tools:
   - AgentOutputTool
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/spec/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/spec` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Planning Agent
 
 Phase 1 "Planning Agent." Understands the issue and AC, reviews or synthesizes a plan, identifies gaps and risks, and drafts a GitHub issue comment.

package/dist/marketplace/external_plugins/sequant/skills/test/SKILL.md

@@ -19,6 +19,9 @@ allowed-tools:
   - Bash(npx tsx:*)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/test/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/test` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Browser Testing Command
 
 You are the "Testing Agent" for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/testgen/SKILL.md

@@ -20,6 +20,9 @@ allowed-tools:
   - Agent(sequant-testgen)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/testgen/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/testgen` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Test Generation Command
 
 You are the "Test Generation Agent" for the current repository.

package/dist/marketplace/external_plugins/sequant/skills/verify/SKILL.md

@@ -15,6 +15,9 @@ allowed-tools:
   - Bash(gh issue comment:*)
 ---
 
+<!-- sequant:local-override -->
+> **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/verify/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/verify` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite.
+
 # Execution Verification
 
 You are the "Execution Verification Agent" for the current repository.

package/dist/src/commands/ready.js

@@ -130,7 +130,7 @@ export async function readyCommand(issueArg, options) {
         const branch = listWorktrees().find((w) => w.issue === issueNumber)?.branch ?? "";
         adapter = new ReadySnapshotAdapter({ issueNumber, title, branch });
         onProgress = adapter.onProgress;
-        const { renderTui } = await import("../ui/tui/index.js");
+        const { renderTui } = await (await import("../ui/tui/load.js")).loadTui();
         tuiHandle = renderTui(adapter);
     }
     else if (!options.json) {

package/dist/src/commands/run.js

@@ -92,7 +92,7 @@ export async function runCommand(issues, options) {
         maxLoopIterations: resolved.config.maxIterations,
     });
     if (tuiEnabled) {
-        const { renderTui } = await import("../ui/tui/index.js");
+        const { renderTui } = await (await import("../ui/tui/load.js")).loadTui();
         let tuiHandle = null;
         // Unmount the TUI before ShutdownManager writes its shutdown banner so
         // the two don't race on stdout / leave the terminal in alt-screen buffer.

package/dist/src/commands/sync.d.ts

@@ -7,22 +7,61 @@
 interface SyncOptions {
     force?: boolean;
     quiet?: boolean;
+    dryRun?: boolean;
 }
 /**
  * Get the version of skills currently installed
  */
 export declare function getSkillsVersion(): Promise<string | null>;
 /**
- * Check if skills are outdated compared to package version
+ * Skills status relative to the bundled package, as seen by the pre-flight path.
  */
-export declare function areSkillsOutdated(): Promise<{
+export interface SkillsOutdatedStatus {
+    /** Version-marker mismatch (`.sequant-version` ≠ package). Cheap fast-path. */
     outdated: boolean;
     currentVersion: string | null;
     packageVersion: string;
-}>;
+    /**
+     * Count of bundled files that are `new` or `modified` in place at a *matching*
+     * version (the #708 blind spot the version marker can't see). Only computed
+     * when versions match; `0` otherwise (a mismatch already means stale). Excludes
+     * `local-override`/`unchanged` so customized files (e.g. constitution, #711)
+     * don't register as drift.
+     */
+    contentDrift: number;
+}
+/**
+ * Check if skills are outdated compared to package version.
+ *
+ * The version marker is only a cheap hint: a tree at the matching version can
+ * still have drifted bundled content in place (the #708 root cause). So when the
+ * marker matches we run the same content diff `sync` uses (`computeTemplateChanges`,
+ * the single source of truth from #708/#710) and surface a `contentDrift` count.
+ * On a version *mismatch* we skip the diff entirely — the install is already stale
+ * and the copy path handles it — keeping the per-command pre-flight cheap (AC-5).
+ *
+ * `options.cache` opts into a stat-only fingerprint cache for the content scan,
+ * so the hot pre-flight path (which runs before most commands, including batched
+ * `/assess` dashboard calls) pays the full ~15ms scan only when something that
+ * affects drift actually changed. Off by default so diagnostic callers (`doctor`)
+ * always see fresh truth.
+ */
+export declare function areSkillsOutdated(options?: {
+    cache?: boolean;
+}): Promise<SkillsOutdatedStatus>;
 export declare function syncCommand(options?: SyncOptions): Promise<void>;
 /**
- * Check and warn if skills are outdated (for use by other commands)
+ * Check and warn if skills are outdated (for use by other commands).
+ *
+ * Warns on either signal: a version-marker mismatch, or in-place content drift at
+ * a matching version (#708/#713). The content-drift path is warn-only by design —
+ * it never mutates files and never sets `process.exitCode` (this is a pre-flight,
+ * not the command itself), so customized installs (#711) are left intact.
+ *
+ * Callers that have already computed the status (e.g. the `preAction` hook) can
+ * pass it in to avoid a second template scan on the hot path (AC-5).
+ *
+ * @returns `true` if a warning was emitted, `false` if up to date.
  */
-export declare function checkAndWarnSkillsOutdated(): Promise<boolean>;
+export declare function checkAndWarnSkillsOutdated(status?: SkillsOutdatedStatus): Promise<boolean>;
 export {};