sequant 2.7.0 → 2.9.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "sequant",
       "description": "AI coding agent orchestrator for Claude Code — resolve GitHub issues end-to-end with isolated git worktrees, quality gates, and an MCP server. Includes 17 skills, workflow MCP tools, and pre/post-tool hooks.",
-      "version": "2.7.0",
+      "version": "2.9.0",
       "author": {
         "name": "sequant-io",
         "email": "hello@sequant.io"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "sequant",
   "description": "AI coding agent orchestrator for Claude Code — resolve GitHub issues end-to-end with isolated git worktrees and quality gates, through spec → exec → qa phases.",
-  "version": "2.7.0",
+  "version": "2.9.0",
   "author": {
     "name": "sequant-io",
     "email": "hello@sequant.io"

package/README.md

@@ -16,6 +16,18 @@ AI coding agents write code well, but leave you to run the workflow around it
 
 See the [CHANGELOG](CHANGELOG.md) for release notes, or the [migration guide](CHANGELOG.md#migration-from-v1x) if upgrading from v1.x.
 
+### What's new in 2.9
+
+- **`--chain` survives a failed link** — re-running a partially-completed chain resumes from its last good link, skipping the completed prefix and rebasing onto that committed tip instead of redoing hours of finished work (#760). A warn-by-default content pre-flight also runs before the first worktree is provisioned, flagging missing ACs, mis-ordered dependencies, predicted file overlaps, and closed issues; `--strict-preflight` makes any warning a hard stop (#762).
+- **Rate limits stop burning hours** — a rate limit hit inside a phase now skips doomed cold-start retries, and the run summary labels the chain halt with its cause and how to resume, instead of cascading into a ~2h retry ladder (#761).
+- **Stale plugin-cache warning** — `pre-tool.sh` now prints a once-per-day, network-free reminder (`claude plugin update sequant@sequant`) when a plugin-channel install has drifted behind the marketplace (#784, #788).
+
+### What's new in 2.8
+
+- **Clearer failures when an agent stops early** — phases that hit a turn cap now preserve their partial work and halt cleanly for resume instead of discarding it (#739, #733), and rate-limit/out-of-credits failures are named for what they are (with reset time and credit-purchase hints) rather than buried under generic retry noise (#732).
+- **Runtime Node-version guard** — `sequant` checks the running Node against its `engines.node` floor (`>=22.12.0`) at startup and exits with a friendly upgrade message instead of crashing later on a Node-22-only API (#734).
+- **`/assess` avoids npx version skew** — it now emits `sequant run …` when a global install is on `PATH` (and the unchanged `npx sequant run …` otherwise), so copy-pasted commands don't silently run a stale binary (#740).
+
 ### What's new in 2.7
 
 - **Trustworthy `--dry-run` previews for `sync` and `update`** — `sequant sync --dry-run` (`-d`) previews the exact set the apply would write (`new` + `modified` + `local-override`) and mutates nothing. Both `sync --dry-run` and `update --dry-run` now exit non-zero when work is pending, so a CI/automation job can gate on the exit code instead of parsing stdout. (`update` is the interactive command; `sync` is the documented non-interactive/CI surface.)
@@ -36,7 +48,7 @@ See the [CHANGELOG](CHANGELOG.md) for release notes, or the [migration guide](CH
 ### Prerequisites
 
 **An AI coding agent — one of:**
-- [Claude Code](https://claude.ai/code) — default agent
+- [Claude Code](https://claude.ai/code) — default agent. **Recommended: Claude Code ≥ 2.1.208.** The pre-tool hooks lean on Claude Code's native dangerous-`rm` analyzer (which fires even under `bypassPermissions`) instead of re-implementing catastrophic-delete detection; that analyzer's command-substitution coverage landed in 2.1.208. This is a recommendation, not an enforced floor — plugins cannot declare a minimum Claude Code version, so nothing gates install, and the pre-2.1.208 command-substitution gap (e.g. `echo "$(rm -rf ~)"`) is accepted rather than guarded.
 - [Aider](https://aider.chat/) — alternative, via `--agent aider`
 
 **Always required (both):**
@@ -62,6 +74,8 @@ Pick the path that matches **where you run Sequant**:
 /sequant:setup
 ```
 
+> **Plugins do not auto-update.** Claude Code pins a plugin to the version you installed and never updates it on its own — even as new releases ship. To pick up a new version, run `claude plugin update sequant@sequant`, then restart Claude Code. Sequant's pre-tool hook warns once a day when your installed version falls behind the marketplace.
+
 **Headless / CI (npm package)** — drive runs from the terminal or a CI job:
 ```bash
 npm install sequant          # or: pnpm add / yarn add / bun add sequant
@@ -99,7 +113,9 @@ SEQUANT WORKFLOW · #683
 
 QA findings post back to the issue as comments, with each acceptance criterion re-checked independently.
 
-> 📹 A recorded demo GIF of the live run grid is coming — tracked in [#695](https://github.com/sequant-io/sequant/issues/695).
+<p align="center">
+  <img src="https://raw.githubusercontent.com/sequant-io/sequant/main/docs/assets/run-grid.gif" alt="Sequant run grid: the live boxed TUI driving issue #64 through spec, exec, and qa to a green success rollup" width="760">
+</p>
 
 ---
 

package/dist/bin/cli.d.ts

@@ -4,4 +4,4 @@
  *
  * Sequential AI phases with quality gates for any codebase.
  */
-export {};
+import "./preflight.js";

package/dist/bin/cli.js

@@ -4,6 +4,12 @@
  *
  * Sequential AI phases with quality gates for any codebase.
  */
+// MUST stay first (#734): the Node-version preflight guard. ESM evaluates a
+// module's imports depth-first in source order before the importer's body, so
+// this side-effecting import runs the guard before commander / chalk / the
+// agent SDK / command modules are evaluated — closing the import-time crash
+// window on an old Node below the engines floor. See bin/preflight.ts.
+import "./preflight.js";
 import { Command, InvalidArgumentError, Option } from "commander";
 import chalk from "chalk";
 import { fileURLToPath } from "url";
@@ -15,7 +21,9 @@ import { configureUI, banner } from "../src/lib/cli-ui.js";
 import { isCI, isStdoutTTY } from "../src/lib/tty.js";
 import { detectPackageManagerSync, getPackageManagerCommands, } from "../src/lib/stacks.js";
 // Read version from package.json dynamically
-// Works from both source (bin/) and compiled (dist/bin/) locations
+// Works from both source (bin/) and compiled (dist/bin/) locations.
+// Note: the engines.node floor is read separately in bin/preflight.ts, which
+// must run before this module's imports — see the side-effecting import above.
 function getVersion() {
     const __dirname = dirname(fileURLToPath(import.meta.url));
     let dir = __dirname;
@@ -88,6 +96,7 @@ configureUI({
     isCI: isCI(),
     minimal: process.env.SEQUANT_MINIMAL === "1",
 });
+// (Node-version preflight guard runs at import time — see bin/preflight.ts.)
 // Warn if running from a problematic install location.
 // The home-stray case ($HOME/node_modules/sequant) gets a distinct warning
 // because it pollutes resolution for every subdirectory of $HOME, which the
@@ -187,9 +196,10 @@ program
     .option("--testgen", "Run testgen phase after spec")
     .option("--security-review", "Run security-review phase after spec")
     .option("-s, --quiet", "Suppress version warnings and non-essential output (heartbeat-only)")
-    .option("--chain", "Chain issues: each branches from previous (implies --sequential)")
+    .option("--chain", "Chain issues: each successor is rebased onto the previous issue's committed work before it runs (implies --sequential)")
     .option("--stacked", "Stack PRs: middle PRs target predecessor branch instead of main; first/last target main (implies --chain)")
     .option("--qa-gate", "Wait for QA pass before starting next issue in chain (requires --chain)")
+    .option("--strict-preflight", "Make --chain content pre-flight warnings (missing AC, dependency/overlap order, closed issues) fatal before any worktree is provisioned")
     .option("--base <branch>", "Base branch for worktree creation (default: main or settings.run.defaultBase)")
     .option("--no-mcp", "Disable MCP server injection in headless mode")
     .option("--no-retry", "Disable automatic retry with MCP fallback (useful for debugging)")

package/dist/bin/preflight.d.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+/**
+ * Runtime Node-version preflight (#734).
+ *
+ * This module is imported FIRST in `bin/cli.ts`, ahead of every third-party
+ * import (commander, chalk, the agent SDK) and every command module. ESM
+ * evaluates a module's dependencies depth-first in source order before the
+ * importer's body runs, so this module's top-level guard executes before any
+ * of those heavier modules are evaluated. That closes the import-time crash
+ * window: if a dependency tripped a Node-22-only API at module-load time on an
+ * old Node, the user would otherwise get an opaque stack trace from the import
+ * itself — before the in-body guard at `cli.ts` ever ran.
+ *
+ * The only modules evaluated before this guard are Node built-ins plus the
+ * first-party `version-check.ts` chain (→ `stacks.ts` → `fs.ts`), which import
+ * built-ins only and are therefore safe on the old Node this guard rejects.
+ *
+ * The pure comparison logic lives in `src/lib/version-check.ts` (AC-6); this
+ * file is just the early entry point that reads the floor and invokes it.
+ */
+export {};

package/dist/bin/preflight.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/**
+ * Runtime Node-version preflight (#734).
+ *
+ * This module is imported FIRST in `bin/cli.ts`, ahead of every third-party
+ * import (commander, chalk, the agent SDK) and every command module. ESM
+ * evaluates a module's dependencies depth-first in source order before the
+ * importer's body runs, so this module's top-level guard executes before any
+ * of those heavier modules are evaluated. That closes the import-time crash
+ * window: if a dependency tripped a Node-22-only API at module-load time on an
+ * old Node, the user would otherwise get an opaque stack trace from the import
+ * itself — before the in-body guard at `cli.ts` ever ran.
+ *
+ * The only modules evaluated before this guard are Node built-ins plus the
+ * first-party `version-check.ts` chain (→ `stacks.ts` → `fs.ts`), which import
+ * built-ins only and are therefore safe on the old Node this guard rejects.
+ *
+ * The pure comparison logic lives in `src/lib/version-check.ts` (AC-6); this
+ * file is just the early entry point that reads the floor and invokes it.
+ */
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, resolve } from "path";
+import { assertNodeVersion } from "../src/lib/version-check.js";
+// Derive the engines floor from package.json (single source of truth, AC-3),
+// using the same walk-up read as getVersion() in cli.ts. Built-in globals only,
+// so this runs — rather than crashes — on the old Node it is meant to reject.
+function readEngineFloor() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    while (dir !== dirname(dir)) {
+        const candidate = resolve(dir, "package.json");
+        try {
+            const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
+            if (pkg.name === "sequant") {
+                return pkg.engines?.node ?? null;
+            }
+        }
+        catch {
+            // Not found at this level, keep walking up.
+        }
+        dir = dirname(dir);
+    }
+    return null; // Fallback — assertNodeVersion treats a null floor as "skip".
+}
+assertNodeVersion(readEngineFloor());

package/dist/marketplace/external_plugins/sequant/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "sequant",
   "description": "AI coding agent orchestrator for Claude Code — resolve GitHub issues end-to-end with isolated git worktrees and quality gates, through spec → exec → qa phases.",
-  "version": "2.7.0",
+  "version": "2.9.0",
   "author": {
     "name": "sequant-io",
     "email": "hello@sequant.io"

package/dist/marketplace/external_plugins/sequant/README.md

@@ -20,6 +20,8 @@ Or browse in `/plugin > Discover`.
 
 After installing, run `/sequant:setup` to configure your project.
 
+> **Plugins do not auto-update.** Claude Code pins a plugin to the version you installed. To pick up a new release, run `claude plugin update sequant@sequant`, then restart Claude Code.
+
 ### npm (power users / CI)
 
 ```bash

package/dist/marketplace/external_plugins/sequant/hooks/post-tool.sh

@@ -51,13 +51,28 @@ fi
 
 _TMPDIR="${TMPDIR:-/tmp}"
 
-# Use CLAUDE_PLUGIN_DATA for persistent logs (survives plugin updates)
-if [[ -n "${CLAUDE_PLUGIN_DATA}" ]]; then
+# Log sink (#763 AC-5c: blocked-command history must survive to be a useful
+# regression corpus, so $TMPDIR — which macOS purges — is a last resort only).
+#
+# This block MUST stay identical to the one in pre-tool.sh. The two hooks
+# write the *same* claude-timing.log (START there, END here) and the same
+# claude-quality.log, so any divergence silently splits every START/END pair
+# across two files.
+#
+# Every candidate is absolute and lives outside the repo. A repo-local or
+# relative path is wrong three times over: it resolves against the hook's cwd
+# (which Claude Code does not pin), it yields one sink per directory instead
+# of the single corpus AC-5 asks for, and — worst — creating it inside a repo
+# makes `git status --porcelain` non-empty, which silently defeats pre-tool.sh's
+# no-changes guard that reads exactly that output.
+if [[ -n "${CLAUDE_PLUGIN_DATA:-}" ]]; then
   _LOG_DIR="${CLAUDE_PLUGIN_DATA}/logs"
-  mkdir -p "$_LOG_DIR"
+elif [[ -n "${HOME:-}" ]]; then
+  _LOG_DIR="${HOME}/.sequant/logs"
 else
   _LOG_DIR="${_TMPDIR}"
 fi
+mkdir -p "$_LOG_DIR" 2>/dev/null || _LOG_DIR="${_TMPDIR}"
 
 TIMING_LOG="${_LOG_DIR}/claude-timing.log"
 QUALITY_LOG="${_LOG_DIR}/claude-quality.log"