sequant 2.8.0 → 2.10.0

package/dist/src/commands/run-progress.js

@@ -58,6 +58,18 @@ export function buildProgressWiring(args) {
             // #543: activity events only feed the TUI's nowLine — skip the line renderer.
             if (event === "activity")
                 return;
+            // #804 AC-7: unlike activity, a waiting event MUST reach the renderer —
+            // it is the only signal during a pause that can last hours.
+            if (event === "waiting") {
+                renderer.onEvent({
+                    issue,
+                    phase,
+                    event,
+                    text: extra?.text,
+                    wakeAtMs: extra?.wakeAtMs,
+                });
+                return;
+            }
             // #624 Item 3: pass the outer-loop iteration through so the renderer can
             // render `(attempt N/M)` / `loop N/M`.
             renderer.onEvent({
@@ -71,9 +83,22 @@ export function buildProgressWiring(args) {
         };
     }
     else if (heartbeat) {
-        onProgress = (issue, phase, event) => {
+        onProgress = (issue, phase, event, extra) => {
             if (event === "activity")
                 return;
+            // #804 AC-7: mark/clear the auto-wait so the heartbeat reports the wait
+            // and, critically, does not report it as a stall. Must be handled before
+            // the `else` below, which would otherwise `stop()` the phase entirely and
+            // leave a multi-hour wait with no liveness signal at all.
+            if (event === "waiting") {
+                if (extra?.wakeAtMs !== undefined) {
+                    heartbeat.pauseForWait({ issueNumber: issue, phase }, extra.wakeAtMs);
+                }
+                else {
+                    heartbeat.resumeFromWait({ issueNumber: issue, phase });
+                }
+                return;
+            }
             if (event === "start")
                 heartbeat.start({
                     issueNumber: issue,

package/dist/src/commands/run.js

@@ -8,15 +8,21 @@ import { parseBatches } from "../lib/workflow/batch-executor.js";
 import { RunOrchestrator } from "../lib/workflow/run-orchestrator.js";
 import { displayConfig, displaySummary } from "./run-display.js";
 import { buildProgressWiring } from "./run-progress.js";
-import { normalizeQualityLoop, resolveTuiEnabled } from "./run-flags.js";
+import { normalizeQualityLoop, resolveTuiEnabled, warnDeprecatedFlags, } from "./run-flags.js";
 // Re-export public API for backwards compatibility
 export * from "./run-compat.js";
+// #848: red pre-flight rejection + non-zero exit (process.exitCode, not exit()).
+function rejectPreflight(message) {
+    console.log(chalk.red(message));
+    process.exitCode = 1;
+}
 /** Parse CLI args → validate → delegate to RunOrchestrator.run() → display summary. */
 export async function runCommand(issues, options) {
     // #705: fold the hidden `-q` alias into qualityLoop before any consumer reads
     // it (`-q` no longer maps to --quiet, which moved to `-s`). See run-flags.ts.
     options.qualityLoop = normalizeQualityLoop(options);
     console.log(ui.headerBox("SEQUANT WORKFLOW"));
+    warnDeprecatedFlags(options);
     if (!options.quiet) {
         try {
             const v = await checkVersionCached();
@@ -31,31 +37,26 @@ export async function runCommand(issues, options) {
     }
     const manifest = await getManifest();
     if (!manifest) {
-        console.log(chalk.red("❌ Sequant is not initialized. Run `sequant init` first."));
+        rejectPreflight("❌ Sequant is not initialized. Run `sequant init` first.");
         return;
     }
     const settings = await getSettings();
     // #605: --stacked implies --chain; reject explicit --no-chain combo before
     // we evaluate any --chain-dependent constraint below.
     if (options.stacked && options.chain === false) {
-        console.log(chalk.red("❌ --stacked cannot be combined with --no-chain"));
+        rejectPreflight("❌ --stacked cannot be combined with --no-chain");
         return;
     }
     if (options.stacked) {
         options.chain = true;
     }
-    // Validate constraints
     if (options.chain && options.batch?.length) {
-        console.log(chalk.red("❌ --chain cannot be used with --batch"));
+        rejectPreflight("❌ --chain cannot be used with --batch");
         return;
     }
     if (options.concurrency !== undefined &&
         (options.concurrency < 1 || !Number.isInteger(options.concurrency))) {
-        console.log(chalk.red(`❌ Invalid --concurrency value: ${options.concurrency}. Must be a positive integer.`));
-        return;
-    }
-    if (options.qaGate && !options.chain) {
-        console.log(chalk.red("❌ --qa-gate requires --chain flag"));
+        rejectPreflight(`❌ Invalid --concurrency value: ${options.concurrency}. Must be a positive integer.`);
         return;
     }
     let batches = null;

package/dist/src/commands/state.js

@@ -27,10 +27,13 @@ export async function stateInitCommand(options = {}) {
     const result = await discoverUntrackedWorktrees(discoverOptions);
     if (options.json) {
         console.log(JSON.stringify(result, null, 2));
+        if (!result.success)
+            process.exitCode = 1;
         return;
     }
     if (!result.success) {
         console.log(chalk.red(`✗ Discovery failed: ${result.error}`));
+        process.exitCode = 1;
         return;
     }
     if (result.discovered.length === 0) {
@@ -106,6 +109,7 @@ export async function stateRebuildCommand(options = {}) {
         else {
             console.log(chalk.red(`✗ Log rebuild failed: ${logResult.error}`));
         }
+        process.exitCode = 1;
         return;
     }
     // Step 2: Discover and add untracked worktrees
@@ -204,10 +208,13 @@ export async function stateCleanCommand(options = {}) {
     });
     if (options.json) {
         console.log(JSON.stringify(result, null, 2));
+        if (!result.success)
+            process.exitCode = 1;
         return;
     }
     if (!result.success) {
         console.log(chalk.red(`✗ Cleanup failed: ${result.error}`));
+        process.exitCode = 1;
         return;
     }
     const orphanedCount = result.orphaned.length;

package/dist/src/commands/stats.js

@@ -263,6 +263,35 @@ function loadMetrics() {
         return null;
     }
 }
+/**
+ * Compute the failure-category breakdown over runs that recorded a failure —
+ * outcome "failed" (every issue failed) or "partial" (at least one issue
+ * failed) (#783).
+ *
+ * NOTE — deviation from AC-1's literal "over failed runs" wording: partial runs
+ * also carry a failureCategory (recorded whenever >=1 issue fails) and are
+ * genuine signal for "what's killing my runs", so they are counted here by
+ * explicit user decision. Success runs never carry the field and are excluded.
+ *
+ * Runs without the field (pre-#761 records, or a partial whose failure was
+ * never categorized) are bucketed as "unclassified" — never dropped and never
+ * conflated with the "unknown" enum value.
+ *
+ * Pure function of the passed runs array, so any upstream cohort filtering is
+ * automatically respected (computed after filtering, not before).
+ */
+function calculateFailureCategoryBreakdown(runs) {
+    const counts = new Map();
+    for (const run of runs) {
+        if (run.outcome === "success")
+            continue;
+        const category = run.failureCategory ?? "unclassified";
+        counts.set(category, (counts.get(category) ?? 0) + 1);
+    }
+    return [...counts.entries()]
+        .map(([category, count]) => ({ category, count }))
+        .sort((a, b) => b.count - a.count || a.category.localeCompare(b.category));
+}
 /**
  * Calculate analytics from metrics
  */
@@ -274,6 +303,7 @@ function calculateMetricsAnalytics(metrics) {
             successCount: 0,
             partialCount: 0,
             failedCount: 0,
+            failureCategories: [],
             successRate: 0,
             avgTokensPerRun: 0,
             avgFilesChanged: 0,
@@ -294,6 +324,7 @@ function calculateMetricsAnalytics(metrics) {
     const successCount = runs.filter((r) => r.outcome === "success").length;
     const partialCount = runs.filter((r) => r.outcome === "partial").length;
     const failedCount = runs.filter((r) => r.outcome === "failed").length;
+    const failureCategories = calculateFailureCategoryBreakdown(runs);
     const successRate = (successCount / runs.length) * 100;
     const avgTokensPerRun = runs.reduce((sum, r) => sum + r.metrics.tokensUsed, 0) / runs.length;
     const avgFilesChanged = runs.reduce((sum, r) => sum + r.metrics.filesChanged, 0) / runs.length;
@@ -323,6 +354,7 @@ function calculateMetricsAnalytics(metrics) {
         successCount,
         partialCount,
         failedCount,
+        failureCategories,
         successRate,
         avgTokensPerRun,
         avgFilesChanged,
@@ -415,6 +447,19 @@ function displayMetricsAnalytics(analytics) {
         const failedRate = (analytics.failedCount / total) * 100;
         console.log(`  ${colors.error("\u2717 Failed")}    ${analytics.failedCount} (${failedRate.toFixed(0)}%)    ${failedBar}`);
     }
+    // Failure-category breakdown (#783) \u2014 adjacent to the outcome bars above.
+    // Counts runs that recorded a failure (outcome "failed" or "partial"); hidden
+    // entirely when there are none (AC-3).
+    if (analytics.failureCategories.length > 0) {
+        const failureRunCount = analytics.failureCategories.reduce((sum, b) => sum + b.count, 0);
+        const runNoun = failureRunCount === 1 ? "run with a failure" : "runs with a failure";
+        console.log(ui.sectionHeader(`Failure Categories (${failureRunCount} ${runNoun})`));
+        const pad = Math.max(...analytics.failureCategories.map((b) => b.category.length));
+        for (const bucket of analytics.failureCategories) {
+            const pct = ((bucket.count / failureRunCount) * 100).toFixed(0);
+            console.log(`  ${bucket.category.padEnd(pad)}  ${bucket.count} (${pct}%)`);
+        }
+    }
     // Averages table
     console.log(ui.sectionHeader("Averages"));
     const avgData = {};
@@ -653,6 +698,8 @@ export async function statsCommand(options) {
                 partialCount: analytics.partialCount,
                 failedCount: analytics.failedCount,
                 successRate: analytics.successRate,
+                // Failure-category breakdown over failed runs (#783 AC-5)
+                failureCategories: analytics.failureCategories,
                 avgTokensPerRun: analytics.avgTokensPerRun,
                 avgFilesChanged: analytics.avgFilesChanged,
                 avgLinesAdded: analytics.avgLinesAdded,

package/dist/src/commands/status.d.ts

@@ -1,6 +1,7 @@
 /**
  * sequant status - Show version, configuration, and workflow state
  */
+import { type IssueState } from "../lib/workflow/state-schema.js";
 export interface StatusCommandOptions {
     /** Show only issues state */
     issues?: boolean;
@@ -21,4 +22,12 @@ export interface StatusCommandOptions {
     /** Skip GitHub API queries (offline mode) */
     offline?: boolean;
 }
+/**
+ * Format a single issue state for display
+ *
+ * @internal Exported for testing only (#892: the windowHalt/autoWait pause
+ * lines are display contract — a halted issue must read as resumable, not as
+ * a bare failure).
+ */
+export declare function formatIssueState(issue: IssueState): string;
 export declare function statusCommand(options?: StatusCommandOptions): Promise<void>;

package/dist/src/commands/status.js

@@ -2,6 +2,8 @@
  * sequant status - Show version, configuration, and workflow state
  */
 import chalk from "chalk";
+import { formatResetTime } from "../lib/errors.js";
+import { MAX_RESUME_REENTRIES } from "../lib/workflow/state-schema.js";
 import { ui, colors } from "../lib/cli-ui.js";
 import { getManifest, getPackageVersion } from "../lib/manifest.js";
 import { fileExists } from "../lib/fs.js";
@@ -102,8 +104,12 @@ function getPhaseSymbol(phaseState) {
 }
 /**
  * Format a single issue state for display
+ *
+ * @internal Exported for testing only (#892: the windowHalt/autoWait pause
+ * lines are display contract — a halted issue must read as resumable, not as
+ * a bare failure).
  */
-function formatIssueState(issue) {
+export function formatIssueState(issue) {
     const lines = [];
     // Issue header
     lines.push(chalk.bold(`  #${issue.number}: ${issue.title.substring(0, 50)}${issue.title.length > 50 ? "..." : ""}`));
@@ -128,6 +134,16 @@ function formatIssueState(issue) {
         .join(" ");
     lines.push(`    Phases: ${phaseProgress}`);
     lines.push(`            ${phases.map((p) => p.charAt(0).toUpperCase()).join(" ")}`);
+    // #860: an auto-waiting issue is paused on purpose, not stalled — name the
+    // wake time so a multi-hour rate-limit pause is distinguishable from a hang.
+    if (issue.autoWait) {
+        lines.push(chalk.yellow(`    ⏸ Auto-wait: ${issue.autoWait.phase} paused — resuming at ${formatResetTime(new Date(issue.autoWait.wakeAt).getTime())}`));
+    }
+    // #892: a window-halted issue exited cleanly (lock released) and is waiting
+    // for `sequant resume` — show the resume time instead of a bare failure.
+    if (issue.windowHalt) {
+        lines.push(chalk.yellow(`    ⏸ Halted: ${issue.windowHalt.phase} hit a rate-limit window — resumable at ${formatResetTime(new Date(issue.windowHalt.resumeAt).getTime())} via \`sequant resume\` (re-entries ${issue.windowHalt.reentries}/${MAX_RESUME_REENTRIES})`));
+    }
     // PR info
     if (issue.pr) {
         lines.push(chalk.gray(`    PR: #${issue.pr.number} ${issue.pr.url}`));
@@ -419,6 +435,7 @@ async function displayIssueState(options) {
         else {
             console.log(chalk.red(`\nError reading state: ${error}`));
         }
+        process.exitCode = 1;
     }
 }
 /**
@@ -431,6 +448,8 @@ async function handleRebuild(options) {
     const result = await rebuildStateFromLogs({ verbose: !options.json });
     if (options.json) {
         console.log(JSON.stringify(result, null, 2));
+        if (!result.success)
+            process.exitCode = 1;
         return;
     }
     if (result.success) {
@@ -443,6 +462,7 @@ async function handleRebuild(options) {
     }
     else {
         console.log(chalk.red(`✗ Rebuild failed: ${result.error}`));
+        process.exitCode = 1;
     }
 }
 /**
@@ -470,6 +490,8 @@ async function handleCleanup(options) {
     });
     if (options.json) {
         console.log(JSON.stringify(result, null, 2));
+        if (!result.success)
+            process.exitCode = 1;
         return;
     }
     if (result.success) {
@@ -511,5 +533,6 @@ async function handleCleanup(options) {
     }
     else {
         console.log(chalk.red(`✗ Cleanup failed: ${result.error}`));
+        process.exitCode = 1;
     }
 }

package/dist/src/commands/sync.js

@@ -8,8 +8,10 @@ import chalk from "chalk";
 import { join } from "path";
 import { createHash } from "crypto";
 import { getManifest, updateManifest, getPackageVersion, } from "../lib/manifest.js";
-import { copyTemplates, computeTemplateChanges, listTemplateFiles, getTemplatesDir, } from "../lib/templates.js";
+import { copyTemplates, computeTemplateChanges, listTemplateFiles, getTemplatesDir, assertTemplatesDirExists, isCustomizableFile, } from "../lib/templates.js";
 import { getConfig } from "../lib/config.js";
+import { resolveCliInvocation } from "../lib/version-check.js";
+import { syncSequantMcpPin } from "../lib/mcp-config.js";
 import { writeFile, readFile, fileExists, getFileStats } from "../lib/fs.js";
 import { generateAgentsMd, writeAgentsMd, AGENTS_MD_PATH, } from "../lib/agents-md.js";
 import { getProjectName } from "../lib/project-name.js";
@@ -195,6 +197,18 @@ export async function syncCommand(options = {}) {
         process.exitCode = 1;
         return;
     }
+    // Fail loudly on a missing templates root before anything reads or writes.
+    // This must precede the version fast path below: that path diffs against the
+    // same (missing) directory, sees no drift, and reports "already up to date"
+    // over an empty tree — the second-run trap in #822.
+    try {
+        await assertTemplatesDirExists();
+    }
+    catch (error) {
+        console.log(chalk.red(`❌ ${error.message}`));
+        process.exitCode = 1;
+        return;
+    }
     const packageVersion = getPackageVersion();
     const skillsVersion = await getSkillsVersion();
     if (!quiet) {
@@ -205,6 +219,18 @@ export async function syncCommand(options = {}) {
     // Get config tokens for template processing
     const config = await getConfig();
     const tokens = config?.tokens || {};
+    // Re-pin the project .mcp.json MCP server to the installed version (#793).
+    // `syncSequantMcpPin`'s contract has always named this the `update`/`sync`
+    // path, but only `update` ever called it, so a `sync` left the pin stale.
+    // Placed here for the same reason update.ts states: it must precede the
+    // "already up to date" fast path below, because a version-only upgrade
+    // leaves every template byte-identical and returns early — and that is
+    // exactly the case where the pin most needs refreshing.
+    const mcpPin = syncSequantMcpPin(process.cwd(), { dryRun });
+    if (mcpPin.updated && !quiet) {
+        const verb = dryRun ? "Would update" : "Updated";
+        console.log(chalk.blue(`${verb} .mcp.json MCP pin: ${mcpPin.from} → ${mcpPin.to}`));
+    }
     // The version marker is only a fast-path hint — verify actual content before
     // claiming "up to date". On a version match we still diff bundled templates
     // against installed content (rendered with the same variables) so we never
@@ -233,25 +259,36 @@ export async function syncCommand(options = {}) {
     }
     // Preview path: report exactly what the apply would write, then stop without
     // mutating (#722). This branch is only reached when `force` is set or the
-    // version marker mismatches — i.e. the path that runs `copyTemplates(force:
-    // true)` and rewrites the whole tree. (A matching-version, non-force dry-run
-    // already returned at the report-only short-circuit above, which never
-    // mutates.) `copyTemplates` does NOT protect in-place customizations the way
-    // `update` does — the force copy overwrites them — so the preview counts
-    // `local-override` files alongside `new`/`modified`. Reporting only
-    // new+modified would under-report the write-set, the exact divergence #722
-    // is about.
+    // version marker mismatches — i.e. the path that runs `copyTemplates` and
+    // rewrites the whole tree. (A matching-version, non-force dry-run already
+    // returned at the report-only short-circuit above, which never mutates.)
+    //
+    // Since #814 the apply path PRESERVES in-place customizations (files in
+    // CUSTOMIZABLE_FILES) under a plain sync and only overwrites them under an
+    // explicit `--force`. The preview must mirror that split exactly, or it would
+    // re-introduce the dry-run/apply divergence #722 is about: partition the
+    // `local-override` set into preserved (plain sync) vs overwritten (--force,
+    // or a non-customizable `.local`-twin the tree copy still rewrites).
     if (dryRun) {
         const changes = await computeTemplateChanges(manifest.stack, tokens);
         const newFiles = changes.filter((c) => c.status === "new");
         const modifiedFiles = changes.filter((c) => c.status === "modified");
         const localOverrides = changes.filter((c) => c.status === "local-override");
-        const toWrite = [...newFiles, ...modifiedFiles, ...localOverrides];
+        const preservedOverrides = force
+            ? []
+            : localOverrides.filter((c) => isCustomizableFile(c.path));
+        const overwrittenOverrides = localOverrides.filter((c) => force || !isCustomizableFile(c.path));
+        const toWrite = [...newFiles, ...modifiedFiles, ...overwrittenOverrides];
         if (!quiet) {
             console.log(chalk.bold("Summary (dry-run):"));
             console.log(chalk.green(`  New files: ${newFiles.length}`));
             console.log(chalk.yellow(`  Modified: ${modifiedFiles.length}`));
-            console.log(chalk.blue(`  Local overrides (overwritten by sync): ${localOverrides.length}`));
+            if (preservedOverrides.length > 0) {
+                console.log(chalk.blue(`  Customizable (preserved): ${preservedOverrides.length}`));
+            }
+            if (overwrittenOverrides.length > 0) {
+                console.log(chalk.blue(`  Local overrides (overwritten): ${overwrittenOverrides.length}`));
+            }
             if (modifiedFiles.length > 0) {
                 console.log(chalk.bold("\nModified files:"));
                 for (const file of modifiedFiles) {
@@ -264,9 +301,15 @@ export async function syncCommand(options = {}) {
                     console.log(chalk.green(`  ${file.path}`));
                 }
             }
-            if (localOverrides.length > 0) {
-                console.log(chalk.bold("\nLocal overrides (will be overwritten by sync):"));
-                for (const file of localOverrides) {
+            if (preservedOverrides.length > 0) {
+                console.log(chalk.bold("\nCustomizable files (preserved — run `sync --force` to replace):"));
+                for (const file of preservedOverrides) {
+                    console.log(chalk.blue(`  ${file.path}`));
+                }
+            }
+            if (overwrittenOverrides.length > 0) {
+                console.log(chalk.bold("\nLocal overrides (will be overwritten):"));
+                for (const file of overwrittenOverrides) {
                     console.log(chalk.blue(`  ${file.path}`));
                 }
             }
@@ -286,14 +329,39 @@ export async function syncCommand(options = {}) {
         }
         return;
     }
-    // Copy templates with force to overwrite existing files
+    // Copy templates: always refresh the managed trees, but only overwrite
+    // user-owned CUSTOMIZABLE_FILES (e.g. the constitution) when the user
+    // explicitly passed --force. These are two distinct notions of "force" and
+    // conflating them is what silently ate the constitution (#814).
     const copyOptions = {
-        force: true, // Always overwrite when syncing
+        force: true, // Always overwrite the managed skills/agents/hooks trees
+        overwriteCustomizable: force, // Clobber user-owned files only on explicit --force
     };
+    // AC-3: under --force, announce which customizable files are about to be
+    // overwritten *before* writing them, so the destructive action is never
+    // silent. Reuse the diff path's `local-override` classification (the same
+    // set --dry-run reports), narrowed to CUSTOMIZABLE_FILES.
+    if (force && !quiet) {
+        const changes = await computeTemplateChanges(manifest.stack, tokens);
+        const overwrites = changes.filter((c) => c.status === "local-override" && isCustomizableFile(c.path));
+        if (overwrites.length > 0) {
+            console.log(chalk.yellow(`Overwriting ${overwrites.length} customizable file(s) (--force):`));
+            for (const file of overwrites) {
+                console.log(chalk.yellow(`  ${file.path}`));
+            }
+        }
+    }
     if (!quiet) {
         console.log(chalk.blue("Copying templates..."));
     }
-    await copyTemplates(manifest.stack, tokens, copyOptions);
+    const { preservedCustomizable } = await copyTemplates(manifest.stack, tokens, copyOptions);
+    // AC-4: on a plain sync, report each customizable file that was preserved so
+    // the apply path's output matches what --dry-run already promises (#722).
+    if (!quiet && preservedCustomizable.length > 0) {
+        for (const file of preservedCustomizable) {
+            console.log(chalk.blue(`  preserved: ${file} — run \`sync --force\` to replace`));
+        }
+    }
     // Update version markers
     await updateSkillsVersion();
     await updateManifest();
@@ -340,9 +408,12 @@ export async function syncCommand(options = {}) {
  */
 export async function checkAndWarnSkillsOutdated(status) {
     const { outdated, currentVersion, packageVersion, contentDrift } = status ?? (await areSkillsOutdated());
+    // Name the invocation that reaches *this* build rather than assuming the
+    // documented `npm install sequant` shape — see resolveCliInvocation.
+    const cli = resolveCliInvocation();
     if (outdated) {
         console.log(chalk.yellow(`\n!  Skills are outdated (${currentVersion || "unknown"} → ${packageVersion})`));
-        console.log(chalk.yellow("   Run: npx sequant sync\n"));
+        console.log(chalk.yellow(`   Run: ${cli} sync\n`));
         return true;
     }
     if (contentDrift > 0) {
@@ -350,7 +421,7 @@ export async function checkAndWarnSkillsOutdated(status) {
         // version is report-only (it won't copy), so point at the commands that
         // actually resolve in-place drift — `sync --force` or `update`.
         console.log(chalk.yellow(`\n!  Version current, but ${contentDrift} file(s) differ from bundled content`));
-        console.log(chalk.yellow("   Run: npx sequant sync --force (or npx sequant update)\n"));
+        console.log(chalk.yellow(`   Run: ${cli} sync --force (or ${cli} update)\n`));
         return true;
     }
     return false;

package/dist/src/commands/update.js

@@ -7,9 +7,11 @@ import { spawnSync } from "child_process";
 import { getManifest, updateManifest, getPackageVersion, } from "../lib/manifest.js";
 import { computeTemplateChanges } from "../lib/templates.js";
 import { getConfig, saveConfig } from "../lib/config.js";
-import { getStackConfig, PM_CONFIG, getPackageManagerCommands, } from "../lib/stacks.js";
+import { getStackConfig, PM_CONFIG, getPackageManagerCommands, resolvePackageManager, } from "../lib/stacks.js";
 import { writeFile } from "../lib/fs.js";
+import { chmod } from "fs/promises";
 import { isStdinTTY, isCI, getNonInteractiveReason } from "../lib/tty.js";
+import { syncSequantMcpPin } from "../lib/mcp-config.js";
 /**
  * True when `update` must not prompt: stdin is not a terminal (piped input) or
  * we are running in a recognized CI environment. CI is checked explicitly
@@ -41,8 +43,18 @@ export async function updateCommand(options) {
     const manifest = await getManifest();
     if (!manifest) {
         console.log(chalk.red("❌ Sequant is not initialized. Run `sequant init` first."));
+        process.exitCode = 1;
         return;
     }
+    // Resolved once for the whole command. The manifest's packageManager is a
+    // snapshot taken at `sequant init`, so it is absent on pre-1.3.0 installs —
+    // exactly the population the PM_RUN backfill below exists to serve. The
+    // three sites that used to spell this `(manifest.packageManager as keyof
+    // typeof PM_CONFIG) || "npm"` therefore assumed npm for those installs, and
+    // wrote an npm PM_RUN token into a pnpm/yarn/bun project's config (#870).
+    // The root is the cwd because `update` operates on the project in place,
+    // the same directory `getManifest` and `syncSequantMcpPin` read.
+    const pm = resolvePackageManager(manifest.packageManager, process.cwd());
     const packageVersion = getPackageVersion();
     console.log(chalk.gray(`Current version: ${manifest.version}`));
     console.log(chalk.gray(`Stack: ${manifest.stack}`));
@@ -64,7 +76,6 @@ export async function updateCommand(options) {
         console.log(chalk.gray(`Dev URL: ${tokens.DEV_URL || "(not set)"}\n`));
         // Add PM_RUN if missing (for existing installs before v1.3.0)
         if (!tokens.PM_RUN) {
-            const pm = manifest.packageManager || "npm";
             const pmConfig = getPackageManagerCommands(pm);
             tokens.PM_RUN = pmConfig.run;
             config.tokens = tokens;
@@ -78,7 +89,6 @@ export async function updateCommand(options) {
         const stackConfig = getStackConfig(manifest.stack);
         const defaultDevUrl = stackConfig.devUrl;
         // Get package manager run command
-        const pm = manifest.packageManager || "npm";
         const pmConfig = getPackageManagerCommands(pm);
         if (options.force || options.yes) {
             tokens = { DEV_URL: defaultDevUrl, PM_RUN: pmConfig.run };
@@ -116,6 +126,16 @@ export async function updateCommand(options) {
             console.log(chalk.green("✔ Configuration saved\n"));
         }
     }
+    // Re-pin the project .mcp.json MCP server to the installed version (#793).
+    // Independent of template changes: a version-only upgrade leaves every
+    // template unchanged (so the flow would short-circuit at "Everything is up to
+    // date" below) but should still refresh the pin so the MCP server tracks the
+    // release the user just updated to. Runs here, before that short-circuit.
+    const mcpPin = syncSequantMcpPin(process.cwd(), { dryRun: options.dryRun });
+    if (mcpPin.updated) {
+        const verb = options.dryRun ? "Would update" : "Updated";
+        console.log(chalk.blue(`${verb} .mcp.json MCP pin: ${mcpPin.from} → ${mcpPin.to}`));
+    }
     // Compute changes using the shared, variable-aware comparison.
     // Templates are rendered (PROJECT_NAME, STACK_NOTES, etc.) before diffing,
     // and in-place-customizable files (constitution) are protected as overrides.
@@ -202,6 +222,11 @@ export async function updateCommand(options) {
     let updated = 0;
     for (const file of applySet) {
         await writeFile(file.path, file.rendered);
+        // Shell scripts (hooks, scripts/dev) need the exec bit, matching the
+        // copyTemplates write path.
+        if (file.path.endsWith(".sh")) {
+            await chmod(file.path, 0o755);
+        }
         updated++;
     }
     // Update manifest
@@ -210,8 +235,6 @@ export async function updateCommand(options) {
     // Check if package.json was updated and run install
     const packageJsonUpdated = applySet.some((f) => f.path === "package.json" || f.path.endsWith("/package.json"));
     if (packageJsonUpdated) {
-        // Use detected package manager or default to npm
-        const pm = manifest.packageManager || "npm";
         const pmConfig = PM_CONFIG[pm];
         console.log(chalk.blue(`\npackage.json updated, running ${pmConfig.install}...`));
         const [cmd, ...args] = pmConfig.install.split(" ");

package/dist/src/lib/ac-parser.d.ts

@@ -6,6 +6,12 @@
  * Also supports alternate formats: `- [ ] **B2:** Description`
  * And bold-wrapped format: `- [ ] **AC-1: Description**`
  *
+ * Bare checkbox items (`- [ ] Some requirement`, no ID prefix) are also
+ * honored, but ONLY under an explicit `## Acceptance Criteria` heading, where
+ * they receive synthesized stable IDs. Human-authored issues rarely prefix
+ * their ACs with IDs, so without this every hand-written issue parsed to zero
+ * ACs — blinding every downstream AC consumer (#850).
+ *
  * @example
  * ```typescript
  * import { parseAcceptanceCriteria } from './ac-parser';
@@ -39,8 +45,16 @@ export declare function inferVerificationMethod(description: string): ACVerifica
  * - `- [ ] **AC-1:** Description`
  * - `- [ ] **B2:** Description`
  * - `- [ ] **AC-1: Description**` (bold wraps ID + description)
+ * - `- [ ] **AC-1** Description` (bold ID, no colon)
+ * - `- [ ] **AC-1**: Description` (colon outside the bold)
  * - `- [ ] AC-1: Description`
  *
+ * Bare checkbox items without an ID prefix (`- [ ] Some requirement`) are also
+ * parsed, but ONLY under an explicit `## Acceptance Criteria` heading, where
+ * they receive synthesized stable IDs (`AC-1`, `AC-2`, ...). This keeps
+ * unrelated checklists elsewhere in the body (Open Questions, Test Plan) from
+ * being misread as ACs, while letting ordinary human-written issues parse.
+ *
  * @param issueBody - The full GitHub issue body markdown
  * @returns Array of parsed acceptance criteria
  */