sequant 2.8.0 → 2.10.0

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "sequant",
-  "version": "2.8.0",
+  "version": "2.10.0",
   "description": "AI coding agent orchestrator — resolve GitHub issues end-to-end with isolated git worktrees, quality gates, and an MCP server. Works with Claude Code or Aider.",
   "type": "module",
   "bin": {
     "sequant": "dist/bin/cli.js"
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "types": "./dist/src/index.d.ts",
+      "import": "./dist/src/index.js"
     }
   },
   "files": [
@@ -21,7 +21,7 @@
     ".claude-plugin"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "rm -rf dist/src dist/bin dist/dashboard && tsc && chmod +x dist/bin/cli.js",
     "dev": "tsx bin/cli.ts",
     "test": "vitest run",
     "lint": "eslint src/ bin/ --max-warnings 0",
@@ -29,6 +29,7 @@
     "sync:hooks": "bash scripts/sync-hooks.sh",
     "validate:skills": "for skill in templates/skills/*/; do case \"$skill\" in *_shared*|*/references/*) continue;; esac; npx skills-ref validate \"$skill\"; done",
     "lint:skill-calls": "npx tsx scripts/lint-skill-calls.ts",
+    "lint:skill-gates": "npx tsx scripts/lint-skill-gates.ts",
     "lint:skill-sync": "npx tsx scripts/check-skill-sync.ts",
     "prepare:marketplace": "npx tsx scripts/prepare-marketplace.ts",
     "validate:marketplace": "npx tsx scripts/prepare-marketplace.ts --validate-only",
@@ -78,7 +79,7 @@
   },
   "homepage": "https://sequant.io",
   "engines": {
-    "node": ">=22.12.0"
+    "node": ">=22.13.0"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1"
@@ -97,7 +98,6 @@
     "cli-table3": "^0.6.5",
     "commander": "^14.0.3",
     "diff": "^9.0.0",
-    "gradient-string": "^3.0.0",
     "hono": "^4.12.1",
     "ink": "^7.0.1",
     "inquirer": "^14.0.1",
@@ -112,9 +112,8 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/gradient-string": "^1.1.6",
     "@types/inquirer": "^9.0.7",
-    "@types/node": "^25.4.0",
+    "@types/node": "^26.0.1",
     "@types/react": "^19.2.14",
     "@typescript-eslint/eslint-plugin": "^8.58.0",
     "@typescript-eslint/parser": "^8.58.0",

package/templates/hooks/parallel-marker.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Shared naming contract for /exec parallel-group marker files (#881).
+#
+# One writer (the /exec skill) and two readers (pre-tool.sh, post-tool.sh) must
+# agree on (a) the marker filename and (b) how the owning project is identified.
+# Before #881 the filename was a global constant, so a parallel group in ONE
+# project silently redirected worktree enforcement for EVERY concurrent Claude
+# session on the machine — the first matching marker in the shared temp dir won,
+# regardless of which project wrote it. Keeping the scheme in this single sourced
+# file is what stops the writer and the readers from drifting apart (AC-4).
+#
+# Marker filename: ${TMPDIR}/claude-parallel-<project-hash>-<group-id>.marker
+# Marker contents: line 1 = worktree path, line 2 = owning project root.
+
+# parallel_marker_project_root — the canonical identity of the current project,
+# derived identically in skill-context and hook-context. CLAUDE_PROJECT_DIR is
+# set by Claude Code for both the skill's shell and the hook's shell within the
+# same session; the git-toplevel fallback resolves to the same worktree when it
+# is unset. A mismatch here would silently re-introduce the cross-project
+# collision this fix exists to close, so the two contexts MUST agree.
+parallel_marker_project_root() {
+    if [[ -n "${CLAUDE_PROJECT_DIR:-}" ]]; then
+        printf '%s' "$CLAUDE_PROJECT_DIR"
+    else
+        git rev-parse --show-toplevel 2>/dev/null || printf '%s' "$PWD"
+    fi
+}
+
+# parallel_marker_hash — a stable per-project hash used in the marker filename so
+# two projects running parallel groups at once cannot collide (AC-1). Reuses the
+# md5-with-md5sum-fallback idiom already used for the per-file lock in
+# pre-tool.sh. printf (no trailing newline) keeps writer and reader identical.
+parallel_marker_hash() {
+    local root
+    root="$(parallel_marker_project_root)"
+    printf '%s' "$root" | md5 -q 2>/dev/null || printf '%s' "$root" | md5sum | cut -d' ' -f1
+}
+
+# parallel_marker_prefix — the ${TMPDIR}-anchored, project-scoped filename prefix
+# that both the writer and the readers glob on (AC-2). Honors $TMPDIR (macOS's
+# per-user temp) with a /tmp fallback, matching the hooks' own _TMPDIR.
+parallel_marker_prefix() {
+    local tmp="${TMPDIR:-/tmp}"
+    printf '%s/claude-parallel-%s-' "$tmp" "$(parallel_marker_hash)"
+}
+
+# parallel_marker_path <group-id> — the full marker path for one group.
+parallel_marker_path() {
+    printf '%s%s.marker' "$(parallel_marker_prefix)" "$1"
+}

package/templates/hooks/post-tool.sh

@@ -51,33 +51,61 @@ fi
 
 _TMPDIR="${TMPDIR:-/tmp}"
 
-# Use CLAUDE_PLUGIN_DATA for persistent logs (survives plugin updates)
-if [[ -n "${CLAUDE_PLUGIN_DATA}" ]]; then
+# Log sink (#763 AC-5c: blocked-command history must survive to be a useful
+# regression corpus, so $TMPDIR — which macOS purges — is a last resort only).
+#
+# This block MUST stay identical to the one in pre-tool.sh. The two hooks
+# write the *same* claude-timing.log (START there, END here) and the same
+# claude-quality.log, so any divergence silently splits every START/END pair
+# across two files.
+#
+# Every candidate is absolute and lives outside the repo. A repo-local or
+# relative path is wrong three times over: it resolves against the hook's cwd
+# (which Claude Code does not pin), it yields one sink per directory instead
+# of the single corpus AC-5 asks for, and — worst — creating it inside a repo
+# makes `git status --porcelain` non-empty, which silently defeats pre-tool.sh's
+# no-changes guard that reads exactly that output.
+if [[ -n "${CLAUDE_PLUGIN_DATA:-}" ]]; then
   _LOG_DIR="${CLAUDE_PLUGIN_DATA}/logs"
-  mkdir -p "$_LOG_DIR"
+elif [[ -n "${HOME:-}" ]]; then
+  _LOG_DIR="${HOME}/.sequant/logs"
 else
   _LOG_DIR="${_TMPDIR}"
 fi
+mkdir -p "$_LOG_DIR" 2>/dev/null || _LOG_DIR="${_TMPDIR}"
 
 TIMING_LOG="${_LOG_DIR}/claude-timing.log"
 QUALITY_LOG="${_LOG_DIR}/claude-quality.log"
 TESTS_LOG="${_LOG_DIR}/claude-tests.log"
-PARALLEL_MARKER_PREFIX="${_TMPDIR}/claude-parallel-"
+
+# Parallel-group marker naming (#881). Source the shared helper next to this
+# hook so the project-scoped prefix stays identical to the writer and pre-tool.sh.
+_MARKER_HELPER="$(dirname "${BASH_SOURCE[0]:-$0}")/parallel-marker.sh"
+if [[ -f "$_MARKER_HELPER" ]]; then
+    # shellcheck source=parallel-marker.sh disable=SC1091
+    source "$_MARKER_HELPER"
+    PARALLEL_MARKER_PREFIX="$(parallel_marker_prefix)"
+else
+    PARALLEL_MARKER_PREFIX="${_TMPDIR}/claude-parallel-"
+fi
 
 # === AGENT ID DETECTION ===
-# For parallel agents, detect group ID from marker files
-# Format: ${_TMPDIR}/claude-parallel-<group-id>.marker
+# For parallel agents, detect group ID from marker files. The glob is scoped to
+# the current project's marker prefix (#881) so a foreign project's marker never
+# labels this session's timing rows.
 AGENT_ID=""
 IS_PARALLEL_AGENT="false"
+_MARKER_BASE=$(basename "$PARALLEL_MARKER_PREFIX")
 # Find marker files using find (works in both bash and zsh)
 while IFS= read -r marker; do
     if [[ -n "$marker" && -f "$marker" ]]; then
-        # Extract group ID from marker filename
-        AGENT_ID=$(basename "$marker" | sed 's/claude-parallel-//' | sed 's/\.marker//')
+        # Extract group ID: strip the project-scoped prefix and the suffix.
+        AGENT_ID=$(basename "$marker" .marker)
+        AGENT_ID=${AGENT_ID#"$_MARKER_BASE"}
         IS_PARALLEL_AGENT="true"
         break
     fi
-done < <(find "${_TMPDIR}" -maxdepth 1 -name "claude-parallel-*.marker" 2>/dev/null)
+done < <(find "${_TMPDIR}" -maxdepth 1 -name "${_MARKER_BASE}*.marker" 2>/dev/null)
 
 # === TIMING END ===
 # Include agent ID in log format if available (AC-4)
@@ -238,7 +266,7 @@ if [[ "${CLAUDE_HOOKS_COVERAGE:-}" == "true" ]]; then
             COVERAGE_LOG="${_LOG_DIR}/claude-coverage.log"
 
             # Get changed source files (excluding tests)
-            changed_files=$(git diff main...HEAD --name-only 2>/dev/null | grep -E '\.(ts|tsx|js|jsx)$' | grep -v -E '\.test\.|\.spec\.|__tests__' || true)
+            changed_files=$(git diff origin/main...HEAD --name-only 2>/dev/null | grep -E '\.(ts|tsx|js|jsx)$' | grep -v -E '\.test\.|\.spec\.|__tests__' || true)
 
             if [[ -n "$changed_files" ]]; then
                 echo "$(date +%H:%M:%S) COVERAGE_ANALYSIS: Checking test coverage for changed files" >> "$QUALITY_LOG"