sequant 2.9.0 → 2.10.0

package/templates/hooks/pre-tool.sh

@@ -60,7 +60,23 @@ mkdir -p "$_LOG_DIR" 2>/dev/null || _LOG_DIR="${_TMPDIR}"
 
 TIMING_LOG="${_LOG_DIR}/claude-timing.log"
 HOOK_LOG="${_LOG_DIR}/claude-hook.log"
-PARALLEL_MARKER_PREFIX="${_TMPDIR}/claude-parallel-"
+
+# Parallel-group marker naming (#881). The scheme lives in one sourced helper
+# next to this hook so the writer (/exec skill) and the readers (this hook and
+# post-tool.sh) cannot drift. PARALLEL_MARKER_PREFIX is project-scoped, so a
+# parallel group in another project no longer collides in the shared temp dir.
+_MARKER_HELPER="$(dirname "${BASH_SOURCE[0]:-$0}")/parallel-marker.sh"
+if [[ -f "$_MARKER_HELPER" ]]; then
+    # shellcheck source=parallel-marker.sh disable=SC1091
+    source "$_MARKER_HELPER"
+    PARALLEL_MARKER_PREFIX="$(parallel_marker_prefix)"
+    PARALLEL_MARKER_PROJECT_ROOT="$(parallel_marker_project_root)"
+else
+    # Helper missing (unexpected): fall back to the pre-#881 global prefix so the
+    # hook still functions, accepting the old cross-project collision risk.
+    PARALLEL_MARKER_PREFIX="${_TMPDIR}/claude-parallel-"
+    PARALLEL_MARKER_PROJECT_ROOT=""
+fi
 
 # === HELPERS ===
 
@@ -237,17 +253,20 @@ if [[ "$TOOL_NAME" == "Bash" ]]; then
 fi
 
 # === AGENT ID DETECTION ===
-# For parallel agents, detect group ID from marker files
-# Format: ${_TMPDIR}/claude-parallel-<group-id>.marker
+# For parallel agents, detect group ID from marker files. The glob is scoped to
+# the current project's marker prefix (#881) so a foreign project's marker never
+# labels this session's timing rows.
 AGENT_ID=""
+_MARKER_BASE=$(basename "$PARALLEL_MARKER_PREFIX")
 # Find marker files using find (works in both bash and zsh)
 while IFS= read -r marker; do
     if [[ -n "$marker" && -f "$marker" ]]; then
-        # Extract group ID from marker filename
-        AGENT_ID=$(basename "$marker" | sed 's/claude-parallel-//' | sed 's/\.marker//')
+        # Extract group ID: strip the project-scoped prefix and the suffix.
+        AGENT_ID=$(basename "$marker" .marker)
+        AGENT_ID=${AGENT_ID#"$_MARKER_BASE"}
         break
     fi
-done < <(find "${_TMPDIR}" -maxdepth 1 -name "claude-parallel-*.marker" 2>/dev/null)
+done < <(find "${_TMPDIR}" -maxdepth 1 -name "${_MARKER_BASE}*.marker" 2>/dev/null)
 
 # === TIMING START ===
 # Include agent ID in log format if available (AC-4)
@@ -617,6 +636,36 @@ if [[ "$TOOL_NAME" == "Bash" ]] && seg_match 'git commit'; then
     fi
 fi
 
+# Resolve a path to its canonical form, tolerating components that do not exist
+# yet. Plain `realpath` fails outright on a missing path, and BSD/macOS realpath
+# has no `-m`. The old code fell back to the raw string on failure, which broke
+# the comparison below whenever the worktree path crossed a symlink: a Write
+# creating a NEW file resolved to nothing (raw "/tmp/.../x.ts") while the
+# existing worktree dir resolved through the symlink ("/private/tmp/.../"), so
+# the prefix test failed and writes *inside* the worktree were blocked. macOS
+# hits this every time, since /tmp is a symlink to /private/tmp.
+#
+# Walk up to the nearest existing ancestor, canonicalise that, then re-append
+# the missing tail so both sides normalise identically.
+resolve_path_allow_missing() {
+    local p="$1"
+    local suffix=""
+
+    while [[ ! -e "$p" && "$p" != "/" && "$p" != "." && -n "$p" ]]; do
+        suffix="/$(basename "$p")$suffix"
+        local parent
+        parent="$(dirname "$p")"
+        [[ "$parent" == "$p" ]] && break
+        p="$parent"
+    done
+
+    local resolved
+    resolved="$(realpath "$p" 2>/dev/null || echo "$p")"
+    # Avoid a doubled slash when the resolved ancestor is "/"
+    [[ "$resolved" == "/" ]] && resolved=""
+    echo "${resolved}${suffix}"
+}
+
 # === WORKTREE PATH ENFORCEMENT ===
 # Enforces that file operations stay within the designated worktree
 # Sources for worktree path (in priority order):
@@ -631,10 +680,21 @@ if [[ "$TOOL_NAME" == "Edit" || "$TOOL_NAME" == "Write" ]]; then
         EXPECTED_WORKTREE="$SEQUANT_WORKTREE"
     fi
 
-    # Priority 2: Fall back to parallel marker file
+    # Priority 2: Fall back to parallel marker file. The glob prefix is already
+    # scoped to this project's hash (#881, AC-2), so a foreign project's marker
+    # is not matched here. As defense-in-depth (AC-3), also verify the marker's
+    # stored owning project root (line 2) matches the current one before trusting
+    # it — a stale or hand-placed marker with a colliding name is ignored rather
+    # than allowed to redirect enforcement.
     if [[ -z "$EXPECTED_WORKTREE" ]]; then
         for marker in "${PARALLEL_MARKER_PREFIX}"*.marker; do
             if [[ -f "$marker" ]]; then
+                MARKER_PROJECT_ROOT=$(sed -n '2p' "$marker" 2>/dev/null || true)
+                if [[ -n "$MARKER_PROJECT_ROOT" && -n "$PARALLEL_MARKER_PROJECT_ROOT" \
+                      && "$MARKER_PROJECT_ROOT" != "$PARALLEL_MARKER_PROJECT_ROOT" ]]; then
+                    # Foreign owner — ignore this marker entirely.
+                    continue
+                fi
                 # Read expected worktree path from marker file (first line)
                 EXPECTED_WORKTREE=$(head -1 "$marker" 2>/dev/null || true)
                 break
@@ -660,9 +720,14 @@ if [[ "$TOOL_NAME" == "Edit" || "$TOOL_NAME" == "Write" ]]; then
         fi
 
         if [[ -n "$FILE_PATH" ]]; then
-            # Resolve to absolute path for consistent comparison
-            REAL_FILE_PATH=$(realpath "$FILE_PATH" 2>/dev/null || echo "$FILE_PATH")
-            REAL_WORKTREE=$(realpath "$EXPECTED_WORKTREE" 2>/dev/null || echo "$EXPECTED_WORKTREE")
+            # Resolve to canonical absolute paths for consistent comparison.
+            # resolve_path_allow_missing (defined above) tolerates a file that
+            # does not exist yet; a bare `realpath` fallback-to-raw-string broke
+            # new-file Writes whenever the worktree path crossed a symlink
+            # (macOS /tmp -> /private/tmp): the new file stayed raw while the
+            # existing worktree dir resolved, so the prefix test always failed.
+            REAL_FILE_PATH=$(resolve_path_allow_missing "$FILE_PATH")
+            REAL_WORKTREE=$(resolve_path_allow_missing "$EXPECTED_WORKTREE")
 
             # Check if file path is within the expected worktree
             if [[ "$REAL_FILE_PATH" != "$REAL_WORKTREE"* ]]; then

package/templates/scripts/cleanup-worktree.sh

@@ -1,7 +1,17 @@
 #!/bin/bash
 
 # Clean up a worktree after PR is merged
-# Usage: ./scripts/cleanup-worktree.sh [flags] <branch-name>
+# Usage: ./scripts/cleanup-worktree.sh [flags] <branch>
+# <branch> accepts a bare issue number (`123`), a QUOTED glob
+# (`'feature/123-*'`), or the full branch name — all resolve to the same
+# worktree and, since #838, to the same underlying branch ref.
+# A bare number is ANCHORED to the issue-number position (#844): `838` resolves
+# `feature/838-*` and never `feature/1838-other-work`. When the argument matches
+# more than one worktree branch the script lists every candidate and exits
+# non-zero instead of silently deleting the first.
+# Quote the glob: this script resolves the pattern itself, so it must arrive
+# unexpanded. zsh (the default macOS shell) aborts on an unmatched unquoted
+# glob before the script ever runs; bash would pass it through literally.
 # Example: ./scripts/cleanup-worktree.sh feature/123-add-user-dashboard
 #
 # The remote branch is deleted ONLY when the branch's PR is MERGED (the
@@ -28,7 +38,20 @@ NC='\033[0m'
 # Print CLI usage/help (kept in sync with the header comment above).
 print_usage() {
     cat <<'USAGE'
-Usage: ./scripts/cleanup-worktree.sh [flags] <branch-name>
+Usage: ./scripts/cleanup-worktree.sh [flags] <branch>
+
+<branch> may be any of (all resolve to the same worktree):
+  838                    a bare issue number — anchored to the issue-number
+                         position, so it never matches feature/1838-other-work
+  'feature/838-*'        a glob — MUST be quoted (see below)
+  feature/838-fix-thing  the full branch name
+
+An argument that matches more than one worktree branch is rejected: the script
+lists every candidate and exits non-zero rather than deleting the first.
+
+Quote the glob form. This script resolves the pattern itself, so it must
+arrive unexpanded; zsh aborts on an unmatched unquoted glob before the
+script ever runs.
 
 Clean up a feature worktree. The remote branch is deleted ONLY when the
 branch's PR is MERGED (the documented post-merge contract) or when an
@@ -101,17 +124,149 @@ if [ -z "$BRANCH_NAME" ]; then
     exit 1
 fi
 
-# Find worktree path. Parse porcelain (which separates path/branch onto distinct
-# lines) so paths containing whitespace survive intact, and so we match against
-# the branch ref rather than against a free-form `grep` over the entire line —
-# the latter false-matches whenever the branch name appears in the path string.
-WORKTREE_PATH=$(git worktree list --porcelain | awk -v target="$BRANCH_NAME" '
-  /^worktree / { sub(/^worktree /, ""); path = $0 }
-  /^branch refs\/heads\// {
-    sub(/^branch refs\/heads\//, "")
-    if (index($0, target) > 0) { print path; exit }
-  }
-')
+# Resolve $BRANCH_NAME to exactly one worktree AND its full branch ref. Both are
+# captured because every downstream consumer (`gh pr list --head`, `git branch
+# -D`, `git push origin --delete`) needs the EXACT ref, or it silently no-ops on
+# a shorthand and the script prints "Cleanup complete!" while leaving the branch
+# behind (the #838 defect $RESOLVED_BRANCH closes).
+#
+# Matching is TIERED and anchored (#844). The old matcher was a single
+# unanchored substring test with first-match-wins and no ambiguity check:
+#
+#     case "$_wt_branch" in *"$BRANCH_NAME"* | $BRANCH_NAME)
+#
+# so `838` matched `feature/1838-other-work`, and whichever worktree porcelain
+# emitted first was torn down — local AND remote, since #838. Porcelain sorts
+# linked worktrees lexicographically by basename (`1838- < 838-`), so the
+# mis-resolution was deterministic, not a race. The tiers below anchor bare
+# numbers to the issue-number position and make any 2+-way match fatal.
+#
+# Tiers (first tier with any match decides; 2+ matches in a tier is fatal):
+#   1. exact    — branch == argument. Guards coexisting feature/838-fix and
+#                 feature/838-fix-more (both legal via new-feature.sh's title
+#                 truncation): the full name must resolve, not trip ambiguity.
+#   2. anchored — branch's last path segment == argument; plus, when the
+#                 argument is all digits, the sequant issue-number branch shapes
+#                 parseIssueNumberFromBranch (worktree-discovery.ts) recognizes:
+#                 feature/<N>-*, feature/<N>, issue-<N>, <N>-*.
+#   3. glob     — only when the argument itself contains * ? or [ : a plain
+#                 `case` glob over the branch ref. Keeps the documented, quoted
+#                 `feature/<issue>-*` form working, now behind the ambiguity gate.
+#
+# bash 3.2 (macOS floor): no arrays/mapfile. Candidates live in a
+# newline-delimited string of "<path>\t<branch>"; each tier re-scans it via
+# process substitution (which keeps loop-set counters in the current shell — a
+# pipe would lose them to a subshell). `while IFS= read -r` preserves whitespace
+# in paths (the #575 hardening).
+_TAB=$(printf '\t')
+
+# Collect candidate worktrees: porcelain stanzas carrying a branch ref, minus
+# the main worktree (first entry — without this, `'*'`/`'feature/*'` could
+# resolve to and `git worktree remove` it) and minus the `exec-agent-*`
+# sub-worktree branches parallel isolation leaves behind (real porcelain
+# candidates, per this script's own reaping below).
+CANDIDATES=""
+_wt_path=""
+while IFS= read -r _line; do
+    case "$_line" in
+        "worktree "*)
+            _wt_path="${_line#worktree }"
+            ;;
+        "branch refs/heads/"*)
+            _wt_branch="${_line#branch refs/heads/}"
+            if [ "$_wt_path" = "$MAIN_WORKTREE" ]; then
+                continue
+            fi
+            case "$_wt_branch" in
+                exec-agent-*) continue ;;
+            esac
+            CANDIDATES="${CANDIDATES}${_wt_path}${_TAB}${_wt_branch}
+"
+            ;;
+    esac
+done < <(git worktree list --porcelain)
+
+# Classify the argument once: a bare issue number (all digits) enables the
+# anchored issue-number shapes; a glob metacharacter enables the glob tier.
+_is_number=false
+case "$BRANCH_NAME" in
+    ''|*[!0-9]*) ;;
+    *) _is_number=true ;;
+esac
+_is_glob=false
+case "$BRANCH_NAME" in
+    *[*?[]*) _is_glob=true ;;
+esac
+
+# Test one branch ref ($2) against one tier ($1); returns 0 on match. Called
+# only as an `if` condition, so a non-zero return never trips `set -e`.
+_branch_matches() {
+    case "$1" in
+        exact)
+            [ "$2" = "$BRANCH_NAME" ]
+            ;;
+        anchored)
+            # Last path segment equals the argument (covers `838-spaced`).
+            if [ "${2##*/}" = "$BRANCH_NAME" ]; then
+                return 0
+            fi
+            # All-digit argument: the sequant issue-number branch shapes.
+            if [ "$_is_number" = true ]; then
+                case "$2" in
+                    feature/"$BRANCH_NAME"-* | feature/"$BRANCH_NAME" \
+                        | issue-"$BRANCH_NAME" | "$BRANCH_NAME"-*)
+                        return 0
+                        ;;
+                esac
+            fi
+            return 1
+            ;;
+        glob)
+            case "$2" in
+                $BRANCH_NAME) return 0 ;;
+            esac
+            return 1
+            ;;
+    esac
+}
+
+# Walk the tiers in order; the first tier with any match decides. A tier with
+# 2+ matches is fatal (AC-2/AC-3): list every candidate and exit non-zero
+# rather than silently deleting the first.
+WORKTREE_PATH=""
+RESOLVED_BRANCH=""
+for _tier in exact anchored glob; do
+    # The glob tier only participates when the argument is itself a glob.
+    if [ "$_tier" = glob ] && [ "$_is_glob" != true ]; then
+        continue
+    fi
+
+    _match_count=0
+    _match_list=""
+    while IFS="$_TAB" read -r _cand_path _cand_branch; do
+        [ -n "$_cand_branch" ] || continue
+        if _branch_matches "$_tier" "$_cand_branch"; then
+            _match_count=$((_match_count + 1))
+            if [ "$_match_count" -eq 1 ]; then
+                WORKTREE_PATH="$_cand_path"
+                RESOLVED_BRANCH="$_cand_branch"
+            fi
+            _match_list="${_match_list}  ${_cand_branch}${_TAB}${_cand_path}
+"
+        fi
+    done < <(printf '%s' "$CANDIDATES")
+
+    if [ "$_match_count" -gt 1 ]; then
+        echo -e "${RED}❌ Error: '$BRANCH_NAME' is ambiguous — it matches ${_match_count} worktree branches:${NC}" >&2
+        printf '%s' "$_match_list" >&2
+        echo -e "${RED}Refusing to guess. Re-run with the full branch name to disambiguate.${NC}" >&2
+        exit 1
+    fi
+
+    if [ "$_match_count" -eq 1 ]; then
+        break
+    fi
+done
 
 if [ -z "$WORKTREE_PATH" ]; then
     echo -e "${RED}❌ Error: Worktree not found for branch: $BRANCH_NAME${NC}"
@@ -121,12 +276,17 @@ if [ -z "$WORKTREE_PATH" ]; then
     exit 1
 fi
 
-echo -e "${BLUE}🧹 Cleaning up worktree for: $BRANCH_NAME${NC}"
+echo -e "${BLUE}🧹 Cleaning up worktree for: $RESOLVED_BRANCH${NC}"
 echo -e "${BLUE}Path: $WORKTREE_PATH${NC}"
 echo ""
 
-# Check if PR is merged
-PR_STATUS=$(gh pr list --head "$BRANCH_NAME" --state merged --json number,state --jq '.[0].state' 2>/dev/null || echo "")
+# Check if PR is merged. Queries the RESOLVED ref (#838): `--head` is an exact
+# match, so passing the caller's shorthand here reported "not merged" for every
+# invocation form except a full literal branch name — including the
+# `feature/<issue>-*` form the skills and docs prescribe. A warning that always
+# fires carries no signal and makes --yes/--force the mandatory incantation,
+# which re-arms the very bypass reflex #750 removed.
+PR_STATUS=$(gh pr list --head "$RESOLVED_BRANCH" --state merged --json number,state --jq '.[0].state' 2>/dev/null || echo "")
 
 # Confirmation gate — only reached when the PR is NOT merged. When MERGED we
 # short-circuit past this entirely (no prompt, no TTY check) so the documented
@@ -179,9 +339,11 @@ fi
 echo -e "${BLUE}📂 Removing worktree...${NC}"
 git worktree remove "$WORKTREE_PATH" --force
 
-# Delete local branch
+# Delete local branch. Uses the RESOLVED ref (#838) — `git branch -D 817` finds
+# no such branch and, being `|| true`-suppressed, failed silently: the script
+# reported "Cleanup complete!" while leaving the branch behind.
 echo -e "${BLUE}🌿 Deleting local branch...${NC}"
-git branch -D "$BRANCH_NAME" 2>/dev/null || true
+git branch -D "$RESOLVED_BRANCH" 2>/dev/null || true
 
 # Delete remote branch — hard-gated on merge state. Only delete when the PR is
 # MERGED or an explicit override flag (--delete-remote/--force) was passed.
@@ -189,7 +351,8 @@ git branch -D "$BRANCH_NAME" 2>/dev/null || true
 # PR's head branch makes GitHub close the PR unmerged, stranding the work.
 if [ "$PR_STATUS" = "MERGED" ] || [ "$DELETE_REMOTE" = true ]; then
     echo -e "${BLUE}☁️  Deleting remote branch...${NC}"
-    git push origin --delete "$BRANCH_NAME" 2>/dev/null || true
+    # Resolved ref (#838): same silent-no-op class as the local delete above.
+    git push origin --delete "$RESOLVED_BRANCH" 2>/dev/null || true
 else
     echo -e "${YELLOW}⏭️  Skipped remote-branch delete (PR not merged; pass --delete-remote or --force to override).${NC}"
 fi