sequant 2.9.0 → 2.11.0

package/dist/src/lib/workflow/worktree-resolver.js

@@ -0,0 +1,126 @@
+/**
+ * Repo-scoped worktree resolution and verification (#899).
+ *
+ * Skill-driven `/fullsolve` used to hand `/exec` an unexpanded glob
+ * (`../worktrees/feature/<issue>-` followed by a star and a slash) and `/exec`
+ * was instructed to trust it without checking. Two things went wrong:
+ *
+ * 1. When nothing had created the worktree, the `cd` failed and the agent
+ *    silently kept working in the main checkout.
+ * 2. `../worktrees/` is one flat namespace shared by every repo under the same
+ *    parent directory, and issue numbers are per-repo — so where the glob *did*
+ *    match, it could match a sibling project's worktree.
+ *
+ * Both are fixed the same way: never resolve worktrees through the filesystem.
+ * `git worktree list` reports only the worktrees of the repository containing
+ * `cwd`, so scoping is structural rather than a filter that can be forgotten,
+ * and it reports the *branch*, which is the real identity — a worktree
+ * directory slug can drift from its branch after a rename.
+ */
+import { existsSync, realpathSync, statSync } from "fs";
+import path from "path";
+import { listWorktrees } from "./worktree-manager.js";
+/**
+ * Find the worktree of the *current* repository that holds issue `issue`.
+ *
+ * Selection keys on the branch git reports, never on the directory name, so a
+ * worktree whose slug has drifted from its branch still resolves — and a
+ * directory that merely looks like a match (a sibling repo's worktree, or a
+ * stray directory) never does.
+ *
+ * @param issue - Issue number to look up.
+ * @param cwd - Directory inside the repository to search. Defaults to process cwd.
+ */
+export function resolveIssueWorktree(issue, cwd) {
+    const matches = listWorktrees(cwd)
+        .filter((w) => w.issue === issue)
+        .map(({ path: p, branch }) => ({ path: p, branch }));
+    if (matches.length === 0) {
+        return {
+            ok: false,
+            error: "WORKTREE_NOT_FOUND",
+            message: `WORKTREE_NOT_FOUND: no worktree of this repository has a branch for issue #${issue}. ` +
+                `Create one with \`./scripts/new-feature.sh ${issue}\`.`,
+            candidates: [],
+        };
+    }
+    if (matches.length > 1) {
+        const list = matches.map((m) => `${m.branch} -> ${m.path}`).join("; ");
+        return {
+            ok: false,
+            error: "WORKTREE_AMBIGUOUS",
+            message: `WORKTREE_AMBIGUOUS: ${matches.length} worktrees claim issue #${issue} (${list}). ` +
+                `Remove the stale one, or set SEQUANT_WORKTREE explicitly.`,
+            candidates: matches,
+        };
+    }
+    return { ok: true, ...matches[0] };
+}
+/**
+ * Canonicalize a path for comparison, tolerating paths that do not exist.
+ *
+ * `realpathSync` throws on a missing path, so fall back to resolving the
+ * deepest existing ancestor and re-appending the remainder — enough to make
+ * `/tmp/...` and `/private/tmp/...` compare equal on macOS.
+ */
+function canonicalize(target) {
+    const absolute = path.resolve(target);
+    try {
+        return realpathSync(absolute);
+    }
+    catch {
+        const parent = path.dirname(absolute);
+        if (parent === absolute)
+            return absolute;
+        return path.join(canonicalize(parent), path.basename(absolute));
+    }
+}
+/**
+ * Verify that a caller-supplied worktree path is safe to work in.
+ *
+ * This is the guard `/exec` runs before trusting `SEQUANT_WORKTREE`. It fails
+ * closed on every uncertain case — a bad path must halt the run, never degrade
+ * into "keep going in whatever directory we happen to be in".
+ *
+ * @param worktreePath - The path to check (typically `$SEQUANT_WORKTREE`).
+ * @param options.issue - When set, the branch must belong to this issue.
+ * @param options.cwd - Directory inside the repository to check against.
+ */
+export function verifyWorktreePath(worktreePath, options = {}) {
+    const raw = worktreePath.trim();
+    if (raw.length === 0 || raw.includes("*")) {
+        return {
+            ok: false,
+            error: "SEQUANT_WORKTREE_NOT_FOUND",
+            message: `SEQUANT_WORKTREE_NOT_FOUND: ${raw.length === 0 ? "empty path" : `unexpanded glob "${raw}"`}. Expected a resolved absolute directory.`,
+        };
+    }
+    const absolute = path.resolve(raw);
+    if (!existsSync(absolute) || !statSync(absolute).isDirectory()) {
+        return {
+            ok: false,
+            error: "SEQUANT_WORKTREE_NOT_FOUND",
+            message: `SEQUANT_WORKTREE_NOT_FOUND: "${raw}" is not an existing directory.`,
+        };
+    }
+    const canonical = canonicalize(absolute);
+    const known = listWorktrees(options.cwd);
+    const match = known.find((w) => canonicalize(w.path) === canonical);
+    if (!match) {
+        return {
+            ok: false,
+            error: "SEQUANT_WORKTREE_FOREIGN",
+            message: `SEQUANT_WORKTREE_FOREIGN: "${raw}" is not a worktree of this repository. ` +
+                `It belongs to another project or is stale; \`../worktrees/\` is shared across repos.`,
+        };
+    }
+    if (options.issue !== undefined && match.issue !== options.issue) {
+        return {
+            ok: false,
+            error: "SEQUANT_WORKTREE_ISSUE_MISMATCH",
+            message: `SEQUANT_WORKTREE_ISSUE_MISMATCH: "${raw}" has branch "${match.branch}", ` +
+                `which is not issue #${options.issue}.`,
+        };
+    }
+    return { ok: true, path: match.path, branch: match.branch };
+}

package/dist/src/mcp/tools/run.d.ts

@@ -94,13 +94,21 @@ export declare function parseRunIdLine(line: string): string | null;
 export interface ProgressEvent {
     issue: number;
     phase: string;
-    event: "start" | "complete" | "failed";
+    event: "start" | "complete" | "failed" | "waiting";
     durationSeconds?: number;
     error?: string;
+    /** #860: epoch ms of the auto-wait wake; absent on the terminal notice. */
+    wakeAtMs?: number;
+    /** #860: ms remaining in the auto-wait (0 on the terminal notice). */
+    remainingMs?: number;
 }
 /**
  * Parse a SEQUANT_PROGRESS line emitted by the batch executor.
  * Returns the parsed event or null if the line isn't a progress line.
+ *
+ * `waiting` events (#860) are the auto-wait liveness signal: a run paused on
+ * a rate-limit window emits one per minute so an MCP client sees a deliberate
+ * pause with a wake time rather than silence indistinguishable from a hang.
  */
 export declare function parseProgressLine(line: string): ProgressEvent | null;
 /**

package/dist/src/mcp/tools/run.js

@@ -11,6 +11,7 @@ import { resolve, dirname, join } from "path";
 import { existsSync } from "fs";
 import { readdir, readFile } from "fs/promises";
 import { homedir } from "os";
+import { formatResetTime } from "../../lib/errors.js";
 import { LOG_PATHS, RunLogSchema } from "../../lib/workflow/run-log-schema.js";
 import { registerRun, unregisterRun } from "../run-registry.js";
 /** Maximum total response size in bytes (64 KB) */
@@ -261,6 +262,10 @@ export function parseRunIdLine(line) {
 /**
  * Parse a SEQUANT_PROGRESS line emitted by the batch executor.
  * Returns the parsed event or null if the line isn't a progress line.
+ *
+ * `waiting` events (#860) are the auto-wait liveness signal: a run paused on
+ * a rate-limit window emits one per minute so an MCP client sees a deliberate
+ * pause with a wake time rather than silence indistinguishable from a hang.
  */
 export function parseProgressLine(line) {
     if (!line.startsWith(PROGRESS_LINE_PREFIX))
@@ -272,7 +277,8 @@ export function parseProgressLine(line) {
             typeof json.event === "string" &&
             (json.event === "start" ||
                 json.event === "complete" ||
-                json.event === "failed")) {
+                json.event === "failed" ||
+                json.event === "waiting")) {
             const result = {
                 issue: json.issue,
                 phase: json.phase,
@@ -284,6 +290,12 @@ export function parseProgressLine(line) {
             if (typeof json.error === "string") {
                 result.error = json.error;
             }
+            if (typeof json.wakeAtMs === "number") {
+                result.wakeAtMs = json.wakeAtMs;
+            }
+            if (typeof json.remainingMs === "number") {
+                result.remainingMs = json.remainingMs;
+            }
             return result;
         }
         return null;
@@ -341,6 +353,13 @@ export function formatProgressMessage(event) {
             const reason = event.error ? ` \u2014 ${event.error}` : "";
             return `${prefix}: ${event.phase} \u2717${reason}`;
         }
+        case "waiting": {
+            // #860: name the wake time so a paused run reads as deliberate.
+            if (event.wakeAtMs === undefined) {
+                return `${prefix}: ${event.phase} auto-wait complete \u2014 resuming`;
+            }
+            return `${prefix}: ${event.phase} \u23f8 rate-limit window \u2014 resuming at ${formatResetTime(event.wakeAtMs)}`;
+        }
     }
 }
 /**

package/dist/src/mcp/tools/status.js

@@ -97,6 +97,12 @@ export function registerStatusTool(server) {
                             phases: issueState.phases,
                             worktree: issueState.worktree,
                             pr: issueState.pr,
+                            // #860: surfaced so MCP pollers see a deliberate rate-limit
+                            // pause (with its wake time) instead of a stale in-progress.
+                            autoWait: issueState.autoWait,
+                            // #892: a durable window halt — resumable via `sequant
+                            // resume` after `resumeAt` — is a pause, not a failure.
+                            windowHalt: issueState.windowHalt,
                             lastActivity: issueState.lastActivity,
                             nextAction: getNextActionHint(issueState),
                             lastSynced: reconcileResult.lastSynced,

package/dist/src/ui/tui/ElapsedTimer.d.ts

@@ -1,10 +1,19 @@
 import { type JSX } from "react";
 /**
- * Per-issue elapsed timer. Owns its own interval so tick-driven re-renders
- * are scoped to this leaf component and do not propagate to `IssueBox`.
+ * Per-issue elapsed timer. Reads the shared 1 Hz `now` that `App` already owns
+ * and threads through `IssueBox`, rather than running its own interval: `App`'s
+ * snapshot poller re-renders the whole tree every tick regardless, so a
+ * per-issue clock bought no re-render scoping.
+ *
+ * When `completedAt` is set, the duration freezes at `completedAt - startedAt`.
+ * This is computed in render (not by tearing down an interval on mount), so an
+ * issue that transitions running → passed on the same mounted component freezes
+ * at the transition without a remount.
  */
-export declare function ElapsedTimer({ startedAt }: {
+export declare function ElapsedTimer({ startedAt, completedAt, now, }: {
     startedAt?: Date;
+    completedAt?: Date;
+    now: number;
 }): JSX.Element;
 /** Format an absolute timestamp as the "last activity Xs ago" stamp. */
 export declare function formatSinceActivity(now: number, activityAt: Date): string;

package/dist/src/ui/tui/ElapsedTimer.js

@@ -1,19 +1,21 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { useEffect, useState } from "react";
 import { Text } from "ink";
 /**
- * Per-issue elapsed timer. Owns its own interval so tick-driven re-renders
- * are scoped to this leaf component and do not propagate to `IssueBox`.
+ * Per-issue elapsed timer. Reads the shared 1 Hz `now` that `App` already owns
+ * and threads through `IssueBox`, rather than running its own interval: `App`'s
+ * snapshot poller re-renders the whole tree every tick regardless, so a
+ * per-issue clock bought no re-render scoping.
+ *
+ * When `completedAt` is set, the duration freezes at `completedAt - startedAt`.
+ * This is computed in render (not by tearing down an interval on mount), so an
+ * issue that transitions running → passed on the same mounted component freezes
+ * at the transition without a remount.
  */
-export function ElapsedTimer({ startedAt }) {
-    const [now, setNow] = useState(() => Date.now());
-    useEffect(() => {
-        const id = setInterval(() => setNow(Date.now()), 1000);
-        return () => clearInterval(id);
-    }, []);
+export function ElapsedTimer({ startedAt, completedAt, now, }) {
     if (!startedAt)
         return _jsx(Text, { children: "--:--" });
-    const secs = Math.max(0, Math.floor((now - startedAt.getTime()) / 1000));
+    const end = completedAt?.getTime() ?? now;
+    const secs = Math.max(0, Math.floor((end - startedAt.getTime()) / 1000));
     const mm = Math.floor(secs / 60)
         .toString()
         .padStart(2, "0");

package/dist/src/ui/tui/IssueBox.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { Box, Text } from "ink";
-import { ACTIVE_PHASE_COLOR, DIVIDER_COLOR, PHASE_GLYPHS, borderColorForIssue, phaseStatusColor, } from "./theme.js";
+import { ACTIVE_PHASE_COLOR, DIVIDER_COLOR, PHASE_GLYPHS, borderColorForIssue, isTerminalStatus, phaseStatusColor, } from "./theme.js";
 import { Spinner } from "./Spinner.js";
 import { ElapsedTimer, formatSinceActivity } from "./ElapsedTimer.js";
 import { truncateToWidth } from "./truncate.js";
@@ -20,7 +20,15 @@ export function IssueBox({ state, slot, width, now, }) {
     const displayPhaseN = activePhaseIndex >= 0 ? activePhaseIndex + 1 : doneCount;
     const total = state.phases.length;
     const headerTitle = truncateToWidth(`#${state.number}  ${state.title}`, Math.max(10, innerWidth - 20));
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: border, paddingX: 1, marginBottom: 1, width: width, children: [_jsxs(Box, { justifyContent: "space-between", children: [_jsx(Text, { color: border, children: headerTitle }), _jsxs(Text, { color: DIVIDER_COLOR, children: ["phase ", displayPhaseN, "/", total, " \u2022", " ", _jsx(ElapsedTimer, { startedAt: state.startedAt })] })] }), _jsx(Divider, { width: innerWidth }), _jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: DIVIDER_COLOR, children: "branch " }), _jsx(Text, { children: truncateToWidth(state.branch, innerWidth - 8) })] }), _jsx(PhaseProgression, { phases: state.phases, activeColor: ACTIVE_PHASE_COLOR }), state.currentPhase?.logPath ? (_jsxs(Box, { children: [_jsx(Text, { color: DIVIDER_COLOR, children: "log " }), _jsx(Text, { children: truncateToWidth(state.currentPhase.logPath, innerWidth - 8) })] })) : null] }), _jsx(Divider, { width: innerWidth }), _jsx(Box, { flexDirection: "column", children: state.currentPhase ? (_jsxs(_Fragment, { children: [_jsxs(Box, { children: [_jsx(Text, { color: DIVIDER_COLOR, children: "now " }), _jsx(Spinner, { color: ACTIVE_PHASE_COLOR }), _jsxs(Text, { children: ["  ", truncateToWidth(state.currentPhase.nowLine, innerWidth - 12)] })] }), _jsx(Box, { children: _jsxs(Text, { color: DIVIDER_COLOR, children: ["        └ last activity ", formatSinceActivity(now, state.currentPhase.lastActivityAt)] }) })] })) : (_jsx(Text, { color: DIVIDER_COLOR, children: statusLine(state) })) })] }));
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: border, paddingX: 1, marginBottom: 1, width: width, children: [_jsxs(Box, { justifyContent: "space-between", children: [_jsx(Text, { color: border, children: headerTitle }), _jsxs(Text, { color: DIVIDER_COLOR, children: ["phase ", displayPhaseN, "/", total, " \u2022", " ", _jsx(ElapsedTimer, { startedAt: state.startedAt, 
+                                // #866: only a terminal status may freeze the clock. Mirrors the
+                                // plain renderer, which branches on status *before* reading
+                                // `completedAt` (`run-renderer.ts` `statusHeader`) and so always
+                                // measures a running issue against the live clock. Without this
+                                // gate a stale `completedAt` on a running issue — what the #766
+                                // quality-loop recovery used to publish — freezes the header while
+                                // the issue is visibly working.
+                                completedAt: isTerminalStatus(state.status) ? state.completedAt : undefined, now: now })] })] }), _jsx(Divider, { width: innerWidth }), _jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: DIVIDER_COLOR, children: "branch " }), _jsx(Text, { children: truncateToWidth(state.branch, innerWidth - 8) })] }), _jsx(PhaseProgression, { phases: state.phases, activeColor: ACTIVE_PHASE_COLOR }), state.currentPhase?.logPath ? (_jsxs(Box, { children: [_jsx(Text, { color: DIVIDER_COLOR, children: "log " }), _jsx(Text, { children: truncateToWidth(state.currentPhase.logPath, innerWidth - 8) })] })) : null] }), _jsx(Divider, { width: innerWidth }), _jsx(Box, { flexDirection: "column", children: state.currentPhase ? (_jsxs(_Fragment, { children: [_jsxs(Box, { children: [_jsx(Text, { color: DIVIDER_COLOR, children: "now " }), _jsx(Spinner, { color: ACTIVE_PHASE_COLOR }), _jsxs(Text, { children: ["  ", truncateToWidth(state.currentPhase.nowLine, innerWidth - 12)] })] }), _jsx(Box, { children: _jsxs(Text, { color: DIVIDER_COLOR, children: ["        └ last activity ", formatSinceActivity(now, state.currentPhase.lastActivityAt)] }) })] })) : (_jsx(Text, { color: DIVIDER_COLOR, children: statusLine(state) })) })] }));
 }
 function statusLine(state) {
     switch (state.status) {

package/dist/src/ui/tui/row-cap.js

@@ -12,6 +12,7 @@
  * bottom margin). `LINES_PER_BOX` is sized accordingly so the dynamic cap
  * reflects how many boxes actually fit.
  */
+import { isTerminalStatus } from "./theme.js";
 /** Static row cap (matches the plain renderer's default). */
 export const DEFAULT_TUI_ROW_CAP = 10;
 /**
@@ -27,7 +28,7 @@ export const TUI_LINES_PER_BOX = 11;
 const FIXED_OVERHEAD = 4;
 /** A queued or running issue is "active"; passed/failed are terminal. */
 function isActive(issue) {
-    return issue.status === "queued" || issue.status === "running";
+    return !isTerminalStatus(issue.status);
 }
 /**
  * Effective cap: the smaller of the static cap and a dynamic terminal-height

package/dist/src/ui/tui/theme.d.ts

@@ -46,6 +46,13 @@ export declare const ACTIVE_PHASE_COLOR: "#FF8012";
 /** Brand green for the rolled-up `✔ N done` summary line (#699, parity with the
  *  plain renderer's #624 rollup). */
 export declare const ROLLUP_COLOR: "#10b981";
+/**
+ * `passed`/`failed` are terminal; `queued`/`running` mean the issue is still
+ * live. The single definition of that split for the TUI — `row-cap` uses it to
+ * decide which issues can roll up, and `IssueBox` uses it to decide whether the
+ * elapsed clock may freeze (#866).
+ */
+export declare function isTerminalStatus(status: IssueStatus): boolean;
 /**
  * Pick the border color for an issue.
  * Failed / passed states win over rotation; otherwise rotate by slot.

package/dist/src/ui/tui/theme.js

@@ -44,6 +44,15 @@ export const ACTIVE_PHASE_COLOR = BRAND_ORANGE;
 /** Brand green for the rolled-up `✔ N done` summary line (#699, parity with the
  *  plain renderer's #624 rollup). */
 export const ROLLUP_COLOR = BRAND_GREEN;
+/**
+ * `passed`/`failed` are terminal; `queued`/`running` mean the issue is still
+ * live. The single definition of that split for the TUI — `row-cap` uses it to
+ * decide which issues can roll up, and `IssueBox` uses it to decide whether the
+ * elapsed clock may freeze (#866).
+ */
+export function isTerminalStatus(status) {
+    return status === "passed" || status === "failed";
+}
 /**
  * Pick the border color for an issue.
  * Failed / passed states win over rotation; otherwise rotate by slot.

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "sequant",
-  "version": "2.9.0",
+  "version": "2.11.0",
   "description": "AI coding agent orchestrator — resolve GitHub issues end-to-end with isolated git worktrees, quality gates, and an MCP server. Works with Claude Code or Aider.",
   "type": "module",
   "bin": {
     "sequant": "dist/bin/cli.js"
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "types": "./dist/src/index.d.ts",
+      "import": "./dist/src/index.js"
     }
   },
   "files": [
@@ -21,14 +21,16 @@
     ".claude-plugin"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "rm -rf dist/src dist/bin dist/dashboard && tsc && chmod +x dist/bin/cli.js",
     "dev": "tsx bin/cli.ts",
     "test": "vitest run",
-    "lint": "eslint src/ bin/ --max-warnings 0",
+    "lint": "eslint src/ bin/ scripts/ --max-warnings 0",
     "sync:skills": "npx tsx scripts/check-skill-sync.ts --fix",
     "sync:hooks": "bash scripts/sync-hooks.sh",
     "validate:skills": "for skill in templates/skills/*/; do case \"$skill\" in *_shared*|*/references/*) continue;; esac; npx skills-ref validate \"$skill\"; done",
+    "typecheck:scripts": "tsc --noEmit -p tsconfig.scripts.json",
     "lint:skill-calls": "npx tsx scripts/lint-skill-calls.ts",
+    "lint:skill-gates": "npx tsx scripts/lint-skill-gates.ts",
     "lint:skill-sync": "npx tsx scripts/check-skill-sync.ts",
     "prepare:marketplace": "npx tsx scripts/prepare-marketplace.ts",
     "validate:marketplace": "npx tsx scripts/prepare-marketplace.ts --validate-only",
@@ -78,7 +80,7 @@
   },
   "homepage": "https://sequant.io",
   "engines": {
-    "node": ">=22.12.0"
+    "node": ">=22.13.0"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1"

package/templates/hooks/parallel-marker.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Shared naming contract for /exec parallel-group marker files (#881).
+#
+# One writer (the /exec skill) and two readers (pre-tool.sh, post-tool.sh) must
+# agree on (a) the marker filename and (b) how the owning project is identified.
+# Before #881 the filename was a global constant, so a parallel group in ONE
+# project silently redirected worktree enforcement for EVERY concurrent Claude
+# session on the machine — the first matching marker in the shared temp dir won,
+# regardless of which project wrote it. Keeping the scheme in this single sourced
+# file is what stops the writer and the readers from drifting apart (AC-4).
+#
+# Marker filename: ${TMPDIR}/claude-parallel-<project-hash>-<group-id>.marker
+# Marker contents: line 1 = worktree path, line 2 = owning project root.
+
+# parallel_marker_project_root — the canonical identity of the current project,
+# derived identically in skill-context and hook-context. CLAUDE_PROJECT_DIR is
+# set by Claude Code for both the skill's shell and the hook's shell within the
+# same session; the git-toplevel fallback resolves to the same worktree when it
+# is unset. A mismatch here would silently re-introduce the cross-project
+# collision this fix exists to close, so the two contexts MUST agree.
+parallel_marker_project_root() {
+    if [[ -n "${CLAUDE_PROJECT_DIR:-}" ]]; then
+        printf '%s' "$CLAUDE_PROJECT_DIR"
+    else
+        git rev-parse --show-toplevel 2>/dev/null || printf '%s' "$PWD"
+    fi
+}
+
+# parallel_marker_hash — a stable per-project hash used in the marker filename so
+# two projects running parallel groups at once cannot collide (AC-1). Reuses the
+# md5-with-md5sum-fallback idiom already used for the per-file lock in
+# pre-tool.sh. printf (no trailing newline) keeps writer and reader identical.
+parallel_marker_hash() {
+    local root
+    root="$(parallel_marker_project_root)"
+    printf '%s' "$root" | md5 -q 2>/dev/null || printf '%s' "$root" | md5sum | cut -d' ' -f1
+}
+
+# parallel_marker_prefix — the ${TMPDIR}-anchored, project-scoped filename prefix
+# that both the writer and the readers glob on (AC-2). Honors $TMPDIR (macOS's
+# per-user temp) with a /tmp fallback, matching the hooks' own _TMPDIR.
+parallel_marker_prefix() {
+    local tmp="${TMPDIR:-/tmp}"
+    printf '%s/claude-parallel-%s-' "$tmp" "$(parallel_marker_hash)"
+}
+
+# parallel_marker_path <group-id> — the full marker path for one group.
+parallel_marker_path() {
+    printf '%s%s.marker' "$(parallel_marker_prefix)" "$1"
+}

package/templates/hooks/post-tool.sh

@@ -77,22 +77,35 @@ mkdir -p "$_LOG_DIR" 2>/dev/null || _LOG_DIR="${_TMPDIR}"
 TIMING_LOG="${_LOG_DIR}/claude-timing.log"
 QUALITY_LOG="${_LOG_DIR}/claude-quality.log"
 TESTS_LOG="${_LOG_DIR}/claude-tests.log"
-PARALLEL_MARKER_PREFIX="${_TMPDIR}/claude-parallel-"
+
+# Parallel-group marker naming (#881). Source the shared helper next to this
+# hook so the project-scoped prefix stays identical to the writer and pre-tool.sh.
+_MARKER_HELPER="$(dirname "${BASH_SOURCE[0]:-$0}")/parallel-marker.sh"
+if [[ -f "$_MARKER_HELPER" ]]; then
+    # shellcheck source=parallel-marker.sh disable=SC1091
+    source "$_MARKER_HELPER"
+    PARALLEL_MARKER_PREFIX="$(parallel_marker_prefix)"
+else
+    PARALLEL_MARKER_PREFIX="${_TMPDIR}/claude-parallel-"
+fi
 
 # === AGENT ID DETECTION ===
-# For parallel agents, detect group ID from marker files
-# Format: ${_TMPDIR}/claude-parallel-<group-id>.marker
+# For parallel agents, detect group ID from marker files. The glob is scoped to
+# the current project's marker prefix (#881) so a foreign project's marker never
+# labels this session's timing rows.
 AGENT_ID=""
 IS_PARALLEL_AGENT="false"
+_MARKER_BASE=$(basename "$PARALLEL_MARKER_PREFIX")
 # Find marker files using find (works in both bash and zsh)
 while IFS= read -r marker; do
     if [[ -n "$marker" && -f "$marker" ]]; then
-        # Extract group ID from marker filename
-        AGENT_ID=$(basename "$marker" | sed 's/claude-parallel-//' | sed 's/\.marker//')
+        # Extract group ID: strip the project-scoped prefix and the suffix.
+        AGENT_ID=$(basename "$marker" .marker)
+        AGENT_ID=${AGENT_ID#"$_MARKER_BASE"}
         IS_PARALLEL_AGENT="true"
         break
     fi
-done < <(find "${_TMPDIR}" -maxdepth 1 -name "claude-parallel-*.marker" 2>/dev/null)
+done < <(find "${_TMPDIR}" -maxdepth 1 -name "${_MARKER_BASE}*.marker" 2>/dev/null)
 
 # === TIMING END ===
 # Include agent ID in log format if available (AC-4)
@@ -253,7 +266,7 @@ if [[ "${CLAUDE_HOOKS_COVERAGE:-}" == "true" ]]; then
             COVERAGE_LOG="${_LOG_DIR}/claude-coverage.log"
 
             # Get changed source files (excluding tests)
-            changed_files=$(git diff main...HEAD --name-only 2>/dev/null | grep -E '\.(ts|tsx|js|jsx)$' | grep -v -E '\.test\.|\.spec\.|__tests__' || true)
+            changed_files=$(git diff origin/main...HEAD --name-only 2>/dev/null | grep -E '\.(ts|tsx|js|jsx)$' | grep -v -E '\.test\.|\.spec\.|__tests__' || true)
 
             if [[ -n "$changed_files" ]]; then
                 echo "$(date +%H:%M:%S) COVERAGE_ANALYSIS: Checking test coverage for changed files" >> "$QUALITY_LOG"