@cspeach/cli 0.6.5 → 0.7.1

package/README.md

@@ -60,6 +60,32 @@ machine.
 Ten Forge Rules are non-negotiable. Full philosophy in the `CSPeach Principles`
 preamble shown to the model every turn.
 
+## Cost transparency (since 0.7.0)
+
+Every turn shows what it cost. After each model call you see:
+
+```
+session abc123 │ S4H │ /abap-explain │ 2 turns │ 487 tok │ $0.07 │ session: $0.18 │ 3.6s
+```
+
+- `tok` = tokens billed this turn (input + output + cache)
+- `$` = this turn's cost
+- `session:` = cumulative across the open session
+- `/cost` shows a per-skill / per-tool breakdown
+- `/compact` summarises older turns when context gets large (cuts subsequent-turn cost ~80-90%)
+- `auto_compact` in `~/.cspeach/config.toml` fires `/compact` automatically over a configurable threshold
+
+On `/exit` you get a session summary + the `cspeach --resume <id>` command in plain text so you can pick up where you left off.
+
+## UI modes
+
+Two REPL modes, both supported. **Default is `classic`.** Switch with `/ui ink` or `/ui classic`; saves to `~/.cspeach/config.toml` under `[ui]`.
+
+- **`classic`** — chalk + readline. The supported, demo-tested mode. Use this unless you have a reason not to. Native terminal scroll, mouse wheel, search — everything your terminal does naturally just works.
+- **`ink`** — React-based TUI. **PREVIEW.** Some rendering quirks remain (occasional phantom cursor, picker fossil in scrollback). Functional for daily use but not yet polished enough to recommend as default. Promoted to default in a later release.
+
+If `ink` is misbehaving for you, run `/ui classic` once — change applies after relaunch.
+
 ## Configuration
 
 `~/.cspeach/config.toml` is created on first `cspeach config add-sap`:

package/dist/agent/intent-system-prompt.js

@@ -0,0 +1,46 @@
+/**
+ * Phase 4 — neutral system prompt for intent-driven agent loop.
+ *
+ * Intent-mode is the user-states-intent / model-composes-plan dispatch
+ * pattern (parallel to skill-mode where a /skill scaffolds the flow).
+ * The prompt is intentionally short — the playbook library + tool
+ * descriptions carry domain knowledge; the prompt only frames role +
+ * safety + how to fetch playbooks.
+ *
+ * Project-context block (if available) is appended by runTurnIntent
+ * via the existing `maybeBuildProjectContext()` path; it is NOT part
+ * of this constant.
+ */
+export function getIntentSystemPrompt() {
+    return `You are CSPeach, an AI development agent for SAP / ABAP work.
+
+You help senior SAP consultants and ABAP developers plan, build, modernize, migrate, test, review, and ship SAP solutions. You have:
+
+- Live access to the user's SAP system via the sap_* tool family (~30 tools — get_source, set_source, atc_run, transport_create, sql_query, snapshot_take, etc.).
+- Filesystem + shell + web access to the project the user is working in (file_read, file_edit, file_write, glob, grep, shell_exec, web_fetch, web_search).
+- Subagent dispatch (agent_run) for focused sub-tasks; background_run + monitor_emit for non-blocking processes; schedule_draft_create for persisting schedule envelopes (no runner yet — see tool description).
+- A library of 34 SAP-development playbooks you can read on demand via playbook_get. These cover RAP scaffolding, S/4HANA upgrade remediation, CCA estate analysis, modernization, code review, performance triage, and more. When you need expertise on a specific workflow, fetch the relevant playbook BEFORE acting.
+- The project context for this session (CDS views, tables, packages, conventions) — appended below if available.
+
+When the user states an intent, your job is:
+
+1. **Confirm the intent** — repeat what they want in one sentence; ask clarifying questions only if essential.
+2. **Pick the right approach** — fetch playbooks if relevant via playbook_get; otherwise compose tools from first principles.
+3. **Execute** — use tools as needed. Snapshot before any SAP write (Forge Rule 7); use sap_update_method for method-only changes (Rule 7a); never overwrite without a transport (Rule 9); verify after every write (Rule 10).
+4. **Surface artefacts** — for substantial work, save a .cspeach.json envelope per the existing artefact-type convention (cca-assessment, upgrade-progress, spec-gap, etc.).
+5. **Hand back** — when the work is done OR when human decision is needed.
+
+Follow the 10 Forge Rules. They are binding:
+1. No blind code generation — ask missing questions first
+2. No code change without impact thinking
+3. No cloud readiness claims without evidence
+4. No review without quality criteria
+5. No done without preflight
+6. Read only by default
+7. No write without snapshot
+8. No batch without plan (any 2+ mutating tools in one turn pauses for explicit approval — Rule 8 is active and you cannot disable it)
+9. Transport isolation
+10. Verify after every write
+
+Tone: senior consultant talking to peer. No marketing prose. Specific verifiable claims. Plain writing.`;
+}

package/dist/agent/loop.js

@@ -7,10 +7,12 @@ import { loadConfig } from '../config/loader.js';
 import { retryWithBackoff } from './retry.js';
 import { renderChunk, initialBufferState, render } from '../renderer/pipeline.js';
 import { renderToolCallTop, renderToolCallBottom, startToolSpinner, startThinkingSpinner } from '../renderer/tool-widget.js';
+import { formatToolErrorSummary } from '../sap-errors/parse-adt-exception.js';
 import { startThinkingHeartbeat } from '../renderer/thinking-heartbeat.js';
 // (progress-chatter import removed 2026-05-01 — superseded by CC-style
 //  two-line dispatch renderer; re-add if a future in-place spinner returns)
-import { ERR } from '../errors/codes.js';
+import { buildRetryCapPausePayload, buildSkippedSiblingResults } from './retry-cap.js';
+import { appendCostLine, buildEntry as buildCostEntry } from '../cost/cost-log.js';
 import { lastAssistantIsAwaitingAnswer } from '../session/awaiting-answer.js';
 import { enrichUserMessage } from '../router/intent-extractor.js';
 import { resetRule8State } from '../repl/rule8-detector.js';
@@ -21,7 +23,7 @@ import { withInquirer } from '../repl/inquirer-guard.js';
 import { expandTextFileAttachments } from '../projects/workspace.js';
 import { getSapSystemInfo, renderSapSystemBlock } from '../sap/system-info.js';
 import { objectKeyFromInput } from './retry-key.js';
-import { repairPartialBlocks } from './repair-partial.js';
+import { repairPartialBlocks, healSessionMessagesInPlace, isPartialJsonApiError } from './repair-partial.js';
 import { TurnStreamWriter } from './turn-stream.js';
 import { applyToolResultCheckpoint } from './skill-checkpoint.js';
 import { loadWatchdogConfig, evaluateWatchdog } from './turn-watchdog.js';
@@ -29,6 +31,7 @@ import { maybeBuildProjectContext } from './maybe-build-project-context.js';
 import { buildSapConnectionContext } from './sap-connection-adapter.js';
 import { getCurrentTransport } from '../repl/current-transport.js';
 import { collectTurnAssistantText } from './turn-assistant-text.js';
+import { checkAndMark, newGuardState } from './parallel-write-guard.js';
 /**
  * Author identity for project-file metadata. Reads CSPEACH_AUTHOR_NAME first,
  * then platform USER/USERNAME, then a generic fallback. Role is fixed to
@@ -99,6 +102,29 @@ export function hasProjectContextBlock(messages) {
     }
     return false;
 }
+/**
+ * Critical #3 (2026-05-17) — shared prompt helper that routes through the
+ * Ink-native ask_question modal when running under Ink, falls back to
+ * inquirer in classic mode. Prior code path called withInquirer() directly
+ * which corrupted the Ink frame on every save-offer / --from prompt.
+ *
+ * Single shape `(q) => Promise<string>` so it slots straight into the
+ * existing `prompt:` callback in runSaveCommand + runPromoteCommand.
+ */
+async function inkAwarePrompt(q) {
+    const { shouldUseInk } = await import('../renderer/tty.js');
+    if (shouldUseInk()) {
+        const { askQuestionEmitter } = await import('../ui/ask-question-emitter.js');
+        const result = await askQuestionEmitter.request({
+            id: 'agent-prompt',
+            question: q,
+            kind: 'text',
+            choices: [],
+        });
+        return result.answer ?? '';
+    }
+    return withInquirer(() => input({ message: q }));
+}
 export async function maybeOfferSave(p) {
     if (!SAVE_HOOK_SKILLS.has(p.skill))
         return;
@@ -114,7 +140,7 @@ export async function maybeOfferSave(p) {
             model: p.model,
             author: getAuthorIdentity(),
             cwd: process.cwd(),
-            prompt: async (q) => withInquirer(() => input({ message: q })),
+            prompt: inkAwarePrompt,
             log: (...lines) => lines.forEach((l) => p.emit(l)),
             promotedFrom: p.promotedFrom ?? null,
         });
@@ -152,7 +178,7 @@ export async function runTurn(params) {
             const result = await runPromoteCommand({
                 sourcePath: fromPath,
                 targetSkill: params.skill,
-                prompt: async (q) => withInquirer(() => input({ message: q })),
+                prompt: inkAwarePrompt,
                 log: (...lines) => lines.forEach((l) => emit(l)),
             });
             if (!result) {
@@ -263,6 +289,18 @@ export async function runTurn(params) {
     // missing on older session schemas; the loop initializes it before the
     // first stream event, so 0 is a safe pre-init baseline.
     const turnStartOutputTokens = session.usage?.output_tokens ?? 0;
+    // Phase 1 cost tracking (2026-05-16) — snapshot ALL four counters at
+    // turn start so we can compute a per-turn $ cost at turn end. The
+    // existing turnStartOutputTokens stays for the watchdog (it only cares
+    // about output tokens), but the cost calculator needs the full set.
+    const turnStartTokens = {
+        input: session.usage?.input_tokens ?? 0,
+        output: session.usage?.output_tokens ?? 0,
+        cacheRead: session.usage?.cache_read_input_tokens ?? 0,
+        cacheCreate: session.usage?.cache_creation_input_tokens ?? 0,
+    };
+    // Turn number for the cost log — count of prior user messages + this one.
+    const turnNumber = session.messages.filter((m) => m.role === 'user').length + 1;
     // Snapshot session.messages.length at turn start so the save hook can
     // walk every assistant message added during this turn — not just the
     // final one. Skills like /abap-cca emit their manifest in an early
@@ -299,7 +337,11 @@ export async function runTurn(params) {
         // reports isTTY=false; resume mode also lost spinner visibility) so a
         // 45-second wait looked like a hang. The heartbeat prints fresh lines
         // at 3s/10s/30s/60s/90s/2m/3m/5m thresholds — works on any terminal.
-        const thinkingHeartbeat = startThinkingHeartbeat();
+        // Phase A #4 (2026-05-16) — pass chunkEmitter so under Ink the
+        // heartbeat lines land in the Body region (via React) instead of
+        // being raw-written to stdout (which Ink overdraws on its next
+        // render, briefly flashing the line then making it disappear).
+        const thinkingHeartbeat = startThinkingHeartbeat({ chunkEmitter: params.chunkEmitter });
         try {
             stream = await retryWithBackoff(() => (async () => {
                 const tools = toAnthropicTools(listTools());
@@ -333,6 +375,23 @@ export async function runTurn(params) {
             // it spinning while an error message is emitted looks broken.
             thinkingSpinner.stop();
             thinkingHeartbeat.stop();
+            // Bug 11a (2026-05-15) — in-process heal for partial_json poisoning.
+            // When a prior turn persisted a tool_use block carrying both `input`
+            // AND a leftover `partial_json` field, the next createStream call
+            // fails with HTTP 400:
+            //   messages.N.content.M.tool_use.partial_json:
+            //     Extra inputs are not permitted
+            // The on-disk session was healed by loadSession's strip pass, but the
+            // in-memory session.messages array we just sent is what poisoned the
+            // call. Scrub it in place, save, tell the user the session was healed,
+            // and return cleanly so the REPL prompt comes back — they retype the
+            // last prompt without having to /exit + --resume.
+            if (isPartialJsonApiError(err)) {
+                const scrubbed = healSessionMessagesInPlace(session.messages);
+                await saveSession(session);
+                emit(chalk.yellow(`\n⚠  Session was poisoned by a partial-json tool_use block; healed in-memory${scrubbed > 0 ? ` (${scrubbed} block${scrubbed === 1 ? '' : 's'} cleaned)` : ''}. Please retry your last message.`));
+                return;
+            }
             // Proxy returns 409 upgrade_required when CLI is older than skill's min_cli_version.
             const status = err?.status ?? err?.response?.status;
             const bodyRaw = err?.error ?? err?.response?.data ?? err?.body;
@@ -350,7 +409,12 @@ export async function runTurn(params) {
         // M10 — ensure session.usage is present (shipped session schema may omit it
         // for older saved sessions; we default to zero on first turn).
         if (!session.usage) {
-            session.usage = { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+            session.usage = { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 };
+        }
+        // Phase 1 cost tracking — backfill cache_creation if loaded from an
+        // older schema (store.ts:validateSchema also does this; belt + braces).
+        if (session.usage.cache_creation_input_tokens == null) {
+            session.usage.cache_creation_input_tokens = 0;
         }
         // H2 — Anthropic's `message_delta.usage.output_tokens` is CUMULATIVE for the
         // current message (it grows monotonically as the model streams). Naively
@@ -444,6 +508,12 @@ export async function runTurn(params) {
                     if (msgUsage) {
                         session.usage.input_tokens += msgUsage.input_tokens ?? 0;
                         session.usage.cache_read_input_tokens += msgUsage.cache_read_input_tokens ?? 0;
+                        // Phase 1 cost tracking — cache writes are billed at 1.25× input.
+                        // Anthropic emits cache_creation_input_tokens alongside cache_read
+                        // when this message wrote new content to the cache.
+                        session.usage.cache_creation_input_tokens =
+                            (session.usage.cache_creation_input_tokens ?? 0)
+                                + (msgUsage.cache_creation_input_tokens ?? 0);
                     }
                     // New message begins — reset the per-message cumulative-output scratch.
                     messageOutputTokensSoFar = 0;
@@ -512,6 +582,28 @@ export async function runTurn(params) {
             session.turnInterruptedReason = undefined;
         }
         await saveSession(session);
+        // Phase 1 cost tracking (2026-05-16) — compute this turn's $ cost from
+        // the deltas (turn-end counters minus turn-start snapshot) and append a
+        // single JSONL line to ~/.cspeach/sessions/<id>-cost.jsonl. Best-effort:
+        // failures inside appendCostLine are swallowed so cost-tracking can
+        // never crash a turn. Runs for both happy and interrupted paths so
+        // the user's spend is recorded even when a turn dies mid-stream.
+        {
+            const turnTokens = {
+                input: (session.usage?.input_tokens ?? 0) - turnStartTokens.input,
+                output: (session.usage?.output_tokens ?? 0) - turnStartTokens.output,
+                cacheRead: (session.usage?.cache_read_input_tokens ?? 0) - turnStartTokens.cacheRead,
+                cacheCreate: (session.usage?.cache_creation_input_tokens ?? 0) - turnStartTokens.cacheCreate,
+            };
+            const turnDurationMs = Date.now() - turnStartedAt;
+            const entry = buildCostEntry({
+                turn: turnNumber,
+                model: session.model,
+                tokens: turnTokens,
+                duration_ms: turnDurationMs,
+            });
+            void appendCostLine(session.id, entry);
+        }
         // Close the stream-to-disk mirror with a footer (lightweight diagnostics).
         // Best-effort — failure here is invisible to the turn flow.
         void turnStreamWriter.close(interruptedError !== null
@@ -575,6 +667,30 @@ export async function runTurn(params) {
                 emit,
                 promotedFrom: promotedFromForSave,
             });
+            // Phase 2 #9 (2026-05-16) — auto-compact end-of-turn hook.
+            // Runs only on the success path (after maybeOfferSave) so an interrupted
+            // turn never triggers a summariser call on partial state. The maybeAutoCompact
+            // helper internally swallows non-fatal errors and emits a yellow note so
+            // a Haiku blip never regresses a turn that just succeeded. Threshold and
+            // throttle live in config.compact — see config/loader.ts:CompactConfig.
+            try {
+                const { maybeAutoCompact } = await import('../commands/auto-compact.js');
+                const { buildSummarisationPrompt, serialiseForSummariser, COMPACTION_MODEL } = await import('../commands/compact.js');
+                const { summariseViaProvider } = await import('./summarise-via-provider.js');
+                await maybeAutoCompact({
+                    session,
+                    config: cfg.compact,
+                    turnNumber,
+                    emit,
+                    summarise: async (toSummarise) => summariseViaProvider(params.provider, buildSummarisationPrompt(), serialiseForSummariser(toSummarise), { model: COMPACTION_MODEL, maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact' } }),
+                });
+            }
+            catch (err) {
+                // Belt-and-braces — maybeAutoCompact already swallows internally,
+                // but if its own dynamic-import or wiring blows up we still must
+                // not regress the success path.
+                emit(chalk.gray(`[auto-compact] skipped: ${err instanceof Error ? err.message : String(err)}`));
+            }
             return;
         }
         if (!sawToolUse) {
@@ -583,6 +699,14 @@ export async function runTurn(params) {
             return;
         }
         // Dispatch each tool_use block.
+        //
+        // Bug 8 — parallel-write guard: when the model emits multiple write-class
+        // tool_use blocks in a single round (sap_set_source, sap_update_method,
+        // sap_delete_object, sap_create_object), execute only the FIRST. Reject
+        // the rest with a structured envelope so the model reissues them
+        // sequentially on the next round. Read-only tools and approval requests
+        // continue to run normally. See ./parallel-write-guard.ts.
+        const writeGuard = newGuardState();
         const toolResults = [];
         for (const block of currentAssistantContent) {
             if (block.type === 'tool_use') {
@@ -599,14 +723,23 @@ export async function runTurn(params) {
                 const spinner = startToolSpinner({ chunkEmitter: params.chunkEmitter });
                 // Phase 2b: dispatch (may take 100ms–several seconds for write tools).
                 const dispatchStart = Date.now();
-                const result = await dispatchTool(block.name, block.input, params.ctx);
+                // Bug 8 — short-circuit for 2nd+ write-class tool in the same round.
+                const guardDecision = checkAndMark(block.name, writeGuard);
+                const result = guardDecision.allow
+                    ? await dispatchTool(block.name, block.input, params.ctx)
+                    : { content: guardDecision.errorContent, is_error: true };
                 const durationMs = Date.now() - dispatchStart;
                 // Phase 2c: stop the spinner, which erases its line so the result
                 // row paints in place of it (no scrollback artifacts).
                 spinner.stop();
                 // Phase 3: print result line (  ⎿ ✓ summary · timing).
+                // 2026-05-15 (bug 1): the old `slice(0, 80)` clipped to the JSON
+                // preamble (e.g. `{"error":"write_failed","detail":"HTTP 409: <?xml v…`)
+                // and hid the actual SAP error message behind XML noise. We now
+                // unwrap the JSON, pull the ADT exception message if there is one,
+                // and let renderToolCallBottom apply its own (wider) width clamp.
                 const resultSummary = result.is_error
-                    ? (typeof result.content === 'string' ? result.content.slice(0, 80) : 'error')
+                    ? (typeof result.content === 'string' ? formatToolErrorSummary(result.content) : 'error')
                     : undefined;
                 renderToolCallBottom({
                     durationMs,
@@ -654,19 +787,48 @@ export async function runTurn(params) {
                     const count = (failMap.get(objKey) ?? 0) + 1;
                     failMap.set(objKey, count);
                     if (count >= RETRY_CAP) {
-                        // Cap hit — push the error result, save session, and abort the turn.
-                        toolResults.push({
-                            type: 'tool_result',
-                            tool_use_id: block.id,
-                            is_error: true,
-                            content: JSON.stringify({
-                                error: ERR.APPROVAL_THRASH,
-                                detail: `Retry cap hit after ${RETRY_CAP} consecutive failures on ${objKey}. Aborting turn.`,
-                            }),
+                        // Bug 2 (2026-05-15) — pause the turn instead of aborting it.
+                        // The old behaviour returned with the model's last context being
+                        // an error tool_result, so the next user message resumed from a
+                        // confused state and the user had no clear "retry" affordance.
+                        //
+                        // New behaviour: synthesise a single user-readable tool_result
+                        // explaining the cap and quoting the last error so the model on
+                        // the next turn knows the context, then emit a yellow [paused]
+                        // line telling the human exactly what to do, reset the failMap
+                        // entry to zero so the next retry has full runway, save, and
+                        // return cleanly. The REPL prompt comes back and the user's
+                        // next message routes normally.
+                        const pause = buildRetryCapPausePayload({
+                            toolUseId: block.id,
+                            objKey,
+                            retryCap: RETRY_CAP,
+                            lastErrorContent: result.content,
                         });
+                        toolResults.push(pause.toolResult);
+                        // Reviewer #2 fix (2026-05-15): if the assistant message had
+                        // sibling tool_use blocks AFTER the one that tripped the cap,
+                        // they were never dispatched. Without paired tool_results the
+                        // next createStream call rejects with `tool_use_id was not
+                        // found`. Push a synthetic skipped result for every remaining
+                        // tool_use so the message is well-formed for the next round.
+                        const skipped = buildSkippedSiblingResults({
+                            assistantContent: currentAssistantContent,
+                            currentBlockIndex: currentAssistantContent.indexOf(block),
+                            objKey,
+                        });
+                        for (const sk of skipped)
+                            toolResults.push(sk);
                         session.messages.push({ role: 'user', content: toolResults });
+                        // Reset the counter so the next retry has full runway. Without
+                        // this reset the next attempt by the model would re-trip the cap
+                        // on its first failure and pause again.
+                        failMap.set(objKey, 0);
                         await saveSession(session);
-                        emit(chalk.red(`\n[retry cap] ${objKey} failed ${RETRY_CAP} times — aborting turn.`));
+                        emit(chalk.yellow(`\n${pause.pauseLine}`));
+                        if (pause.lastErrorSummary) {
+                            emit(chalk.gray(`   last error: ${pause.lastErrorSummary}`));
+                        }
                         return;
                     }
                 }

package/dist/agent/parallel-write-guard.js

@@ -0,0 +1,71 @@
+/**
+ * Bug 8 — parallel-write guard.
+ *
+ * The `/abap-generate` skill (and others) instruct the model to issue writes
+ * "one at a time". The model nevertheless emits multiple write-class
+ * `tool_use` blocks in a single assistant round, which causes:
+ *
+ *   1. Approval JWTs being spent in parallel — the second+ write fails with
+ *      "approval already spent / invalid".
+ *   2. Read-modify-write corruption (Bug 13) when two writes race against the
+ *      same class.
+ *   3. Snapshot/audit ordering becomes non-deterministic.
+ *
+ * Fix: within a single LLM round, allow at most ONE write-class tool to
+ * execute. Reject subsequent write-class blocks with a structured envelope
+ * the model can recover from on the next round (sequential reissue).
+ *
+ * Read-only tools and approval requests still run normally, even after a
+ * write-class tool has already executed in the same round — the round
+ * boundary is a one-shot guard for *writes*, not a general serialiser.
+ *
+ * Scope of "write-class" matches the spec for this bug fix and is narrower
+ * than tools/write-mode.ts WRITE_TOOLS: only the four tools that perform
+ * net-new source mutation are gated here.
+ */
+/** Tools that mutate ABAP source. Narrower than WRITE_TOOLS — excludes
+ *  activate / publish / transport_release / message_maintain. The bug
+ *  specifically targets source-write parallelism. */
+export const WRITE_CLASS_TOOLS = new Set([
+    'sap_set_source',
+    'sap_update_method',
+    'sap_delete_object',
+    'sap_create_object',
+]);
+export function isWriteClassTool(name) {
+    return WRITE_CLASS_TOOLS.has(name);
+}
+export function newGuardState() {
+    return { writeIssued: false };
+}
+/**
+ * Decide whether the given tool may dispatch in the current round.
+ *
+ * Returns `{ allow: true }` to proceed.
+ * Returns `{ allow: false, errorContent }` when the tool is a write-class
+ *   tool and another write-class tool has already issued in this round.
+ *   The caller should NOT dispatch — emit `errorContent` as the tool
+ *   result so the model sees the rejection and reissues sequentially on
+ *   the next round.
+ *
+ * Mutates `state.writeIssued = true` when allowing a write-class tool.
+ */
+export function checkAndMark(toolName, state) {
+    if (!isWriteClassTool(toolName)) {
+        return { allow: true };
+    }
+    if (state.writeIssued) {
+        return {
+            allow: false,
+            errorContent: JSON.stringify({
+                error: 'parallel_writes_forbidden',
+                detail: 'Issue write-class tools one at a time. ' +
+                    'Tool N+ in this round was not executed. ' +
+                    'Reissue this call on the next round, after the first write completes.',
+                tool: toolName,
+            }),
+        };
+    }
+    state.writeIssued = true;
+    return { allow: true };
+}

package/dist/agent/repair-partial.js

@@ -23,9 +23,96 @@ export function repairPartialBlocks(blocks) {
             return false;
         if (b.type === 'tool_use') {
             // Complete only when input was successfully parsed (object, not undefined).
-            return b.input !== undefined;
+            if (b.input === undefined)
+                return false;
+            // Strip residual `partial_json` left over by interrupted streaming.
+            // Even with `input` parsed, an extra `partial_json` field on the block
+            // gets persisted to session.messages and the next API call fails with
+            //   400 messages.N.content.M.tool_use.partial_json:
+            //        Extra inputs are not permitted
+            // Mirrors the heal in session/store.ts:loadSession.
+            if (typeof b.partial_json === 'string')
+                delete b.partial_json;
+            return true;
         }
         // text, thinking, redacted_thinking, etc. — keep as-is.
         return true;
     });
 }
+/**
+ * In-memory heal for a poisoned session.messages array.
+ *
+ * Counterpart to the heal in session/store.ts:loadSession that runs on every
+ * disk load. When the agent loop catches an API 400 whose message contains
+ * `partial_json: Extra inputs are not permitted`, the live in-memory messages
+ * array is the culprit — a previous turn persisted a tool_use block with both
+ * `input` parsed AND a leftover `partial_json` string. The session on disk
+ * was already healed by loadSession, but the in-process array is what the
+ * SDK call serialises, so we need to scrub it here too.
+ *
+ * Before this heal existed, the only path back was `/exit` then
+ * `cspeach --resume <id>` (which goes through loadSession's heal). Users
+ * had to bounce the REPL after every poisoned turn.
+ *
+ * Returns the number of blocks scrubbed so the caller can decide whether
+ * the heal actually changed anything (no-op heals shouldn't print a yellow
+ * note).
+ */
+export function healSessionMessagesInPlace(messages) {
+    let scrubbed = 0;
+    for (const msg of messages ?? []) {
+        if (!Array.isArray(msg.content))
+            continue;
+        for (const block of msg.content) {
+            if (block?.type === 'tool_use' && typeof block.partial_json === 'string') {
+                if (block.input === undefined) {
+                    try {
+                        block.input = JSON.parse(block.partial_json);
+                    }
+                    catch {
+                        block.input = {};
+                    }
+                }
+                delete block.partial_json;
+                scrubbed++;
+            }
+        }
+    }
+    return scrubbed;
+}
+/**
+ * Heuristic — recognises the Anthropic API 400 that fires when a persisted
+ * tool_use block still carries `partial_json` alongside the parsed `input`.
+ * Matches both the raw SDK error message and a stringified body.
+ *
+ * Narrow fingerprint: `partial_json` token AND a phrase from the documented
+ * Anthropic 400 (`Extra inputs are not permitted` / `not permitted`). The
+ * substring `partial_json` alone is broad enough to false-positive on
+ * unrelated 4xx whose error body echoes the offending request — we'd then
+ * silently scrub a healthy session. Requiring the second phrase keeps the
+ * heal scoped to the actual fingerprint without burning correctness when
+ * Anthropic varies wording slightly (`/not permitted|Extra inputs/i`
+ * matches both observed forms).
+ */
+export function isPartialJsonApiError(err) {
+    if (err == null)
+        return false;
+    const candidates = [];
+    if (err instanceof Error)
+        candidates.push(err.message ?? '');
+    if (typeof err === 'object') {
+        const e = err;
+        const body = e.body ?? e.error ?? e.response?.data;
+        if (typeof body === 'string')
+            candidates.push(body);
+        else if (body && typeof body === 'object') {
+            try {
+                candidates.push(JSON.stringify(body));
+            }
+            catch { /* ignore */ }
+        }
+    }
+    return candidates.some((s) => typeof s === 'string'
+        && s.includes('partial_json')
+        && /not permitted|Extra inputs/i.test(s));
+}