@cspeach/cli 0.7.1 → 0.9.0

package/dist/agent/loop.js

@@ -9,6 +9,10 @@ import { renderChunk, initialBufferState, render } from '../renderer/pipeline.js
 import { renderToolCallTop, renderToolCallBottom, startToolSpinner, startThinkingSpinner } from '../renderer/tool-widget.js';
 import { formatToolErrorSummary } from '../sap-errors/parse-adt-exception.js';
 import { startThinkingHeartbeat } from '../renderer/thinking-heartbeat.js';
+// 2026-06-07 — status-row narration. Safe to import in every mode: the
+// emitter has zero listeners outside Ink (classic / one-shot / subagent),
+// so activity() calls are no-ops there.
+import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
 // (progress-chatter import removed 2026-05-01 — superseded by CC-style
 //  two-line dispatch renderer; re-add if a future in-place spinner returns)
 import { buildRetryCapPausePayload, buildSkippedSiblingResults } from './retry-cap.js';
@@ -24,6 +28,7 @@ import { expandTextFileAttachments } from '../projects/workspace.js';
 import { getSapSystemInfo, renderSapSystemBlock } from '../sap/system-info.js';
 import { objectKeyFromInput } from './retry-key.js';
 import { repairPartialBlocks, healSessionMessagesInPlace, isPartialJsonApiError } from './repair-partial.js';
+import { drainSteering } from './steering-queue.js';
 import { TurnStreamWriter } from './turn-stream.js';
 import { applyToolResultCheckpoint } from './skill-checkpoint.js';
 import { loadWatchdogConfig, evaluateWatchdog } from './turn-watchdog.js';
@@ -73,6 +78,10 @@ const SAVE_HOOK_SKILLS = new Set([
     // and can fan out into further chains after their own envelope saves.
     'abap-modernize',
     'abap-test',
+    // 2026-06-06 B3: /abap-plan create mode emits a csforge:plan-manifest
+    // JSON block → plan envelope. Resume turns set suppressSaveHook so the
+    // revision path in commands/plan-resume.ts persists instead.
+    'abap-plan',
 ]);
 /**
  * True when any user message in the session already carries the rendered
@@ -318,20 +327,47 @@ export async function runTurn(params) {
     const watchdogConfig = loadWatchdogConfig();
     const turnStartedAt = Date.now();
     let watchdogWarned = false;
+    // 2026-06-08 — manifest-on-interrupt: track the last plan-manifest block we
+    // already handed to onPlanManifest, so we fire once per DISTINCT manifest
+    // (a continue-in-session run emits one per phase) and not once per round.
+    let lastFiredManifest = null;
     // (emit was hoisted to the top of the function in v0.5 so the Phase J
     //  promote dispatch could share it. Original location was here.)
     while (true) {
+        // Mid-turn steering (2026-06-08): inject any user corrections typed since the
+        // last round so the next createStream sees them. Drains at the top of EVERY
+        // round — round 1 normally drains an empty queue (no-op); a steer typed
+        // during round N lands at the start of round N+1 (between rounds). The
+        // Anthropic API concatenates consecutive user messages, so injecting after a
+        // tool_result user message is valid.
+        {
+            const steers = drainSteering();
+            if (steers.length > 0) {
+                const text = steers.join('\n');
+                session.messages.push({ role: 'user', content: text });
+                emit(chalk.cyan(`↳ steering: ${steers.join(' / ')}`));
+            }
+        }
         let buffer = initialBufferState();
         let stream;
         // 2026-05-06: paint a "thinking" spinner during the LLM round-trip
         // wait so the user sees activity instead of staring at a silent
-        // prompt. The function disables itself when a chunkEmitter is
-        // provided (it would otherwise race with the chunkEmitter renderer's
-        // own paint loop), so call it without one — the spinner writes
-        // directly to stdout. Stopped on the first content_block_start (so
-        // the response stream paints in its place) and on any error path
-        // below.
-        const thinkingSpinner = startThinkingSpinner({});
+        // prompt. Stopped on the first content_block_start (so the response
+        // stream paints in its place) and on any error path below.
+        //
+        // Phantom cursor #25 (2026-06-06) — pass chunkEmitter so the spinner
+        // self-disables under Ink, same as the heartbeat below. The original
+        // pre-Ink code deliberately called this with {} so the spinner would
+        // write directly to stdout; once Ink owned the frame that meant the
+        // spinner's stop() wrote \x1B[?25h on EVERY turn, re-showing the
+        // native cursor repl.tsx hid at mount → the blinking "booger cursor"
+        // below the Footer. Under Ink the user loses nothing: the raw spinner
+        // was overdrawn by the frame anyway, and the heartbeat (chunkEmitter-
+        // routed) covers liveness feedback. Classic mode (no chunkEmitter)
+        // keeps the stdout spinner unchanged.
+        // Guard: test/unit/ink-cursor-invariant.test.ts.
+        turnStatusEmitter.activity('thinking');
+        const thinkingSpinner = startThinkingSpinner({ chunkEmitter: params.chunkEmitter });
         // v0.6 — guaranteed-visible heartbeat alongside the in-place spinner.
         // The spinner self-disables on non-TTY (Windows PowerShell sometimes
         // reports isTTY=false; resume mode also lost spinner visibility) so a
@@ -344,7 +380,25 @@ export async function runTurn(params) {
         const thinkingHeartbeat = startThinkingHeartbeat({ chunkEmitter: params.chunkEmitter });
         try {
             stream = await retryWithBackoff(() => (async () => {
-                const tools = toAnthropicTools(listTools());
+                // W2.5 — apply optional tool filter (used by agent_run with
+                // read_only: true to send a smaller, read-only tool list to
+                // the subagent). Mirrors CC's Tq2() pattern.
+                const allTools = listTools();
+                const filteredTools = params.toolFilter ? allTools.filter(params.toolFilter) : allTools;
+                const tools = toAnthropicTools(filteredTools);
+                // Bug 11a (proactive heal, 2026-06-07) — strip any residual
+                // `partial_json` from tool_use blocks on EVERY outgoing request.
+                // `content_block_stop` normally deletes it (see below), but any miss —
+                // a multi-tool grounding round, an SDK edge case, poison rehydrated
+                // from disk — leaves a block carrying both `input` AND `partial_json`,
+                // and the NEXT createStream 400s with:
+                //   messages.N.content.M.tool_use.partial_json: Extra inputs are not permitted
+                // which interrupts the turn and (in a /abap-plan resume) discards the
+                // expensive grounding work before any manifest is written. The reactive
+                // heal in the catch below only fires AFTER that damage. Sanitising here —
+                // the single chokepoint every request passes through, retries included —
+                // makes the 400 categorically impossible. Idempotent and O(messages).
+                healSessionMessagesInPlace(session.messages);
                 const streamParams = {
                     model: cfg.default_model,
                     // v0.3.1 — was 8192. Bumped because code-gen skills (abap-generate
@@ -444,6 +498,11 @@ export async function runTurn(params) {
                     // call stop on an already-stopped handle, which is a no-op.
                     thinkingSpinner.stop();
                     thinkingHeartbeat.stop();
+                    // 2026-06-07 — status-row narration: the model is now emitting
+                    // content. Long emissions (a 4k-token plan manifest) can look
+                    // silent if the renderer buffers the block — the row keeps
+                    // ticking "writing response · 90s" regardless.
+                    turnStatusEmitter.activity('writing response');
                     const block = event.content_block;
                     currentAssistantContent.push(block);
                     if (block.type === 'text') {
@@ -558,18 +617,36 @@ export async function runTurn(params) {
                 process.stdout.write(flushed);
             buffer = initialBufferState();
         }
-        // Repair partial blocks before persistence — drop incomplete tool_use
-        // fragments so the next API call doesn't reject the assistant message.
-        // See ./repair-partial.ts for the full rationale.
-        if (interruptedError !== null) {
-            currentAssistantContent = repairPartialBlocks(currentAssistantContent);
-        }
+        // Repair partial blocks before persistence. ALWAYS run, not just on
+        // interruption: on a clean tool-use round the model's tool_use blocks can
+        // still carry a leftover `partial_json` field, and persisting that poisons
+        // the on-disk session (the next createStream 400s — see the proactive heal
+        // above). `repairPartialBlocks` strips `partial_json` unconditionally and
+        // only DROPS a block when its `input` is undefined — which never happens on
+        // a clean round (content_block_stop always sets `input`), so this is a
+        // no-op-except-strip on the happy path. See ./repair-partial.ts.
+        currentAssistantContent = repairPartialBlocks(currentAssistantContent);
         // Persist the assistant message — even if it's partial. Empty content
         // arrays are skipped so we don't push a meaningless empty assistant
         // message that would confuse the next round.
         if (currentAssistantContent.length > 0) {
             session.messages.push({ role: 'assistant', content: currentAssistantContent });
         }
+        // 2026-06-08 — manifest-on-interrupt. The assistant message just pushed may
+        // carry a finalised csforge:plan-manifest block (the /abap-plan resume emits
+        // it BEFORE the continuation ask_question, in this same message). Persist it
+        // NOW — before the round's tool loop dispatches that modal — so a Ctrl+C /
+        // exit during the modal can't lose the phase. Fire once per distinct block;
+        // never let a save error crash the turn.
+        if (params.onPlanManifest) {
+            const turnText = collectTurnAssistantText(session.messages, turnStartMessageCount);
+            const blocks = turnText.match(/<!--\s*csforge:plan-manifest\s*\n[\s\S]*?\n\s*-->/g);
+            const latest = blocks ? blocks[blocks.length - 1] : null;
+            if (latest && latest !== lastFiredManifest) {
+                lastFiredManifest = latest;
+                void Promise.resolve(params.onPlanManifest(turnText)).catch(() => { });
+            }
+        }
         session.last_turn_at = new Date().toISOString();
         if (interruptedError !== null) {
             session.turnInterrupted = true;
@@ -657,16 +734,19 @@ export async function runTurn(params) {
             // their manifest in an early message before a closing ask_question
             // widget; the final wrap-up message ends the turn but doesn't
             // carry the manifest. See ./turn-assistant-text.ts for details.
+            turnStatusEmitter.activity('finishing up');
             const assistantText = collectTurnAssistantText(session.messages, turnStartMessageCount);
-            await maybeOfferSave({
-                skill: params.skill,
-                assistantText,
-                userMessage: userMessageForSave,
-                tokensUsed: Math.max(0, (session.usage?.output_tokens ?? 0) - turnStartOutputTokens),
-                model: cfg.default_model ?? session.model ?? 'unknown',
-                emit,
-                promotedFrom: promotedFromForSave,
-            });
+            if (!params.suppressSaveHook) {
+                await maybeOfferSave({
+                    skill: params.skill,
+                    assistantText,
+                    userMessage: userMessageForSave,
+                    tokensUsed: Math.max(0, (session.usage?.output_tokens ?? 0) - turnStartOutputTokens),
+                    model: cfg.default_model ?? session.model ?? 'unknown',
+                    emit,
+                    promotedFrom: promotedFromForSave,
+                });
+            }
             // Phase 2 #9 (2026-05-16) — auto-compact end-of-turn hook.
             // Runs only on the success path (after maybeOfferSave) so an interrupted
             // turn never triggers a summariser call on partial state. The maybeAutoCompact
@@ -721,13 +801,51 @@ export async function runTurn(params) {
                 // animation. Spinner is purely a "still working" cue, not
                 // load-bearing for output.
                 const spinner = startToolSpinner({ chunkEmitter: params.chunkEmitter });
+                // 2026-06-06 (turn-liveness, B5 smoke feedback) — the in-place tool
+                // spinner self-disables under Ink (phantom cursor #25), which left
+                // slow tool calls (SAP over VPN: 10-60s) as DEAD AIR between the ⏺
+                // dispatch line and the ⎿ result line. Labelled heartbeat prints
+                // fresh "<tool> running… (10s)" lines at thresholds — visible on
+                // every terminal, Ink included.
+                // Interactive tools wait on the USER, not the system — ticking
+                // "ask_question running… (30s)" while they think is noise.
+                const isInteractiveTool = block.name === 'ask_question' || block.name === 'request_approval';
+                // Interactive tools block on the USER. PAUSE the turn-status row (don't
+                // just relabel it): a live 250ms tick repaints the dynamic frame and
+                // overdraws the inquirer approval picker / churns the Ink ask_question
+                // modal — the hidden-question + stacked-border + lost-Enter bug
+                // (2026-06-07). resume() in the finally brings it back the moment the
+                // user answers. Non-interactive tools keep the ticking label + heartbeat.
+                if (isInteractiveTool)
+                    turnStatusEmitter.pause();
+                else
+                    turnStatusEmitter.activity(block.name);
+                const toolHeartbeat = isInteractiveTool
+                    ? { stop: () => undefined }
+                    : startThinkingHeartbeat({
+                        chunkEmitter: params.chunkEmitter,
+                        label: `${block.name} running…`,
+                    });
                 // Phase 2b: dispatch (may take 100ms–several seconds for write tools).
                 const dispatchStart = Date.now();
                 // Bug 8 — short-circuit for 2nd+ write-class tool in the same round.
                 const guardDecision = checkAndMark(block.name, writeGuard);
-                const result = guardDecision.allow
-                    ? await dispatchTool(block.name, block.input, params.ctx)
-                    : { content: guardDecision.errorContent, is_error: true };
+                let result;
+                try {
+                    result = guardDecision.allow
+                        ? await dispatchTool(block.name, block.input, params.ctx)
+                        : { content: guardDecision.errorContent, is_error: true };
+                }
+                finally {
+                    // Stop on the error path too — the interval is unref'd but would
+                    // otherwise keep printing "<tool> running…" into the NEXT prompt
+                    // after a dispatch throw.
+                    toolHeartbeat.stop();
+                    // Resume the turn-status row now that the user has answered (or the
+                    // interactive dispatch threw). No-op for non-interactive tools.
+                    if (isInteractiveTool)
+                        turnStatusEmitter.resume();
+                }
                 const durationMs = Date.now() - dispatchStart;
                 // Phase 2c: stop the spinner, which erases its line so the result
                 // row paints in place of it (no scrollback artifacts).

package/dist/agent/steering-queue.js

@@ -0,0 +1,27 @@
+/**
+ * Mid-turn steering queue (2026-06-08).
+ *
+ * While a turn is in flight the user can type a correction and press Enter;
+ * the Footer enqueues it here instead of bouncing it. The agent loop drains
+ * this at each round boundary and injects the text as a user message before
+ * the next createStream, so the model reads the correction and adapts —
+ * CC-style "type any time". Module-level singleton, mirroring the
+ * pendingDispatch accessor pattern; there is exactly one interactive REPL
+ * turn loop at a time.
+ */
+const queue = [];
+/** Add a steer. Trims; ignores empty / whitespace-only input. */
+export function enqueueSteering(text) {
+    const t = text.trim();
+    if (t.length === 0)
+        return;
+    queue.push(t);
+}
+/** Return all queued steers (FIFO) and clear the queue. */
+export function drainSteering() {
+    return queue.splice(0, queue.length);
+}
+/** True when at least one steer is queued. */
+export function hasSteering() {
+    return queue.length > 0;
+}

package/dist/approvals/jwt.js

@@ -3,12 +3,44 @@ import crypto from 'node:crypto';
 // Session-scoped HMAC key — generated per CLI start, never persisted.
 const sessionKey = crypto.randomBytes(32);
 const usedNonces = new Set();
+/**
+ * Op-group coverage. An approval the user granted for one op also authorizes
+ * the natural follow-on ops that *complete* it, on the SAME object:
+ *
+ *   - approving `create` covers create → modify (source write) → activate,
+ *     because creating a DDIC/repo object via ADT is always shell → source →
+ *     activate. One user "yes" to "create ZPM_DT_REASON", not three.
+ *   - approving `modify` covers modify → activate (write then activate).
+ *   - `delete` / `release` stay single-op (and single-use) — one-shot ops the
+ *     user must approve explicitly each time.
+ *
+ * This removes the op_mismatch APPROVAL_INVALID storm (create approval used,
+ * then set_source rejected because it's a different op) without weakening the
+ * invariant that an approval only ever authorizes ITS object, within TTL.
+ */
+const OP_COVERAGE = {
+    create: new Set(['create', 'modify', 'activate']),
+    modify: new Set(['modify', 'activate']),
+    delete: new Set(['delete']),
+    activate: new Set(['activate']),
+    release: new Set(['release']),
+};
+/** create/modify approvals are reusable across their object's lifecycle ops
+ *  until TTL; delete/release are genuinely one-shot. */
+function isOneShotOp(op) {
+    return op === 'delete' || op === 'release';
+}
 export async function mintApprovalId(payload) {
     const nonce = crypto.randomBytes(16).toString('hex');
     return new SignJWT({ ...payload, nonce })
         .setProtectedHeader({ alg: 'HS256' })
         .setIssuedAt()
-        .setExpirationTime('5m')
+        // 30m, was 5m. A single build phase (DDIC batch + RAP stack) runs many
+        // rounds over a slow VPN; the one-write-per-round guard stretches it well
+        // past 5m, which expired approvals mid-phase and forced re-prompts. The
+        // key is session-scoped (regenerated per CLI start) and every approval is
+        // object+op-group bounded, so a longer in-turn window is safe.
+        .setExpirationTime('30m')
         .sign(sessionKey);
 }
 export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp) {
@@ -43,12 +75,20 @@ export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp)
         // taxonomy short. Mismatch / spent-nonce paths NEVER reach this catch.
         return { ok: false, reason: 'invalid_signature' };
     }
-    if (usedNonces.has(payload.nonce))
-        return { ok: false, reason: 'nonce_spent' };
     if (payload.object !== expectedObject)
         return { ok: false, reason: 'object_mismatch' };
-    if (payload.op !== expectedOp)
+    // Op-group coverage: a create approval also authorizes the modify+activate
+    // that complete the create; a modify approval authorizes its activate.
+    const covered = OP_COVERAGE[payload.op];
+    if (!covered || !covered.has(expectedOp))
         return { ok: false, reason: 'op_mismatch' };
-    usedNonces.add(payload.nonce);
+    // Single-use only for one-shot destructive ops. create/modify approvals are
+    // reusable for their object's lifecycle ops (create→modify→activate) within
+    // TTL — that IS the change the user approved, so re-spending is not replay.
+    if (isOneShotOp(payload.op)) {
+        if (usedNonces.has(payload.nonce))
+            return { ok: false, reason: 'nonce_spent' };
+        usedNonces.add(payload.nonce);
+    }
     return { ok: true, payload };
 }

package/dist/approvals/render.js

@@ -2,6 +2,7 @@ import { select, input } from '@inquirer/prompts';
 import chalk from 'chalk';
 import { shouldUseInk } from '../renderer/tty.js';
 import { approvalEmitter } from '../ui/approval-emitter.js';
+import { askQuestionEmitter } from '../ui/ask-question-emitter.js';
 import { withInquirer } from '../repl/inquirer-guard.js';
 import { inquirerTheme } from '../repl/inquirer-theme.js';
 import { PEACH } from '../renderer/banners.js';
@@ -102,6 +103,43 @@ export async function renderPlanGate(summary, changes, transport, effectiveRisk)
     const visibleChanges = collapseImplicitActivates(changes);
     const visibleCount = visibleChanges.length;
     const noun = visibleCount === 1 ? 'change' : 'changes';
+    // Ink path (default): route the gate through the ask_question choice modal so
+    // it renders INSIDE the React frame. The prior inquirer select drew raw to
+    // stdout while Ink owned the terminal — it toggled raw mode out from under
+    // Ink and competed with the Footer for keystrokes (the "turn in progress —
+    // input kept in box" confusion, and dead arrow keys on the modal that
+    // followed). One input system = no handoff, no competition. Mirrors
+    // renderPerChangeApprovalV3, which already went Ink-native via approvalEmitter.
+    if (shouldUseInk()) {
+        const ctx = [
+            summary,
+            [`${visibleCount} ${noun}`, riskTag(effectiveRisk.level), transport ? `transport ${transport}` : '']
+                .filter(Boolean).join(' · '),
+        ];
+        if (effectiveRisk.raisedBy.length > 0) {
+            ctx.push(`(raised from low: ${effectiveRisk.raisedBy.join(', ')})`);
+        }
+        for (const c of visibleChanges)
+            ctx.push(`  ${opIcon(c.op)} ${c.object} (${c.type})`);
+        const result = await askQuestionEmitter.request({
+            id: 'plan-gate',
+            question: 'Apply this plan?',
+            // Strip chalk ANSI from opIcon/riskTag — the Ink modal renders `context`
+            // itself (dimColor), so embedded escape codes would show as raw text.
+            context: ctx.join('\n').replace(/\x1b\[[0-9;]*m/g, ''),
+            kind: 'choice',
+            choices: [
+                { value: 'apply_all', label: `Apply all ${visibleCount} ${noun}` },
+                { value: 'review', label: 'Review each change individually' },
+                { value: 'cancel', label: 'Cancel' },
+            ],
+        });
+        if (result.answer === 'apply_all' || result.answer === 'review' || result.answer === 'cancel') {
+            return result.answer;
+        }
+        return 'cancel'; // Esc / no answer → cancel the plan (safe default)
+    }
+    // Non-Ink (one-shot / non-TTY / classic): the original inquirer flow.
     console.log('');
     console.log(`${peach('Plan')}  ${summary}`);
     const meta = [`${visibleCount} ${noun}`, riskTag(effectiveRisk.level)];

package/dist/classifier/client.js

@@ -32,6 +32,10 @@ const RULES = [
     { skill: 'abap-upgrade-scan', patterns: [/upgrade\s+scan|scan.*s\/4|readiness\s+variant/i] },
     { skill: 'abap-migrate', patterns: [/ecc.*migration|migrate.*s\/4|api\s+successor/i] },
     { skill: 'abap-performance', patterns: [/performance|\bn\+1\b|select\s+inside\s+loop|slow\s+(query|select)/i] },
+    // abap-plan (B4, 2026-06-06): deliberately NO bare \bplan\b — "I plan to
+    // refactor X" must keep falling through to the refactor/explain rules.
+    // Multi-session / project-plan framing only; refine after real prompts.
+    { skill: 'abap-plan', patterns: [/project\s+plan|implementation\s+plan|plan\s+(this|the|my)\s+(project|build|development)|multi.session\s+(project|plan|build)|resume\s+(the\s+|my\s+)?plan|step.by.step\s+plan/i] },
     { skill: 'abap-preflight', patterns: [/preflight|pre.release|go\/no.go|release\s+readiness/i] },
     { skill: 'abap-radar', patterns: [/radar|quick\s+look|overview\s+of\s+(this\s+)?(class|program|object)/i] },
     { skill: 'abap-refactor', patterns: [/refactor|clean\s+up\s+(code|abap)|procedural.*to\s+oo/i] },
@@ -42,12 +46,12 @@ const RULES = [
     { skill: 'abap-transport-analysis', patterns: [/transport\s+analysis|pre.release\s+transport|transport\s+readiness/i] },
     { skill: 'abap-transport', patterns: [/transport\s+(create|release|list)|\bcts\b|release.*request/i] },
 ];
-if (RULES.length !== 32) {
+if (RULES.length !== 33) {
     // Warn-not-throw — managed-mode users never exercise classify() (the proxy
     // does server-side classification), so a module-load crash would break
     // them for a local-only consistency check. Unit tests assert the exact
     // count.
-    console.warn(`[classifier] RULES drift: expected 32, got ${RULES.length} — reconcile with .claude/skills/`);
+    console.warn(`[classifier] RULES drift: expected 33, got ${RULES.length} — reconcile with .claude/skills/`);
 }
 export function classify(prompt) {
     for (const rule of RULES) {