@cspeach/cli 0.8.0 → 1.0.0

package/dist/repl/safety-confirm.js

@@ -5,13 +5,21 @@
  * surface, every rule-triggering operation gets a card showing which rule
  * applies, what's about to happen, and what rollback is available.
  *
- * Pure orchestration over `@inquirer/prompts.confirm` — no I/O of its own
- * beyond the prompt invocation.
+ * Three presentation surfaces, decided per call (headless first):
+ *   - headless        → fail-fast decline, no prompt (B5)
+ *   - Ink             → askQuestionEmitter choice modal (UX-5 review I1) —
+ *                       inquirer must NEVER run under Ink: it fights the
+ *                       React frame for stdin and paints over it
+ *   - classic         → inquirer select via withInquirer (unchanged)
  */
 import chalk from 'chalk';
 import { select } from '@inquirer/prompts';
 import { withInquirer } from './inquirer-guard.js';
 import { inquirerTheme } from './inquirer-theme.js';
+import { isHeadless, shouldUseInk } from '../renderer/tty.js';
+import { askQuestionEmitter } from '../ui/ask-question-emitter.js';
+import { clearActiveSpinner } from '../renderer/tool-widget.js';
+import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
 const RULE_LABEL = {
     RULE_7_SNAPSHOT_BEFORE_WRITE: 'RULE 7 — snapshot before write',
     RULE_7A_USE_UPDATE_METHOD: 'RULE 7a — use sap_update_method (not sap_set_source)',
@@ -21,7 +29,100 @@ const RULE_LABEL = {
     RULE_10_VERIFY_AFTER_WRITE: 'RULE 10 — verify after write',
 };
 export async function presentSafetyConfirmation(action) {
+    // B5 (2026-06-11) — headless fail-fast. This card is a stdin modal (the
+    // Rule 8 batch gate reaches it on the 2nd+ mutating call per turn even in
+    // one-shot, e.g. two local file writes); a headless run would hang on it
+    // forever. Headless runs NEVER auto-confirm safety gates — decline with a
+    // clear reason so the model can wrap up gracefully.
+    if (isHeadless()) {
+        console.error(chalk.red(`headless: ${RULE_LABEL[action.rule]} requires interactive confirmation — ` +
+            'declining (headless runs never auto-confirm safety gates; run interactively).'));
+        return {
+            confirmed: false,
+            reason: 'headless run cannot confirm safety gates — run interactively',
+            headless: true,
+        };
+    }
     const card = renderCard(action);
+    // UX-5 review I1 (2026-06-12) — Ink-native branch. /safety-mode on made
+    // this card reachable under Ink, where the raw inquirer select() below
+    // toggled raw mode out from under the React frame and painted over it.
+    // Mirror of renderPlanGate (approvals/render.ts): route through the
+    // askQuestionEmitter choice modal — one input system, no stdin handoff.
+    // The modal renders `context` itself in dimColor, so strip the chalk ANSI
+    // codes (they'd show as raw escape text). Same choice semantics as the
+    // classic path below: Apply/Cancel, plus the Rule 9 irreversibility ack.
+    // Esc / no listener resolve as cancelled → decline (safe default).
+    if (shouldUseInk()) {
+        // CRITICAL race fix (2026-06-13) — this gate fires from INSIDE
+        // dispatchTool, on the 2nd+ mutating op of a turn. For local-FS ops
+        // (file_write / shell_exec, the fiori-build path) the agent loop
+        // classifies the tool as NON-interactive: it starts the in-place tool
+        // spinner, a per-second labelled heartbeat, AND keeps the turn-status
+        // row ticking — none of which it pauses (only ask_question /
+        // request_approval get paused at the loop level). So when this modal
+        // opens, three render sources are still repainting the Ink frame
+        // underneath it. That produced the observed live bug: the RULE 8 card
+        // rendered DOUBLED, Enter was not consumed by the modal, the keystroke
+        // LEAKED to the outer prompt (history-replay of the slash command), and
+        // the turn wedged for ~10 minutes while the tool spinner kept ticking.
+        //
+        // The gate must claim exclusive input focus itself (it can't rely on the
+        // loop, which doesn't know a non-interactive tool is about to block on
+        // the user). Mirror what the loop does for interactive tools:
+        //   - clearActiveSpinner(): stop the live in-place tool spinner so only
+        //     ONE surface (this modal) renders.
+        //   - turnStatusEmitter.pause(): freeze the ticking status row so it
+        //     stops repainting the dynamic frame and overdrawing the modal.
+        // resume() in the finally restores normal rendering the moment the gate
+        // resolves. (The per-second heartbeat is loop-local and is stopped on
+        // the loop side by ordering the gate ahead of heartbeat start — see
+        // tool-dispatch.ts / loop.ts.)
+        clearActiveSpinner();
+        const statusWasActive = turnStatusEmitter.snapshot().active;
+        if (statusWasActive)
+            turnStatusEmitter.pause();
+        try {
+            const first = await askQuestionEmitter.request({
+                id: 'safety-confirm',
+                question: `⚠  ${RULE_LABEL[action.rule]}`,
+                context: stripAnsi(card).trim(),
+                kind: 'choice',
+                choices: [
+                    { value: 'apply', label: 'Apply' },
+                    { value: 'cancel', label: 'Cancel' },
+                ],
+            });
+            if (first.cancelled || first.answer !== 'apply') {
+                return { confirmed: false, reason: 'user declined first prompt' };
+            }
+            // RULE 9 transport-release is irreversible — require a second explicit ack.
+            if (action.rule === 'RULE_9_TRANSPORT_RELEASE') {
+                const second = await askQuestionEmitter.request({
+                    id: 'safety-confirm-irreversible',
+                    question: `IRREVERSIBLE — releasing ${action.transport} cannot be undone from this side. ` +
+                        `Are you absolutely sure?`,
+                    kind: 'choice',
+                    // Cancel first → the modal cursor starts there (mirrors the classic
+                    // path's `default: 'cancel'`).
+                    choices: [
+                        { value: 'cancel', label: 'Cancel' },
+                        { value: 'release', label: 'Release transport' },
+                    ],
+                });
+                if (second.cancelled || second.answer !== 'release') {
+                    return { confirmed: false, reason: 'user declined irreversibility ack' };
+                }
+            }
+            return { confirmed: true };
+        }
+        finally {
+            // Restore normal rendering. resume() is a no-op if the turn already
+            // ended (e.g. the user Ctrl+C'd mid-modal) or was never paused.
+            if (statusWasActive)
+                turnStatusEmitter.resume();
+        }
+    }
     // 2026-05-01: switched from confirm() to select() to fix the "press Enter
     // first, then 'y'" race observed in dispatched-tool rule-8 prompts. confirm
     // has a brief window after rendering its multi-line message before raw
@@ -60,6 +161,14 @@ export async function presentSafetyConfirmation(action) {
     }
     return { confirmed: true };
 }
+/**
+ * Strip chalk ANSI escape codes. The Ink ask-question modal renders the
+ * card via its own <Text dimColor> — embedded escapes would display as
+ * literal `[33m` noise there. (Same approach as renderPlanGate.)
+ */
+function stripAnsi(s) {
+    return s.replace(/\x1b\[[0-9;]*m/g, '');
+}
 /**
  * Minimal indented summary block — replaces the chunky ASCII-art box.
  * Renders as:

package/dist/repl/safety-mode-state.js

@@ -1,7 +1,9 @@
 /**
- * Module-scope state for the safety-confirm-as-mode toggle. The REPL turns
- * this on via `--safety-confirm` flag at start, or `/safety-mode on|off` at
- * runtime. Tool dispatchers that hit a Forge Rule (snapshot, write, batch,
+ * Module-scope state for the safety-confirm-as-mode toggle. Off by default;
+ * the user turns it on with the `/safety-mode on` slash command at runtime
+ * (M3, 2026-06-12: there is no startup flag — an earlier version of this
+ * header claimed a `--safety-confirm` flag that was never implemented).
+ * Tool dispatchers that hit a Forge Rule (snapshot, write, batch,
  * transport release, activation) read isSafetyConfirmEnabled() and choose
  * presentSafetyConfirmation() vs the legacy ad-hoc inquirer prompt.
  *
@@ -34,3 +36,17 @@ export function handleSafetyModeCommand(args) {
     }
     return `Safety-confirm mode is currently ${enabled ? 'ON' : 'OFF'}. Use \`/safety-mode on\` or \`/safety-mode off\`.`;
 }
+/**
+ * REPL slash-dispatch entry. Returns the status string when `trimmed` is a
+ * `/safety-mode` command (bare or with args), or null when the line is not
+ * a /safety-mode command at all. Both REPL paths (Ink handleSubmit and the
+ * classic readline loop) route through this single matcher so the command
+ * behaves identically everywhere — mirrors how /transport dispatches via
+ * handleTransportCommand.
+ */
+export function matchSafetyModeCommand(trimmed) {
+    if (trimmed !== '/safety-mode' && !trimmed.startsWith('/safety-mode '))
+        return null;
+    const args = trimmed === '/safety-mode' ? '' : trimmed.slice('/safety-mode '.length);
+    return handleSafetyModeCommand(args);
+}

package/dist/repl/slash-picker.js

@@ -21,21 +21,10 @@
 import { search } from '@inquirer/prompts';
 import { withInquirer } from './inquirer-guard.js';
 import { inquirerTheme } from './inquirer-theme.js';
-import { SKILL_CATALOG } from '../skill-catalog.js';
-const BUILTIN_ENTRIES = [
-    { name: '/cancel', description: 'Cancel the current pre-filled command, return to a clean prompt' },
-    { name: '/cost', description: 'Show this session\'s API spend so far ($ + token breakdown)' },
-    { name: '/compact', description: 'Summarise older turns into a compact context block — cuts subsequent turn cost by 80-90%' },
-    { name: '/exit', description: 'Exit CSPeach' },
-    { name: '/quit', description: 'Exit CSPeach (alias)' },
-    { name: '/help', description: 'Show all skills and commands' },
-    { name: '/skills', description: 'Show all skills (alias)' },
-    { name: '/new', description: 'Reset routing — next prompt is classified afresh' },
-    { name: '/reset', description: 'Reset routing (alias)' },
-    { name: '/ui', description: 'View or change rendering mode (auto / ink / classic)' },
-    { name: '/reroute', description: 'Re-dispatch the previous prompt to a different skill' },
-    { name: '/transport', description: 'View or set the active transport for this session' },
-];
+import { SKILL_CATALOG, SKILL_ALIASES } from '../skill-catalog.js';
+// 2026-06-11 — builtin list extracted to builtin-commands.ts (pure data)
+// so the router layer can check builtin heads without importing inquirer.
+import { BUILTIN_ENTRIES } from './builtin-commands.js';
 function buildCatalogue() {
     const skillEntries = SKILL_CATALOG.map((s) => ({
         name: `/${s.name}`,
@@ -44,6 +33,20 @@ function buildCatalogue() {
     return [...BUILTIN_ENTRIES, ...skillEntries].sort((a, b) => a.name.localeCompare(b.name));
 }
 const ALL_ENTRIES = buildCatalogue();
+/**
+ * 2026-06-06 (Ink picker parity): the full command catalogue (builtins +
+ * skills) and the substring pre-filter, exported so the Ink CommandPalette
+ * shares the exact same data + seeding semantics as the classic inquirer
+ * picker instead of maintaining a drifting copy.
+ */
+export const ALL_SLASH_ENTRIES = ALL_ENTRIES;
+/** Substring filter over the catalogue; empty prefix returns everything. */
+export function filterSlashEntries(prefix) {
+    const lower = prefix.trim().toLowerCase();
+    return lower.length === 0
+        ? [...ALL_ENTRIES]
+        : ALL_ENTRIES.filter((e) => e.name.toLowerCase().includes(lower));
+}
 /**
  * Open the slash picker. Returns the picked command WITHOUT a leading
  * slash (caller is expected to construct the full prompt) or null if
@@ -58,10 +61,7 @@ export async function openSlashPicker(prefix) {
     // contains the typed prefix as a substring — substring rather than
     // startsWith because users often remember a fragment in the middle of
     // a name (e.g. 'fix' should bring up /abap-atc-fix and /abap-upgrade-fix).
-    const lowerPrefix = prefix.trim().toLowerCase();
-    const seeded = lowerPrefix.length === 0
-        ? ALL_ENTRIES
-        : ALL_ENTRIES.filter((e) => e.name.toLowerCase().includes(lowerPrefix));
+    const seeded = filterSlashEntries(prefix);
     // If the prefix narrows down to exactly one command, just return it
     // without opening a picker — saves the user a keystroke.
     if (seeded.length === 1) {
@@ -122,5 +122,11 @@ export function isExactSlashMatch(trimmed) {
     if (!trimmed.startsWith('/'))
         return false;
     const head = trimmed.split(/\s+/, 1)[0].toLowerCase();
+    // Retired-but-redirected names (SKILL_ALIASES) count as exact so the
+    // line passes through to parseShortcut, which resolves the redirect and
+    // emits the "renamed" notice — instead of dumping the user into the
+    // picker. Aliases are deliberately NOT in the picker/completer lists.
+    if (head.startsWith('/') && head.slice(1) in SKILL_ALIASES)
+        return true;
     return ALL_ENTRIES.some((e) => e.name === head);
 }