@cspeach/cli 0.8.0 → 1.0.0

package/dist/repl.js

@@ -10,7 +10,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { select, password as promptPassword } from '@inquirer/prompts';
-import { loadConfig } from './config/loader.js';
+import { loadConfig, resolveLocalBuild } from './config/loader.js';
 import { getStore } from './auth/api-key.js';
 import { readAuthFile } from './auth/auth-file.js';
 import { fetchMe } from './auth/me.js';
@@ -23,16 +23,18 @@ import { makeSessionId, saveSession } from './session/store.js';
 import { newSession } from './session/schema.js';
 import { computeCost, formatCost } from './cost/pricing.js';
 import { createProviderForMode } from './agent/providers/factory.js';
+import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
 import { renderTurnError } from './agent/turn-error-ux.js';
-import { classifyPrompt, parseShortcut } from './router/classifier.js';
+import { classifyPrompt, parseShortcut, rejectUnknownSkill } from './router/classifier.js';
 import { decideRouting } from './router/routing-decision.js';
 import { coachingPickerClassic } from './ui/coaching-picker-classic.js';
 import { coachingPickerEmitter } from './ui/coaching-picker-emitter.js';
 import { globalStore as sapStateStore } from './ui/sap-state-store.js';
 import { PICK_CANCELLED } from './ui/skill-picker.js';
 import { registerReadline, withInquirer } from './repl/inquirer-guard.js';
-import { maybePromptWorkspaceMigration } from './projects/migration.js';
+import { maybePromptWorkspaceMigration, maybeOfferAbapforgeMigration } from './projects/migration.js';
+import { findProjectRoot } from './projects/workspace.js';
 import { slashCompleter } from './repl/slash-completer.js';
 import { openSlashPicker, isExactSlashMatch } from './repl/slash-picker.js';
 import { openAtPicker, pendingAtTokenPrefix } from './repl/at-picker.js';
@@ -60,14 +62,19 @@ function prefillReadline(rl, text) {
 import { BracketedPasteDecoder, enableBracketedPaste, disableBracketedPaste, } from './repl/bracketed-paste.js';
 import { printHelp } from './commands/help.js';
 import { shouldUseInk, setRenderingOverride } from './renderer/tty.js';
+import { createClassicOutputEmitter } from './renderer/notices.js';
 import { saveConfig } from './config/loader.js';
 import { EventEmitter } from 'node:events';
 import { parseAndValidateReroute } from './commands/reroute.js';
 import { SKILL_CATALOG } from './skill-catalog.js';
 import { replPreviewHook } from './repl/update-method-preview-hook.js';
 import { getCurrentTransport, handleTransportCommand } from './repl/current-transport.js';
+import { matchSafetyModeCommand } from './repl/safety-mode-state.js';
+import { maybeExpandNumberSelection, lastAssistantText } from './repl/numbered-menu.js';
+import { attachEarlyLineBuffer, noopEarlyLineBuffer } from './repl/early-line-buffer.js';
 import { snapshotTurnStart, pushPostTurnStatus } from './repl/post-turn-status.js';
 import { looksLikeCspeachShellCommand, CSPEACH_SHELL_NUDGE } from './repl/cspeach-shell-detect.js';
+import { applyLocalBuildConfig } from './tools/local-build.js';
 // Side-effect imports so tool registrations happen before listTools() is called.
 import './tools/sap-read.js';
 import './tools/sap-write.js';
@@ -77,16 +84,22 @@ import './tools/snapshot.js';
 import './tools/ask-question.js';
 import './tools/dispatch-skill.js';
 import './tools/filesystem/file-read.js';
+import './tools/filesystem/read-document.js';
 import './tools/filesystem/file-edit.js';
 import './tools/filesystem/file-write.js';
 import './tools/filesystem/glob.js';
 import './tools/filesystem/grep.js';
 import './tools/shell/shell_exec.js';
+import './tools/fiori/tools.js';
+import './tools/extend-model/tool.js';
+import './tools/capability/tool.js';
 import './tools/web/web_fetch.js';
 import './tools/web/web_search.js';
 import './tools/project/project_context_get.js';
 import './tools/project/playbook_get.js';
 import './tools/project/convention_get.js';
+import './tools/project/cca_merge.js';
+import './tools/project/upgrade_merge_progress.js';
 import './tools/subagent/_background-shared.js';
 import './tools/subagent/background_run.js';
 import './tools/subagent/monitor_emit.js';
@@ -252,7 +265,7 @@ function isBareAck(trimmed) {
  *   instead of having to arrow to the right item.
  */
 const PICKER_FALLBACK_SKILLS = [
-    'abap-explain', 'abap-review', 'abap-document', 'abap-rap', 'abap-radar',
+    'abap-explain', 'abap-review', 'abap-handover', 'abap-rap', 'abap-impact',
 ];
 const MIN_PICKER_OPTIONS = 3;
 function buildCoachingParams(result, prompt, preSelect, lastSkill) {
@@ -376,6 +389,18 @@ export async function runRepl(opts) {
     else {
         console.log(chalk.gray(`Write mode: ${cfg.write_mode}\n`));
     }
+    // local_build toggle — when persisted-on, force-enable the flag-gated
+    // filesystem tools AND shell_exec BEFORE the first listTools()/turn (listTools
+    // reads flag state live per turn). Resolve with backward compat: a stale
+    // legacy `local_files = on` still applies via resolveLocalBuild. Announce
+    // visibly: the toggle is persisted, not re-consented each session, so the user
+    // must see that local file access + command execution are live this session.
+    // Printed to stdout here (before any Ink frame mounts).
+    {
+        const announce = applyLocalBuildConfig(resolveLocalBuild(cfg), process.cwd());
+        if (announce)
+            console.log(chalk.dim(announce + '\n'));
+    }
     const aliases = Object.keys(cfg.sap);
     // C.1 — --sap-alias flag override skips the interactive picker
     let selectedAlias;
@@ -415,6 +440,19 @@ export async function runRepl(opts) {
     if (!opts?.resumedSession) {
         await saveSession(session);
     }
+    // License gate: non-managed modes (byok/local/ai-hub) bypass our proxy for
+    // inference, so without this anyone who never logged in could use the bundled
+    // skills untracked. Require a valid CSPeach login before the REPL starts.
+    try {
+        await assertModeLicensed(cfg.llm.mode, async () => (await store.get()) ?? '');
+    }
+    catch (e) {
+        if (e instanceof CspeachLicenseError) {
+            console.error(chalk.yellow(`\n${e.message}\n`));
+            process.exit(1);
+        }
+        throw e;
+    }
     const provider = createProviderForMode(cfg, async () => {
         const key = await store.get();
         if (!key)
@@ -640,13 +678,20 @@ export async function runRepl(opts) {
                 chunkEmitter.emit('chunk', chalk.dim(`\n↪ Rerouting "${preview}" → /${rr.skill}\n`));
                 if (rr.warning)
                     chunkEmitter.emit('chunk', chalk.dim(`  (${rr.warning})\n`));
-                await runTurn({
-                    provider,
-                    userMessage: rr.prompt,
-                    skill: rr.skill,
-                    ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, chunkEmitter, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
-                    chunkEmitter,
-                });
+                const { turnStatusEmitter: rerouteStatus } = await import('./ui/turn-status-emitter.js');
+                rerouteStatus.start(`/${rr.skill}`);
+                try {
+                    await runTurn({
+                        provider,
+                        userMessage: rr.prompt,
+                        skill: rr.skill,
+                        ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, chunkEmitter, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
+                        chunkEmitter,
+                    });
+                }
+                finally {
+                    rerouteStatus.stop();
+                }
                 return;
             }
             // /new — clear any "awaiting skill answer" state so the next prompt
@@ -664,7 +709,40 @@ export async function runRepl(opts) {
                 chunkEmitter.emit('chunk', chalk.cyan(`\n${msg}\n`));
                 return;
             }
-            const parsed = parseShortcut(trimmed);
+            // /safety-mode on|off — structured Forge Rule confirmation cards.
+            // UX-5 #1 (2026-06-12): handleSafetyModeCommand existed (unit-tested)
+            // but no REPL path ever routed to it — the toggle was unreachable at
+            // runtime. Mirrors the /transport dispatch shape above.
+            {
+                const msg = matchSafetyModeCommand(trimmed);
+                if (msg !== null) {
+                    chunkEmitter.emit('chunk', chalk.cyan(`\n${msg}\n`));
+                    return;
+                }
+            }
+            // UX-5 #2 (2026-06-12) — numbered-menu expansion. When the model
+            // ended the previous turn with a plain-text numbered menu and the
+            // user types a bare `2`, expand the input to that item's text (with
+            // a dim echo) so the turn carries real intent instead of a lone
+            // digit. Conservative: fires only on pure 1–2 digit input matching
+            // an item in a 2+-item list in the LAST assistant message.
+            let effectiveInput = trimmed;
+            {
+                const expansion = maybeExpandNumberSelection(trimmed, lastAssistantText(session.messages));
+                if (expansion) {
+                    chunkEmitter.emit('chunk', chalk.dim(`${expansion.echo}\n`));
+                    effectiveInput = expansion.text;
+                }
+            }
+            const parsed = parseShortcut(effectiveInput);
+            // D35 (2026-06-11) — explicit slash naming a skill that isn't in the
+            // catalog: print the notice ("did you mean" / builtin-with-args) and
+            // end the turn. Slash input must NEVER fall through to the classifier
+            // (classifyPrompt asserts on it) and must never dispatch to a
+            // nonexistent skill. Shared gate: rejectUnknownSkill in classifier.ts.
+            if (rejectUnknownSkill(parsed, (m) => chunkEmitter.emit('chunk', chalk.yellow(`\n${m}\n`)))) {
+                return;
+            }
             // Record the prose body (post-shortcut stripping) for /reroute. Using
             // `parsed.prompt` rather than `trimmed` means:
             //   - plain prose: `parsed.prompt === trimmed`, stored as-is
@@ -673,7 +751,9 @@ export async function runRepl(opts) {
             //   - `@ZCL_ORDER explain this`: stored as `explain this` — @OBJECT
             //     context is lost on reroute, acceptable v0.3.1 limitation
             session.lastUserPrompt = parsed.prompt;
-            const prompt = parsed.prompt;
+            // `let`, not `const` — the B3 plan-resume interception below rewrites
+            // the prompt with the prepared bounded phase context before runTurn.
+            let prompt = parsed.prompt;
             const extractedObject = parsed.object ?? null;
             const previousSkill = session.skill;
             const previousObject = session.last_object ?? null;
@@ -765,7 +845,7 @@ export async function runRepl(opts) {
             // consume model tokens, so we intercept here AFTER skill resolution
             // but BEFORE runTurn. The body lives in `prompt` (post-parseShortcut),
             // e.g. `--status @./foo.cspeach.json`.
-            if ((skill === 'abap-spec-gap' || skill === 'abap-design' || skill === 'abap-estimate') &&
+            if ((skill === 'abap-spec-gap' || skill === 'abap-design' || skill === 'abap-estimate' || skill === 'abap-plan') &&
                 /(^|\s)--status(\s|$)/.test(prompt)) {
                 try {
                     const files = prompt
@@ -785,6 +865,76 @@ export async function runRepl(opts) {
                 session.last_object = extractedObject ?? previousObject ?? null;
                 return;
             }
+            // B3 (2026-06-06) — `/abap-plan --resume @plan-file`. Token-free
+            // pre-work (load envelope, pick next eligible phase, print the
+            // tracker board, inline the phase's rule files) happens in
+            // preparePlanResume; terminal states (plan complete / all blocked)
+            // print and end the turn without any model call. When a phase IS
+            // eligible, the prepared bounded prompt replaces the user prompt
+            // and falls through to runTurn below — with suppressSaveHook so
+            // the new-envelope save hook stays quiet; finishPlanResume then
+            // persists the version-N+1 REVISION after the turn.
+            let planResume = null;
+            let planResumeMsgStart = 0;
+            // A4 — set only when plan model tiering picks Sonnet for this phase.
+            let planModelOverride;
+            if (skill === 'abap-plan' && /(^|\s)--resume(\s|$)/.test(prompt)) {
+                try {
+                    const { preparePlanResume } = await import('./commands/plan-resume.js');
+                    planResume = await preparePlanResume({
+                        body: prompt,
+                        cwd: process.cwd(),
+                        log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
+                    });
+                }
+                catch (err) {
+                    chunkEmitter.emit('chunk', chalk.red(`\n[--resume] ${err.message}\n`));
+                }
+                if (!planResume) {
+                    session.last_skill = previousSkill ?? null;
+                    session.last_object = extractedObject ?? previousObject ?? null;
+                    return;
+                }
+                // A1 (defect D23) — true bounded phases: EVERY plan-resume turn
+                // (harness-dispatched or manually typed) starts from reset session
+                // messages. The envelope + bounded prompt carry all needed state;
+                // prior transcript is pure context cost (a 6-phase run once
+                // snowballed to a 3.24M-token cache read per call).
+                {
+                    const { resetContextForPlanResume } = await import('./commands/plan-resume.js');
+                    if (resetContextForPlanResume(session)) {
+                        chunkEmitter.emit('chunk', chalk.dim('↪ Plan phase starts in a fresh bounded context — prior transcript cleared\n'));
+                    }
+                }
+                planResumeMsgStart = session.messages.length;
+                prompt = planResume.llmPrompt;
+                // A4 (2026-06-11) — flag-gated per-phase model tiering: design/test/
+                // document-shaped phases (structural signal: the phase's delegateTo
+                // skill) run on Sonnet; everything else — and the flag-off default —
+                // stays on cfg.default_model. The dim notice keeps cost attribution
+                // auditable next to the cost-log line that records the same model.
+                {
+                    const { isPlanModelTieringEnabled, selectPlanPhaseModel } = await import('./commands/plan-model-tier.js');
+                    const choice = selectPlanPhaseModel({
+                        enabled: isPlanModelTieringEnabled(cfg),
+                        phaseId: planResume.nextPhaseId,
+                        delegateTo: planResume.nextDelegateTo,
+                        defaultModel: cfg.default_model,
+                    });
+                    if (choice.model) {
+                        planModelOverride = choice.model;
+                        chunkEmitter.emit('chunk', chalk.dim(`${choice.notice}\n`));
+                    }
+                }
+            }
+            // 2026-06-08 — manifest-on-interrupt. Set true once the mid-turn
+            // onPlanManifest hook has persisted the revision, so the post-turn
+            // finishPlanResume below doesn't write it a second time.
+            let planSavedEarly = false;
+            // A1 — outcome of the persisted revision (exact saved path + the
+            // harness-built resume command). Drives the post-turn next-phase offer.
+            let planOutcome = null;
+            const planResumeForHook = planResume;
             // Phase A** wiring fix (2026-05-16) — snapshot pre-turn counters so
             // pushPostTurnStatus can compute per-turn deltas. The classic-mode
             // turn loop has its own equivalent below; both paths now call the
@@ -798,6 +948,11 @@ export async function runRepl(opts) {
             // the signal we thread into runTurn.
             currentTurnAbort = new AbortController();
             interruptCount = 0;
+            // 2026-06-07 — persistent status row lifecycle. Started here (not in
+            // loop.ts) so the try/finally GUARANTEES the row clears even when the
+            // turn throws; loop.ts only narrates activity changes in between.
+            const { turnStatusEmitter } = await import('./ui/turn-status-emitter.js');
+            turnStatusEmitter.start(`/${skill}`);
             try {
                 await runTurn({
                     provider,
@@ -806,6 +961,29 @@ export async function runRepl(opts) {
                     ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, chunkEmitter, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
                     chunkEmitter,
                     signal: currentTurnAbort.signal,
+                    suppressSaveHook: planResume !== null,
+                    // A4 — undefined on every non-plan turn (and when tiering is off).
+                    modelOverride: planModelOverride,
+                    // Persist the plan revision the instant its manifest is finalised
+                    // (before the continuation modal) so a Ctrl+C can't lose the phase.
+                    onPlanManifest: planResumeForHook
+                        ? async (assistantText) => {
+                            try {
+                                const { finishPlanResume } = await import('./commands/plan-resume.js');
+                                planOutcome = await finishPlanResume({
+                                    prepared: planResumeForHook,
+                                    messages: session.messages,
+                                    messagesStart: planResumeMsgStart,
+                                    log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
+                                    textOverride: assistantText,
+                                });
+                                planSavedEarly = true;
+                            }
+                            catch (err) {
+                                chunkEmitter.emit('chunk', chalk.red(`\n[plan] early revision save failed: ${err.message}\n`));
+                            }
+                        }
+                        : undefined,
                 });
             }
             catch (err) {
@@ -817,19 +995,77 @@ export async function runRepl(opts) {
                 });
             }
             finally {
+                turnStatusEmitter.stop();
                 currentTurnAbort = null;
             }
-            pushPostTurnStatus({ session, selectedAlias, snapshot: turnSnapshot, chunkEmitter });
+            // B3 — persist the plan revision from the resume turn's manifest
+            // block (runs even after a turn error: partial assistant content is
+            // already in session.messages, and a phase may have written real SAP
+            // objects whose status must not be lost). FALLBACK path: skipped when
+            // the mid-turn onPlanManifest hook already saved it (manifest-on-
+            // interrupt, 2026-06-08). Still runs when no manifest was streamed —
+            // e.g. the turn errored before emitting one — so behaviour is unchanged
+            // for the no-manifest case.
+            if (planResume && !planSavedEarly) {
+                try {
+                    const { finishPlanResume } = await import('./commands/plan-resume.js');
+                    planOutcome = await finishPlanResume({
+                        prepared: planResume,
+                        messages: session.messages,
+                        messagesStart: planResumeMsgStart,
+                        log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
+                    });
+                }
+                catch (err) {
+                    chunkEmitter.emit('chunk', chalk.red(`\n[plan] revision save failed: ${err.message}\n`));
+                }
+            }
+            // A1 (defect D23) — harness-owned continuation. The model's turn ended
+            // at the manifest; if the persisted revision has a next eligible phase,
+            // the HARNESS asks for consent (Rule 8) and queues the exact
+            // `/abap-plan --resume @<saved-file>` it just built — the model never
+            // authors this command. The pendingDispatch consumer below re-enters
+            // it, and the resume turn itself resets session messages.
+            if (planResume && planOutcome?.nextPhaseId) {
+                try {
+                    const { offerNextPhaseAutoRun } = await import('./commands/plan-resume.js');
+                    const { inkAwarePrompt } = await import('./agent/loop.js');
+                    await offerNextPhaseAutoRun({
+                        outcome: planOutcome,
+                        prompt: inkAwarePrompt,
+                        queueDispatch: (cmd) => pendingDispatchAccessor.set(cmd),
+                        log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
+                    });
+                }
+                catch (err) {
+                    chunkEmitter.emit('chunk', chalk.red(`\n[plan] next-phase offer failed: ${err.message}\n`));
+                }
+            }
+            // A4 — turn-cost line must price at the model that actually ran the
+            // turn (planModelOverride on tiered plan phases), not session.model.
+            pushPostTurnStatus({
+                session,
+                selectedAlias,
+                snapshot: turnSnapshot,
+                chunkEmitter,
+                turnModel: planModelOverride ?? session.model,
+            });
             session.last_skill = previousSkill ?? null;
             session.last_object = extractedObject ?? previousObject ?? null;
             // 2026-05-08: post-turn auto-dispatch. The dispatch_skill tool may
             // have queued a slash command (typically after the user picked
-            // "Switch to /abap-X" via ask_question). Consume the slot and
-            // re-enter handleSubmit with that command — no user keypress.
-            // The user's consent was the picker pick.
+            // "Switch to /abap-X" via ask_question), or — A1 — the harness
+            // next-phase offer above queued the plan-resume it built itself.
+            // Consume the slot and re-enter handleSubmit with that command —
+            // no user keypress. The user's consent was the picker pick / y answer.
             const dispatched = pendingDispatchAccessor.get();
             if (dispatched) {
                 pendingDispatchAccessor.set(null);
+                // No context clear here: resetContextForPlanResume (called in the
+                // plan-resume prepare branch of handleSubmit) is the single owner of
+                // the transcript reset — it runs for typed AND dispatched resumes,
+                // and only AFTER preparePlanResume succeeds, so a failed prepare
+                // never destroys the session context.
                 chunkEmitter.emit('chunk', chalk.dim(`↪ Auto-routed: ${dispatched}\n`));
                 // Schedule on next tick so the current handleSubmit's promise
                 // resolves cleanly before the next one starts. Recursion via
@@ -932,6 +1168,25 @@ export async function runRepl(opts) {
     // Disable bracketed paste on shutdown so the user's shell prompt after
     // CSPeach exits doesn't keep receiving wrapped pastes.
     process.on('exit', () => disableBracketedPaste());
+    // UX-5 #5 (2026-06-12) — piped-stdin support. Lines piped into the REPL
+    // (`"/cost`n/exit" | cspeach`) arrive BEFORE the loop's first rl.question
+    // is pending; readline emits them as 'line' EVENTS that nobody consumed,
+    // so every line was silently dropped and EOF hard-exited the process.
+    // The buffer queues those early lines (with a BOM strip on the first —
+    // PowerShell pipes inject one); the loop below drains the queue before
+    // calling rl.question, and EOF only ends the session after the queue is
+    // empty. Attached ONLY for non-TTY stdin: interactive type-ahead during
+    // a turn keeps its existing semantics.
+    const pipedStdin = !process.stdin.isTTY;
+    const earlyLines = pipedStdin ? attachEarlyLineBuffer(rl) : noopEarlyLineBuffer();
+    // B2 fix (2026-06-12) — classic-mode notice channel. Tool handlers emit
+    // 'warn'/'info' (and pre-formatted 'chunk' lines like the write verify
+    // chain) on ctx.chunkEmitter; in classic mode that slot used to be
+    // undefined, so every Rule 9 transport notice was silently dropped.
+    // This emitter renders them straight to stdout. It is intentionally NOT
+    // passed as RunTurnParams.chunkEmitter — the loop's render functions
+    // keep their direct-stdout classic path (spinner stays enabled).
+    const classicOutputEmitter = createClassicOutputEmitter();
     // Prompt string: 'CSPeach ' + '›' in peach colour
     const promptStr = 'CSPeach ' + chalk.hex(PEACH)('›') + ' ';
     // When we dispatch an inquirer sub-prompt (coaching picker, pickSkill),
@@ -978,6 +1233,11 @@ export async function runRepl(opts) {
             return;
         if (turnInProgress)
             return; // turn handler owns the abort + UX
+        // UX-5 #5 — piped stdin: EOF must NOT hard-exit while queued lines are
+        // still unprocessed (or while a builtin like /cost is mid-flight). The
+        // loop drains the queue and owns shutdown via earlyLines.closed().
+        if (pipedStdin)
+            return;
         console.log('\nGoodbye.\n');
         process.exit(0);
     });
@@ -1149,6 +1409,23 @@ export async function runRepl(opts) {
         })),
         log: (line) => console.log(chalk.dim(line)),
     });
+    // 2026-06-15: one-time output-namespace migration. The customer-output
+    // root was renamed from the dead-brand `.abapforge/` to `.cspeach/`.
+    // Workspaces that still have a top-level `.abapforge/` get offered a
+    // one-time merge-move into `.cspeach/`. The dual-read resolver keeps old
+    // projects working if the user declines; "never" suppresses future offers.
+    await maybeOfferAbapforgeMigration(findProjectRoot(process.cwd()) ?? process.cwd(), {
+        prompt: async ({ legacyDir, newDir }) => withInquirer(() => select({
+            message: `Found legacy CSPeach outputs in ${legacyDir}. The output folder is now '.cspeach/'. Move them?`,
+            default: 'move',
+            choices: [
+                { value: 'move', name: `Move everything into ${newDir} (recommended)` },
+                { value: 'skip', name: `Not now — ask me again next time` },
+                { value: 'never', name: `Leave it and never ask again` },
+            ],
+        })),
+        log: (line) => console.log(chalk.dim(line)),
+    });
     while (true) {
         // Re-attach the bare-Esc detector every iteration. Inquirer prompts
         // (slash-picker, approval, ask_question, safety-confirm) remove
@@ -1164,9 +1441,27 @@ export async function runRepl(opts) {
         const dispatchedCmd = pendingDispatchAccessor.get();
         if (dispatchedCmd) {
             pendingDispatchAccessor.set(null);
+            // No context clear here: resetContextForPlanResume (called in the
+            // plan-resume prepare branch below) is the single owner of the
+            // transcript reset — it runs for typed AND dispatched resumes, and
+            // only AFTER preparePlanResume succeeds, so a failed prepare never
+            // destroys the session context.
             console.log(chalk.dim(`↪ Auto-routed: ${dispatchedCmd}`));
             line = dispatchedCmd;
         }
+        else if (earlyLines.size() > 0) {
+            // UX-5 #5 — drain piped lines queued while no question was pending.
+            // Echo with the prompt string so transcripts/CI logs show what ran.
+            line = earlyLines.shift();
+            console.log(promptStr + line);
+        }
+        else if (earlyLines.closed()) {
+            // Piped stdin hit EOF and every queued line has been processed —
+            // end the session the same way /exit does.
+            printGoodbye(session);
+            rl.close();
+            return 0;
+        }
         else {
             const effectivePrompt = pendingPrefill ? promptStr + pendingPrefill : promptStr;
             try {
@@ -1184,6 +1479,11 @@ export async function runRepl(opts) {
                 // discriminates the two cases reliably.
                 const rlAny = rl;
                 if (rlAny.closed) {
+                    // UX-5 #5 — piped stdin: a multi-line chunk can resolve the
+                    // pending question with line 1 and QUEUE line 2+ before EOF
+                    // closes the readline. Drain the queue before exiting.
+                    if (earlyLines.size() > 0)
+                        continue;
                     console.log('\nGoodbye.\n');
                     rl.close();
                     return 0;
@@ -1368,7 +1668,7 @@ export async function runRepl(opts) {
                 provider,
                 userMessage: rr.prompt,
                 skill: rr.skill,
-                ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
+                ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, chunkEmitter: classicOutputEmitter, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
             });
             continue;
         }
@@ -1386,6 +1686,15 @@ export async function runRepl(opts) {
             console.log(chalk.cyan(msg));
             continue;
         }
+        // /safety-mode on|off — structured Forge Rule confirmation cards.
+        // UX-5 #1 (2026-06-12): classic-path mirror of the Ink dispatch above.
+        {
+            const msg = matchSafetyModeCommand(trimmed);
+            if (msg !== null) {
+                console.log(chalk.cyan(msg));
+                continue;
+            }
+        }
         // 2026-05-01: live slash-command picker. When the user types something
         // that LOOKS like a slash command but isn't an exact match — `/`,
         // `/abap-r`, `/fix`, etc. — open a search-as-you-type picker
@@ -1504,7 +1813,25 @@ export async function runRepl(opts) {
         }
         // Any non-empty submit clears the empty-prefill latch.
         lastEmptyPrefill = null;
+        // UX-5 #2 (2026-06-12) — numbered-menu expansion (classic mirror of the
+        // Ink block above). Bare `2` after a plain-text numbered menu expands
+        // to that item's text with a dim echo; everything else passes through.
+        {
+            const expansion = maybeExpandNumberSelection(resolvedTrimmed, lastAssistantText(session.messages));
+            if (expansion) {
+                console.log(chalk.dim(expansion.echo));
+                resolvedTrimmed = expansion.text;
+            }
+        }
         const parsed = parseShortcut(resolvedTrimmed);
+        // D35 (2026-06-11) — explicit slash naming a skill that isn't in the
+        // catalog: print the notice ("did you mean" / builtin-with-args) and
+        // end the turn. Slash input must NEVER fall through to the classifier
+        // (classifyPrompt asserts on it) and must never dispatch to a
+        // nonexistent skill. Shared gate: rejectUnknownSkill in classifier.ts.
+        if (rejectUnknownSkill(parsed, (m) => console.log(chalk.yellow(`\n${m}\n`)))) {
+            continue;
+        }
         // Record the prose body (post-shortcut stripping) for /reroute. Using
         // `parsed.prompt` rather than `trimmed` means:
         //   - plain prose: `parsed.prompt === trimmed`, stored as-is
@@ -1513,7 +1840,9 @@ export async function runRepl(opts) {
         //   - `@ZCL_ORDER explain this`: stored as `explain this` — @OBJECT
         //     context is lost on reroute, acceptable v0.3.1 limitation
         session.lastUserPrompt = parsed.prompt;
-        const prompt = parsed.prompt;
+        // `let`, not `const` — the B3 plan-resume interception below rewrites
+        // the prompt with the prepared bounded phase context before runTurn.
+        let prompt = parsed.prompt;
         const extractedObject = parsed.object ?? null;
         const previousSkill = session.skill; // snapshot before this turn dispatches
         const previousObject = session.last_object ?? null; // carries from two turns ago
@@ -1601,7 +1930,7 @@ export async function runRepl(opts) {
         // /abap-design, and /abap-estimate (renderer in projects/status.ts is
         // type-agnostic). Intercept after skill resolution, before runTurn. The
         // prompt body (post-parseShortcut) looks like `--status @./foo.cspeach.json`.
-        if ((skill === 'abap-spec-gap' || skill === 'abap-design' || skill === 'abap-estimate') &&
+        if ((skill === 'abap-spec-gap' || skill === 'abap-design' || skill === 'abap-estimate' || skill === 'abap-plan') &&
             /(^|\s)--status(\s|$)/.test(prompt)) {
             try {
                 const files = prompt
@@ -1621,6 +1950,65 @@ export async function runRepl(opts) {
             session.last_object = extractedObject ?? previousObject ?? null;
             continue;
         }
+        // B3 (2026-06-06) — `/abap-plan --resume @plan-file` (classic-mode
+        // mirror of the Ink path above; see that block for the full design
+        // note). Token-free pre-work; terminal states end the turn with no
+        // model call; otherwise the prepared bounded prompt falls through to
+        // runTurn with suppressSaveHook, and finishPlanResume persists the
+        // envelope revision after the turn.
+        let planResume = null;
+        let planResumeMsgStart = 0;
+        // A4 — set only when plan model tiering picks Sonnet for this phase.
+        let planModelOverride;
+        if (skill === 'abap-plan' && /(^|\s)--resume(\s|$)/.test(prompt)) {
+            try {
+                const { preparePlanResume } = await import('./commands/plan-resume.js');
+                planResume = await preparePlanResume({
+                    body: prompt,
+                    cwd: process.cwd(),
+                    log: (...lines) => lines.forEach((l) => console.log(l)),
+                });
+            }
+            catch (err) {
+                console.log(chalk.red(`\n[--resume] ${err.message}\n`));
+            }
+            if (!planResume) {
+                session.last_skill = previousSkill ?? null;
+                session.last_object = extractedObject ?? previousObject ?? null;
+                continue;
+            }
+            // A1 (defect D23) — see the Ink path: every plan-resume turn starts
+            // from reset session messages (true bounded phases).
+            {
+                const { resetContextForPlanResume } = await import('./commands/plan-resume.js');
+                if (resetContextForPlanResume(session)) {
+                    console.log(chalk.dim('↪ Plan phase starts in a fresh bounded context — prior transcript cleared'));
+                }
+            }
+            planResumeMsgStart = session.messages.length;
+            prompt = planResume.llmPrompt;
+            // A4 — flag-gated per-phase model tiering (classic-mode mirror of the
+            // Ink path above; see that block for the design note).
+            {
+                const { isPlanModelTieringEnabled, selectPlanPhaseModel } = await import('./commands/plan-model-tier.js');
+                const choice = selectPlanPhaseModel({
+                    enabled: isPlanModelTieringEnabled(cfg),
+                    phaseId: planResume.nextPhaseId,
+                    delegateTo: planResume.nextDelegateTo,
+                    defaultModel: cfg.default_model,
+                });
+                if (choice.model) {
+                    planModelOverride = choice.model;
+                    console.log(chalk.dim(choice.notice));
+                }
+            }
+        }
+        // 2026-06-08 — manifest-on-interrupt (classic path). See the Ink path for
+        // the full rationale; persist the revision mid-turn so a Ctrl+C can't lose it.
+        let planSavedEarly = false;
+        // A1 — persisted-revision outcome; drives the post-turn next-phase offer.
+        let planOutcome = null;
+        const planResumeForHook = planResume;
         const turnStart = Date.now();
         // H1 — `session.usage` is session-LIFETIME (initialised once in
         // newSession, saved across turns). The footer's "this turn" label was
@@ -1673,8 +2061,29 @@ export async function runRepl(opts) {
                 provider,
                 userMessage: prompt,
                 skill: skill,
-                ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
+                ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, chunkEmitter: classicOutputEmitter, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
                 signal: turnAbort.signal,
+                suppressSaveHook: planResume !== null,
+                // A4 — undefined on every non-plan turn (and when tiering is off).
+                modelOverride: planModelOverride,
+                onPlanManifest: planResumeForHook
+                    ? async (assistantText) => {
+                        try {
+                            const { finishPlanResume } = await import('./commands/plan-resume.js');
+                            planOutcome = await finishPlanResume({
+                                prepared: planResumeForHook,
+                                messages: session.messages,
+                                messagesStart: planResumeMsgStart,
+                                log: (...lines) => lines.forEach((l) => console.log(l)),
+                                textOverride: assistantText,
+                            });
+                            planSavedEarly = true;
+                        }
+                        catch (err) {
+                            console.log(chalk.red(`\n[plan] early revision save failed: ${err.message}\n`));
+                        }
+                    }
+                    : undefined,
             });
         }
         catch (err) {
@@ -1694,6 +2103,42 @@ export async function runRepl(opts) {
             rl.removeListener('SIGINT', onSigint);
             turnInProgress = false;
         }
+        // B3 — persist the plan revision from the resume turn's manifest block.
+        // FALLBACK: skipped when the mid-turn onPlanManifest hook already saved it
+        // (manifest-on-interrupt, 2026-06-08); still runs when no manifest streamed.
+        if (planResume && !planSavedEarly) {
+            try {
+                const { finishPlanResume } = await import('./commands/plan-resume.js');
+                planOutcome = await finishPlanResume({
+                    prepared: planResume,
+                    messages: session.messages,
+                    messagesStart: planResumeMsgStart,
+                    log: (...lines) => lines.forEach((l) => console.log(l)),
+                });
+            }
+            catch (err) {
+                console.log(chalk.red(`\n[plan] revision save failed: ${err.message}\n`));
+            }
+        }
+        // A1 (defect D23) — harness-owned continuation (classic-path mirror of
+        // the Ink block; see there for the design note). Consent via inquirer,
+        // exact command from the saved path, dispatched through the same
+        // pendingDispatch slot the pre-prompt consumer reads.
+        if (planResume && planOutcome?.nextPhaseId) {
+            try {
+                const { offerNextPhaseAutoRun } = await import('./commands/plan-resume.js');
+                const { inkAwarePrompt } = await import('./agent/loop.js');
+                await offerNextPhaseAutoRun({
+                    outcome: planOutcome,
+                    prompt: inkAwarePrompt,
+                    queueDispatch: (cmd) => pendingDispatchAccessor.set(cmd),
+                    log: (...lines) => lines.forEach((l) => console.log(l)),
+                });
+            }
+            catch (err) {
+                console.log(chalk.red(`\n[plan] next-phase offer failed: ${err.message}\n`));
+            }
+        }
         // Status footer after each turn.
         // tool_result messages also have role:'user' but content is an array —
         // filter them out so we count actual user prompts, not tool rounds.
@@ -1714,6 +2159,9 @@ export async function runRepl(opts) {
                 cacheCreate: turnStartCostSnapshot.cacheCreate,
                 startedAt: turnStart,
             },
+            // A4 — price the turn at the model that actually ran it (classic-path
+            // mirror of the Ink call site above).
+            turnModel: planModelOverride ?? session.model,
         });
         // Post-turn roll-forward (Step 7c.2 / 7c.5) — the skill from the turn that
         // JUST finished becomes `last_skill` for the next turn's classifier context.