@cspeach/cli 0.8.0 → 1.0.0

package/dist/sap/capability.js

@@ -0,0 +1,146 @@
+/**
+ * Pillar A — data-driven capability resolver.
+ *
+ * Answers "can the connected SAP release do feature X?" from the committed
+ * ABAP feature-matrix snapshot — so skills stop hardcoding version prose
+ * (e.g. the old "FILTER needs 7.50" guess that the matrix proves wrong on
+ * a 7.40 SP08 system with the feature backported).
+ *
+ * This module is PURE: the matrix is passed in, so it is unit-testable
+ * without filesystem or network. The snapshot loader lives in
+ * capability-matrix.ts; the tool wrapper in tools/capability/tool.ts.
+ *
+ * NO hardcoded version thresholds — every yes/no/with-fallback decision is
+ * read out of the snapshot data.
+ *
+ * See docs/superpowers/specs/2026-06-24-revision-aware-cspeach-design.md.
+ */
+export const CAPABILITY_REGISTRY = {
+    'cds.viewEntity': { feature: 'Define View Entity', fallback: "use classic 'define view' (DDIC-based) instead of 'define view entity'" },
+    'rap.managed': { feature: 'Managed Scenario', fallback: '' }, // empty = no fallback
+    'rap.behaviorDefinition': { feature: 'Behavior Definitions', fallback: '' }, // no classic equivalent if BDEF unsupported
+    'abap.filterExpr': { feature: 'FILTER', fallback: 'use LOOP AT ... / READ TABLE instead of FILTER( )' },
+    'abap.inlineData': { feature: 'Inline Declaration', fallback: 'declare the variable explicitly with DATA: before use' },
+};
+export const CAPABILITY_IDS = Object.keys(CAPABILITY_REGISTRY);
+function isCapabilityId(s) {
+    return Object.prototype.hasOwnProperty.call(CAPABILITY_REGISTRY, s);
+}
+/**
+ * Map an `abapVersion` (as produced by system-info.ts: "7.57", "7.40",
+ * "unknown") to one of the snapshot's column keys. The column keys are
+ * DERIVED from the snapshot row passed in — never hardcoded — so adding or
+ * renaming columns in the snapshot needs no code change here.
+ *
+ * Rules:
+ *   - falsy / 'unknown'  → null
+ *   - '7.40'             → the 7.40 column containing 'SP08' (the release
+ *                          floor); else any 7.40 column
+ *   - else               → the column whose key contains the substring
+ *                          `(<abapVersion>)`, e.g. '7.57' → '2022 (7.57)'
+ */
+export function mapReleaseToColumn(abapVersion, columns) {
+    if (!abapVersion || abapVersion === 'unknown')
+        return null;
+    if (abapVersion === '7.40') {
+        const sp08 = columns.find((c) => c.startsWith('7.40') && c.includes('SP08'));
+        if (sp08)
+            return sp08;
+        const any740 = columns.find((c) => c.includes('7.40'));
+        return any740 ?? null;
+    }
+    const needle = `(${abapVersion})`;
+    return columns.find((c) => c.includes(needle)) ?? null;
+}
+/**
+ * Pure resolver. `capability` may be a registry id (cds.viewEntity, …) or a
+ * raw matrix feature name. Implements the design's decision table exactly.
+ */
+export function resolveCapability(info, matrix, capability) {
+    // 1. Resolve target feature + fallback.
+    let feature;
+    let fallback;
+    if (isCapabilityId(capability)) {
+        feature = CAPABILITY_REGISTRY[capability].feature;
+        fallback = CAPABILITY_REGISTRY[capability].fallback || undefined;
+    }
+    else {
+        feature = capability;
+        fallback = undefined;
+    }
+    const release = info.release;
+    const base = (overrides) => ({
+        capability,
+        feature,
+        status: 'no',
+        reason: '',
+        release,
+        column: null,
+        source: 'matrix-snapshot',
+        ...overrides,
+    });
+    // 3. Find the feature row (case-insensitive exact match). Done before
+    //    the column map so column-derivation can use the row's own keys.
+    const wanted = feature.toLowerCase();
+    const row = matrix.features.find((f) => f.feature.toLowerCase() === wanted);
+    // 2. Determine the matrix column. Prefer the keys of the found row; if the
+    //    feature is missing, fall back to any feature's keys so the verdict can
+    //    still report the column it would have used.
+    const columnKeys = row
+        ? Object.keys(row.statusByRelease)
+        : matrix.features.length > 0
+            ? Object.keys(matrix.features[0].statusByRelease)
+            : [];
+    const column = mapReleaseToColumn(info.abapVersion, columnKeys);
+    // 3 (cont). Feature not found.
+    if (!row) {
+        return base({
+            status: fallback ? 'with-fallback' : 'no',
+            reason: `feature '${feature}' not found in the matrix snapshot`,
+            column,
+            ...(fallback ? { fallback } : {}),
+        });
+    }
+    // 4. Column could not be mapped.
+    if (column === null) {
+        return base({
+            status: fallback ? 'with-fallback' : 'no',
+            reason: `could not map release '${info.abapVersion}' to a matrix column`,
+            column: null,
+            ...(fallback ? { fallback } : {}),
+        });
+    }
+    // 5. Read + map the cell value.
+    const raw = row.statusByRelease[column];
+    switch (raw) {
+        case 'available':
+            return base({ status: 'yes', reason: `available on ${release}`, column });
+        case 'downport':
+            return base({ status: 'yes', reason: `available on ${release} (backported)`, column });
+        case 'unavailable':
+            return base({
+                status: fallback ? 'with-fallback' : 'no',
+                reason: `not available on ${release}`,
+                column,
+                ...(fallback ? { fallback } : {}),
+            });
+        case 'deprecated':
+            if (fallback) {
+                return base({
+                    status: 'with-fallback',
+                    reason: `available but deprecated on ${release}`,
+                    column,
+                    fallback,
+                });
+            }
+            return base({ status: 'yes', reason: `available but deprecated on ${release}`, column });
+        default:
+            // needs_review / unknown / undefined / anything else.
+            return base({
+                status: fallback ? 'with-fallback' : 'no',
+                reason: `matrix status '${raw ?? ''}' for ${release} is inconclusive`,
+                column,
+                ...(fallback ? { fallback } : {}),
+            });
+    }
+}

package/dist/sap/connection-manager.js

@@ -1,6 +1,8 @@
 import keytar from 'keytar';
 import { SapConnection } from '@cspeach/sap-client';
+import { resolveSapTls } from '../config/loader.js';
 import { password as promptPassword } from '@inquirer/prompts';
+import { isHeadless } from '../renderer/tty.js';
 const SAP_SERVICE = 'cspeach-sap';
 const cache = new Map();
 export async function getConnection(alias, cfg) {
@@ -14,6 +16,14 @@ export async function getConnection(alias, cfg) {
         }
         catch { /* keychain unavailable */ }
         if (!passwordValue) {
+            // B5 (2026-06-11) — headless guard: the keytar-miss fallback is a
+            // stdin password prompt, which would hang a headless run forever
+            // (same defect family as D1). Fail fast with an actionable error
+            // instead of prompting.
+            if (isHeadless()) {
+                throw new Error(`no stored password for SAP alias '${alias}' — store credentials first ` +
+                    '(run interactively once or use cspeach config) — headless runs cannot prompt');
+            }
             passwordValue = await promptPassword({
                 message: `SAP password for ${alias}/${cfg.username}:`,
                 mask: '*',
@@ -26,12 +36,20 @@ export async function getConnection(alias, cfg) {
     // SapConnection constructor is (config, username, password) — 3 positional args.
     // SapConfig.authType is typed as 'basic' only (v1); SapSystemConfig carries the
     // wider union so we cast to satisfy the narrower SapConfig shape.
+    //
+    // TLS posture (2026-06-14): verification is ON by default. resolveSapTls maps
+    // the per-alias config (ca_cert_path / insecure_skip_tls_verify, with the
+    // legacy sslVerify:false → insecure fallback) into the sap-client options.
+    // We pass caCertPath / insecureSkipTlsVerify explicitly — NOT the legacy
+    // sslVerify — so the new verify-by-default contract holds.
+    const tls = resolveSapTls(cfg);
     const conn = new SapConnection({
         host: cfg.host,
         port: cfg.port,
         client: cfg.client,
         useSsl: cfg.useSsl,
-        sslVerify: cfg.sslVerify,
+        caCertPath: tls.caCertPath,
+        insecureSkipTlsVerify: tls.insecureSkipTlsVerify,
         credentialRef: alias,
         authType: 'basic',
     }, cfg.username, passwordValue ?? '');

package/dist/sap/onboarding.js

@@ -23,9 +23,45 @@ export async function runAddSapWizard() {
         validate: (v) => /^\d{3}$/.test(v) || 'Must be a 3-digit client number',
     });
     const useSsl = await confirm({ message: 'Use HTTPS/TLS?', default: true });
-    const sslVerify = useSsl
-        ? await confirm({ message: 'Verify server certificate? (Say no for self-signed SAP certs)', default: false })
-        : false;
+    // TLS posture (2026-06-14): verification is ON by default. For self-signed /
+    // internal-CA SAP systems, the production-grade answer is to trust the
+    // corporate CA (verification stays ON). Disabling verification is an explicit
+    // dev-only opt-out, never the default.
+    let caCertPath;
+    let insecureSkipTlsVerify = false;
+    if (useSsl) {
+        const tlsChoice = await select({
+            message: 'TLS certificate handling:',
+            choices: [
+                {
+                    name: 'verify (recommended) — trust the system certificate via the OS/Node trust store',
+                    value: 'verify',
+                    description: 'Use this when the SAP cert is issued by a public or already-trusted CA.',
+                },
+                {
+                    name: 'trust a corporate/internal CA — verification stays ON',
+                    value: 'ca',
+                    description: 'Best for self-signed / internal-CA SAP systems. Point CSPeach at your CA PEM file; verification remains enabled.',
+                },
+                {
+                    name: 'INSECURE — disable verification (dev only)',
+                    value: 'insecure',
+                    description: 'Last resort for a dev box with no CA available. Logs a loud warning on every connect. NEVER use in production.',
+                },
+            ],
+            default: 'verify',
+        });
+        if (tlsChoice === 'ca') {
+            caCertPath = await input({
+                message: 'Path to the CA certificate PEM file (e.g. /etc/ssl/corp-ca.pem):',
+                validate: (v) => v.length > 0 || 'Required',
+            });
+        }
+        else if (tlsChoice === 'insecure') {
+            console.log(chalk.yellow('  ⚠ TLS verification will be DISABLED for this system — dev only, NEVER use in production.'));
+            insecureSkipTlsVerify = true;
+        }
+    }
     const authType = await select({
         message: 'Authentication type:',
         choices: [
@@ -164,7 +200,9 @@ export async function runAddSapWizard() {
         port: Number(port),
         client,
         useSsl,
-        sslVerify,
+        // New TLS keys — verify by default; trust a CA, or explicit dev-only insecure.
+        ...(caCertPath ? { ca_cert_path: caCertPath } : {}),
+        ...(insecureSkipTlsVerify ? { insecure_skip_tls_verify: true } : {}),
         username,
         authType,
         certPath,

package/dist/session/pending.js

@@ -35,3 +35,30 @@ export async function finalizeToolCall(session, toolUseId, result, isError, dura
 export function hasUnfinishedMutations(session) {
     return session.toolCalls.some((c) => !c.completed);
 }
+/**
+ * D19 (2026-06-11) — loop-side ledger record, upsert semantics.
+ *
+ * runTurn records every dispatched tool call in session.toolCalls after the
+ * handler returns. Write handlers ALSO journal the same call through the WAL
+ * (appendPending → finalizeToolCall) — and since the WAL is now keyed by the
+ * REAL tool_use_id (ctx.toolUseId), the loop's record must UPDATE that entry
+ * rather than push a sibling. Previously the loop pushed unconditionally and
+ * the WAL used a random UUID, so every approval-gated write produced TWO
+ * ledger entries per logical call (the D19 "double execution" signature).
+ *
+ * The loop's version of the entry wins: its `result` is the handler's full
+ * returned content (the WAL finalize stores a leaner internal summary) and
+ * its duration includes dispatch overhead.
+ *
+ * In-memory only — the caller persists (unlike appendPending/finalizeToolCall,
+ * which saveSession themselves).
+ */
+export function recordCompletedToolCall(session, entry) {
+    const idx = session.toolCalls.findIndex((c) => c.tool_use_id === entry.tool_use_id);
+    if (idx >= 0) {
+        session.toolCalls[idx] = entry;
+    }
+    else {
+        session.toolCalls.push(entry);
+    }
+}

package/dist/skill-catalog.js

@@ -1,8 +1,12 @@
 /**
  * Static skill catalog for CSPeach CLI v0.2.
  *
- * STALENESS RISK (spec §3.3): This constant is hardcoded against the 33 skills
- * in .claude/skills/ as of 2026-04-19. It will drift if skills are added or
+ * STALENESS RISK (spec §3.3): This constant is hardcoded against the 32 skills
+ * in .claude/skills/ as of 2026-06-28 (abap-dump-analyze + abap-dump-triage
+ * merged into abap-dump 2026-06-12; abap-extend-model added 2026-06-25;
+ * abap-radar/abap-document/abap-performance/abap-cloud-check merged into
+ * abap-explain/abap-handover/abap-review 2026-06-28 per
+ * plan 2026-06-28-skill-portfolio-merge). It will drift if skills are added or
  * removed. At Plan 4b kickoff decision the build-time generation option
  * (scripts/generate-skill-catalog.ts reads SKILL.md frontmatter) or runtime
  * fetch (/v1/skills endpoint) will be chosen to replace this file. Until then,
@@ -10,65 +14,35 @@
  */
 export const SKILL_CATALOG = [
     // ── Read / Analyze ───────────────────────────────────────────────────────
-    {
-        name: 'abap-radar',
-        category: 'Read / Analyze',
-        description: 'Understand an ABAP object quickly — dependencies, tables, risk areas, modernisation summary',
-        whenToUse: 'pick this for a 3-min cold read of an object (not /abap-review — no quality grade)',
-    },
     {
         name: 'abap-impact',
         category: 'Read / Analyze',
         description: 'Impact analysis before changes — traces usage, callers, transports',
-        whenToUse: 'pick this for blast radius before a change (not /abap-radar — radar = inside the object)',
+        whenToUse: 'pick this for blast radius before a change (not /abap-explain — explain = teach the code)',
     },
     {
         name: 'abap-explain',
         category: 'Read / Analyze',
-        description: 'Plain-language explanation of ABAP code for juniors, non-ABAP developers, or architects',
-        whenToUse: `pick this to teach code to a human (not /abap-document — that's a dev reference doc)`,
+        description: 'Understand an object — plain-language (default) or `technical` orientation (deps, tables, risks)',
+        whenToUse: `plain teaching, or technical=fast orientation (not /abap-impact = blast radius)`,
     },
     {
         name: 'abap-review',
         category: 'Read / Analyze',
-        description: 'Code review against 7 quality criteria: conventions, performance, security, error handling, tests, cloud-readiness, comments',
-        whenToUse: `pick this to grade SOURCE against 7 criteria (not a release gate — see /abap-preflight)`,
-    },
-    {
-        name: 'abap-performance',
-        category: 'Read / Analyze',
-        description: 'Identify N+1 queries, missing indexes, SELECT *, FOR ALL ENTRIES pitfalls',
-        whenToUse: 'pick this for deep SQL/loop bottleneck hunt (not /abap-review — review only skims perf)',
-    },
-    {
-        name: 'abap-cloud-check',
-        category: 'Read / Analyze',
-        description: 'ABAP Cloud / Clean Core readiness — restricted APIs, tier violations, released object alternatives',
-        whenToUse: `pick this for ABAP Cloud verdict on one object (not /abap-cca — that's whole-system)`,
+        description: 'Read-only review across lenses: quality (default), performance, cloud-readiness',
+        whenToUse: `grade source: quality (default) + performance/cloud lenses`,
     },
     {
         name: 'abap-handover',
         category: 'Read / Analyze',
-        description: 'Generate technical documentation for ABAP objects or a complete development package',
-        whenToUse: `pick this for a whole-package handover dossier (not /abap-document — that's one object)`,
-    },
-    {
-        name: 'abap-document',
-        category: 'Read / Analyze',
-        description: 'Reference doc for ONE ABAP object — purpose, interface, logic flow, dependencies, where-used',
-        whenToUse: `pick this for a reference doc on ONE object (not /abap-handover — that's whole-package)`,
-    },
-    {
-        name: 'abap-dump-analyze',
-        category: 'Read / Analyze',
-        description: 'Analyze ABAP short dumps (ST22) — root cause, call stack, fix suggestions',
-        whenToUse: `pick this to diagnose an ST22 dump AND apply the fix (not /abap-dump-triage — read-only)`,
+        description: 'Documentation for one object (`object` scope) or a whole package (`package` scope)',
+        whenToUse: `object doc OR full package handover dossier`,
     },
     {
-        name: 'abap-dump-triage',
+        name: 'abap-dump',
         category: 'Read / Analyze',
-        description: 'Structured triage of a runtime dump — ranked hypotheses, what to inspect next, read-only',
-        whenToUse: `pick this for ranked dump hypotheses, read-only (not /abap-dump-analyze — that writes a fix)`,
+        description: 'Diagnose ABAP short dumps (ST22) and fix them — root cause, call stack, fix with approval; ask for "triage" for ranked read-only hypotheses',
+        whenToUse: `pick this for any ST22 dump — diagnose + fix by default, say "triage" for read-only ranking (not /abap-incident — that's the full dump-to-transport pipeline)`,
     },
     // ── Modify / Fix ─────────────────────────────────────────────────────────
     {
@@ -89,11 +63,17 @@ export const SKILL_CATALOG = [
         description: 'Extend SAP standard via BAdI implementations, enhancement spots, user exits',
         whenToUse: `pick this to hook into SAP-STANDARD code via BAdI/exit (not /abap-refactor — that's for YOUR Z code)`,
     },
+    {
+        name: 'abap-extend-model',
+        category: 'Modify / Fix',
+        description: 'Add a field or @UI column to an EXISTING custom CDS view / DDLX metadata extension in place — anchored insertion, snapshot, syntax-check, activate, republish-if-needed. The Fiori Elements column-add.',
+        whenToUse: `pick this to add a field/column to an EXISTING custom CDS/DDLX in place (not /abap-rap — that's a new stack; not /abap-refactor — that's ABAP code, not CDS)`,
+    },
     {
         name: 'abap-incident',
         category: 'Modify / Fix',
         description: 'End-to-end incident pipeline — dump to fix deployed to transport in one skill',
-        whenToUse: `pick this for full ST22-to-transport pipeline with formal report (not /abap-dump-analyze — single fix only)`,
+        whenToUse: `pick this for full ST22-to-transport pipeline with formal report (not /abap-dump — single fix only)`,
     },
     {
         name: 'abap-test',
@@ -126,6 +106,12 @@ export const SKILL_CATALOG = [
         description: 'Scaffold a complete RAP stack on S/4HANA 1909+ — table, CDS interface, projection, BDEF, BP class, SRVD, SRVB, DDLX, DCL. ECC/older S/4 → use /abap-segw.',
         whenToUse: `pick this for a full RAP stack on S/4 1909+ (10 objects, table → SRVB; not /abap-segw — that's ECC/older S/4 OData; not /abap-generate — that's one object)`,
     },
+    {
+        name: 'abap-fiori-build',
+        category: 'Create / Generate',
+        description: 'Build a working freestyle SAPUI5 app on the laptop from a published OData service — scaffold, pages, dialogs, chart, value help, local preview. Freestyle only, not Fiori Elements.',
+        whenToUse: `pick this for a freestyle UI5 frontend on a published OData service (not /abap-rap — that's the backend; produces local files, not ADT objects)`,
+    },
     {
         name: 'abap-data-model',
         category: 'Create / Generate',
@@ -219,4 +205,29 @@ export const SKILL_CATALOG = [
         description: 'Effort estimation for ABAP tickets — component breakdown with hour ranges (optimistic / realistic / pessimistic) + risk adjustments',
         whenToUse: `pick this for hour ranges + risk adjustments on a confirmed object list (step 3 of 3 — needs /abap-design first; high uncertainty without it)`,
     },
+    {
+        name: 'abap-plan',
+        category: 'Pre-Coding',
+        description: 'Multi-session project plan — phase envelope holds state across sessions; create from a goal or spec-gap file, resume one bounded phase per session',
+        whenToUse: `pick this when the work spans multiple sessions or components (not /abap-design — that's one design in one session; plan calls design per phase)`,
+    },
 ];
+/**
+ * Portfolio-merge redirects (2026-06-12). Old skill names that were merged
+ * into a surviving skill keep routing for ONE release: `/abap-dump-analyze`
+ * resolves to `abap-dump` with a dim "renamed" notice instead of the
+ * unknown-skill error. Resolution happens in parseShortcut (slash input)
+ * and classifyPrompt (stale proxy-classifier outputs). Remove the entries
+ * — and the proxy-side alias seeds — one release after the rename ships.
+ */
+export const SKILL_ALIASES = {
+    'abap-dump-analyze': 'abap-dump',
+    'abap-dump-triage': 'abap-dump',
+};
+/**
+ * Resolve a (possibly retired) skill name to its current catalog name.
+ * Returns the input unchanged when it is not an alias.
+ */
+export function resolveSkillAlias(skill) {
+    return SKILL_ALIASES[skill] ?? skill;
+}