@cspeach/cli 0.8.0 → 1.0.0

package/dist/commands/plan-model-tier.js

@@ -0,0 +1,83 @@
+// A4 (2026-06-11) — per-phase model tiering for the plan runner.
+//
+// Cost-control Phase 3, pre-approved by the 2026-05-18 model bench
+// (cspeach-cli/scripts/bench-models.ts): Sonnet matches Opus on
+// explain/document/test/design-shaped ABAP work at ~85% lower cost, while
+// Haiku is UNSAFE on ABAP content (hallucinates SAP terms — bench memo) and
+// is therefore NEVER a tiering target here.
+//
+// FLAG-GATED, OFF BY DEFAULT. Two switches, env wins when set:
+//   - config:  plan_model_tiering = true        (~/.cspeach/config.toml)
+//   - env:     CSPEACH_PLAN_MODEL_TIERING=on    (also 1/true; off/0/false force-disable)
+//
+// Classification is STRUCTURAL, not id-string parsing: each plan phase
+// carries a `delegateTo` skill (Zod enum PLAN_DELEGATE_SKILLS in
+// projects/plan-schema.ts). Only the read/reason-shaped skills the bench
+// cleared go to Sonnet; every write/codegen delegate — and anything
+// ambiguous or unknown — stays on the session's default model.
+//
+// Extra guard: tiering only fires when the session default is Opus-family.
+// A user who deliberately set default_model to Sonnet (or anything cheaper)
+// must never be silently moved to a different model by this feature.
+//
+// Wiring (single read path): repl.tsx computes the choice right after
+// preparePlanResume succeeds (both Ink and classic paths), prints the dim
+// notice for cost auditability, and threads the model into runTurn via
+// RunTurnParams.modelOverride — which also feeds the per-turn cost-log
+// entry so ~/.cspeach/sessions/<id>-cost.jsonl records the ACTUAL model.
+/** The only model this feature ever tiers down to. Never Haiku. */
+export const PLAN_TIER_SONNET_MODEL = 'claude-sonnet-4-6';
+/**
+ * Delegate skills whose phases are design/test/document-shaped — the shapes
+ * the 2026-05-18 bench cleared for Sonnet. `abap-document` is not in
+ * PLAN_DELEGATE_SKILLS today; included so an enum extension is covered
+ * without touching this file. Everything else (abap-data-model, abap-rap,
+ * abap-eml, abap-generate, abap-segw, abap-fiori-build) writes SAP objects
+ * or code and stays on the default model.
+ */
+export const SONNET_TIER_DELEGATES = new Set([
+    'abap-design',
+    'abap-test',
+    'abap-document',
+]);
+const ENV_FLAG = 'CSPEACH_PLAN_MODEL_TIERING';
+/**
+ * Resolve the feature flag. Env var (when set) wins over config so a single
+ * shell can A/B the feature without editing config.toml; the config flag is
+ * the persistent opt-in. Strict `=== true` on the config value — TOML is
+ * hand-edited, and a typo'd string must read as OFF, never ON.
+ */
+export function isPlanModelTieringEnabled(cfg, env = process.env) {
+    const raw = env[ENV_FLAG];
+    if (raw !== undefined && raw !== '') {
+        const v = raw.trim().toLowerCase();
+        return v === 'on' || v === '1' || v === 'true';
+    }
+    return cfg.plan_model_tiering === true;
+}
+const NO_OVERRIDE = { model: null, notice: null };
+/**
+ * Pure decision function: which model should this plan phase run on?
+ *
+ * Returns an override ONLY when all of:
+ *   - the flag is on,
+ *   - the phase's delegateTo is a bench-cleared design/test/document shape,
+ *   - the session default is an Opus-family model (we only tier DOWN from
+ *     Opus — never sideways/up from a deliberately cheaper default).
+ *
+ * Anything ambiguous resolves to "no override". The returned model is
+ * claude-sonnet-4-6 or nothing — Haiku is unreachable by construction
+ * (pinned in plan-model-tier.test.ts).
+ */
+export function selectPlanPhaseModel(args) {
+    if (!args.enabled)
+        return NO_OVERRIDE;
+    if (!args.delegateTo || !SONNET_TIER_DELEGATES.has(args.delegateTo))
+        return NO_OVERRIDE;
+    if (!/opus/i.test(args.defaultModel))
+        return NO_OVERRIDE;
+    return {
+        model: PLAN_TIER_SONNET_MODEL,
+        notice: `phase ${args.phaseId} → ${PLAN_TIER_SONNET_MODEL} (plan model tiering)`,
+    };
+}

package/dist/commands/plan-resume.js

@@ -0,0 +1,435 @@
+// cspeach-cli/src/commands/plan-resume.ts
+//
+// `/abap-plan --resume @<plan-file>` — B3 (2026-06-06).
+//
+// Split around the model turn:
+//
+//   preparePlanResume  (token-free, BEFORE runTurn)
+//     resolve @token → load + validate envelope → compute next eligible
+//     phase → print the tracker board → inline the phase's declared rule
+//     files → return the bounded LLM prompt. Terminal states (plan
+//     complete / everything blocked) print and return null — no model
+//     turn happens at all.
+//
+//   finishPlanResume   (AFTER runTurn)
+//     collect the turn's assistant text (ALL messages — the manifest may
+//     precede a closing ask_question, see turn-assistant-text.ts) →
+//     extract the LAST csforge:plan-manifest block → build the version
+//     N+1 revision (same id, history appended) → save → print the
+//     updated tracker + next-step hint → return the saved path + the
+//     HARNESS-built resume command for the next phase (A1, 2026-06-10).
+//
+// A1 (defect D23) — true bounded phases: phase end = turn end.
+//   The model's resume turn ends at the manifest block. It must NOT ask a
+//   continuation question, NOT call dispatch_skill, and NOT execute a
+//   second phase in-turn (the old contract allowed in-session "continue",
+//   which snowballed a 6-phase run into one 3.24M-token-context session).
+//   Continuation is harness-owned: repl.tsx calls offerNextPhaseAutoRun
+//   with the PlanResumeOutcome; on consent it queues the EXACT command
+//   buildResumeCommand produced from the just-saved path (the model once
+//   hallucinated a wrong base when it authored this text itself), and
+//   every plan-resume turn starts from reset session messages
+//   (resetContextForPlanResume).
+//
+// The save hook inside runTurn is suppressed for resume turns
+// (RunTurnParams.suppressSaveHook) — it would otherwise offer to save a
+// duplicate NEW envelope with a fresh id, breaking the version chain.
+// Resume persistence is unconditional: the envelope is the only state
+// that survives the session, so losing the write-back breaks the plan.
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { readProjectFile } from '../projects/status.js';
+import { resolveAtTokenAsync, formatProjectFileList, ensureWorkspace } from '../projects/workspace.js';
+import { parsePlanContent } from '../projects/plan-schema.js';
+import { statusesFromItems, computeNextPhase, renderPlanTracker, buildPlanRevision, isPhaseSatisfied, planCompletionLines, } from '../projects/plan-run.js';
+import { extractPlan } from '../projects/extract-plan.js';
+import { saveProject } from '../projects/save.js';
+import { validateEnvelope } from '../projects/validate.js';
+import { collectTurnAssistantText } from '../agent/turn-assistant-text.js';
+import { getAuthorIdentity } from '../agent/loop.js';
+/**
+ * A1 (defect D23) — the harness-owned continuation contract, stated to the
+ * model verbatim in every resume prompt: the manifest ends the turn; the
+ * model must not call dispatch_skill or ask a continuation question — the
+ * CLI dispatches the next phase itself. Exported as a named constant so
+ * tests pin the prompt to this exact block instead of brittle prose
+ * regexes (the old contract let the model keep executing phases in-turn —
+ * a 6-phase run once snowballed to a 3.24M-token context).
+ */
+export const PLAN_RESUME_HARNESS_OVERRIDE = 'HARNESS OVERRIDE of the skill\'s Mode 2 step 8: do NOT ask a continuation question, do NOT call dispatch_skill, and NEVER start another phase in this turn. After your manifest is persisted, the CLI itself asks the user whether to run the next phase and dispatches it with the exact saved file in a fresh bounded context. Phase end = turn end.';
+export async function preparePlanResume(args) {
+    const tokens = args.body
+        .split(/\s+/)
+        .filter((tok) => tok.startsWith('@'))
+        .map((tok) => tok.slice(1))
+        .filter((tok) => tok.length > 0);
+    if (tokens.length === 0) {
+        args.log('Usage: /abap-plan --resume @<plan>.cspeach.json');
+        args.log('Bare names work too — e.g. @hr-extract-plan — resolved from the workspace folder.');
+        return null;
+    }
+    const resolved = await resolveAtTokenAsync(tokens[0], args.cwd);
+    let path;
+    if (resolved.kind === 'path') {
+        path = resolved.path;
+    }
+    else if (resolved.kind === 'notFound') {
+        args.log(`--resume: no file matching '${resolved.token}' in workspace ${resolved.workspace}`);
+        args.log('Run /files to see available .cspeach.json files.');
+        return null;
+    }
+    else {
+        // Version-less resume: a base name / short id matches every version of one
+        // plan family. Resolve to the newest instead of erroring — the user (and
+        // the auto-fire dispatch) should never have to name a version number.
+        const newestOfFamily = pickNewestPlanVersion(resolved.matches.map((m) => m.path));
+        if (newestOfFamily) {
+            args.log(`↪ resolved @${tokens[0]} to the latest version ${basename(newestOfFamily)}`);
+            path = newestOfFamily;
+        }
+        else {
+            args.log(`--resume: '${tokens[0]}' is ambiguous — multiple matches:`);
+            args.log(formatProjectFileList(resolved.matches, ''));
+            args.log('Use a more specific @<fragment> to disambiguate.');
+            return null;
+        }
+    }
+    let envelope;
+    try {
+        envelope = readProjectFile(path);
+    }
+    catch (e) {
+        args.log(`--resume: ${e instanceof Error ? e.message : String(e)}`);
+        return null;
+    }
+    // 2026-06-06 (live-smoke UX): users should never have to remember which
+    // vN file is current — resuming a stale version re-runs already-validated
+    // phases. If a newer version of the SAME envelope (matching id) exists
+    // next to the picked file, silently redirect to it with a note.
+    const newest = findNewestVersion(path, envelope);
+    if (newest) {
+        args.log(`↪ newer version found — resuming ${basename(newest.path)} (you picked ${basename(path)})`);
+        path = newest.path;
+        envelope = newest.envelope;
+    }
+    if (envelope.artefactType !== 'plan') {
+        args.log(`--resume expects a plan envelope; got ${envelope.artefactType}.`);
+        args.log(`For ${envelope.artefactType} files use --status / --from instead.`);
+        return null;
+    }
+    // Defense-in-depth: top-level validation passed in readProjectFile, but
+    // the content payload is only checked by the Zod schema.
+    const pc = parsePlanContent(envelope.content);
+    if (!pc.ok) {
+        args.log('--resume: plan content failed validation — fix the file before resuming:');
+        for (const e of pc.errors)
+            args.log(`  ${e}`);
+        return null;
+    }
+    const content = pc.content;
+    const statuses = statusesFromItems(envelope.interaction.items, content.phases);
+    const next = computeNextPhase(content.phases, statuses);
+    args.log('');
+    args.log(renderPlanTracker({
+        title: envelope.title,
+        version: envelope.version,
+        content,
+        statuses,
+        currentId: next?.id ?? null,
+    }));
+    args.log('');
+    if (!next) {
+        // C1 (D30 waiver): 'validated-with-waiver' is satisfied — a plan whose
+        // last gate was explicitly waived is complete, not stuck.
+        const allValidated = content.phases.every((p) => isPhaseSatisfied(statuses[p.id]));
+        if (allValidated) {
+            // C2 (D24): a finished UI-less backend stack chains to /abap-fiori-build
+            // with the exact binding name — the marketed idea→app story must not
+            // silently end at the service binding.
+            args.log(...planCompletionLines(content.phases));
+        }
+        else {
+            const blocked = content.phases.filter((p) => statuses[p.id] === 'blocked').map((p) => p.id);
+            args.log(`No eligible phase. Blocked: ${blocked.join(', ') || '(none)'} — remaining phases wait on them.`);
+            args.log('Unblock (fix + edit the envelope status back to todo) and resume again.');
+        }
+        return null;
+    }
+    // Inline the phase's declared rule files (coarse v1: whole files).
+    // Paths resolve against cwd — dogfood runs sit inside a repo carrying
+    // .claude/rules/. A missing file is noted, not fatal: the skill falls
+    // back to its built-in Forge defaults.
+    const ruleBlocks = [];
+    for (const rel of next.manifest.rules) {
+        try {
+            const text = readFileSync(join(args.cwd, rel), 'utf8');
+            ruleBlocks.push(`<rule file="${rel}">\n${text}\n</rule>`);
+        }
+        catch {
+            ruleBlocks.push(`<rule file="${rel}" missing="true"/>  <!-- not found locally — apply built-in Forge defaults -->`);
+        }
+    }
+    const planState = JSON.stringify({ title: envelope.title, version: envelope.version, statuses, content }, null, 2);
+    // A2 (defects D23/D30) — compact write-back: the model re-emitting the
+    // full plan content every phase cost ~6–10k output tokens/phase at Opus
+    // pricing for data the envelope already holds. The resume turn emits
+    // statuses + a `changed` entry for the executed phase only; extractPlan
+    // merges it into the prior content. The example is built with the REAL
+    // phase ids and current statuses so the model copies, not reconstructs.
+    const compactExample = [
+        '<!-- csforge:plan-manifest',
+        JSON.stringify({
+            title: envelope.title,
+            statuses: { ...statuses, [next.id]: '<validated | validated-with-waiver | blocked>' },
+            changed: {
+                [next.id]: {
+                    work: {
+                        generated: ['<object names created/changed>'],
+                        transport: '<transport number — omit the key if none>',
+                        // C2 (D24): the service phase records the published SRVB name in
+                        // work.binding — the plan-complete message hands it to
+                        // /abap-fiori-build. Only shown when this turn IS the service phase.
+                        ...(next.layer === 'service'
+                            ? { binding: '<published service binding name, e.g. ZUI_MAINTREQ_O4>' }
+                            : {}),
+                        notes: '<decisions, substitutions, blocker details worth keeping — omit if none>',
+                    },
+                },
+            },
+        }, null, 2),
+        '-->',
+    ].join('\n');
+    const llmPrompt = [
+        `Resume execution of the project plan "${envelope.title}" (envelope v${envelope.version}).`,
+        '',
+        `Execute Mode 2 of the abap-plan skill for phase "${next.id}" ONLY — it is the computed next eligible phase. Never execute any other phase in this turn; the CLI itself offers and dispatches the next phase (in a fresh bounded context) after this one is persisted.`,
+        '',
+        '<plan_state>',
+        planState,
+        '</plan_state>',
+        '',
+        '<phase_rules>',
+        ...ruleBlocks,
+        '</phase_rules>',
+        '',
+        // A1 (2026-06-10, defect D23): the old contract let the model ask a
+        // continuation question and keep executing phases in-turn — a 6-phase
+        // run snowballed to a 3.24M-token context because the turn never
+        // ended. The manifest now ENDS the turn; the harness owns continuation
+        // (offerNextPhaseAutoRun) and dispatches the next phase itself with
+        // the exact saved path, in reset context.
+        'CRITICAL — the write-back ENDS the turn: emit ONE COMPACT <!-- csforge:plan-manifest --> block as the LAST thing in your output, then END THE TURN. Compact shape = "title" + a "statuses" entry for EVERY phase + a "changed" map carrying ONLY the phase(s) you touched this turn (normally exactly this one). Each "changed" entry holds the phase\'s COMPLETE updated "work" (generated / transport / snapshot / notes — put the compact decision register in work.notes when the phase produced decisions rather than SAP objects); it replaces that phase\'s prior work wholesale. Do NOT re-emit "content" or the full phase list — the CLI already holds the full plan, merges your "changed" entries into it, and recomputes the summary. Exact shape for this turn:',
+        '',
+        compactExample,
+        '',
+        // C1 (D30 waiver) — the waiver status exists so an explicitly-waived exit
+        // gate is recorded as what it is, instead of being laundered into a
+        // "validated" the gate never earned (the c1.test AUnit-gap incident).
+        'Status rules: "validated" ONLY when the exit gate actually held and was verified. If the gate could NOT be met but the user EXPLICITLY waived it this turn (e.g. "skip the test gate, continue anyway"), use "validated-with-waiver" and record what was waived and why in work.notes — never mark an unmet gate "validated", and never use the waiver status without an explicit user waiver. Otherwise the phase is "blocked".',
+        '',
+        'Only if the plan itself must change structurally (a phase added, removed, or re-sequenced) fall back to the full shape with "content" — the CLI accepts both. The manifest block is how the result is persisted; a turn that ends without it LOSES the phase.',
+        '',
+        PLAN_RESUME_HARNESS_OVERRIDE,
+    ].join('\n');
+    return { path, envelope, statuses, nextPhaseId: next.id, nextDelegateTo: next.delegateTo, llmPrompt };
+}
+/**
+ * Given a set of candidate file paths (e.g. the matches from an ambiguous
+ * @token resolution), return the newest version IF they are all versions of
+ * ONE plan family (`<base>-v<N>[-<sub>].cspeach.json`), else null. Lets a
+ * version-less resume token (`@<base>` or a short id matching every version)
+ * resolve to the current file instead of erroring "ambiguous". Pure —
+ * deterministic ordering, no fs / mtime.
+ */
+export function pickNewestPlanVersion(paths) {
+    // Sibling: findNewestVersion (below) uses the same filename convention with a
+    // different capture shape (prefix-based + mtime) for the post-read redirect.
+    const re = /^(.+)-v(\d+)(?:-(\d+))?\.cspeach\.json$/;
+    const parsed = paths.map((p) => {
+        const m = re.exec(basename(p));
+        return m ? { path: p, base: m[1], version: Number(m[2]), sub: m[3] ? Number(m[3]) : 0 } : null;
+    });
+    if (parsed.length === 0 || parsed.some((x) => x === null))
+        return null;
+    const items = parsed;
+    const base0 = items[0].base;
+    if (items.some((x) => x.base !== base0))
+        return null;
+    items.sort((a, b) => 
+    // Tiebreak: lexically-greater path wins — deterministic, arbitrary, never
+    // reached in practice (version+sub are always distinct siblings from saveProject).
+    b.version - a.version || b.sub - a.sub || (a.path < b.path ? 1 : -1));
+    return items[0].path;
+}
+/**
+ * True when a queued dispatch command is a `/abap-plan --resume …`.
+ * Consumer: dispatch_skill REJECTS model-authored plan-resume dispatches
+ * (A1 — the harness owns that command; the model once hallucinated a wrong
+ * base token). The transcript clear for resume turns is owned solely by
+ * resetContextForPlanResume, called from the REPL's plan-resume prepare
+ * branch after preparePlanResume succeeds.
+ */
+export function isPlanResumeCommand(cmd) {
+    const c = cmd.trim();
+    return /^\/abap-plan\b/.test(c) && /(^|\s)--resume(\s|$)/.test(c);
+}
+/**
+ * A1 (defect D23) — the HARNESS builds the next-phase resume command from
+ * the exact path finishPlanResume just saved. Single construction site:
+ * the model never authors this text (it once invented `@…-plan-c1` when
+ * the real file was `…-plan-c9b3-v14.cspeach.json`). The basename keeps
+ * the version suffix — it resolves to that exact file, and the
+ * newest-version redirect in preparePlanResume still protects against a
+ * concurrent later save.
+ */
+export function buildResumeCommand(savedPath) {
+    return `/abap-plan --resume @${basename(savedPath)}`;
+}
+/**
+ * A1 — every plan-resume turn starts from RESET session messages: the
+ * envelope + the bounded preparePlanResume prompt carry all needed state,
+ * so prior-phase (or prior-chat) transcript is pure cost. Called by the
+ * REPL right after preparePlanResume succeeds, which covers BOTH the
+ * harness-dispatched auto-run path and a manually typed `--resume`.
+ * Returns true when messages were actually cleared (caller logs a notice).
+ * Property reassignment (not splice) — session.messages consumers always
+ * re-read the property.
+ */
+export function resetContextForPlanResume(session) {
+    if (session.messages.length === 0)
+        return false;
+    session.messages = [];
+    return true;
+}
+export async function offerNextPhaseAutoRun(args) {
+    if (!args.outcome.nextPhaseId)
+        return false;
+    const delegate = args.outcome.nextDelegateTo ? ` (${args.outcome.nextDelegateTo})` : '';
+    const answer = (await args.prompt(`Run next phase ${args.outcome.nextPhaseId}${delegate} now in a fresh context? [y/N]: `)).trim().toLowerCase();
+    if (answer !== 'y' && answer !== 'yes') {
+        args.log(`Exiting — resume later with: ${args.outcome.resumeCommand}`);
+        return false;
+    }
+    args.queueDispatch(args.outcome.resumeCommand);
+    return true;
+}
+/**
+ * Find the newest sibling version of the envelope at `path` — same
+ * filename family (`<slug>-<shortid>-vN[...]`) AND same envelope id (the
+ * filename check is just a cheap pre-filter; slug collisions are settled
+ * by the id). Returns null when `path` is already the newest.
+ */
+export function findNewestVersion(path, picked) {
+    const fam = /^(.*-v)(\d+)(?:-\d+)?\.cspeach\.json$/.exec(basename(path));
+    if (!fam)
+        return null;
+    const familyPrefix = fam[1];
+    const dir = dirname(path);
+    let candidates;
+    try {
+        candidates = readdirSync(dir)
+            .map((name) => {
+            const m = new RegExp(`^${familyPrefix.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(\\d+)(?:-\\d+)?\\.cspeach\\.json$`).exec(name);
+            if (!m)
+                return null;
+            const full = join(dir, name);
+            return { full, version: Number(m[1]), mtimeMs: statSync(full).mtimeMs };
+        })
+            .filter((c) => c !== null)
+            .sort((a, b) => b.version - a.version || b.mtimeMs - a.mtimeMs);
+    }
+    catch {
+        return null;
+    }
+    for (const c of candidates) {
+        if (c.full === path)
+            break; // picked file is already the newest valid one
+        try {
+            const env = readProjectFile(c.full);
+            if (env.artefactType === 'plan' && env.id === picked.id && env.version > picked.version) {
+                return { path: c.full, envelope: env };
+            }
+        }
+        catch {
+            // Unreadable sibling — skip, keep looking.
+        }
+    }
+    return null;
+}
+export async function finishPlanResume(args) {
+    const text = args.textOverride ?? collectTurnAssistantText(args.messages, args.messagesStart);
+    if (text.trim().length === 0) {
+        args.log('');
+        args.log('[plan] turn produced no assistant output — plan envelope UNCHANGED.');
+        args.log(`[plan] re-run: /abap-plan --resume @${basename(args.prepared.path)}`);
+        return null;
+    }
+    let extract;
+    try {
+        // A2 — pass the prior content so a COMPACT manifest (statuses + changed
+        // map) can be merged into it. prepared.envelope.content already passed
+        // parsePlanContent in preparePlanResume; re-parsing here hands extractPlan
+        // the normalised PlanContent without widening PreparedPlanResume. If the
+        // parse somehow fails, prior stays undefined and a compact manifest fails
+        // loudly below (full manifests are unaffected).
+        const prior = parsePlanContent(args.prepared.envelope.content);
+        extract = extractPlan(text, prior.ok ? prior.content : undefined);
+    }
+    catch (e) {
+        // Loud by design: the phase may have built real SAP objects, but the
+        // envelope write-back failed — the user must know state and file have
+        // diverged before the next resume.
+        args.log('');
+        args.log(`[plan] PHASE RESULT NOT PERSISTED — ${e instanceof Error ? e.message : String(e)}`);
+        args.log('[plan] The plan envelope is unchanged. Check what the phase actually built');
+        args.log('[plan] (transport, activated objects), update the envelope statuses by hand or');
+        args.log(`[plan] re-run: /abap-plan --resume @${basename(args.prepared.path)}`);
+        return null;
+    }
+    const revision = buildPlanRevision(args.prepared.envelope, extract, getAuthorIdentity(), new Date().toISOString());
+    // JSON round-trip simulates disk serialization for the validator.
+    const check = validateEnvelope(JSON.parse(JSON.stringify(revision)));
+    if (!check.ok) {
+        args.log('');
+        args.log(`[plan] PHASE RESULT NOT PERSISTED — revision failed validation: ${check.error.message}`);
+        return null;
+    }
+    let outDir;
+    try {
+        outDir = await ensureWorkspace();
+    }
+    catch {
+        outDir = process.cwd();
+    }
+    const savedPath = await saveProject(revision, { cwd: outDir });
+    const statuses = extract.statuses;
+    const next = computeNextPhase(extract.content.phases, statuses);
+    args.log('');
+    args.log(`Plan updated: ${savedPath}`);
+    args.log('');
+    args.log(renderPlanTracker({
+        title: revision.title,
+        version: revision.version,
+        content: extract.content,
+        statuses,
+        currentId: null,
+    }));
+    args.log('');
+    if (next) {
+        args.log(`Next: ${next.id} (${next.delegateTo}) — run /abap-plan --resume @${basename(savedPath)} in a fresh session.`);
+    }
+    else if (extract.content.phases.every((p) => isPhaseSatisfied(statuses[p.id]))) {
+        // C2 (D24): same chain as preparePlanResume — single source in plan-run.ts.
+        args.log(...planCompletionLines(extract.content.phases));
+    }
+    else {
+        const blocked = extract.content.phases.filter((p) => statuses[p.id] === 'blocked').map((p) => p.id);
+        args.log(`No eligible next phase. Blocked: ${blocked.join(', ')}. Unblock, then resume again.`);
+    }
+    return {
+        savedPath,
+        resumeCommand: buildResumeCommand(savedPath),
+        nextPhaseId: next?.id ?? null,
+        nextDelegateTo: next?.delegateTo ?? null,
+    };
+}

package/dist/config/loader.js

@@ -11,7 +11,7 @@ export function isValidWriteMode(v) {
 }
 const DEFAULT_CONFIG = {
     proxy_url: 'https://api.cspeach.dev',
-    default_model: 'claude-opus-4-7',
+    default_model: 'claude-opus-4-8',
     effort: 'xhigh',
     telemetry: 'minimal',
     sap: {},
@@ -26,6 +26,13 @@ const DEFAULT_CONFIG = {
     write_mode: 'approval-gated',
     // Default `managed` — lowest-friction entry point; uses the cspeach.dev proxy.
     llm: { mode: 'managed' },
+    // local_build is intentionally NOT defaulted here. If it were set to `false`,
+    // the `...DEFAULT_CONFIG` spread would leave merged.local_build defined even
+    // when the file omits the key — which permanently defeats resolveLocalBuild's
+    // `local_build ?? local_files` fallback (the legacy `local_files = on` case
+    // could never fire). Absence must stay `undefined` so the fallback can read
+    // the legacy key. The effective default-off is enforced by resolveLocalBuild
+    // (returns false when both are undefined). See loadConfig coercion below.
     // Defaults tuned 2026-05-16 from session 0618a42d evidence — see CompactConfig doc.
     compact: {
         keep_recent_turns: 5,
@@ -62,10 +69,34 @@ function sanitiseCompact(raw) {
         min_turns_between_auto: intInRange(r.min_turns_between_auto, d.min_turns_between_auto, 1, 100),
     };
 }
+/**
+ * Resolve the effective TLS options for a SAP system, applying the legacy
+ * `sslVerify: false` → insecure mapping. A configured `ca_cert_path` always
+ * wins (verification on). Pure — no I/O. Shared by the connection-manager and
+ * doctor checks so they agree on the posture.
+ */
+export function resolveSapTls(sys) {
+    if (sys.ca_cert_path) {
+        return { mode: 'ca-trusted', caCertPath: sys.ca_cert_path, insecureSkipTlsVerify: false };
+    }
+    // Explicit insecure opt-in, OR the legacy sslVerify:false mapping.
+    const insecure = sys.insecure_skip_tls_verify === true || sys.sslVerify === false;
+    if (insecure) {
+        return { mode: 'insecure', insecureSkipTlsVerify: true };
+    }
+    return { mode: 'verify', insecureSkipTlsVerify: false };
+}
+/** Tracks whether the one-time legacy-sslVerify deprecation note has printed. */
+let legacySslVerifyNoticeShown = false;
 export async function loadConfig() {
     try {
         const raw = await fs.readFile(configFile(), 'utf-8');
-        const parsed = toml.parse(raw);
+        // Strip a leading UTF-8 BOM (U+FEFF). Node's 'utf-8' read does NOT remove it,
+        // and @iarna/toml throws "Unknown character 65279" on a BOM at row 1 col 1.
+        // PowerShell's Set-Content / Out-File add a BOM by default, so a config edited
+        // on Windows can crash the REPL on next launch — tolerate it instead.
+        const noBom = raw.charCodeAt(0) === 0xFEFF ? raw.slice(1) : raw;
+        const parsed = toml.parse(noBom);
         // Shallow merge top-level, but deep-merge `ui` and `classifier` so a user
         // config that omits the new `ui.rendering` key still receives the default.
         // Sanitize the optional shell_exec.allow array. The interface types it as
@@ -82,9 +113,27 @@ export async function loadConfig() {
         else {
             allow = [];
         }
-        return {
+        const merged = {
             ...DEFAULT_CONFIG,
             ...parsed,
+            // Coerce defensively, but PRESERVE the absent→undefined distinction so the
+            // legacy fallback in resolveLocalBuild can fire:
+            //   - explicit `true`                → true
+            //   - explicit `false`/off           → false (defined; overrides legacy)
+            //   - present-but-invalid (string)   → false (defined; fails safe, can't
+            //     grant access via a typo, but DOES override a stale legacy on)
+            //   - absent / undefined             → undefined (legacy fallback applies)
+            // A defined `false` (whether explicit or typo) must win the
+            // `local_build ?? local_files` resolution so an explicit off is honoured.
+            local_build: parsed.local_build === true
+                ? true
+                : parsed.local_build === undefined
+                    ? undefined
+                    : false,
+            // Preserve a legacy `local_files` value (read-only backward compat) ONLY
+            // when it's strictly true — a string/typo collapses to "absent" so it
+            // can't win the `local_build ?? local_files` fallback.
+            local_files: parsed.local_files === true ? true : undefined,
             write_mode: isValidWriteMode(parsed.write_mode) ? parsed.write_mode : DEFAULT_CONFIG.write_mode,
             llm: { ...DEFAULT_CONFIG.llm, ...(parsed.llm ?? {}) },
             classifier: { ...DEFAULT_CONFIG.classifier, ...(parsed.classifier ?? {}) },
@@ -95,6 +144,37 @@ export async function loadConfig() {
             compact: sanitiseCompact(parsed.compact),
             shell_exec: parsed.shell_exec === undefined ? undefined : { allow },
         };
+        // Drop the legacy `local_files` key entirely when it isn't a genuine on
+        // (the `...parsed` spread above can leave a `local_files = false` behind,
+        // and our explicit coercion sets it to `undefined`). Removing the key keeps
+        // `config show` and saveConfig output clean — no `local_files = undefined`.
+        if (merged.local_files === undefined)
+            delete merged.local_files;
+        // Same for `local_build`: when the key is absent from disk we coerce it to
+        // `undefined` (so resolveLocalBuild's legacy fallback can fire). Delete the
+        // key so it doesn't serialise as `local_build = undefined` and so callers
+        // see a clean "absent" shape. resolveLocalBuild treats missing === undefined.
+        if (merged.local_build === undefined)
+            delete merged.local_build;
+        // One-time deprecation note: a SAP system still relies on the legacy
+        // `sslVerify` toggle and has not adopted either new key. It KEEPS WORKING
+        // (resolveSapTls maps sslVerify:false → insecure), but we nudge the user
+        // once per process toward `ca_cert_path` (preferred) or the explicit
+        // insecure flag. Only fires when sslVerify is present AND no new key is set.
+        if (!legacySslVerifyNoticeShown) {
+            const legacyAlias = Object.entries(merged.sap ?? {}).find(([, s]) => typeof s?.sslVerify === 'boolean' &&
+                s.ca_cert_path === undefined &&
+                s.insecure_skip_tls_verify === undefined);
+            if (legacyAlias) {
+                legacySslVerifyNoticeShown = true;
+                const [alias, sys] = legacyAlias;
+                const suggestion = sys.sslVerify === false
+                    ? `set 'ca_cert_path' to your corporate CA (keeps verification ON), or set 'insecure_skip_tls_verify = true' to keep verification off (dev only, logs a warning)`
+                    : `the default is now verify-ON; you can drop 'sslVerify' or set 'ca_cert_path' for internal-CA systems`;
+                process.stderr.write(`[cspeach] note: [sap.${alias}] uses the deprecated 'sslVerify' key — ${suggestion}.\n`);
+            }
+        }
+        return merged;
     }
     catch (err) {
         if (err?.code === 'ENOENT')
@@ -102,6 +182,25 @@ export async function loadConfig() {
         throw err;
     }
 }
+/**
+ * Resolve the effective "local build tools" toggle from a loaded config.
+ *
+ * Backward compat (2026-06-13 rename): the new key is `local_build`; the legacy
+ * key is `local_files`. A user who set `local_files = on` before the rename
+ * must keep working without re-running `config set`. The rule is:
+ *
+ *     effective = local_build ?? local_files   (default false)
+ *
+ * `local_build` always wins when present (so `config set local_build off`
+ * overrides a stale legacy `local_files = on`). Only when `local_build` is
+ * undefined does the legacy value apply. Both keys are already strictly coerced
+ * to `true | undefined` by loadConfig, so this is a pure read.
+ */
+export function resolveLocalBuild(cfg) {
+    if (cfg.local_build !== undefined)
+        return cfg.local_build === true;
+    return cfg.local_files === true;
+}
 export async function saveConfig(config) {
     await fs.mkdir(cspeachRoot(), { recursive: true });
     await fs.writeFile(configFile(), toml.stringify(config), 'utf-8');