@cspeach/cli 0.9.0 → 1.0.0

package/dist/config/loader.js

@@ -26,6 +26,13 @@ const DEFAULT_CONFIG = {
     write_mode: 'approval-gated',
     // Default `managed` — lowest-friction entry point; uses the cspeach.dev proxy.
     llm: { mode: 'managed' },
+    // local_build is intentionally NOT defaulted here. If it were set to `false`,
+    // the `...DEFAULT_CONFIG` spread would leave merged.local_build defined even
+    // when the file omits the key — which permanently defeats resolveLocalBuild's
+    // `local_build ?? local_files` fallback (the legacy `local_files = on` case
+    // could never fire). Absence must stay `undefined` so the fallback can read
+    // the legacy key. The effective default-off is enforced by resolveLocalBuild
+    // (returns false when both are undefined). See loadConfig coercion below.
     // Defaults tuned 2026-05-16 from session 0618a42d evidence — see CompactConfig doc.
     compact: {
         keep_recent_turns: 5,
@@ -62,6 +69,25 @@ function sanitiseCompact(raw) {
         min_turns_between_auto: intInRange(r.min_turns_between_auto, d.min_turns_between_auto, 1, 100),
     };
 }
+/**
+ * Resolve the effective TLS options for a SAP system, applying the legacy
+ * `sslVerify: false` → insecure mapping. A configured `ca_cert_path` always
+ * wins (verification on). Pure — no I/O. Shared by the connection-manager and
+ * doctor checks so they agree on the posture.
+ */
+export function resolveSapTls(sys) {
+    if (sys.ca_cert_path) {
+        return { mode: 'ca-trusted', caCertPath: sys.ca_cert_path, insecureSkipTlsVerify: false };
+    }
+    // Explicit insecure opt-in, OR the legacy sslVerify:false mapping.
+    const insecure = sys.insecure_skip_tls_verify === true || sys.sslVerify === false;
+    if (insecure) {
+        return { mode: 'insecure', insecureSkipTlsVerify: true };
+    }
+    return { mode: 'verify', insecureSkipTlsVerify: false };
+}
+/** Tracks whether the one-time legacy-sslVerify deprecation note has printed. */
+let legacySslVerifyNoticeShown = false;
 export async function loadConfig() {
     try {
         const raw = await fs.readFile(configFile(), 'utf-8');
@@ -87,9 +113,27 @@ export async function loadConfig() {
         else {
             allow = [];
         }
-        return {
+        const merged = {
             ...DEFAULT_CONFIG,
             ...parsed,
+            // Coerce defensively, but PRESERVE the absent→undefined distinction so the
+            // legacy fallback in resolveLocalBuild can fire:
+            //   - explicit `true`                → true
+            //   - explicit `false`/off           → false (defined; overrides legacy)
+            //   - present-but-invalid (string)   → false (defined; fails safe, can't
+            //     grant access via a typo, but DOES override a stale legacy on)
+            //   - absent / undefined             → undefined (legacy fallback applies)
+            // A defined `false` (whether explicit or typo) must win the
+            // `local_build ?? local_files` resolution so an explicit off is honoured.
+            local_build: parsed.local_build === true
+                ? true
+                : parsed.local_build === undefined
+                    ? undefined
+                    : false,
+            // Preserve a legacy `local_files` value (read-only backward compat) ONLY
+            // when it's strictly true — a string/typo collapses to "absent" so it
+            // can't win the `local_build ?? local_files` fallback.
+            local_files: parsed.local_files === true ? true : undefined,
             write_mode: isValidWriteMode(parsed.write_mode) ? parsed.write_mode : DEFAULT_CONFIG.write_mode,
             llm: { ...DEFAULT_CONFIG.llm, ...(parsed.llm ?? {}) },
             classifier: { ...DEFAULT_CONFIG.classifier, ...(parsed.classifier ?? {}) },
@@ -100,6 +144,37 @@ export async function loadConfig() {
             compact: sanitiseCompact(parsed.compact),
             shell_exec: parsed.shell_exec === undefined ? undefined : { allow },
         };
+        // Drop the legacy `local_files` key entirely when it isn't a genuine on
+        // (the `...parsed` spread above can leave a `local_files = false` behind,
+        // and our explicit coercion sets it to `undefined`). Removing the key keeps
+        // `config show` and saveConfig output clean — no `local_files = undefined`.
+        if (merged.local_files === undefined)
+            delete merged.local_files;
+        // Same for `local_build`: when the key is absent from disk we coerce it to
+        // `undefined` (so resolveLocalBuild's legacy fallback can fire). Delete the
+        // key so it doesn't serialise as `local_build = undefined` and so callers
+        // see a clean "absent" shape. resolveLocalBuild treats missing === undefined.
+        if (merged.local_build === undefined)
+            delete merged.local_build;
+        // One-time deprecation note: a SAP system still relies on the legacy
+        // `sslVerify` toggle and has not adopted either new key. It KEEPS WORKING
+        // (resolveSapTls maps sslVerify:false → insecure), but we nudge the user
+        // once per process toward `ca_cert_path` (preferred) or the explicit
+        // insecure flag. Only fires when sslVerify is present AND no new key is set.
+        if (!legacySslVerifyNoticeShown) {
+            const legacyAlias = Object.entries(merged.sap ?? {}).find(([, s]) => typeof s?.sslVerify === 'boolean' &&
+                s.ca_cert_path === undefined &&
+                s.insecure_skip_tls_verify === undefined);
+            if (legacyAlias) {
+                legacySslVerifyNoticeShown = true;
+                const [alias, sys] = legacyAlias;
+                const suggestion = sys.sslVerify === false
+                    ? `set 'ca_cert_path' to your corporate CA (keeps verification ON), or set 'insecure_skip_tls_verify = true' to keep verification off (dev only, logs a warning)`
+                    : `the default is now verify-ON; you can drop 'sslVerify' or set 'ca_cert_path' for internal-CA systems`;
+                process.stderr.write(`[cspeach] note: [sap.${alias}] uses the deprecated 'sslVerify' key — ${suggestion}.\n`);
+            }
+        }
+        return merged;
     }
     catch (err) {
         if (err?.code === 'ENOENT')
@@ -107,6 +182,25 @@ export async function loadConfig() {
         throw err;
     }
 }
+/**
+ * Resolve the effective "local build tools" toggle from a loaded config.
+ *
+ * Backward compat (2026-06-13 rename): the new key is `local_build`; the legacy
+ * key is `local_files`. A user who set `local_files = on` before the rename
+ * must keep working without re-running `config set`. The rule is:
+ *
+ *     effective = local_build ?? local_files   (default false)
+ *
+ * `local_build` always wins when present (so `config set local_build off`
+ * overrides a stale legacy `local_files = on`). Only when `local_build` is
+ * undefined does the legacy value apply. Both keys are already strictly coerced
+ * to `true | undefined` by loadConfig, so this is a pure read.
+ */
+export function resolveLocalBuild(cfg) {
+    if (cfg.local_build !== undefined)
+        return cfg.local_build === true;
+    return cfg.local_files === true;
+}
 export async function saveConfig(config) {
     await fs.mkdir(cspeachRoot(), { recursive: true });
     await fs.writeFile(configFile(), toml.stringify(config), 'utf-8');

package/dist/doctor/checks/_http-probe.js

@@ -35,6 +35,7 @@ export function probeGet(url, opts) {
             path: u.pathname + u.search,
             timeout: opts.timeoutMs ?? 8000,
             rejectUnauthorized: opts.rejectUnauthorized,
+            ...(opts.ca !== undefined ? { ca: opts.ca } : {}),
             headers,
         }, (res) => {
             const chunks = [];

package/dist/doctor/checks/cert.js

@@ -1,5 +1,5 @@
 import tls from 'node:tls';
-import { loadConfig } from '../../config/loader.js';
+import { loadConfig, resolveSapTls } from '../../config/loader.js';
 export async function checkCert() {
     const cfg = await loadConfig();
     const systems = Object.entries(cfg.sap).filter(([_, s]) => s.useSsl);
@@ -7,14 +7,25 @@ export async function checkCert() {
         return { name: 'cert', ok: true, message: 'n/a (no TLS SAP systems configured)' };
     const results = [];
     for (const [alias, sys] of systems) {
+        const tlsMode = resolveSapTls(sys);
         const info = await new Promise((resolve) => {
+            // Probe with rejectUnauthorized:false so we can always read the cert and
+            // report the OS-trust chain status, then describe the configured posture
+            // separately (verify / CA-trusted / INSECURE).
             const socket = tls.connect({ host: sys.host, port: sys.port, rejectUnauthorized: false, timeout: 5000 }, () => {
                 const cert = socket.getPeerCertificate();
                 const authorized = socket.authorized;
                 socket.end();
                 const chainValid = authorized ? 'yes' : 'no';
-                const clientAccepted = !sys.sslVerify ? 'yes (trust-manager allows self-signed)' : (authorized ? 'yes' : 'no');
-                resolve(`${alias}: chain valid: ${chainValid} / client accepted: ${clientAccepted} / subject: ${cert.subject?.CN ?? '?'}`);
+                // What the configured client mode means for acceptance:
+                //   verify     → accepts only if the OS/Node trust chain validates
+                //   CA-trusted → accepts via the configured CA (verification ON)
+                //   INSECURE   → accepts anything (verification OFF — dev only)
+                const clientAccepted = tlsMode.mode === 'insecure' ? 'yes (INSECURE — verification disabled, dev only)'
+                    : tlsMode.mode === 'ca-trusted' ? 'yes (CA-trusted — verification ON via configured CA)'
+                        : (authorized ? 'yes' : 'no (verify ON — configure ca_cert_path to trust an internal CA)');
+                resolve(`${alias}: mode: ${tlsMode.mode} / chain valid: ${chainValid} / ` +
+                    `client accepted: ${clientAccepted} / subject: ${cert.subject?.CN ?? '?'}`);
             });
             socket.on('error', (err) => resolve(`${alias}: ${err.message}`));
         });

package/dist/doctor/checks/sap.js

@@ -1,4 +1,5 @@
-import { loadConfig } from '../../config/loader.js';
+import { readFile } from 'node:fs/promises';
+import { loadConfig, resolveSapTls } from '../../config/loader.js';
 import { probeGet } from './_http-probe.js';
 export async function checkSap() {
     const cfg = await loadConfig();
@@ -9,23 +10,44 @@ export async function checkSap() {
     let anyFailed = false;
     for (const [alias, sys] of systems) {
         const url = `${sys.useSsl ? 'https' : 'http'}://${sys.host}:${sys.port}/sap/bc/adt/discovery`;
-        // Use node's https directly so we can honor sslVerify=false for
-        // self-signed dev systems — Node's built-in fetch() doesn't expose a
-        // per-request TLS-verify toggle. See checks/_http-probe.ts.
+        // TLS posture (2026-06-14): verification ON by default. resolveSapTls maps
+        // the per-alias config (ca_cert_path / insecure_skip_tls_verify, legacy
+        // sslVerify:false fallback). Node's built-in fetch() doesn't expose a
+        // per-request TLS-verify toggle, so we use node's https directly — see
+        // checks/_http-probe.ts.
+        const tls = resolveSapTls(sys);
+        // Tag the connectivity result with the cert mode so doctor surfaces it.
+        const modeTag = tls.mode === 'verify' ? 'verify'
+            : tls.mode === 'ca-trusted' ? 'CA-trusted'
+                : 'INSECURE';
+        let ca;
+        if (tls.mode === 'ca-trusted' && tls.caCertPath) {
+            try {
+                ca = await readFile(tls.caCertPath);
+            }
+            catch (e) {
+                // Fail closed, like the connection path: a configured-but-unreadable CA
+                // is an error, not a reason to drop verification.
+                results.push(`${alias}: CA unreadable at ${tls.caCertPath} (${e.message})`);
+                anyFailed = true;
+                continue;
+            }
+        }
         const r = await probeGet(url, {
-            rejectUnauthorized: sys.sslVerify,
+            rejectUnauthorized: tls.mode !== 'insecure',
+            ca,
             timeoutMs: 8000,
         });
         if (r.error) {
-            results.push(`${alias}: ${r.error}`);
+            results.push(`${alias}: ${r.error} [${modeTag}]`);
             anyFailed = true;
         }
         else if (r.status === 200 || r.status === 401) {
             // 200 = anonymous discovery allowed; 401 = reachable + auth-required (expected, fine)
-            results.push(`${alias}: reachable`);
+            results.push(`${alias}: reachable [${modeTag}]`);
         }
         else {
-            results.push(`${alias}: HTTP ${r.status}`);
+            results.push(`${alias}: HTTP ${r.status} [${modeTag}]`);
             anyFailed = true;
         }
     }

package/dist/doctor/checks/zcspeach.js

@@ -1,5 +1,6 @@
 import keytar from 'keytar';
-import { loadConfig } from '../../config/loader.js';
+import { readFile } from 'node:fs/promises';
+import { loadConfig, resolveSapTls } from '../../config/loader.js';
 import { probeGet } from './_http-probe.js';
 const SAP_SERVICE = 'cspeach-sap';
 export async function checkZcspeach() {
@@ -29,10 +30,24 @@ export async function checkZcspeach() {
             results.push(`${alias}: skipped (no password in keychain)`);
             continue;
         }
-        // Use node's https directly so we can honor sslVerify=false for
-        // self-signed dev systems. See checks/_http-probe.ts.
+        // TLS posture (2026-06-14): verification ON by default; resolveSapTls maps
+        // the per-alias config (ca_cert_path / insecure_skip_tls_verify, legacy
+        // sslVerify:false fallback). See checks/_http-probe.ts.
+        const tls = resolveSapTls(sys);
+        let ca;
+        if (tls.mode === 'ca-trusted' && tls.caCertPath) {
+            try {
+                ca = await readFile(tls.caCertPath);
+            }
+            catch (e) {
+                results.push(`${alias}: CA unreadable at ${tls.caCertPath} (${e.message})`);
+                anyFailed = true;
+                continue;
+            }
+        }
         const r = await probeGet(url, {
-            rejectUnauthorized: sys.sslVerify,
+            rejectUnauthorized: tls.mode !== 'insecure',
+            ca,
             auth: `${sys.username}:${pwd}`,
             accept: 'application/json',
             timeoutMs: 5000,

package/dist/one-shot.js

@@ -1,15 +1,18 @@
 import chalk from 'chalk';
-import { loadConfig } from './config/loader.js';
+import { loadConfig, resolveLocalBuild } from './config/loader.js';
 import { getStore } from './auth/api-key.js';
 import { getConnection } from './sap/connection-manager.js';
 import { AdtClient } from '@cspeach/sap-client';
 import { makeSessionId, saveSession } from './session/store.js';
 import { newSession } from './session/schema.js';
 import { createProviderForMode } from './agent/providers/factory.js';
+import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
-import { classifyPrompt, parseShortcut } from './router/classifier.js';
-import { setRenderingOverride } from './renderer/tty.js';
+import { classifyPrompt, parseShortcut, rejectUnknownSkill } from './router/classifier.js';
+import { setRenderingOverride, setHeadlessOverride } from './renderer/tty.js';
 import { alwaysDeclinePreviewHook } from './repl/update-method-preview-hook.js';
+import { createClassicOutputEmitter } from './renderer/notices.js';
+import { applyLocalBuildConfig } from './tools/local-build.js';
 // Side-effect imports for tool registration.
 import './tools/sap-read.js';
 import './tools/sap-write.js';
@@ -19,16 +22,22 @@ import './tools/snapshot.js';
 import './tools/ask-question.js';
 import './tools/dispatch-skill.js';
 import './tools/filesystem/file-read.js';
+import './tools/filesystem/read-document.js';
 import './tools/filesystem/file-edit.js';
 import './tools/filesystem/file-write.js';
 import './tools/filesystem/glob.js';
 import './tools/filesystem/grep.js';
 import './tools/shell/shell_exec.js';
+import './tools/fiori/tools.js';
+import './tools/extend-model/tool.js';
+import './tools/capability/tool.js';
 import './tools/web/web_fetch.js';
 import './tools/web/web_search.js';
 import './tools/project/project_context_get.js';
 import './tools/project/playbook_get.js';
 import './tools/project/convention_get.js';
+import './tools/project/cca_merge.js';
+import './tools/project/upgrade_merge_progress.js';
 import './tools/subagent/_background-shared.js';
 import './tools/subagent/background_run.js';
 import './tools/subagent/monitor_emit.js';
@@ -37,12 +46,27 @@ import './tools/subagent/agent_run.js';
 export async function runOneShot(prompt, opts) {
     const cfg = await loadConfig();
     setRenderingOverride(cfg.ui.rendering);
+    // B5 (2026-06-11) — one-shot is headless by design: a single turn, no
+    // REPL, often piped (CI / battery). Any stdin prompt would hang forever
+    // (defect D1). The headless answer policy (ask_question auto-answers,
+    // save hook defaults YES, approvals fail fast) keys off this flag.
+    setHeadlessOverride(true);
     // Task C.10 — advisory-only is the only mode the one-shot announces, because
     // non-interactive output should stay minimal. The user needs to know that
     // writes will NOT be executed before a skill that normally writes runs.
     if (cfg.write_mode === 'advisory-only') {
         console.log(chalk.yellow('⚠  Advisory mode: writes will be proposed, not executed.'));
     }
+    // local_build toggle — force-enable the flag-gated filesystem tools AND
+    // shell_exec BEFORE the (single) turn when persisted-on. Resolve with backward
+    // compat (legacy `local_files = on` still applies). Announce so headless
+    // transcripts record that local file access + command execution were live
+    // (trust-visibility / auditability).
+    {
+        const announce = applyLocalBuildConfig(resolveLocalBuild(cfg), process.cwd());
+        if (announce)
+            console.log(chalk.dim(announce));
+    }
     const store = await getStore();
     if (!(await store.get())) {
         console.error('No API key configured. Run `cspeach` (interactive) first to set one.');
@@ -66,6 +90,14 @@ export async function runOneShot(prompt, opts) {
     const body = parsed.prompt;
     let skill;
     if (parsed.skill) {
+        // D35 (2026-06-11) — explicit slash naming a skill that isn't in the
+        // catalog. One-shot has no picker, so fail fast with the notice ("did
+        // you mean" / builtin-with-args) instead of dispatching to a
+        // nonexistent skill (and NEVER falling through to the classifier with
+        // the slash embedded). Shared gate: rejectUnknownSkill in classifier.ts.
+        if (rejectUnknownSkill(parsed, (m) => console.error(chalk.red(m)))) {
+            return 1;
+        }
         skill = parsed.skill;
     }
     else {
@@ -94,6 +126,19 @@ export async function runOneShot(prompt, opts) {
         }
         skill = c.skill;
     }
+    // License gate: non-managed modes (byok/local/ai-hub) bypass our proxy for
+    // inference, so without this anyone who never logged in could use the bundled
+    // skills untracked. Require a valid CSPeach login. (See license-gate.ts.)
+    try {
+        await assertModeLicensed(cfg.llm.mode, async () => (await store.get()) ?? '');
+    }
+    catch (e) {
+        if (e instanceof CspeachLicenseError) {
+            console.error(chalk.yellow(`\n${e.message}\n`));
+            process.exit(1);
+        }
+        throw e;
+    }
     const provider = createProviderForMode(cfg, async () => {
         const key = await store.get();
         if (!key)
@@ -104,7 +149,10 @@ export async function runOneShot(prompt, opts) {
         provider,
         userMessage: body,
         skill,
-        ctx: { adt, sapAlias: alias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: alwaysDeclinePreviewHook },
+        // B2 fix (2026-06-12): one-shot runs render tool notices ('warn'/'info'
+        // — Rule 9 transport overrides, snapshot lines) to stdout instead of
+        // dropping them. Headless transcripts need these for auditability.
+        ctx: { adt, sapAlias: alias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: alwaysDeclinePreviewHook, chunkEmitter: createClassicOutputEmitter() },
     });
     return 0;
 }

package/dist/projects/answer-blockers.js

@@ -0,0 +1,137 @@
+import { writeFileSync } from 'node:fs';
+import { readProjectFile } from './status.js';
+import { validateEnvelope } from './validate.js';
+/**
+ * The still-open BLOCKER-severity questions of a spec-gap envelope, in item
+ * order. Returns [] for any non-spec-gap artefact (only spec-gap has gaps with
+ * a severity + an `answered` status). Carries any candidate `options` so the
+ * answer UI can offer choices instead of a bare text box.
+ */
+export function openBlockers(env) {
+    if (env.artefactType !== 'spec-gap')
+        return [];
+    const gapById = new Map();
+    for (const s of env.content.sections) {
+        for (const g of s.gaps)
+            gapById.set(g.id, g);
+    }
+    const out = [];
+    for (const it of env.interaction.items) {
+        if (it.status !== 'open')
+            continue;
+        const g = gapById.get(it.id);
+        if (g?.severity !== 'BLOCKER')
+            continue;
+        const ob = { id: it.id, text: g.text };
+        if (g.options && g.options.length > 0) {
+            ob.options = g.options;
+            if (g.optionsMultiSelect)
+                ob.multiSelect = true;
+        }
+        out.push(ob);
+    }
+    return out;
+}
+/**
+ * Return a copy of `env` with each item in `answers` marked answered. Keys with
+ * a blank value are ignored (treated as skipped). version + history are left
+ * untouched (invariant version === history.length holds); lastEditedAt/By move
+ * to the answerer to reflect who filled them.
+ */
+export function applyBlockerAnswers(env, answers, answerer, nowIso) {
+    const items = env.interaction.items.map((it) => {
+        const a = answers.get(it.id);
+        if (a === undefined || a.trim().length === 0)
+            return it;
+        return {
+            ...it,
+            status: 'answered',
+            answer: a,
+            answeredBy: answerer,
+            answeredAt: nowIso,
+        };
+    });
+    return {
+        ...env,
+        interaction: { items },
+        lastEditedAt: nowIso,
+        lastEditedBy: answerer,
+    };
+}
+function affirmative(reply) {
+    const v = reply.trim().toLowerCase();
+    return v === 'y' || v === 'yes';
+}
+/**
+ * Offer to answer the open blockers of the just-saved spec-gap file inline.
+ * No-op (no prompt) when the file isn't a spec-gap or has no open blockers, so
+ * it is always safe to call after any save. In headless runs the prompt returns
+ * '' → declined → nothing happens.
+ *
+ * Returns the count recorded, or null when nothing was offered/written.
+ */
+export async function offerAnswerBlockers(args) {
+    let env;
+    try {
+        env = readProjectFile(args.path);
+    }
+    catch {
+        return null;
+    }
+    const blockers = openBlockers(env);
+    if (blockers.length === 0)
+        return null;
+    const reply = await args.prompt(`Answer the ${blockers.length} unanswered blocker(s) now? [y/N]: `);
+    if (!affirmative(reply))
+        return null;
+    const answers = new Map();
+    for (let i = 0; i < blockers.length; i++) {
+        const b = blockers[i];
+        args.log('');
+        args.log(`Blocker ${i + 1}/${blockers.length}: ${b.text}`);
+        // Choices first, where the question has them and a picker is available.
+        // 'write' falls through to the text box; 'skip' leaves the blocker open.
+        let askText = true;
+        if (b.options && b.options.length > 0 && args.choose) {
+            const c = await args.choose({
+                question: b.text,
+                options: b.options,
+                multiSelect: !!b.multiSelect,
+                index: i,
+                total: blockers.length,
+            });
+            if (c.kind === 'picked') {
+                if (c.answer.trim().length > 0)
+                    answers.set(b.id, c.answer.trim());
+                askText = false;
+            }
+            else if (c.kind === 'skip') {
+                askText = false;
+            }
+            // c.kind === 'write' → askText stays true
+        }
+        if (askText) {
+            const a = (await args.prompt('  Your answer (Enter to skip): ')).trim();
+            if (a.length > 0)
+                answers.set(b.id, a);
+        }
+    }
+    if (answers.size === 0) {
+        args.log('');
+        args.log('No answers entered — all blockers left open for the viewer.');
+        return null;
+    }
+    const nowIso = (args.now ?? (() => new Date().toISOString()))();
+    const revised = applyBlockerAnswers(env, answers, args.identity, nowIso);
+    const check = validateEnvelope(JSON.parse(JSON.stringify(revised)));
+    if (!check.ok) {
+        args.log(`[answer] revision invalid (${check.error.message}) — answers NOT saved.`);
+        return null;
+    }
+    writeFileSync(args.path, JSON.stringify(revised, null, 2), 'utf8');
+    const stillOpen = blockers.length - answers.size;
+    args.log('');
+    args.log(`Recorded ${answers.size} answer(s) in the file`
+        + (stillOpen > 0 ? ` — ${stillOpen} blocker(s) still open for the viewer.` : '.'));
+    return answers.size;
+}