@cspeach/cli 0.9.0 → 1.1.0

package/dist/sap/capability.js

@@ -0,0 +1,146 @@
+/**
+ * Pillar A — data-driven capability resolver.
+ *
+ * Answers "can the connected SAP release do feature X?" from the committed
+ * ABAP feature-matrix snapshot — so skills stop hardcoding version prose
+ * (e.g. the old "FILTER needs 7.50" guess that the matrix proves wrong on
+ * a 7.40 SP08 system with the feature backported).
+ *
+ * This module is PURE: the matrix is passed in, so it is unit-testable
+ * without filesystem or network. The snapshot loader lives in
+ * capability-matrix.ts; the tool wrapper in tools/capability/tool.ts.
+ *
+ * NO hardcoded version thresholds — every yes/no/with-fallback decision is
+ * read out of the snapshot data.
+ *
+ * See docs/superpowers/specs/2026-06-24-revision-aware-cspeach-design.md.
+ */
+export const CAPABILITY_REGISTRY = {
+    'cds.viewEntity': { feature: 'Define View Entity', fallback: "use classic 'define view' (DDIC-based) instead of 'define view entity'" },
+    'rap.managed': { feature: 'Managed Scenario', fallback: '' }, // empty = no fallback
+    'rap.behaviorDefinition': { feature: 'Behavior Definitions', fallback: '' }, // no classic equivalent if BDEF unsupported
+    'abap.filterExpr': { feature: 'FILTER', fallback: 'use LOOP AT ... / READ TABLE instead of FILTER( )' },
+    'abap.inlineData': { feature: 'Inline Declaration', fallback: 'declare the variable explicitly with DATA: before use' },
+};
+export const CAPABILITY_IDS = Object.keys(CAPABILITY_REGISTRY);
+function isCapabilityId(s) {
+    return Object.prototype.hasOwnProperty.call(CAPABILITY_REGISTRY, s);
+}
+/**
+ * Map an `abapVersion` (as produced by system-info.ts: "7.57", "7.40",
+ * "unknown") to one of the snapshot's column keys. The column keys are
+ * DERIVED from the snapshot row passed in — never hardcoded — so adding or
+ * renaming columns in the snapshot needs no code change here.
+ *
+ * Rules:
+ *   - falsy / 'unknown'  → null
+ *   - '7.40'             → the 7.40 column containing 'SP08' (the release
+ *                          floor); else any 7.40 column
+ *   - else               → the column whose key contains the substring
+ *                          `(<abapVersion>)`, e.g. '7.57' → '2022 (7.57)'
+ */
+export function mapReleaseToColumn(abapVersion, columns) {
+    if (!abapVersion || abapVersion === 'unknown')
+        return null;
+    if (abapVersion === '7.40') {
+        const sp08 = columns.find((c) => c.startsWith('7.40') && c.includes('SP08'));
+        if (sp08)
+            return sp08;
+        const any740 = columns.find((c) => c.includes('7.40'));
+        return any740 ?? null;
+    }
+    const needle = `(${abapVersion})`;
+    return columns.find((c) => c.includes(needle)) ?? null;
+}
+/**
+ * Pure resolver. `capability` may be a registry id (cds.viewEntity, …) or a
+ * raw matrix feature name. Implements the design's decision table exactly.
+ */
+export function resolveCapability(info, matrix, capability) {
+    // 1. Resolve target feature + fallback.
+    let feature;
+    let fallback;
+    if (isCapabilityId(capability)) {
+        feature = CAPABILITY_REGISTRY[capability].feature;
+        fallback = CAPABILITY_REGISTRY[capability].fallback || undefined;
+    }
+    else {
+        feature = capability;
+        fallback = undefined;
+    }
+    const release = info.release;
+    const base = (overrides) => ({
+        capability,
+        feature,
+        status: 'no',
+        reason: '',
+        release,
+        column: null,
+        source: 'matrix-snapshot',
+        ...overrides,
+    });
+    // 3. Find the feature row (case-insensitive exact match). Done before
+    //    the column map so column-derivation can use the row's own keys.
+    const wanted = feature.toLowerCase();
+    const row = matrix.features.find((f) => f.feature.toLowerCase() === wanted);
+    // 2. Determine the matrix column. Prefer the keys of the found row; if the
+    //    feature is missing, fall back to any feature's keys so the verdict can
+    //    still report the column it would have used.
+    const columnKeys = row
+        ? Object.keys(row.statusByRelease)
+        : matrix.features.length > 0
+            ? Object.keys(matrix.features[0].statusByRelease)
+            : [];
+    const column = mapReleaseToColumn(info.abapVersion, columnKeys);
+    // 3 (cont). Feature not found.
+    if (!row) {
+        return base({
+            status: fallback ? 'with-fallback' : 'no',
+            reason: `feature '${feature}' not found in the matrix snapshot`,
+            column,
+            ...(fallback ? { fallback } : {}),
+        });
+    }
+    // 4. Column could not be mapped.
+    if (column === null) {
+        return base({
+            status: fallback ? 'with-fallback' : 'no',
+            reason: `could not map release '${info.abapVersion}' to a matrix column`,
+            column: null,
+            ...(fallback ? { fallback } : {}),
+        });
+    }
+    // 5. Read + map the cell value.
+    const raw = row.statusByRelease[column];
+    switch (raw) {
+        case 'available':
+            return base({ status: 'yes', reason: `available on ${release}`, column });
+        case 'downport':
+            return base({ status: 'yes', reason: `available on ${release} (backported)`, column });
+        case 'unavailable':
+            return base({
+                status: fallback ? 'with-fallback' : 'no',
+                reason: `not available on ${release}`,
+                column,
+                ...(fallback ? { fallback } : {}),
+            });
+        case 'deprecated':
+            if (fallback) {
+                return base({
+                    status: 'with-fallback',
+                    reason: `available but deprecated on ${release}`,
+                    column,
+                    fallback,
+                });
+            }
+            return base({ status: 'yes', reason: `available but deprecated on ${release}`, column });
+        default:
+            // needs_review / unknown / undefined / anything else.
+            return base({
+                status: fallback ? 'with-fallback' : 'no',
+                reason: `matrix status '${raw ?? ''}' for ${release} is inconclusive`,
+                column,
+                ...(fallback ? { fallback } : {}),
+            });
+    }
+}

package/dist/sap/connection-manager.js

@@ -1,6 +1,8 @@
 import keytar from 'keytar';
 import { SapConnection } from '@cspeach/sap-client';
+import { resolveSapTls } from '../config/loader.js';
 import { password as promptPassword } from '@inquirer/prompts';
+import { isHeadless } from '../renderer/tty.js';
 const SAP_SERVICE = 'cspeach-sap';
 const cache = new Map();
 export async function getConnection(alias, cfg) {
@@ -14,6 +16,14 @@ export async function getConnection(alias, cfg) {
         }
         catch { /* keychain unavailable */ }
         if (!passwordValue) {
+            // B5 (2026-06-11) — headless guard: the keytar-miss fallback is a
+            // stdin password prompt, which would hang a headless run forever
+            // (same defect family as D1). Fail fast with an actionable error
+            // instead of prompting.
+            if (isHeadless()) {
+                throw new Error(`no stored password for SAP alias '${alias}' — store credentials first ` +
+                    '(run interactively once or use cspeach config) — headless runs cannot prompt');
+            }
             passwordValue = await promptPassword({
                 message: `SAP password for ${alias}/${cfg.username}:`,
                 mask: '*',
@@ -26,12 +36,20 @@ export async function getConnection(alias, cfg) {
     // SapConnection constructor is (config, username, password) — 3 positional args.
     // SapConfig.authType is typed as 'basic' only (v1); SapSystemConfig carries the
     // wider union so we cast to satisfy the narrower SapConfig shape.
+    //
+    // TLS posture (2026-06-14): verification is ON by default. resolveSapTls maps
+    // the per-alias config (ca_cert_path / insecure_skip_tls_verify, with the
+    // legacy sslVerify:false → insecure fallback) into the sap-client options.
+    // We pass caCertPath / insecureSkipTlsVerify explicitly — NOT the legacy
+    // sslVerify — so the new verify-by-default contract holds.
+    const tls = resolveSapTls(cfg);
     const conn = new SapConnection({
         host: cfg.host,
         port: cfg.port,
         client: cfg.client,
         useSsl: cfg.useSsl,
-        sslVerify: cfg.sslVerify,
+        caCertPath: tls.caCertPath,
+        insecureSkipTlsVerify: tls.insecureSkipTlsVerify,
         credentialRef: alias,
         authType: 'basic',
     }, cfg.username, passwordValue ?? '');

package/dist/sap/onboarding.js

@@ -23,9 +23,45 @@ export async function runAddSapWizard() {
         validate: (v) => /^\d{3}$/.test(v) || 'Must be a 3-digit client number',
     });
     const useSsl = await confirm({ message: 'Use HTTPS/TLS?', default: true });
-    const sslVerify = useSsl
-        ? await confirm({ message: 'Verify server certificate? (Say no for self-signed SAP certs)', default: false })
-        : false;
+    // TLS posture (2026-06-14): verification is ON by default. For self-signed /
+    // internal-CA SAP systems, the production-grade answer is to trust the
+    // corporate CA (verification stays ON). Disabling verification is an explicit
+    // dev-only opt-out, never the default.
+    let caCertPath;
+    let insecureSkipTlsVerify = false;
+    if (useSsl) {
+        const tlsChoice = await select({
+            message: 'TLS certificate handling:',
+            choices: [
+                {
+                    name: 'verify (recommended) — trust the system certificate via the OS/Node trust store',
+                    value: 'verify',
+                    description: 'Use this when the SAP cert is issued by a public or already-trusted CA.',
+                },
+                {
+                    name: 'trust a corporate/internal CA — verification stays ON',
+                    value: 'ca',
+                    description: 'Best for self-signed / internal-CA SAP systems. Point CSPeach at your CA PEM file; verification remains enabled.',
+                },
+                {
+                    name: 'INSECURE — disable verification (dev only)',
+                    value: 'insecure',
+                    description: 'Last resort for a dev box with no CA available. Logs a loud warning on every connect. NEVER use in production.',
+                },
+            ],
+            default: 'verify',
+        });
+        if (tlsChoice === 'ca') {
+            caCertPath = await input({
+                message: 'Path to the CA certificate PEM file (e.g. /etc/ssl/corp-ca.pem):',
+                validate: (v) => v.length > 0 || 'Required',
+            });
+        }
+        else if (tlsChoice === 'insecure') {
+            console.log(chalk.yellow('  ⚠ TLS verification will be DISABLED for this system — dev only, NEVER use in production.'));
+            insecureSkipTlsVerify = true;
+        }
+    }
     const authType = await select({
         message: 'Authentication type:',
         choices: [
@@ -164,7 +200,9 @@ export async function runAddSapWizard() {
         port: Number(port),
         client,
         useSsl,
-        sslVerify,
+        // New TLS keys — verify by default; trust a CA, or explicit dev-only insecure.
+        ...(caCertPath ? { ca_cert_path: caCertPath } : {}),
+        ...(insecureSkipTlsVerify ? { insecure_skip_tls_verify: true } : {}),
         username,
         authType,
         certPath,