@cspeach/cli 0.9.0 → 1.1.0

package/dist/tools/ask-question.js

@@ -13,23 +13,161 @@
  * structurally reliable: the API validates the input schema, no parsing
  * needed, no streaming ambiguity.
  *
- * Renders:
+ * Renders (v1 single-question shape):
  *   - kind=text: prompt for free-form answer
  *   - kind=choice: arrow-key pick-one via inquirer select
  *   - kind=multi: space-to-toggle via inquirer checkbox
  *
  * Returns JSON `{ answer, id, kind, cancelled? }` so the LLM knows what
  * it just got back and can cross-reference the question id.
+ *
+ * UX Wave 2 — v2 batched `questions` shape (up to 4 related questions in
+ * ONE call): Ink renders a single <AskForm> (Task 2); classic runs the
+ * questions as a sequential inquirer flow (Task 3). Both return
+ * `{ formId, answers: [{id, answer, custom?}], cancelled? }`.
  */
 import chalk from 'chalk';
 import { registerTool } from './index.js';
 import { input, select, checkbox } from '@inquirer/prompts';
 import { withInquirer } from '../repl/inquirer-guard.js';
-import { shouldUseInk } from '../renderer/tty.js';
+import { shouldUseInk, isHeadless } from '../renderer/tty.js';
 import { askQuestionEmitter } from '../ui/ask-question-emitter.js';
+/** Chip labels in the v2 form are capped at 12 chars (brief-binding). */
+const HEADER_MAX_CHARS = 12;
+/**
+ * UX Wave 2 / Task 1 — validation failure for a v2 `questions` payload.
+ * The handler converts this into an error RESULT (`ask_form_invalid`),
+ * never a throw across the tool boundary.
+ */
+export class AskFormValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AskFormValidationError';
+    }
+}
+function normalizeOptions(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.map((o) => {
+        const opt = { value: String(o.value), label: String(o.label) };
+        if (o.description != null)
+            opt.description = String(o.description);
+        if (o.recommended === true)
+            opt.recommended = true;
+        return opt;
+    });
+}
+/**
+ * UX Wave 2 / Task 1 — normalize EVERY ask_question call (v1 single-question
+ * or v2 `questions` batch) into the one internal AskFormRequest shape.
+ *
+ * v1 mapping: kind=multi → multiSelect; kind=text (or no choices) →
+ * freeText with empty options; header defaults to the question id.
+ * v2 mapping is 1:1; headers (explicit or defaulted from id) are truncated
+ * to 12 chars for the chip row.
+ *
+ * IMPORTANT: normalization does NOT decide routing. The handler routes
+ * v1-shaped ORIGINALS through the untouched v1 code paths (byte-compat by
+ * construction); only genuine v2 calls reach the form machinery.
+ *
+ * Throws AskFormValidationError on an invalid v2 payload (0 or >4
+ * questions, entries missing id/question) — the handler converts that to
+ * an `ask_form_invalid` error result. Exported for tests.
+ */
+export function normalizeAskInput(args) {
+    const header = (q) => String(q.header != null && String(q.header).length > 0 ? q.header : q.id)
+        .slice(0, HEADER_MAX_CHARS);
+    if (Array.isArray(args?.questions)) {
+        const raw = args.questions;
+        if (raw.length < 1 || raw.length > 4) {
+            throw new AskFormValidationError(`\`questions\` must contain 1 to 4 items (got ${raw.length}). ` +
+                'Never ask more than 4 at once — split into a follow-up call instead.');
+        }
+        const questions = raw.map((q, i) => {
+            if (q == null || typeof q !== 'object' || q.id == null || q.question == null) {
+                throw new AskFormValidationError(`questions[${i}] is invalid — each entry needs at least { id, question }.`);
+            }
+            const options = normalizeOptions(q.options);
+            return {
+                id: String(q.id),
+                question: String(q.question),
+                context: q.context != null ? String(q.context) : undefined,
+                header: header({ id: String(q.id), header: q.header }),
+                multiSelect: q.multiSelect === true,
+                freeText: options.length === 0,
+                options,
+            };
+        });
+        const formId = args.id != null ? String(args.id) : questions.map((q) => q.id).join('+');
+        return { formId, questions };
+    }
+    // v1 single-question shape → one-question form.
+    const id = String(args.id);
+    const kind = args.kind;
+    const options = kind === 'text' ? [] : normalizeOptions(args.choices);
+    return {
+        formId: id,
+        questions: [{
+                id,
+                question: String(args.question),
+                context: args.context != null ? String(args.context) : undefined,
+                header: header({ id, header: undefined }),
+                multiSelect: kind === 'multi',
+                freeText: kind === 'text' || options.length === 0,
+                options,
+            }],
+    };
+}
+/**
+ * Label heuristic for rule 2 of pickHeadlessChoices: a string counts as
+ * "recommended" only when it contains the word AND that word is not part of
+ * a negation — skills write both "RAP (recommended)" and "SEGW (not
+ * recommended)" and the latter must NEVER win the auto-pick.
+ */
+function labelSaysRecommended(s) {
+    return /\brecommended\b/i.test(s) && !/\b(?:not|non|never)[\s-]+recommended\b/i.test(s);
+}
+/**
+ * B5 (2026-06-11) — headless auto-pick rule for choice/multi questions.
+ *
+ * Rule order (the fired rule is reported so logs and the tool result are
+ * honest about WHY an option was picked):
+ *   1. `recommended: true` on one or more choices → those choices
+ *      (rule: 'recommended').
+ *   2. No explicit flag, but a label/value contains the word "recommended"
+ *      (skills frequently write "RAP (recommended)") → those choices
+ *      (rule: 'recommended-label'). Negated forms ("not recommended",
+ *      "non-recommended", "never recommended") do NOT match.
+ *   3. Nothing marked → the FIRST option (rule: 'first-option').
+ *
+ * For kind=choice only the first match is taken; for kind=multi the whole
+ * recommended set is taken (or the first option when nothing is marked).
+ *
+ * Contract: `choices` must be non-empty — the handler guards with
+ * `choices.length > 0` before calling (an empty array means there is nothing
+ * to pick and the headless path returns the free-text error instead). An
+ * empty array here is a programming error, so this throws rather than
+ * returning `[undefined]`.
+ *
+ * Exported for unit testing.
+ */
+export function pickHeadlessChoices(kind, choices) {
+    if (choices.length === 0) {
+        throw new Error('pickHeadlessChoices requires at least one choice — callers must guard (see ask_question handler)');
+    }
+    const flagged = choices.filter((c) => c.recommended === true);
+    if (flagged.length > 0) {
+        return { picked: kind === 'multi' ? flagged : [flagged[0]], rule: 'recommended' };
+    }
+    const labelled = choices.filter((c) => labelSaysRecommended(c.label) || labelSaysRecommended(c.value));
+    if (labelled.length > 0) {
+        return { picked: kind === 'multi' ? labelled : [labelled[0]], rule: 'recommended-label' };
+    }
+    return { picked: [choices[0]], rule: 'first-option' };
+}
 registerTool({
     name: 'ask_question',
-    description: "Ask the user a clarifying question and get their answer. Use this for ANY user-decision point in a skill conversation — object names, design choices, approval checkpoints, etc. The CLI renders a formatted prompt, waits for the user's answer, and returns it as the tool result. Prefer this over emitting a text question — it is the only reliable mechanism for mid-turn user interaction.",
+    description: "Ask the user a clarifying question and get their answer. Use this for ANY user-decision point in a skill conversation — object names, design choices, approval checkpoints, etc. The CLI renders a formatted prompt, waits for the user's answer, and returns it as the tool result. Prefer this over emitting a text question — it is the only reliable mechanism for mid-turn user interaction. When you have MULTIPLE related questions, batch up to 4 into ONE call via `questions` — the user answers them in a single form. Never ask more than 4 at once; never split related questions across calls.",
     isMutating: false,
     input_schema: {
         type: 'object',
@@ -59,21 +197,276 @@ registerTool({
                     properties: {
                         value: { type: 'string', description: 'Machine value returned if the user picks this.' },
                         label: { type: 'string', description: 'Human-readable label shown in the picker.' },
+                        recommended: {
+                            type: 'boolean',
+                            description: 'Mark the option you would recommend. In headless (non-interactive) runs this option is auto-picked; in interactive runs it is informational only.',
+                        },
                     },
                     required: ['value', 'label'],
                 },
             },
+            questions: {
+                type: 'array',
+                minItems: 1,
+                maxItems: 4,
+                description: 'v2 batched form — ask up to 4 related questions in ONE call; the user answers them all in a single form. When `questions` is provided, the single-question fields (question/kind/choices) are ignored; a top-level `id` (if given) names the form. Omit `options` on a question for a free-text answer.',
+                items: {
+                    type: 'object',
+                    properties: {
+                        id: { type: 'string', description: 'Short stable identifier for this question.' },
+                        question: { type: 'string', description: 'The question text. Keep concise — max ~200 chars.' },
+                        context: { type: 'string', description: 'Optional one-line explanation of why this matters.' },
+                        header: {
+                            type: 'string',
+                            description: 'Optional chip label for the form header row (max 12 chars). Defaults to the question id.',
+                        },
+                        multiSelect: {
+                            type: 'boolean',
+                            description: 'true = the user may pick several options; false/omitted = pick exactly one.',
+                        },
+                        options: {
+                            type: 'array',
+                            description: 'Answer options. Omit entirely for a free-text question.',
+                            items: {
+                                type: 'object',
+                                properties: {
+                                    value: { type: 'string', description: 'Machine value returned if the user picks this.' },
+                                    label: { type: 'string', description: 'Human-readable label shown in the form.' },
+                                    description: { type: 'string', description: 'Optional secondary line, rendered dim under the label.' },
+                                    recommended: {
+                                        type: 'boolean',
+                                        description: 'Mark the option you would recommend. Auto-picked in headless runs.',
+                                    },
+                                },
+                                required: ['value', 'label'],
+                            },
+                        },
+                    },
+                    required: ['id', 'question'],
+                },
+            },
         },
-        required: ['id', 'question', 'kind'],
+        // v2: `questions` replaces the single-question fields, so nothing can be
+        // unconditionally required any more. Single-question calls still need
+        // id/question/kind (per their descriptions); batched calls need `questions`.
+        required: [],
     },
     handler: async (args, _ctx) => {
+        // UX Wave 2 / Task 1 — v2 batched form branch. Routing rule (byte-compat
+        // by construction): ONLY calls that actually send a `questions` array
+        // enter the form machinery; every v1-shaped original falls through to
+        // the untouched v1 code paths below — identical prompts, results, and
+        // headless behavior, guaranteed structurally rather than by re-testing.
+        if (Array.isArray(args.questions)) {
+            let form;
+            try {
+                form = normalizeAskInput(args);
+            }
+            catch (err) {
+                if (err instanceof AskFormValidationError) {
+                    return {
+                        content: JSON.stringify({ error: 'ask_form_invalid', message: err.message }),
+                        is_error: true,
+                    };
+                }
+                throw err;
+            }
+            // Headless v2 — fully implemented NOW (per-question policy, mirroring
+            // the v1 B5 rules): optioned questions auto-pick with the fired rule
+            // reported; a free-text question inside a batch becomes a per-question
+            // `headless_unanswerable` entry but NEVER fails the whole form.
+            if (isHeadless()) {
+                const answers = form.questions.map((q) => {
+                    if (!q.freeText && q.options.length > 0) {
+                        const { picked, rule } = pickHeadlessChoices(q.multiSelect ? 'multi' : 'choice', q.options);
+                        const answer = picked.map((c) => c.value).join(',');
+                        console.error(chalk.dim(`headless: auto-answered '${q.question}' → '${answer}' (${rule})`));
+                        return { id: q.id, answer, auto_answered: true, auto_answer_rule: rule };
+                    }
+                    console.error(chalk.yellow(`headless: cannot answer free-text question '${q.question}' — ` +
+                        'provide this detail in the prompt or run interactively.'));
+                    return { id: q.id, answer: null, error: 'headless_unanswerable' };
+                });
+                return {
+                    content: JSON.stringify({
+                        formId: form.formId,
+                        headless: true,
+                        answers,
+                        note: 'Headless run: the user did not actually answer this form. Optioned questions ' +
+                            'were auto-selected (rule reported per answer); free-text questions are ' +
+                            'unanswerable (answer: null). Proceed with sensible assumptions and clearly ' +
+                            'note them in your final output.',
+                    }),
+                };
+            }
+            // Interactive v2, INK path — wired by Task 2: requestForm emits the
+            // discriminated form request, App routes it to <AskForm> (v1 requests
+            // keep rendering the untouched AskQuestionModal), and the resolved
+            // AskFormResult comes back here. Cancel (Esc / no listener) mirrors
+            // the v1 cancel contract: empty answers + cancelled: true.
+            if (shouldUseInk()) {
+                const result = await askQuestionEmitter.requestForm(form);
+                if (result.cancelled) {
+                    return {
+                        content: JSON.stringify({ formId: form.formId, answers: [], cancelled: true }),
+                    };
+                }
+                return {
+                    content: JSON.stringify({ formId: result.formId, answers: result.answers }),
+                };
+            }
+            // Interactive v2, CLASSIC path — Task 3 flag-day (this replaces the
+            // Task-1 `ask_form_not_wired` stub; Task 2 wired the Ink side).
+            // Sequential inquirer prompts, one per question IN FORM ORDER, each
+            // under a dim `form i/n · <header>` progress prefix and built from
+            // the v1 building blocks: select + "(type a custom answer)" escape
+            // for pick-one, checkbox for multiSelect, input for freeText.
+            //
+            // Result shapes mirror the Ink AskForm EXACTLY (Task-2 contract):
+            //   success → { formId, answers: [{ id, answer, custom? }] }  — in
+            //             question order; custom:true ONLY for the escape.
+            //   Esc anywhere (ExitPromptError) → { formId, answers: [],
+            //             cancelled: true } — the WHOLE form cancels, partial
+            //             answers are discarded (non-error content, v1 cancel
+            //             semantics).
+            // Empty submissions re-prompt, mirroring the Ink form ignoring
+            // empty submits — a committed form answer is never empty.
+            {
+                const total = form.questions.length;
+                const answers = [];
+                try {
+                    for (let i = 0; i < total; i++) {
+                        const q = form.questions[i];
+                        console.log('');
+                        console.log(chalk.dim(`form ${i + 1}/${total} · ${q.header ?? q.id}`));
+                        console.log(chalk.bold(q.question));
+                        if (q.context)
+                            console.log(chalk.dim(q.context));
+                        console.log('');
+                        let entry = null;
+                        while (entry === null) {
+                            if (!q.freeText && !q.multiSelect && q.options.length > 0) {
+                                // Pick-one — same select + custom-escape recipe as v1.
+                                const CUSTOM = '__cspeach_custom__';
+                                const picked = await withInquirer(() => select({
+                                    message: 'Pick an answer:',
+                                    choices: [
+                                        ...q.options.map((c) => ({ value: c.value, name: c.label })),
+                                        { value: CUSTOM, name: chalk.dim('(type a custom answer)') },
+                                    ],
+                                }));
+                                if (picked === CUSTOM) {
+                                    const raw = (await withInquirer(() => input({ message: 'Your answer:' }))).trim();
+                                    if (raw.length === 0)
+                                        continue; // empty custom — re-prompt
+                                    entry = { id: q.id, answer: raw, custom: true };
+                                }
+                                else {
+                                    entry = { id: q.id, answer: picked };
+                                }
+                            }
+                            else if (q.multiSelect && q.options.length > 0) {
+                                const picked = await withInquirer(() => checkbox({
+                                    message: 'Pick one or more (space to toggle, enter to confirm):',
+                                    choices: q.options.map((c) => ({ value: c.value, name: c.label })),
+                                }));
+                                if (picked.length === 0)
+                                    continue; // nothing toggled — re-prompt
+                                entry = { id: q.id, answer: picked.join(',') };
+                            }
+                            else {
+                                // freeText (options empty — including multiSelect without
+                                // options, which normalization degrades to freeText).
+                                const raw = (await withInquirer(() => input({ message: 'Your answer:' }))).trim();
+                                if (raw.length === 0)
+                                    continue;
+                                entry = { id: q.id, answer: raw };
+                            }
+                        }
+                        console.log(chalk.dim(`  → ${entry.answer}`));
+                        answers.push(entry);
+                    }
+                }
+                catch (err) {
+                    const name = err?.name;
+                    if (name === 'ExitPromptError') {
+                        return {
+                            content: JSON.stringify({ formId: form.formId, answers: [], cancelled: true }),
+                        };
+                    }
+                    throw err;
+                }
+                return { content: JSON.stringify({ formId: form.formId, answers }) };
+            }
+        }
+        // UX Wave 2 / Task 1 review fix — malformed v1 shape guard. With
+        // `required: []` on the schema (needed so `questions`-only calls pass
+        // API validation) a call like `{id:'x'}` with no question/kind/questions
+        // would reach the v1 paths: headless would embed the literal question
+        // "undefined" in its error, and interactive would render a bold prompt
+        // reading `undefined` and BLOCK the loop on user input. Reject it here
+        // with a structured error result instead. Unreachable for any
+        // previously-valid v1 call (id/question/kind used to be schema-required)
+        // ⇒ zero byte-compat exposure.
+        if (args.id == null || args.question == null || args.kind == null) {
+            return {
+                content: JSON.stringify({
+                    error: 'ask_question_invalid',
+                    message: 'Invalid ask_question call: the single-question shape requires `id`, `question`, ' +
+                        'and `kind` ("text" | "choice" | "multi"). To ask several related questions at ' +
+                        'once, use the `questions` array (1-4 items, each { id, question, ... }) instead.',
+                }),
+                is_error: true,
+            };
+        }
         const id = String(args.id);
         const question = String(args.question);
         const context = args.context ? String(args.context) : undefined;
         const kind = args.kind;
-        const choices = Array.isArray(args.choices)
-            ? args.choices
-            : [];
+        const choices = Array.isArray(args.choices) ? args.choices : [];
+        // B5 (2026-06-11) — headless answer policy (defects D1/D1b). In a
+        // headless run (one-shot / piped stdin) NO prompt may ever block on
+        // stdin: battery S2 Pass A stalled forever on exactly this path.
+        //   - choice/multi WITH options: auto-pick (recommended > recommended-
+        //     label > first option), log to stderr, and tell the model via
+        //     `auto_answered: true` that the user did NOT really answer.
+        //   - free text (or choice/multi without options): no auto-answer is
+        //     possible — return an error RESULT to the model (not a hard exit)
+        //     so it can finish gracefully with documented assumptions, the way
+        //     S2 Pass B completed when answers were supplied up front.
+        if (isHeadless()) {
+            if ((kind === 'choice' || kind === 'multi') && choices.length > 0) {
+                const { picked, rule } = pickHeadlessChoices(kind, choices);
+                const answer = picked.map((c) => c.value).join(',');
+                console.error(chalk.dim(`headless: auto-answered '${question}' → '${answer}' (${rule})`));
+                return {
+                    content: JSON.stringify({
+                        id,
+                        kind,
+                        answer,
+                        headless: true,
+                        auto_answered: true,
+                        auto_answer_rule: rule,
+                        note: 'Headless run: the user did not actually answer — this option was auto-selected ' +
+                            `(${rule}). Proceed with it and clearly note the assumption in your final output.`,
+                    }),
+                };
+            }
+            console.error(chalk.yellow(`headless: cannot answer free-text question '${question}' — ` +
+                'provide this detail in the prompt or run interactively.'));
+            return {
+                content: JSON.stringify({
+                    id,
+                    kind,
+                    headless: true,
+                    error: 'headless_unanswerable',
+                    message: `Headless run: no user is available to answer this free-text question: "${question}". ` +
+                        'Either proceed with a sensible assumption and CLEARLY document it in your final output, ' +
+                        'or finish by telling the user to include this detail in the prompt or run interactively.',
+                }),
+                is_error: true,
+            };
+        }
         // 2026-05-01 redesign: when the LLM provides choices, use a real
         // arrow-key picker (select / checkbox) instead of free-text input.
         // The previous "always free-text, smart-resolve digits" pattern produced

package/dist/tools/capability/tool.js

@@ -0,0 +1,74 @@
+/**
+ * `system_capability` — the data-driven capability gate behind Pillar A.
+ *
+ * Given a capability id (cds.viewEntity | rap.managed | abap.filterExpr |
+ * abap.inlineData) or a raw ABAP feature name, returns a yes/no/with-fallback
+ * verdict for the CONNECTED SAP release, read out of the committed ABAP
+ * feature-matrix snapshot. Skills call this instead of hardcoding version
+ * prose like "FILTER needs 7.50".
+ *
+ * Read-only: it consults system-info (which caches/queries CVERS once) and a
+ * static snapshot — it never writes to SAP. Flag-gated with the other
+ * local-build tools (rides the `local_build` switch via LOCAL_BUILD_TOOLS).
+ *
+ * See docs/superpowers/specs/2026-06-24-revision-aware-cspeach-design.md.
+ */
+import { registerTool } from '../index.js';
+import { getSapSystemInfo } from '../../sap/system-info.js';
+import { loadCapabilityMatrix } from '../../sap/capability-matrix.js';
+import { resolveCapability, CAPABILITY_REGISTRY, } from '../../sap/capability.js';
+function isRegistryId(s) {
+    return Object.prototype.hasOwnProperty.call(CAPABILITY_REGISTRY, s);
+}
+async function systemCapabilityHandler(args, ctx) {
+    const capability = args?.capability;
+    if (typeof capability !== 'string' || capability.trim() === '') {
+        return { content: 'error: capability (non-empty string) is required', is_error: true };
+    }
+    const info = await getSapSystemInfo(ctx.adt, ctx.sapAlias);
+    if (!info) {
+        // Release undetectable. Build a minimal verdict-like JSON: with-fallback
+        // when the caller asked for a registry id that HAS a fallback, else no.
+        const fallback = isRegistryId(capability)
+            ? CAPABILITY_REGISTRY[capability].fallback || undefined
+            : undefined;
+        const feature = isRegistryId(capability) ? CAPABILITY_REGISTRY[capability].feature : capability;
+        const verdict = {
+            capability,
+            feature,
+            status: fallback ? 'with-fallback' : 'no',
+            reason: 'SAP release could not be detected — verify the system manually before relying on this feature',
+            release: 'unknown',
+            column: null,
+            source: 'matrix-snapshot',
+            ...(fallback ? { fallback } : {}),
+        };
+        return { content: JSON.stringify(verdict) };
+    }
+    const verdict = resolveCapability(info, loadCapabilityMatrix(), capability);
+    return { content: JSON.stringify(verdict) };
+}
+registerTool({
+    name: 'system_capability',
+    description: 'Returns yes / no / with-fallback for whether the CONNECTED SAP release supports a given ABAP '
+        + 'capability, read out of the committed ABAP feature-matrix snapshot — so skills stop hardcoding '
+        + 'version prose like "FILTER needs 7.50". Pass a capability gate id (cds.viewEntity | rap.managed | '
+        + 'abap.filterExpr | abap.inlineData) OR a raw ABAP feature name from the matrix. The verdict carries '
+        + 'the feature consulted, the matrix column used, the reason, and (only for with-fallback) a concrete '
+        + 'fallback instruction. Read-only — never writes to SAP.',
+    isMutating: false,
+    category: 'sap',
+    flagGated: true,
+    input_schema: {
+        type: 'object',
+        properties: {
+            capability: {
+                type: 'string',
+                description: 'A capability gate id (cds.viewEntity | rap.managed | abap.filterExpr | abap.inlineData) '
+                    + 'OR a raw ABAP feature name from the matrix.',
+            },
+        },
+        required: ['capability'],
+    },
+    handler: systemCapabilityHandler,
+});

package/dist/tools/dispatch-skill.js

@@ -22,11 +22,20 @@
  *
  * The harness clears pendingDispatch at the start of every consume cycle,
  * so a stale dispatch from a prior turn never re-fires.
+ *
+ * A1 (2026-06-10, defect D23): `/abap-plan --resume …` is REJECTED here.
+ * Plan auto-run is harness-owned — commands/plan-resume.ts builds the
+ * resume command from the exact path it just saved and queues it itself
+ * (offerNextPhaseAutoRun). When the model authored this text it once
+ * hallucinated a wrong base token ("@…-plan-c1" → "no file matching")
+ * while the harness had just printed the real saved path. The tool stays
+ * for every other dispatch (e.g. /abap-generate → /abap-rap switch).
  */
 import { registerTool } from './index.js';
+import { isPlanResumeCommand } from '../commands/plan-resume.js';
 registerTool({
     name: 'dispatch_skill',
-    description: 'Queue the next user submission to a slash command the user already explicitly approved via an inquirer picker. Use this in place of telling the user "Type X at the next prompt" — re-typing what they already picked is friction. Only call this AFTER an explicit user consent (ask_question pick, picker confirmation, etc.); never from prose or a one-line suggestion. The command must start with a known slash route (e.g. "/abap-rap --from @<file>"). After this tool returns, end the turn — do not also print a continuation hint.',
+    description: 'Queue the next user submission to a slash command the user already explicitly approved via an inquirer picker. Use this in place of telling the user "Type X at the next prompt" — re-typing what they already picked is friction. Only call this AFTER an explicit user consent (ask_question pick, picker confirmation, etc.); never from prose or a one-line suggestion. The command must start with a known slash route (e.g. "/abap-rap --from @<file>"). NEVER dispatch "/abap-plan --resume" — plan continuation is harness-owned: the CLI offers and dispatches the next phase itself after the manifest is persisted. After this tool returns, end the turn — do not also print a continuation hint.',
     isMutating: false,
     input_schema: {
         type: 'object',
@@ -58,6 +67,18 @@ registerTool({
                 }),
             };
         }
+        // A1 (defect D23) — plan auto-run is harness-owned. The CLI builds the
+        // resume command from the exact saved envelope path and asks the user
+        // itself; a model-authored variant risks a hallucinated file token.
+        if (isPlanResumeCommand(command)) {
+            return {
+                is_error: true,
+                content: JSON.stringify({
+                    error: 'PLAN_RESUME_HARNESS_OWNED',
+                    reason: 'Do not dispatch /abap-plan --resume. After your plan manifest is persisted, the CLI itself offers the user the next phase and dispatches the resume with the exact saved file in a fresh bounded context. Simply end the turn now.',
+                }),
+            };
+        }
         if (!ctx.pendingDispatch) {
             // Non-REPL path (one-shot, tests). Tell the model the dispatch
             // can't take effect here so it falls back to a continuation hint.