@cspeach/cli 1.0.0 → 1.1.1

package/dist/projects/run-lease.js

@@ -0,0 +1,157 @@
+// cspeach-cli/src/projects/run-lease.ts
+//
+// Task 9 (agentic-flow, 2026-07-03) — run lease: concurrent-resume guard for
+// plan envelopes.
+//
+// Problem: two sessions resuming the same plan fork sibling envelope
+// versions silently — saveProject appends collision suffixes and the
+// newest-version redirect tie-breaks on mtime, so neither session notices
+// the other. Guarded mode's long unattended chains make a double-resume
+// likelier. A lightweight lease file makes the second session STOP and say
+// who is already running.
+//
+// Design choices (pinned by __tests__/run-lease.test.ts):
+//
+// - FAMILY-KEYED: the lock path strips the `-vN[-M]` version suffix (same
+//   convention as handoverPathFor in handover-md.ts), so the v3→v4 rotation
+//   every phase save performs does NOT drop the lease —
+//   `hr-plan-ab12-v3.cspeach.json` and `...-v4.cspeach.json` share
+//   `hr-plan-ab12.cspeach.lock`. The FAMILY is the thing being resumed;
+//   individual version files are just its snapshots.
+//
+// - SAME-SESSION IDEMPOTENT: re-acquiring with the sessionId already on the
+//   lease succeeds (and refreshes it). The plan chain re-enters
+//   preparePlanResume on EVERY phase via queueDispatch — without this the
+//   guarded chain would deadlock on its own lease.
+//
+// - STALENESS BY PID LIVENESS: a lease whose holder pid is not alive
+//   (process.kill(pid, 0) throws — works for liveness probing on Windows
+//   Node too) is silently replaced. A crashed or killed session therefore
+//   never needs manual cleanup.
+//
+// - BEST-EFFORT, NOT A SECURITY BOUNDARY: any fs failure while checking or
+//   writing the lease logs one line and reports `acquired: true` —
+//   availability over strictness; a resume must never be blocked by a
+//   broken lock file or a read-only workspace. This is a courtesy guard
+//   against accidental double-resume, nothing more.
+import fs from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+/**
+ * The lease file for an envelope path — keyed on the plan FAMILY base
+ * (version suffix `-vN` and any `-vN-M` collision sub-suffix stripped, same
+ * convention as handoverPathFor), so every version of one plan family maps
+ * to ONE lock file. Non-envelope paths fall back to `<path>.lock`.
+ */
+export function leasePathFor(envelopePath) {
+    const name = basename(envelopePath);
+    if (!name.endsWith('.cspeach.json'))
+        return `${envelopePath}.lock`;
+    const base = name.replace(/(?:-v\d+(?:-\d+)?)?\.cspeach\.json$/, '');
+    return join(dirname(envelopePath), `${base}.cspeach.lock`);
+}
+/**
+ * Liveness probe: signal 0 never delivers, only checks existence. On
+ * Windows Node this maps to an OpenProcess check — valid for liveness.
+ * EPERM means "alive but not ours to signal" — that IS alive.
+ */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === 'EPERM';
+    }
+}
+/**
+ * Try to take the run lease for a plan envelope's family.
+ *
+ * - no lease / stale lease (dead pid) / corrupt lock → acquired, silently
+ * - lease held by the SAME sessionId → acquired (idempotent re-entry;
+ *   the file is refreshed with the current pid + timestamp)
+ * - lease held by a LIVE other session → `{ acquired: false, holder }`
+ * - `force: true` → acquired unconditionally (caller obtained user consent)
+ * - ANY fs error → `{ acquired: true }` after one log line (best-effort)
+ *
+ * The write is atomic (tmp + rename, same style as session/store.ts) so a
+ * concurrent reader never sees a half-written lock.
+ */
+export function acquireRunLease(envelopePath, sessionId, opts) {
+    const lockPath = leasePathFor(envelopePath);
+    try {
+        if (!opts?.force) {
+            let existing = null;
+            try {
+                const raw = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+                if (typeof raw.pid === 'number' && typeof raw.sessionId === 'string') {
+                    existing = { pid: raw.pid, sessionId: raw.sessionId, at: typeof raw.at === 'string' ? raw.at : '' };
+                }
+                // Malformed shape → existing stays null: garbage never holds a lease.
+            }
+            catch {
+                existing = null; // missing or unparseable — treat as absent
+            }
+            if (existing && existing.sessionId !== sessionId && isPidAlive(existing.pid)) {
+                return { acquired: false, holder: existing };
+            }
+        }
+        const holder = { pid: process.pid, sessionId, at: new Date().toISOString() };
+        const tmp = `${lockPath}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(holder, null, 2), 'utf8');
+        try {
+            fs.renameSync(tmp, lockPath);
+        }
+        catch (e) {
+            // Don't orphan the tmp file — best-effort cleanup, then let the outer
+            // catch handle the failure as usual (proceed-as-acquired).
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch { /* best-effort */ }
+            throw e;
+        }
+        return { acquired: true, holder };
+    }
+    catch (e) {
+        // Best-effort by design: a broken lock dir must never block a resume.
+        opts?.log?.(`[plan] run-lease check skipped (${e instanceof Error ? e.message : String(e)}) — proceeding without the concurrency guard.`);
+        return { acquired: true };
+    }
+}
+/**
+ * Release the run lease for a plan envelope's family. Ownership-checked:
+ * a lock held by a DIFFERENT live pid (e.g. another session overrode us
+ * mid-run with user consent) is left untouched — we only ever delete our
+ * own, or a dead holder's, lock. Best-effort: all failures are swallowed
+ * (a leaked lease goes stale with the process anyway).
+ */
+export function releaseRunLease(envelopePath) {
+    const lockPath = leasePathFor(envelopePath);
+    try {
+        const raw = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+        if (typeof raw.pid === 'number' && raw.pid !== process.pid && isPidAlive(raw.pid)) {
+            return; // live foreign holder — never delete someone else's lease
+        }
+        fs.unlinkSync(lockPath);
+    }
+    catch {
+        // missing / unreadable / undeletable — nothing useful to do
+    }
+}
+/**
+ * Chain-aware release for the REPL's plan-resume legs: when a follow-up
+ * dispatch is QUEUED (`queuedDispatch` non-empty — the pendingDispatch slot
+ * still holds the harness-built next `--resume` command), the lease is HELD
+ * across the gap. Releasing between auto-chained phases would let a second
+ * session grab the family lock mid-chain (headless: the chain silently
+ * stops on re-entry; interactive: the user is prompted mid-auto-chain, and
+ * a takeover forks the plan — the exact failure the lease exists to
+ * prevent). The re-entry's same-session re-acquire is idempotent, so
+ * holding through the gap is free. Only when the chain truly ends (nothing
+ * queued) is the lease released.
+ */
+export function releaseRunLeaseUnlessChained(envelopePath, queuedDispatch) {
+    if (queuedDispatch)
+        return; // chain continues — hold the lease across the dispatch
+    releaseRunLease(envelopePath);
+}

package/dist/projects/save-command.js

@@ -15,6 +15,7 @@ import { validateEnvelope } from './validate.js';
 import { readProjectFile } from './status.js';
 import { saveProject } from './save.js';
 import { renderEmailTemplate } from './email-template.js';
+import { writePlanHandover } from './handover-md.js';
 import { ensureWorkspace, resolveWorkspacePath } from './workspace.js';
 const SKILL_REGISTRY = {
     'abap-spec-gap': {
@@ -36,19 +37,19 @@ const SKILL_REGISTRY = {
         artefactType: 'upgrade-scan',
         extract: (md) => extractUpgradeScan(md),
         itemNoun: 'findings',
-        manifestMarker: 'csforge:upgrade-manifest',
+        manifestMarker: 'upgrade-manifest',
     },
     'abap-upgrade-fix': {
         artefactType: 'upgrade-progress',
         extract: (md) => extractUpgradeProgress(md),
         itemNoun: 'fixes',
-        manifestMarker: 'csforge:upgrade-manifest',
+        manifestMarker: 'upgrade-manifest',
     },
     'abap-upgrade-verify': {
         artefactType: 'upgrade-report',
         extract: (md) => extractUpgradeReport(md),
         itemNoun: 'regressions',
-        manifestMarker: 'csforge:upgrade-manifest',
+        manifestMarker: 'upgrade-manifest',
     },
     'abap-upgrade-merge': {
         // Merge produces a NEW upgrade-progress (consolidated) — same shape
@@ -56,13 +57,13 @@ const SKILL_REGISTRY = {
         artefactType: 'upgrade-progress',
         extract: (md) => extractUpgradeProgress(md),
         itemNoun: 'fixes',
-        manifestMarker: 'csforge:upgrade-manifest',
+        manifestMarker: 'upgrade-manifest',
     },
     'abap-cca': {
         artefactType: 'cca-assessment',
         extract: (md) => extractCcaAssessment(md),
         itemNoun: 'classifications',
-        manifestMarker: 'csforge:cca-manifest',
+        manifestMarker: 'cca-manifest',
     },
     'abap-cca-merge': {
         // Merge produces a NEW cca-assessment (consolidated) — same shape as
@@ -70,19 +71,19 @@ const SKILL_REGISTRY = {
         artefactType: 'cca-assessment',
         extract: (md) => extractCcaAssessment(md),
         itemNoun: 'classifications',
-        manifestMarker: 'csforge:cca-manifest',
+        manifestMarker: 'cca-manifest',
     },
     'abap-modernize': {
         artefactType: 'modernize-result',
         extract: (md) => extractModernizeResult(md),
         itemNoun: 'modernizations',
-        manifestMarker: 'csforge:modernize-manifest',
+        manifestMarker: 'modernize-manifest',
     },
     'abap-test': {
         artefactType: 'test-coverage',
         extract: (md) => extractTestCoverage(md),
         itemNoun: 'tests',
-        manifestMarker: 'csforge:test-coverage-manifest',
+        manifestMarker: 'test-coverage-manifest',
     },
     'abap-plan': {
         // 2026-06-06 B3: Mode 1 (create) save. Mode 2 (--resume) turns
@@ -97,7 +98,7 @@ const SKILL_REGISTRY = {
         artefactType: 'plan',
         extract: (md) => extractPlan(md),
         itemNoun: 'phases',
-        manifestMarker: 'csforge:plan-manifest',
+        manifestMarker: 'plan-manifest',
     },
 };
 /**
@@ -114,15 +115,17 @@ const SKILL_REGISTRY = {
  * inside the block disambiguates which extractor (registry skill) applies.
  */
 export function detectArtifactSkill(markdown) {
-    if (/<!--\s*csforge:plan-manifest\b/.test(markdown))
+    // E2 dual-read: accept both the legacy `csforge:` and current `cspeach:`
+    // marker prefixes (legacy acceptance is permanent).
+    if (/<!--\s*(?:csforge|cspeach):plan-manifest\b/.test(markdown))
         return 'abap-plan';
-    if (/<!--\s*csforge:cca-manifest\b/.test(markdown))
+    if (/<!--\s*(?:csforge|cspeach):cca-manifest\b/.test(markdown))
         return 'abap-cca';
-    if (/<!--\s*csforge:modernize-manifest\b/.test(markdown))
+    if (/<!--\s*(?:csforge|cspeach):modernize-manifest\b/.test(markdown))
         return 'abap-modernize';
-    if (/<!--\s*csforge:test-coverage-manifest\b/.test(markdown))
+    if (/<!--\s*(?:csforge|cspeach):test-coverage-manifest\b/.test(markdown))
         return 'abap-test';
-    const up = /<!--\s*csforge:upgrade-manifest\s*\n([\s\S]*?)\n\s*-->/.exec(markdown);
+    const up = /<!--\s*(?:csforge|cspeach):upgrade-manifest\s*\n([\s\S]*?)\n\s*-->/.exec(markdown);
     if (up) {
         const art = /(?:^|\n)\s*artefact:\s*(\S+)/.exec(up[1] ?? '');
         switch (art?.[1]) {
@@ -135,7 +138,8 @@ export function detectArtifactSkill(markdown) {
     return null;
 }
 // Same block grammar as extract-plan.ts:MANIFEST_RE (last block wins).
-const PLAN_MANIFEST_RE = /<!--\s*csforge:plan-manifest\s*\n([\s\S]*?)\n\s*-->/g;
+// E2 dual-read: accept both the legacy `csforge:` and current `cspeach:` prefixes.
+const PLAN_MANIFEST_RE = /<!--\s*(?:csforge|cspeach):plan-manifest\s*\n([\s\S]*?)\n\s*-->/g;
 /**
  * Cheap title peek into the LAST plan-manifest block — needed BEFORE the full
  * extract because compact manifests can only be expanded against the prior
@@ -349,6 +353,13 @@ export async function runSaveCommand(args) {
         outDir = args.cwd;
     }
     const path = await saveProject(env, { cwd: outDir });
+    // Task 8 follow-up (fix-wave): a plan envelope saved through the GENERIC
+    // save path (Mode 1 create AND a steered revision, C1/D30) must regenerate
+    // the markdown handover projection too — otherwise an authoring-session
+    // save leaves a stale or missing projection until the first --resume write.
+    // Best-effort by design (writePlanHandover logs one dim line on failure).
+    if (spec.artefactType === 'plan')
+        writePlanHandover(path, args.log);
     args.log(`Saved: ${path}`);
     if (planExtract && prior) {
         args.log(`(revision v${env.version} of the existing plan — version chain preserved, no new id)`);

package/dist/renderer/status-footer.js

@@ -40,7 +40,7 @@ export const LARGE_SESSION_THRESHOLD = 100_000;
  * direct stdout (which would corrupt the live Ink frame).
  */
 export function formatStatusFooter(params) {
-    const { sessionId, sapAlias, skill, turnCount, tokens, cachedTokens, elapsedMs, costThisTurn, costSession, sessionInputTokens } = params;
+    const { sessionId, sapAlias, skill, turnCount, tokens, cachedTokens, elapsedMs, costThisTurn, costSession, sessionInputTokens, variant } = params;
     const shortSession = sessionId.slice(0, 8);
     const skillDisplay = skill.startsWith('/') ? skill : `/${skill}`;
     const turns = `${turnCount} turn${turnCount === 1 ? '' : 's'}`;
@@ -49,17 +49,27 @@ export function formatStatusFooter(params) {
     const elapsed = elapsedMs > 0 ? `${(elapsedMs / 1000).toFixed(1)}s` : '';
     const costTurnStr = costThisTurn != null ? formatCost(costThisTurn) : '';
     const costSessStr = costSession != null ? `session: ${formatCost(costSession)}` : '';
-    const parts = [
-        chalk.dim(`session ${shortSession}`),
-        chalk.dim(sapAlias),
-        chalk.dim(skillDisplay),
-        chalk.dim(turns),
-        chalk.dim(tokStr),
-        ...(costTurnStr ? [chalk.dim(costTurnStr)] : []),
-        ...(cachedStr ? [chalk.dim(cachedStr)] : []),
-        ...(costSessStr ? [chalk.dim(costSessStr)] : []),
-        ...(elapsed ? [chalk.dim(elapsed)] : []),
-    ];
+    // Ink turn-receipt (see the variant doc on StatusFooterParams):
+    // turn-only facts — everything session-scoped lives in <StatusLine />.
+    const parts = variant === 'turn'
+        ? [
+            chalk.dim(skillDisplay),
+            chalk.dim(turns),
+            chalk.dim(tokStr),
+            ...(costTurnStr ? [chalk.dim(costTurnStr)] : []),
+            ...(elapsed ? [chalk.dim(elapsed)] : []),
+        ]
+        : [
+            chalk.dim(`session ${shortSession}`),
+            chalk.dim(sapAlias),
+            chalk.dim(skillDisplay),
+            chalk.dim(turns),
+            chalk.dim(tokStr),
+            ...(costTurnStr ? [chalk.dim(costTurnStr)] : []),
+            ...(cachedStr ? [chalk.dim(cachedStr)] : []),
+            ...(costSessStr ? [chalk.dim(costSessStr)] : []),
+            ...(elapsed ? [chalk.dim(elapsed)] : []),
+        ];
     const lines = ['', RULE, ' ' + parts.join(chalk.dim(' │ '))];
     if (sessionInputTokens != null && sessionInputTokens >= LARGE_SESSION_THRESHOLD) {
         lines.push(' ' + chalk.yellow(`⚠  session getting large (${sessionInputTokens.toLocaleString()} input tokens)`

package/dist/renderer/thinking-heartbeat.js

@@ -48,24 +48,67 @@ const GENERIC_SUFFIXES = [
     { at: 120_000, suffix: ' (2m — still running; Ctrl+C aborts the turn)' },
     { at: 300_000, suffix: ' (5m — likely stuck; Ctrl+C and check the VPN)' },
 ];
+/**
+ * 2026-07-06 (audit-timeout) — the plan-chain audit's own liveness schedule.
+ *
+ * The audit is a PROXY model call (api.cspeach.dev over the internet), NOT a
+ * SAP tool call, so the generic schedule's "check the VPN" 5m copy is a WRONG
+ * diagnosis (the VPN is only for SAP). It is also now bounded: runPhaseAudit
+ * enforces a 120s hard deadline PER attempt × 3 attempts, so the whole audit
+ * can never exceed ~6m before it returns infra_failed — no infinite hang. This
+ * schedule reflects that reality honestly: past 2m the audit is necessarily in
+ * a retry (a single attempt hard-stops at 120s), and there is nothing to check
+ * — it either recovers on the next attempt or returns infra_failed. The
+ * per-attempt transition ("[audit] attempt N of 3 (previous timed out)") is
+ * printed separately by plan-chain via runPhaseAudit's onRetry hook.
+ */
+export const AUDIT_HEARTBEAT_THRESHOLDS = [
+    { at: 3_000, label: '[audit] …running' },
+    { at: 10_000, label: '[audit] …running (10s)' },
+    { at: 30_000, label: '[audit] …running (30s)' },
+    { at: 60_000, label: '[audit] …running (60s — still running, large evidence can take a while)' },
+    { at: 120_000, label: '[audit] …running (2m — still running; large evidence can take a while · Ctrl+C aborts the turn)' },
+    { at: 240_000, label: '[audit] …running (4m — a prior attempt timed out; retrying · Ctrl+C aborts the turn)' },
+    { at: 300_000, label: '[audit] …running (5m — nearly at the retry ceiling; will stop and re-audit on resume if it can\'t finish)' },
+];
 export function startThinkingHeartbeat(opts) {
     const startedAt = Date.now();
     let nextIdx = 0;
     let stopped = false;
-    const THRESHOLDS_MS = opts?.label
-        ? GENERIC_SUFFIXES.map((t) => ({ at: t.at, label: `${opts.label}${t.suffix}` }))
-        : LLM_THRESHOLDS;
+    // Precedence: an explicit `thresholds` schedule (audit) wins over the
+    // `label` generic-suffix path, which wins over the default LLM schedule.
+    const THRESHOLDS_MS = opts?.thresholds
+        ? opts.thresholds
+        : opts?.label
+            ? GENERIC_SUFFIXES.map((t) => ({ at: t.at, label: `${opts.label}${t.suffix}` }))
+            : LLM_THRESHOLDS;
+    /**
+     * Receives the styled label WITHOUT a newline. Fable review (2026-07-05,
+     * audit-reverify item 1): the newline used to be baked INSIDE the chalk
+     * argument — with color enabled (FORCE_COLOR / real terminals) chalk
+     * appends its closing style codes AFTER the embedded `\n`, so the sink
+     * branch's trailing-`\n` strip was a no-op and every tick rendered an
+     * extra blank line. The label is now styled alone and each branch owns
+     * its own termination: sink = none (the caller terminates), chunkEmitter /
+     * stdout = a plain `\n` appended after the styled text (byte-identical to
+     * before under no-color; under color the closing style code now correctly
+     * precedes the newline).
+     */
     const emitLine = (line) => {
-        if (opts?.chunkEmitter) {
+        if (opts?.emit) {
+            // Custom sink (e.g. plan-chain's args.log) owns line termination.
+            opts.emit(line);
+        }
+        else if (opts?.chunkEmitter) {
             // Phase A #4 — route through Ink's chunk pipeline. The Body
             // component's reducer treats this like any other model chunk and
             // appends it as a node, so the heartbeat lives inside the React
             // render tree and survives subsequent renders.
-            opts.chunkEmitter.emit('chunk', line);
+            opts.chunkEmitter.emit('chunk', line + '\n');
         }
         else {
             // Classic mode — direct stdout, plain newline-terminated line.
-            process.stdout.write(line);
+            process.stdout.write(line + '\n');
         }
     };
     const tick = () => {
@@ -74,8 +117,21 @@ export function startThinkingHeartbeat(opts) {
         const elapsed = Date.now() - startedAt;
         while (nextIdx < THRESHOLDS_MS.length && THRESHOLDS_MS[nextIdx].at <= elapsed) {
             const t = THRESHOLDS_MS[nextIdx];
-            // Indent by 2 spaces to align with tool-call rows.
-            emitLine(chalk.dim(`  ${t.label}\n`));
+            // audit-lean FIX #2 — a dynamic suffix (e.g. the live token count),
+            // evaluated NOW so a stall shows a different number from progress.
+            // Defensive: observability must never break the liveness tick.
+            let suffix = '';
+            if (opts?.suffix) {
+                try {
+                    suffix = opts.suffix();
+                }
+                catch {
+                    suffix = '';
+                }
+            }
+            // Indent by 2 spaces to align with tool-call rows. Style ONLY the
+            // label (+ suffix) — never a newline inside the chalk call (see emitLine).
+            emitLine(chalk.dim(`  ${t.label}${suffix}`));
             nextIdx++;
         }
     };

package/dist/renderer/todo-block.js

@@ -0,0 +1,51 @@
+/**
+ * todo_set transcript block — UX Wave 2 follow-up (CC-style checklist).
+ *
+ * Owner feedback (2026-07): "it's not like we have in Claude Code — only
+ * shows the phase it's working on with an arrow." The turn-status strip
+ * (single ▶ row) and the Ctrl+T panel are both by-design; what was missing
+ * was Claude Code's behaviour of dropping the FULL checklist into the
+ * scrollback transcript on every todo_set, so the user sees the whole plan
+ * advance in place rather than a raw `⏺ todo_set({...})` JSON line.
+ *
+ * This module is the pure formatter for that block. todo.ts emits the
+ * returned string as a `chunk` on ctx.chunkEmitter after a successful set
+ * (routes to Ink Static scrollback AND the classic 'chunk'→stdout path);
+ * the raw ⏺/⎿ todo_set rows are widget-suppressed (tool-widget.ts) so the
+ * block is the sole visible representation — exactly mirroring ask_question.
+ *
+ * House style follows todo-panel.tsx glyphs precisely so the transcript
+ * block and the Ctrl+T panel read as the same list:
+ *   ▣ completed   (dim)
+ *   ▶ in_progress (peach, bold)
+ *   □ pending     (default)
+ * Every row is truncate-end (Wave-1 rule — no soft-wrap), preceded by a
+ * slim `Tasks (done/total done)` header.
+ */
+import chalk from 'chalk';
+import { PEACH } from './banners.js';
+/** Max visible width of a row's TEXT (after the 2-char glyph+space prefix).
+ *  72-col total matches the Ctrl+T panel width; 70 leaves room for `▶ `. */
+export const TODO_BLOCK_TEXT_MAX = 70;
+function truncateEnd(s, max) {
+    return s.length > max ? s.substring(0, max - 1) + '…' : s;
+}
+/**
+ * Render the checklist as a scrollback block (leading + trailing newline for
+ * separation from surrounding transcript content). Returns ANSI-coloured
+ * text ready to emit as a `chunk`.
+ */
+export function formatTodoChecklistBlock(todos) {
+    const done = todos.filter((t) => t.status === 'completed').length;
+    const total = todos.length;
+    const header = chalk.dim(`Tasks (${done}/${total} done)`);
+    const rows = todos.map((t) => {
+        const text = truncateEnd(t.text, TODO_BLOCK_TEXT_MAX);
+        if (t.status === 'completed')
+            return chalk.dim(`▣ ${text}`);
+        if (t.status === 'in_progress')
+            return chalk.hex(PEACH).bold(`▶ ${text}`);
+        return `□ ${text}`;
+    });
+    return '\n' + [header, ...rows].join('\n') + '\n';
+}

package/dist/renderer/tool-widget.js

@@ -21,6 +21,31 @@ import { PEACH } from './banners.js';
  *   - No cyan, no rainbow, no boxes.
  */
 const peach = (s) => chalk.hex(PEACH)(s);
+/**
+ * Widget-representation de-clutter (2026-07): tools whose OWN rendering IS
+ * the visible representation, making the generic ⏺ dispatch line (with its
+ * raw JSON args) and the SUCCESS ⎿ result line pure scrollback noise. For
+ * these the ⏺ top line and the success ⎿ row are suppressed; ERROR ⎿ rows
+ * still render (the ✗ row is the only trace of a failed call). The agent
+ * loop also skips the tool spinner for these (it would orphan without its
+ * ⏺ line).
+ *
+ * Members:
+ *   - ask_question: the Ink form / modal (or the classic console.log
+ *     question text) is the representation. Classic mode is unaffected in
+ *     the ways that matter — the v1 path prints its question via
+ *     console.log and the v2 classic path prints its `form i/n · header`
+ *     blocks, neither of which goes through these renderers.
+ *   - todo_set: the handler emits a CC-style checklist block into the
+ *     transcript (renderer/todo-block.ts) on every successful set — that
+ *     block is the representation, so the raw `⏺ todo_set({"todos":[…])`
+ *     line + ⎿ JSON result are suppressed. Owner feedback drove this: the
+ *     transcript should show the full checklist, not a JSON tool line.
+ */
+const WIDGET_SUPPRESSED_TOOLS = new Set(['ask_question', 'todo_set']);
+export function isWidgetSuppressedTool(name) {
+    return WIDGET_SUPPRESSED_TOOLS.has(name);
+}
 const ARG_SUMMARY_MAX = 64;
 // 2026-05-15 (bug 1): widened from 96 → 240 so a parsed ADT exception
 // message ("CTS_WBO_API/047: Request S4HK903388 is not a local request"
@@ -55,6 +80,10 @@ export function clearActiveSpinner() {
 }
 export function renderToolCallTop(params) {
     const { name, args, chunkEmitter } = params;
+    // Ask-form de-clutter: the form/modal IS the visible representation —
+    // no ⏺ dispatch line (with its raw JSON args) belongs in scrollback.
+    if (isWidgetSuppressedTool(name))
+        return;
     const write = (s) => {
         if (chunkEmitter)
             chunkEmitter.emit('chunk', s);
@@ -137,6 +166,14 @@ function startSpinnerWithVerbs(params, verbs, defaultVerb) {
 }
 export function renderToolCallBottom(params) {
     const { durationMs, isError, resultSummary, chunkEmitter, name, args } = params;
+    // Ask-form de-clutter: paired with the top-line suppression — on SUCCESS
+    // the answer already came back through the form; a ⎿ row would be noise.
+    // ERRORS still render (review fix): an ask_form_invalid /
+    // ask_question_invalid round never mounts a form, so without the ✗ row
+    // the turn would stall silently with nothing in scrollback. D29 made the
+    // bottom row self-identifying (name + args), so no orphan risk.
+    if (name && isWidgetSuppressedTool(name) && !isError)
+        return;
     const write = (s) => {
         if (chunkEmitter)
             chunkEmitter.emit('chunk', s);

package/dist/repl/bracketed-paste.js

@@ -59,18 +59,6 @@ export function disableBracketedPaste(stream = process.stdout) {
     if (stream.isTTY)
         stream.write(BRACKETED_PASTE_DISABLE);
 }
-/**
- * Transform stream that collapses the content between `\x1b[200~` and
- * `\x1b[201~` into a single line (newlines replaced with spaces). The
- * markers themselves are stripped. All other bytes pass through
- * unchanged, including keystrokes, arrow-key escape sequences, and
- * terminal responses — these are not affected because they never contain
- * the paste markers.
- *
- * The implementation uses Buffer operations (not string concat) to avoid
- * splitting multi-byte UTF-8 sequences at chunk boundaries when a paste
- * spans multiple `data` events.
- */
 export class BracketedPasteDecoder extends Transform {
     /**
      * Readline with `terminal: true` inspects `input.isTTY` and calls
@@ -81,9 +69,17 @@ export class BracketedPasteDecoder extends Transform {
      *
      * We present as a TTY and forward the raw-mode toggle and the size
      * getters to the real `process.stdin` / `process.stdout`.
+     *
+     * (Typed `boolean`, not the literal `true`, so InkStdinPasteGuard can
+     * mirror the real process.stdin.isTTY instead.)
      */
     // eslint-disable-next-line @typescript-eslint/naming-convention
     isTTY = true;
+    emitVerbatim;
+    constructor(options = {}) {
+        super();
+        this.emitVerbatim = options.emitVerbatim ?? false;
+    }
     setRawMode(mode) {
         if (typeof process.stdin.setRawMode === 'function')
             process.stdin.setRawMode(mode);
@@ -166,9 +162,9 @@ export class BracketedPasteDecoder extends Transform {
             this.carryTimer = null;
         }
         // End of stream. If we were still inside a paste (unterminated),
-        // flush the buffered content as a single line so it's not lost.
+        // flush the buffered content so it's not lost.
         if (this.inPaste && this.pasteBuf.length > 0) {
-            this.push(this.collapseNewlines(this.pasteBuf));
+            this.push(this.emitVerbatim ? this.pasteBuf : this.collapseNewlines(this.pasteBuf));
             this.pasteBuf = Buffer.alloc(0);
             this.inPaste = false;
         }
@@ -192,11 +188,24 @@ export class BracketedPasteDecoder extends Transform {
                     return;
                 }
                 this.pasteBuf = Buffer.concat([this.pasteBuf, data.subarray(i, endIdx)]);
-                this.push(this.collapseNewlines(this.pasteBuf));
-                // Append a newline so readline commits the pasted line as a
-                // single input — otherwise the user would still have to press
-                // Enter after the paste.
-                this.push(Buffer.from('\n'));
+                if (this.emitVerbatim) {
+                    // Ink mode: ONE chunk, newlines intact, markers stripped, no
+                    // synthetic Enter. Downstream (Ink useInput → text-input paste
+                    // branch) buffers the complete lines and keeps the fragment —
+                    // nothing submits until the user presses Enter. Crucially a
+                    // `\r` that arrived as its own stdin chunk INSIDE the span was
+                    // accumulated here instead of reaching Ink's parseKeypress,
+                    // which would have flagged it key.return and submitted.
+                    if (this.pasteBuf.length > 0)
+                        this.push(this.pasteBuf);
+                }
+                else {
+                    this.push(this.collapseNewlines(this.pasteBuf));
+                    // Append a newline so readline commits the pasted line as a
+                    // single input — otherwise the user would still have to press
+                    // Enter after the paste.
+                    this.push(Buffer.from('\n'));
+                }
                 this.pasteBuf = Buffer.alloc(0);
                 this.inPaste = false;
                 i = endIdx + END_MARKER.length;

package/dist/repl/builtin-commands.js

@@ -11,12 +11,17 @@ export const BUILTIN_ENTRIES = [
     { name: '/cancel', description: 'Cancel the current pre-filled command, return to a clean prompt' },
     { name: '/cost', description: 'Show this session\'s API spend so far ($ + token breakdown)' },
     { name: '/compact', description: 'Summarise older turns into a compact context block — cuts subsequent turn cost by 80-90%' },
+    { name: '/export', description: 'Export the signable session audit record — /export audit [filename]' },
+    { name: '/context', description: 'Show what fills the model context window — a composition grid of bars' },
     { name: '/exit', description: 'Exit CSPeach' },
     { name: '/quit', description: 'Exit CSPeach (alias)' },
     { name: '/help', description: 'Show all skills and commands' },
     { name: '/skills', description: 'Show all skills (alias)' },
+    { name: '/mode', description: 'Cycle or set the session write mode (advisory / gated / auto) — config unchanged' },
     { name: '/new', description: 'Reset routing — next prompt is classified afresh' },
+    { name: '/recap', description: 'Show the session recap (last session · open tasks · plan progress)' },
     { name: '/reset', description: 'Reset routing (alias)' },
+    { name: '/rewind', description: 'Undo a write from this session — restore an object to a pre-write snapshot (Esc Esc)' },
     { name: '/ui', description: 'View or change rendering mode (auto / ink / classic)' },
     { name: '/reroute', description: 'Re-dispatch the previous prompt to a different skill' },
     { name: '/transport', description: 'View or set the active transport for this session' },