@cspeach/cli 1.1.17 → 1.1.18

package/dist/agent/tool-dispatch.js

@@ -31,7 +31,12 @@ export async function dispatchTool(name, args, ctx) {
     // GUIDE.md) — local scratch, not SAP objects. Rule 8 protects SAP batches;
     // applying it here made the 2nd+ file (GUIDE.md) hit the batch card and,
     // headless, get refused. Exempt from the gate AND from the batch count.
-    const scratchWrite = isScratchOutputWrite(tool, args, ctx.cwd);
+    // Local project work (owner decision 2026-09-25, CAP spike F2): the same
+    // reasoning for ALL local work — file edits (the filesystem tools refuse any
+    // path outside the project) and the safelisted local build commands. One-shot
+    // refused the 2nd edit of a CAP schema and left it half-changed. SAP writes
+    // are gated exactly as before.
+    const scratchWrite = isLocalProjectWork(tool, args) || isScratchOutputWrite(tool, args, ctx.cwd);
     if (tool.isMutating && !scratchWrite && shouldGateRule8()) {
         const r = await presentSafetyConfirmation({
             rule: 'RULE_8_BATCH_PLAN',
@@ -83,6 +88,22 @@ export async function dispatchTool(name, args, ctx) {
         return { content: JSON.stringify({ error: String(err) }), is_error: true };
     }
 }
+/**
+ * True for local project work: the filesystem tools (confined to the project
+ * folder by resolveSafePath) and shell_exec (a hardcoded safelist of local build
+ * and VCS commands run in the project). Neither touches an SAP object, which is
+ * what Rule 8 protects — EXCEPT a deploy or publish: `npm run deploy` /
+ * `ui5 deploy` / `fiori deploy` upload to the ABAP repository, so any shell
+ * command with a deploy/publish argument still counts (deliberately broad).
+ */
+export function isLocalProjectWork(tool, args) {
+    if (tool.category === 'filesystem')
+        return true;
+    if (tool.category !== 'shell')
+        return false;
+    const argv = [args?.command, ...(Array.isArray(args?.args) ? args.args : [])].map((a) => String(a ?? ''));
+    return !argv.some((a) => /deploy|publish/i.test(a));
+}
 /**
  * True for a mutating filesystem tool whose target sits under the project's
  * own ./cspeach-out/ (cwd). Accepts `cspeach-out/…`, `./cspeach-out/…`, the

package/dist/skills/bundled-skills.js

@@ -1,6 +1,6 @@
 // GENERATED FILE — bundled skills for local mode.
 // Source: https://manifest.cspeach.dev/v1.json
-// Generated: 2026-09-24T16:31:52.103Z
+// Generated: 2026-09-25T16:38:47.082Z
 // Manifest signature verified at build time.
 export const BUNDLED_SKILLS = {
     "abap-atc-fix": {

package/dist/skills/signing-public-key.js

@@ -1,4 +1,4 @@
 // GENERATED FILE — do not edit by hand.
 // Build artifact: ed25519 public key for SKILL.md body verification.
 // Regenerated by `pnpm prebuild` on each release.
-export const MANIFEST_PUBLIC_KEYS = ['a7Qj8ibfLTj49kQRTn1DOE/UAExuoBgjhaXxf33+JPY='];
+export const MANIFEST_PUBLIC_KEYS = ['Nexqg3TSUYzVPirLv6h1tbCmpQF7MbAtVDmqoLAie+8=', 'a7Qj8ibfLTj49kQRTn1DOE/UAExuoBgjhaXxf33+JPY='];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cspeach/cli",
-  "version": "1.1.17",
+  "version": "1.1.18",
   "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
   "keywords": [
     "abap",
@@ -52,7 +52,7 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.90.0",
     "@cspeach/register-core": "0.1.0",
-    "@cspeach/sap-client": "0.1.12",
+    "@cspeach/sap-client": "0.1.13",
     "@iarna/toml": "^2.2.5",
     "@inkjs/ui": "^2.0.0",
     "@inquirer/prompts": "^7.0.0",