@cspeach/cli 1.1.17 → 1.1.19

package/dist/rewind/cli.js

@@ -21,6 +21,7 @@ import { snapshots } from '@cspeach/sap-client';
 import { collectRewindCandidates } from './candidates.js';
 import { restoreSnapshot } from './restore.js';
 import { hhmm, rewindRowLabel, packageUnknown } from './format.js';
+import { formatInfo } from '../renderer/notice-shape.js';
 // Pure singleton emitter (no Ink) — safe in the classic path. In classic mode
 // nothing consults isBusy() during an awaited builtin, so the reserve is a
 // no-op there; in Ink it is the whole point (see executeRestore).
@@ -62,7 +63,7 @@ export async function buildRestoreDeps(c, w) {
  *    awaits, but ANY residual throw (deps assembly, a future refactor) lands
  *    in the catch below and prints the partial receipt context + error instead
  *    of escaping to the process-level uncaughtException exit.
- *  - M4: a declined approval prints a calm '↩ rewind cancelled' line — the
+ *  - M4: a declined approval prints a calm 'Rewind cancelled' line — the
  *    user said no; nothing failed.
  */
 export async function executeRestore(c, w, print) {
@@ -74,7 +75,7 @@ export async function executeRestore(c, w, print) {
             print(chalk.green(`✓ restored ${c.objType}/${c.object}`));
         }
         else if (r.error === 'declined') {
-            print(chalk.dim(`↩ rewind cancelled — approval declined`));
+            print(formatInfo('Rewind cancelled · approval declined').trimEnd());
         }
         else {
             print(chalk.red(`✗ rewind failed — ${r.error ?? 'unknown'}`));

package/dist/rewind/format.js

@@ -3,22 +3,27 @@
  * inquirer list (rewind/cli.ts). Kept ink-free so importing it from the
  * classic path does not drag React/Ink into a non-TTY process.
  */
-/** UTC HH:MM from an ISO timestamp — deterministic (write & snapshot times are
- *  both UTC 'Z', so relative sense is preserved without a TZ dependency). */
+import { toolLabel } from '../renderer/tool-labels.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
+/** Local HH:MM from an ISO timestamp (piece 2 §10: the user's clock, not UTC). */
 export function hhmm(iso) {
     if (!iso)
         return '??:??';
-    const m = /T(\d{2}):(\d{2})/.exec(iso);
-    return m ? `${m[1]}:${m[2]}` : '??:??';
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime()))
+        return '??:??';
+    return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`;
 }
-/** Row label without glyph / selection styling. Restorable rows carry the
- *  snapshot time; non-restorable rows carry the reason. */
+/** Row label without glyph / selection styling: the piece 1 tool verb, the
+ *  object, and the write time; restorable rows add the snapshot time,
+ *  non-restorable rows the reason. Object, type and reason are sanitised so
+ *  a control character can never reach the terminal. */
 export function rewindRowLabel(c) {
-    const tool = c.writeTool.replace(/^sap_/, '');
-    const base = `${c.object} (${c.objType}) · ${tool} · ${hhmm(c.writtenAt)}`;
+    const verb = toolLabel(c.writeTool, {}).verb;
+    const base = `${verb} ${sanitizeControlChars(c.object)} (${sanitizeControlChars(c.objType)}) · ${hhmm(c.writtenAt)}`;
     if (c.restorable)
         return `${base} · snapshot ${hhmm(c.snapshotAt)}`;
-    return `${base} — ${c.reason ?? 'no restore point'}`;
+    return `${base} — ${sanitizeControlChars(c.reason ?? 'no restore point')}`;
 }
 /** True when a restorable delete has no recreate package to fall back on —
  *  the restore may fail on the real system's empty-package rejection. */

package/dist/rewind/restore.js

@@ -212,6 +212,17 @@ export async function restoreSnapshot(c, deps) {
                 + `${c.objType}/${c.object} is NOT activated; verify it manually.`,
         };
     }
+    // Review r7 I-4 — verifySyntax now reports a check that did not run as
+    // ok:false + didNotRun instead of throwing: same honest wording as before.
+    if (syntax.didNotRun !== undefined) {
+        record(`③ syntax — check failed to run: ${shortError(new Error(syntax.didNotRun))}`);
+        return {
+            ok: false,
+            steps,
+            error: `snapshot source was written, but the syntax check failed to run: ${shortError(new Error(syntax.didNotRun))} — `
+                + `${c.objType}/${c.object} is NOT activated; verify it manually.`,
+        };
+    }
     if (!syntax.ok) {
         record('③ syntax ✗');
         return {

package/dist/router/classifier.js

@@ -5,10 +5,20 @@ import { SKILL_CATALOG, SKILL_ALIASES, resolveSkillAlias } from '../skill-catalo
 import { isBuiltinCommandHead } from '../repl/builtin-commands.js';
 import { expandImageAttachments } from '../projects/image-attachments.js';
 import { expandImageChips } from '../ui/clipboard-image.js';
+/** A non-2xx answer from the classify endpoint (fix 9: carries the kind). */
+export class ClassifyHttpError extends Error {
+    status;
+    transport_kind = 'http';
+    constructor(status) {
+        super(`classifier HTTP ${status}`);
+        this.status = status;
+        this.name = 'ClassifyHttpError';
+    }
+}
 // 8s — sized to cover the observed Fly cold-start (~3.2s on the 2026-05-20
 // probe) plus headroom for a slow network. Tighter values risk timing out
 // legitimate cold-start hits and burning the retry budget on the same.
-const FETCH_TIMEOUT_MS = 8000;
+export const FETCH_TIMEOUT_MS = 8000;
 // 250ms — long enough for a half-open TCP/keep-alive socket to be fully
 // torn down before we try again, short enough that the user doesn't feel
 // the retry as a hang.
@@ -27,9 +37,27 @@ function extractCause(err) {
     }
     return e.message;
 }
-async function tryFetchOnce(proxyUrl, key, prompt, context, images = []) {
+/** Our own abort timer fired (or undici gave up waiting) → a timeout, not an outage. */
+function transportKindOf(err) {
+    if (!err)
+        return 'network';
+    const code = err.cause?.code ?? '';
+    if (err.name === 'AbortError' || err.name === 'TimeoutError')
+        return 'timeout';
+    if (/HEADERS_TIMEOUT|BODY_TIMEOUT/.test(code))
+        return 'timeout';
+    return 'network';
+}
+async function tryFetchOnce(proxyUrl, key, prompt, context, images = [], signal) {
+    // Review I2 — a cancel that landed before this call (e.g. while prompt
+    // images were read) never fires the 'abort' event: honour it here.
+    if (signal?.aborted)
+        throw routingCancelled();
     const ctrl = new AbortController();
     const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
+    // Round 4 item 5 — the caller's cancel (Ctrl+C) ends the request at once.
+    const onAbort = () => ctrl.abort();
+    signal?.addEventListener('abort', onAbort, { once: true });
     try {
         return await fetch(`${proxyUrl}/v1/classify`, {
             method: 'POST',
@@ -43,8 +71,15 @@ async function tryFetchOnce(proxyUrl, key, prompt, context, images = []) {
     }
     finally {
         clearTimeout(timer);
+        signal?.removeEventListener('abort', onAbort);
     }
 }
+/** Round 4 item 5 — thrown when the caller cancelled routing (Ctrl+C). */
+function routingCancelled() {
+    const e = new Error('routing cancelled');
+    e.name = 'AbortError';
+    return e;
+}
 /**
  * Screenshot-aware routing (2026-09-23): images in the prompt (pasted
  * [Image #N] chips or image paths) go to the router so it reads the picture
@@ -80,7 +115,11 @@ export async function classifyPrompt(prompt, context, opts = {}) {
     const key = await store.get();
     if (!key)
         throw new Error('no_api_key');
+    if (opts.signal?.aborted)
+        throw routingCancelled();
     const images = await promptImages(prompt, opts.cwd ?? process.cwd());
+    if (opts.signal?.aborted)
+        throw routingCancelled();
     let r;
     let lastErr;
     // Two attempts total: the second masks the common case of a stale
@@ -91,10 +130,13 @@ export async function classifyPrompt(prompt, context, opts = {}) {
     // they bubble through as before.
     for (let attempt = 0; attempt < 2; attempt++) {
         try {
-            r = await tryFetchOnce(cfg.proxy_url, key, prompt, context, images);
+            r = await tryFetchOnce(cfg.proxy_url, key, prompt, context, images, opts.signal);
             break;
         }
         catch (err) {
+            // A user cancel is not a transport failure: no retry, no local fallback.
+            if (opts.signal?.aborted)
+                throw routingCancelled();
             lastErr = err;
             if (attempt === 0)
                 await new Promise((res) => setTimeout(res, RETRY_DELAY_MS));
@@ -112,10 +154,11 @@ export async function classifyPrompt(prompt, context, opts = {}) {
             alternates: [],
             offline: true,
             transport_error: lastErr ? extractCause(lastErr) : 'unknown',
+            transport_kind: transportKindOf(lastErr),
         };
     }
     if (!r.ok)
-        throw new Error(`classifier HTTP ${r.status}`);
+        throw new ClassifyHttpError(r.status);
     const result = (await r.json());
     // Portfolio-merge resilience (2026-06-12): the proxy classifier's skill
     // list can lag a rename (it still knows 'abap-dump-analyze' until its

package/dist/router/intent-extractor.js

@@ -28,11 +28,23 @@
  */
 const PACKAGE_RE = /(?:^|\s)(?:package|pkg|in\s+package|into\s+package|dev\s*class)\s+([ZY][A-Z0-9_]{1,29})(?:\b|\s|[.,;])/i;
 /**
- * Transport pattern: SAP transport IDs follow SID + K + 6 digits (SxxKnnnnnn
- * e.g. S4HK903342). We match 1-char system letter + 1-2 alphanum + K + 5-7
- * digits to catch variants.
+ * Transport pattern: SAP transport IDs are SID (3 chars) + K + 6 digits
+ * (e.g. S4HK903342, DEVK900123). Round 7 item 7 — only the FULL number
+ * counts: a shorter/longer digit run, or one glued to a SQL wildcard
+ * (`S4HK90373%`), is a pattern, not a transport.
  */
-const TRANSPORT_RE = /\b([A-Z][A-Z0-9]{1,2}K[0-9]{5,7})\b/;
+const TRANSPORT_RE = /(?<![A-Za-z0-9_%*])([A-Z][A-Z0-9]{2}K[0-9]{6})(?![A-Za-z0-9_%*])/;
+/** A SQL statement somewhere in the prompt (round 7 item 7): its literals are never facts. */
+const SQL_PRESENT_RE = /\bSELECT\b[\s\S]*\bFROM\b/i;
+/**
+ * Review r7 M-2 — the prompt IS a read-only query (it starts with SELECT,
+ * optionally after "run/execute … :" or a code fence). Only then is create
+ * intent suppressed; "create a report that does SELECT … FROM …, transport
+ * S4HK…" keeps it.
+ */
+const QUERY_PROMPT_RE = /^\s*(?:(?:please\s+)?(?:run|execute|exec)\b[^\n:]{0,40}:?\s*)?(?:`{1,3}\s*(?:sql)?\s*)?SELECT\b[\s\S]*\bFROM\b/i;
+/** Single-quoted string literals — SQL values / LIKE patterns, never facts. */
+const SQL_LITERAL_RE = /'[^'\n]*'/g;
 /**
  * Object name hints — keyword followed by a Z-prefixed or Y-prefixed name.
  * Triggers: program, report, class, interface, table, structure, function
@@ -53,12 +65,16 @@ export function extractIntent(userPrompt) {
     const pkg = PACKAGE_RE.exec(userPrompt);
     if (pkg)
         result.package = pkg[1].toUpperCase();
-    // Transport
-    const trp = TRANSPORT_RE.exec(userPrompt);
+    // Transport — round 7 item 7: never from inside a SQL string literal
+    // (`WHERE trkorr LIKE 'S4HK90373%'` / `= 'S4HK903731'`).
+    const readOnlyQuery = QUERY_PROMPT_RE.test(userPrompt);
+    const transportText = SQL_PRESENT_RE.test(userPrompt) ? userPrompt.replace(SQL_LITERAL_RE, "''") : userPrompt;
+    const trp = TRANSPORT_RE.exec(transportText);
     if (trp)
         result.transport = trp[1].toUpperCase();
-    // Having a transport strongly implies the user wants SAP creation.
-    if (result.transport)
+    // Having a transport strongly implies the user wants SAP creation — but a
+    // read-only query never carries create intent.
+    if (result.transport && !readOnlyQuery)
         result.createIntent = true;
     // Object names — only when explicitly keyword-prefixed, to avoid
     // accidental matches on random Z* tokens in prose.

package/dist/router/piped-routing.js

@@ -0,0 +1,23 @@
+/**
+ * Round 7 item 8a — `echo "prompt" | cspeach` (piped stdin, no --one-shot).
+ *
+ * Piped stdin has no keyboard, so the skill picker cannot be answered: the
+ * classic REPL opened it anyway and the run ended in "Could not pick a skill
+ * · readline was closed". With piped input the router's top pick is used
+ * directly — the same rule as one-shot — with the one-shot's low-confidence
+ * notice naming the candidates.
+ */
+import { formatAttention } from '../renderer/notice-shape.js';
+import { formatRoutingLine } from '../renderer/routing-line.js';
+export function pipedRoutingPick(c) {
+    const lines = [formatRoutingLine({ kind: 'using', skill: c.skill }).trimEnd()];
+    if (c.confidence < 0.6) {
+        const alternates = [c.skill, ...c.alternates].slice(0, 3).map((s) => `/${s}`).join(', ');
+        lines.push(formatAttention({
+            text: 'Low confidence',
+            fact: `candidates: ${alternates}`,
+            next: 'start the line with a skill, e.g. /abap-explain, to choose',
+        }).trimEnd());
+    }
+    return { skill: c.skill, lines };
+}

package/dist/router/resume-routing.js

@@ -0,0 +1,16 @@
+/**
+ * Round 6 review I2 — the first prompt after a resume. The classifier always
+ * runs; the resumed session's skill is kept only where routing would
+ * otherwise open "Pick a skill" (coach / picker) or when the classifier's top
+ * pick IS that skill. A confident pick of another skill wins.
+ */
+export function applyResumedSkill(decision, resumedSkill) {
+    if (decision.kind === 'silent')
+        return decision;
+    return { kind: 'silent', skill: resumedSkill };
+}
+/** A short follow-up that continues the resumed skill without routing: "continue", "go on", a number. */
+export function isShortFollowUp(text) {
+    const t = text.toLowerCase().trim().replace(/[.!?,]+$/, '');
+    return /^\d{1,2}$/.test(t) || /^(continue|go on|carry on|keep going|next)$/.test(t);
+}

package/dist/router/routing-failure.js

@@ -0,0 +1,57 @@
+/** The failure behind an offline (fallback) classify result, or null when routing worked. */
+export function routingFailureFromResult(c) {
+    if (!c.offline)
+        return null;
+    return c.transport_kind === 'timeout' ? { kind: 'timeout' } : { kind: 'network' };
+}
+/** The failure behind a thrown classify error (HTTP), or null for any other error. */
+export function routingFailureFromError(err) {
+    // Duck-typed (not instanceof) so a re-loaded module instance still matches.
+    const e = err;
+    if (e && e.transport_kind === 'http' && typeof e.status === 'number')
+        return { kind: 'http', status: e.status };
+    return null;
+}
+/** Headline for the notice: "Skill routing timed out" etc. */
+export function routingFailureText(f) {
+    switch (f.kind) {
+        // Review M4: no seconds figure — classifyPrompt retries once (two
+        // FETCH_TIMEOUT_MS attempts + a short delay), so "(8 s)" under-stated the wait.
+        case 'timeout': return 'Skill routing timed out';
+        case 'network': return "Skill routing couldn't reach the CSPeach service";
+        case 'http': return `Skill routing failed (HTTP ${f.status})`;
+    }
+}
+/** The attention notice: headline, plus the real cause for network failures. */
+export function routingFailureNotice(f, transportError) {
+    const text = routingFailureText(f);
+    return f.kind === 'network' && transportError ? { text, fact: transportError } : { text };
+}
+/** One-shot's dim stderr line (the turn continues on the bundled local rules). */
+export function routingFailureOneShotLine(f, transportError) {
+    const n = routingFailureNotice(f, transportError);
+    return `[${n.text}${n.fact ? `: ${n.fact}` : ''} — routed by local rules]`;
+}
+/** Short form for the stay line: "Routing timed out" etc. */
+function routingFailureShort(f) {
+    switch (f.kind) {
+        case 'timeout': return 'Routing timed out';
+        case 'network': return "Routing couldn't reach the CSPeach service";
+        case 'http': return `Routing failed (HTTP ${f.status})`;
+    }
+}
+/**
+ * Fix 10 (2026-09-26) — the ONE decision both REPL paths (Ink + classic) use
+ * when routing fails. A follow-up sent mid-skill (e.g. turn 4 of an
+ * /abap-rap session) must not open the "which skill fits?" picker just
+ * because the classify call failed: with a skill active, the turn continues
+ * in it and the REPL prints one dim line (`· Routing timed out · staying in
+ * /abap-rap`). With no active skill, today's behaviour stands (notice +
+ * picker, or the failure message for HTTP). A successful classify (no
+ * failure) never reaches this — routing is unchanged then.
+ */
+export function routingFailureOutcome(failure, activeSkill) {
+    if (!failure || !activeSkill)
+        return { kind: 'fallback' };
+    return { kind: 'stay', skill: activeSkill, line: `${routingFailureShort(failure)} · staying in /${activeSkill}` };
+}

package/dist/sap/first-run-choice.js

@@ -9,7 +9,7 @@
  * trial user is on. Non-interactive runs (piped stdin, CI) never see the
  * prompt and keep the exact pre-existing behaviour (the SAP wizard branch).
  */
-import { select } from '@inquirer/prompts';
+import { select } from '../repl/themed-prompts.js';
 export const FIRST_RUN_CHOICES = [
     {
         name: 'Work standalone — no SAP connection',

package/dist/sap/onboarding.js

@@ -1,5 +1,6 @@
-import { input, select, password, confirm } from '@inquirer/prompts';
+import { input, select, password, confirm } from '../repl/themed-prompts.js';
 import chalk from 'chalk';
+import { formatAttention } from '../renderer/notice-shape.js';
 import keychain from '../auth/keychain.js';
 import { loadConfig, saveConfig } from '../config/loader.js';
 const SAP_SERVICE = 'cspeach-sap';
@@ -58,7 +59,7 @@ export async function runAddSapWizard() {
             });
         }
         else if (tlsChoice === 'insecure') {
-            console.log(chalk.yellow('  ⚠ TLS verification will be DISABLED for this system — dev only, NEVER use in production.'));
+            console.log(formatAttention({ text: 'TLS verification is off for this system', fact: 'dev only, never in production' }).trimEnd());
             insecureSkipTlsVerify = true;
         }
     }

package/dist/sap/standalone-onboarding.js

@@ -16,7 +16,7 @@ import { loadConfig, saveConfig } from '../config/loader.js';
 import { runStandardsInit } from '../standards/standards-init.js';
 import { STANDALONE_PLATFORMS, STANDALONE_DATABASES, STANDALONE_DEPLOYMENTS, STANDALONE_IDES, deriveDatabase, deriveDeployment, defaultAbapCloudOnly, defaultRelease, releaseExamples, } from './standalone-profile.js';
 async function defaultPrompts() {
-    const { input, select, confirm } = await import('@inquirer/prompts');
+    const { input, select, confirm } = await import('../repl/themed-prompts.js');
     return {
         select: (o) => select({ message: o.message, choices: o.choices, default: o.default }),
         input: (o) => input({ message: o.message, default: o.default }),

package/dist/sap/system-info.js

@@ -179,11 +179,13 @@ export function parseCvers(xml) {
         const nameMatch = /<(?:[\w:]+:)?metadata\b[^>]*?\b(?:[\w:]+:)?name="([^"]+)"/i.exec(block);
         if (!nameMatch)
             continue;
-        const dataRe = /<(?:[\w:]+:)?data\b[^>]*>([\s\S]*?)<\/(?:[\w:]+:)?data\s*>/g;
+        // A self-closing `<data/>` is an EMPTY cell and must keep its row
+        // position (round 4 item 2) — the old pattern swallowed the next cell.
+        const dataRe = /<(?:[\w:]+:)?data\b(?:\s[^>]*?)?(?:\/>|>([\s\S]*?)<\/(?:[\w:]+:)?data\s*>)/g;
         const values = [];
         let d;
         while ((d = dataRe.exec(block)) !== null)
-            values.push(d[1].trim());
+            values.push((d[1] ?? '').trim());
         cols.push({ name: nameMatch[1], values });
     }
     const componentCol = cols.find((c) => c.name.toUpperCase() === 'COMPONENT');

package/dist/sap/unreachable.js

@@ -0,0 +1,28 @@
+// cspeach-cli/src/sap/unreachable.ts
+//
+// Dry run 2026-09-25: with the VPN off and a SAP system configured, startup
+// died with "cspeach: unhandled error: connect ETIMEDOUT" — even for skills
+// that never touch SAP. A network failure to the SAP host gets one clear line
+// (REPL and one-shot alike); every other connection error still throws.
+const UNREACHABLE_CODES = new Set([
+    'ETIMEDOUT',
+    'ECONNREFUSED',
+    'ENOTFOUND',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'ECONNRESET',
+    'EAI_AGAIN',
+]);
+/** The network error code when `err` (or fetch's wrapped `cause`) means "host not reachable". */
+export function unreachableCode(err) {
+    let e = err;
+    for (let depth = 0; e && depth < 3; depth++, e = e.cause) {
+        if (typeof e.code === 'string' && UNREACHABLE_CODES.has(e.code))
+            return e.code;
+    }
+    return undefined;
+}
+export function unreachableMessage(alias, host, port, code) {
+    return (`Can't reach SAP system ${alias} (${host}:${port}) — ${code}. Check the VPN / network, ` +
+        'or run with --no-sap for work that does not need SAP.');
+}

package/dist/sap-errors/clean-error-text.js

@@ -0,0 +1,182 @@
+/**
+ * Readable SAP error text for the screen (live fix 2026-09-26).
+ *
+ * SAP's ICM answers some failures with an HTML page ("Application Server
+ * Error" + a <style> block). sap-client strips the tags but keeps the style
+ * text, so a notice read
+ *   `SAP HTTP 500: sqlQuery — Application Server Error body { background: #ffffff; …`
+ * cleanErrorText drops <style>/<script> blocks, tags, entities and CSS rule
+ * remnants, collapses whitespace and cuts to a sensible length. Plain text
+ * is only length-capped. describeError prefers the SapError's full body
+ * (`sapBody`) when its message is markup-ish, so the real reason (the page's
+ * heading/paragraph) survives instead of the 160-char CSS prefix.
+ *
+ * Review I1 (2026-09-27): ABAP text is full of `<…>` (field symbols, even
+ * lowercase ones named like HTML tags: `<p>`, `<tr>`), comparisons (`a < b`)
+ * and braces (string templates `|{ lv_x }|`, CDS `{ key : abap.char(10); }`).
+ * So detection needs evidence only real HTML/CSS carries, and stripping only
+ * touches known HTML tags and CSS-shaped rules — never a generic `<[^>]*>`.
+ */
+import { parseAdtException } from './parse-adt-exception.js';
+const DEFAULT_MAX = 160;
+const TAG_NAMES = 'html|head|body|title|style|script|div|span|h[1-6]|p|br|hr|table|tr|td|th|pre|meta|link|a|b|i|em|strong|center|font|ul|ol|li';
+const VOID_TAGS = new Set(['br', 'hr', 'meta', 'link']);
+const DOCTYPE = /<!doctype\b[^>]*>/i;
+// A closing tag, or an opening tag carrying attributes / a self-close slash.
+// A field symbol (`<p>`, `<LS_ROW>`) has neither.
+const HTML_EVIDENCE = new RegExp(String.raw `<\/(?:${TAG_NAMES})\s*>|<(?:${TAG_NAMES})\s+[a-z-]+\s*=|<(?:${TAG_NAMES})\s*\/>`, 'i');
+// Known CSS property names — a CDS/ABAP `{ key : …; }` is not CSS.
+const CSS_PROP = String.raw `(?:background|color|font|text-[a-z]+|width|height|(?:min|max)-(?:width|height)|margin|padding|border|display|overflow|vertical-align|line-height|position|float|cursor|white-space|z-index|box-sizing|list-style|opacity|letter-spacing)(?:-[a-z]+)*`;
+// One `prop: value` declaration inside a brace body. The property must start
+// the body or follow whitespace / `;` — JSON (`{"a":1}`) does not match.
+const CSS_DECL = new RegExp(String.raw `(?:^|[\s;])${CSS_PROP}\s*:\s*([^;{}]*)(;?)`, 'gi');
+// Re-review R1: CSS property names are also common CDS/DDIC field names
+// (position, color, width, border…), so a declaration counts only when its
+// VALUE is CSS-shaped: a #hex colour, a length/percentage, 0, rgb(), a quoted
+// font name or a CSS keyword. A CDS type (`abap.numc(4)`) or a data element
+// (`zde_pos`) is none of these.
+const CSS_VALUE = new RegExp(String.raw `#[0-9a-f]{3,8}\b|\b\d+(?:\.\d+)?(?:px|em|rem|pt|vh|vw|%)|(?:^|\s)0(?:\s|$)|\brgba?\(|["']|` +
+    String.raw `(?:^|[\s,])(?:none|solid|dashed|dotted|bold|bolder|normal|italic|auto|inherit|initial|hidden|visible|` +
+    String.raw `block|inline|inline-block|flex|grid|table|table-cell|left|right|center|middle|top|bottom|absolute|relative|` +
+    String.raw `fixed|static|sticky|pointer|default|nowrap|transparent|underline|uppercase|lowercase|collapse|` +
+    String.raw `white|black|red|gray|grey|silver|blue|green|sans-serif|serif|monospace|arial|helvetica|verdana|tahoma)(?=[\s,;!]|$)`, 'i');
+// A CDS/DDIC body — typed with `abap.` or carrying a `key` field — is never CSS.
+const CDS_BODY = /\babap\.|(?:^|[\s;{])key\s/i;
+/**
+ * True when a brace body reads as CSS: not a CDS/DDIC body, and at least one
+ * known-property declaration with a CSS-shaped value. `needSemicolon` (used
+ * for detection) additionally requires that declaration to be `;`-terminated.
+ */
+function isCssBody(body, needSemicolon = false) {
+    if (CDS_BODY.test(body))
+        return false;
+    for (const m of body.matchAll(CSS_DECL)) {
+        if (needSemicolon && m[2] !== ';')
+            continue;
+        if (CSS_VALUE.test(m[1].trim()))
+            return true;
+    }
+    return false;
+}
+/** True when any `{ … }` body (or one cut off at the end) is a CSS rule. */
+function hasCssRule(s) {
+    for (const m of s.matchAll(/\{([^{}]*)(?:\}|$)/g)) {
+        if (isCssBody(m[1], true))
+            return true;
+    }
+    return false;
+}
+// `selector { … }` — selector token(s) required before the brace.
+const CSS_BLOCK = /[^\s{}]+(?:\s*,\s*[^\s{}]+)*\s*\{([^{}]*)\}/g;
+// …and a rule cut off mid-way at the end of an already-truncated message.
+const CSS_TAIL = /[^\s{}]+\s*\{([^{}]*)$/;
+function stripCss(s) {
+    return s
+        .replace(CSS_BLOCK, (whole, body) => (isCssBody(body) ? ' ' : whole))
+        .replace(CSS_TAIL, (whole, body) => (isCssBody(body) ? ' ' : whole));
+}
+// SAP ADT XML error envelopes (review M3): `<?xml …><exc:exception …>`.
+const ADT_XML = /<\?xml\b|<exc:exception\b/i;
+// Fix round 3 (item 10) — a piece of an ADT exception envelope cut out of its
+// `<?xml` head (an error excerpt truncated mid-body): `<entry key="T100KEY-NO">`,
+// `<type id="…"/>`, `</properties>`. Evidence needs the envelope's own
+// attribute (key= / id= / lang=) or a closing tag, so an ABAP field symbol
+// such as `<entry>` never matches.
+const ADT_FRAGMENT_TAGS = '(?:exc:)?(?:entry|properties|localizedMessage|message|namespace|type)';
+const ADT_FRAGMENT_EVIDENCE = new RegExp(String.raw `<${ADT_FRAGMENT_TAGS}\s+(?:key|id|lang)\s*=|<\/${ADT_FRAGMENT_TAGS}\s*>`, 'i');
+const ADT_FRAGMENT_TAG = new RegExp(String.raw `<\/?${ADT_FRAGMENT_TAGS}(?:\s+[a-z]+\s*=\s*"[^"]*")*\s*\/?>`, 'gi');
+/** Drop ADT envelope fragments, then a dangling " — …" they leave behind. */
+function stripAdtFragments(s) {
+    return s
+        .replace(ADT_FRAGMENT_TAG, ' ')
+        .replace(/\s+/g, ' ')
+        .replace(/\s*[—:-]?\s*…?\s*$/, '')
+        .trim();
+}
+/** True when the text carries HTML tags, CSS rule remnants or an ADT XML error body. */
+export function looksLikeMarkup(s) {
+    return DOCTYPE.test(s) || HTML_EVIDENCE.test(s) || hasCssRule(s) || ADT_XML.test(s) || ADT_FRAGMENT_EVIDENCE.test(s);
+}
+/**
+ * Text before an ADT XML envelope + the envelope's message (review M3).
+ * Uses parseAdtException for a whole envelope; for one cut off by an earlier
+ * truncation it takes whatever text follows the opening <message> tag.
+ * Returns null when the text has no envelope.
+ */
+function cleanAdtXml(text) {
+    const m = ADT_XML.exec(text);
+    if (!m)
+        return null;
+    const prefix = text.slice(0, m.index).replace(/[\s:(]+$/, '');
+    const xml = text.slice(m.index);
+    const partial = xml.match(/<(?:[\w]+:)?message\b[^>]*>([^<]+)/i)?.[1];
+    const msg = parseAdtException(xml) ?? (partial ? decodeEntities(partial).replace(/\s+/g, ' ').trim() : '');
+    // No message: an ADT envelope cut off early keeps just the prefix; any other
+    // `<?xml` document (e.g. an XHTML error page) falls through to HTML cleaning.
+    if (!msg)
+        return /<exc:exception\b/i.test(xml) ? prefix : null;
+    return prefix ? `${prefix}: ${msg}` : msg;
+}
+/**
+ * Strip known HTML tags only: closing tags, tags with attributes, void tags,
+ * and bare opening tags whose closing tag is present. A bare `<p>` in a page
+ * that also has `</p>` is inherently ambiguous and goes (accepted, re-review R2). A lone `<p>` (an ABAP
+ * field symbol) stays; `<LS_ROW>`, `<fs>` and `a < b` are never touched.
+ */
+const TAG_ATTRS = /^(?:\s+[a-z-]+\s*=[\s\S]*|\s*\/)$/i;
+function stripHtmlTags(s) {
+    const tag = new RegExp(String.raw `<(\/?)(${TAG_NAMES})\b([^<>]*)>`, 'gi');
+    return s.replace(tag, (whole, slash, name, rest) => {
+        const lower = name.toLowerCase();
+        // Re-review R2: any text after the name is not enough — `<b AND lv_c>` is
+        // an ABAP comparison. Only real attributes (`name=`) or a self-close `/`.
+        if (rest.trim() && !TAG_ATTRS.test(rest))
+            return whole;
+        if (slash || rest.trim() || VOID_TAGS.has(lower))
+            return ' ';
+        return new RegExp(String.raw `<\/${lower}\s*>`, 'i').test(s) ? ' ' : whole;
+    });
+}
+function decodeEntities(s) {
+    return s
+        .replace(/&nbsp;/gi, ' ')
+        .replace(/&lt;/gi, '<')
+        .replace(/&gt;/gi, '>')
+        .replace(/&quot;/gi, '"')
+        .replace(/&#39;|&apos;/gi, "'")
+        .replace(/&#(\d+);/g, (_, n) => String.fromCharCode(Number(n)))
+        .replace(/&amp;/gi, '&');
+}
+function cut(s, max) {
+    return s.length > max ? s.slice(0, max - 1).trimEnd() + '…' : s;
+}
+export function cleanErrorText(text, max = DEFAULT_MAX) {
+    if (!looksLikeMarkup(text))
+        return cut(text, max);
+    const adt = cleanAdtXml(text);
+    if (adt !== null)
+        return cut(adt, max);
+    if (!DOCTYPE.test(text) && !HTML_EVIDENCE.test(text) && ADT_FRAGMENT_EVIDENCE.test(text)) {
+        return cut(decodeEntities(stripAdtFragments(text)), max);
+    }
+    const out = stripCss(decodeEntities(stripHtmlTags(text
+        .replace(/<!--[\s\S]*?-->/g, ' ')
+        .replace(/<(style|script)\b[^>]*>[\s\S]*?(?:<\/\1\s*>|$)/gi, ' ')
+        .replace(/<!doctype\b[^>]*>/gi, ' ')
+        .replace(/<\?xml\b[^>]*\?>/gi, ' '))))
+        .replace(/\s+/g, ' ')
+        .trim();
+    return cut(out, max);
+}
+/** One readable line for a thrown error (SapError-aware). */
+export function describeError(err, max = 200) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const body = err?.sapBody;
+    if (looksLikeMarkup(msg) && typeof body === 'string' && body.trim()) {
+        // Review M2: the head can carry markup too (no " — " in the message).
+        const head = cleanErrorText(msg.split(' — ')[0].trim(), max);
+        const text = cleanErrorText(body, DEFAULT_MAX);
+        return cut(text ? `${head} — ${text}` : head, max);
+    }
+    return cleanErrorText(msg, max);
+}

package/dist/session/interrupt-reason.js

@@ -0,0 +1,39 @@
+import { describeError } from '../agent/turn-error-ux.js';
+/**
+ * Round 6 item 3 — the stored reason a session's last turn was interrupted,
+ * as one readable line. Sessions poisoned before the round-4 fix stored the
+ * raw API 400 (unsigned thinking, leftover partial_json, orphan tool_use);
+ * loadSession / the send path now repair those, so they are not shown as a
+ * failure. Anything else goes through the same cleaner as the error block.
+ */
+const HEALED_POISON = [
+    /Invalid `?signature`? in `?thinking`? block/i,
+    /partial_json[\s\S]*(?:not permitted|Extra inputs)/i,
+    /`?tool_use`? ids were found without `?tool_result`?/i,
+];
+/**
+ * Round 7 item 8d — saved when the USER stopped the turn (Ctrl+C, /exit
+ * mid-turn). Older sessions stored the raw abort message instead
+ * ("Request was aborted."), which read like an error in the picker.
+ */
+export const USER_STOP_REASON = 'stopped_by_user';
+const USER_ABORT_MESSAGES = /^(?:stopped_by_user|Request was aborted\.?|(?:This|The) operation was aborted\.?)$/i;
+export function isUserStopReason(reason) {
+    return USER_ABORT_MESSAGES.test((reason ?? '').trim());
+}
+/** The resume picker's line for an interrupted session. */
+export function interruptedPickerLine(reason) {
+    return isUserStopReason(reason)
+        ? 'Stopped by you — type "continue" after resume'
+        : `Interrupted (${readableInterruptReason(reason)}) — type "continue" after resume`;
+}
+export function readableInterruptReason(reason) {
+    const r = (reason ?? '').trim();
+    if (!r)
+        return 'unknown';
+    if (isUserStopReason(r))
+        return 'Stopped by you';
+    if (HEALED_POISON.some((re) => re.test(r)))
+        return 'the turn was cut off · the session has been repaired';
+    return describeError(new Error(r));
+}