@cspeach/cli 1.1.18 → 1.1.19

package/dist/repl/inquirer-theme.js

@@ -1,41 +1,35 @@
 /**
- * Shared @inquirer/prompts theme. Centralises CSPeach's color discipline
- * so any prompt — select, input, confirm, password, checkbox — looks the
- * same and stays in line with the surrounding terminal aesthetic.
+ * Shared @inquirer/prompts theme (piece 2 §10) — built from the theme roles
+ * and the glyph set, so every wizard (system picker, resume picker, first-run,
+ * onboarding, standalone profile, standards init, and the classic pickers)
+ * looks like the rest of CSPeach on dark AND light terminals and under
+ * NO_COLOR. The answered line reads "✓ <message> <answer>".
  *
- * Why this exists: by default @inquirer/prompts renders the chosen
- * answer in cyan. CC-style discipline says color should encode meaning
- * (success / error / brand) — a cyan answer line on every prompt
- * trains the user to treat color as decoration. Override the answer
- * style to default white so the only colored thing on a finished
- * prompt is the leading green ✔ check.
- *
- * 2026-05-01 (CC-parity color audit): introduced as part of the cuts
- * after screenshot review showed 9 distinct hues on a single screen.
- * Goal is to land at ~5: default, dim, brand peach, green outcome,
- * red error.
+ * `prefix` and `icon` are GETTERS: inquirer merges the theme when a prompt
+ * starts, so chalk level (NO_COLOR) and the Unicode/ASCII glyph choice are
+ * read at that moment, not at import time. `answer` is plain text: the old
+ * chalk.white was invisible on a light terminal.
  */
 import chalk from 'chalk';
-/** The shared theme. Pass as `theme` to any @inquirer/prompts call. */
+import { paint } from '../renderer/theme.js';
+import { getGlyphs } from '../renderer/glyphs.js';
 export const inquirerTheme = {
+    get prefix() {
+        return { idle: paint('sap', '?'), done: paint('ok', getGlyphs().done) };
+    },
+    get icon() {
+        return { cursor: getGlyphs().cursor };
+    },
     style: {
-        /**
-         * The selected answer printed back after Enter — by default cyan,
-         * here default-color. The leading ✔ (provided by inquirer) stays
-         * green to encode "done", which is enough signal on its own.
-         */
-        answer: (s) => chalk.white(s),
-        /**
-         * Help / hint text shown next to the prompt question. Default
-         * inquirer hint is dim — keep it dim, just be explicit so future
-         * inquirer version bumps don't regress us.
-         */
-        help: (s) => chalk.dim(s),
-        /**
-         * Highlighted (cursor-on) choice in select / checkbox. Default is
-         * cyan. Use a subtle inverse instead — the cursor `❯` glyph is
-         * the primary signal anyway.
-         */
-        highlight: (s) => chalk.bold(s),
+        answer: (s) => s,
+        // Round 6 item 4a — once answered, only the message's first line: a
+        // multi-line message (the resume picker's column header) glued the
+        // header to the answer on the "✓" line.
+        message: (s, status) => chalk.bold(status === 'done' ? (s.split('\n')[0] ?? s) : s),
+        help: (s) => paint('dim', s),
+        highlight: (s) => paint('sap', chalk.bold(s)),
+        description: (s) => paint('dim', s),
+        error: (s) => paint('bad', `${getGlyphs().failed} ${s}`),
+        defaultAnswer: (s) => paint('dim', `(${s})`),
     },
 };

package/dist/repl/paste-marker.js

@@ -0,0 +1,19 @@
+// src/repl/paste-marker.ts
+//
+// Piece 2 (spec §8) — "pasted text never triggers the shortcuts sheet". The
+// Ink paste guard (ink-stdin-guard.ts / bracketed-paste.ts) strips the paste
+// markers before Ink parses anything, so a pasted '?' is otherwise identical
+// to a typed one. The decoder marks every paste span it re-emits; App's `?`
+// trigger asks wasPasted() before opening the sheet.
+/** A paste chunk reaches useInput within one drain — 500 ms is ample and far below human retyping. */
+export const PASTE_MARK_TTL_MS = 500;
+let last = null;
+export function markPastedChunk(text, now = Date.now()) {
+    last = { text, at: now };
+}
+export function wasPasted(input, now = Date.now()) {
+    return last !== null && last.text === input && now - last.at <= PASTE_MARK_TTL_MS;
+}
+export function resetPasteMarkForTest() {
+    last = null;
+}

package/dist/repl/plan-turn-end.js

@@ -0,0 +1,20 @@
+import { checklistRenderMode, formatPlanClose, isPlanFinished } from '../renderer/checklist-format.js';
+import { formatTodoChecklistBlock } from '../renderer/todo-block.js';
+import { emitTrace } from '../renderer/trace.js';
+import { todoEmitter, consumeTodoSetThisTurn } from '../ui/todo-emitter.js';
+export function emitPlanTurnEnd(session, write = (s) => { process.stdout.write(s); }) {
+    if (!consumeTodoSetThisTurn())
+        return;
+    const todos = session.todos ?? [];
+    if (todos.length === 0)
+        return;
+    const mode = checklistRenderMode();
+    if (mode === 'live') {
+        emitTrace(formatPlanClose(todos));
+        if (isPlanFinished(todos))
+            todoEmitter.emit('close');
+        return;
+    }
+    if (mode === 'turn-end')
+        write(formatTodoChecklistBlock(todos));
+}

package/dist/repl/post-turn-status.js

@@ -24,6 +24,7 @@ import { globalCredits } from '../cost/credits.js';
 import { printStatusFooter, formatStatusFooter } from '../renderer/status-footer.js';
 import { shouldUseInk } from '../renderer/tty.js';
 import { isUserPrompt } from '../session/user-prompt.js';
+import { emitPlanTurnEnd } from './plan-turn-end.js';
 export function snapshotTurnStart(session) {
     return {
         input: session.usage.input_tokens,
@@ -33,22 +34,34 @@ export function snapshotTurnStart(session) {
         startedAt: Date.now(),
     };
 }
-export function pushPostTurnStatus(params) {
-    const { session, selectedAlias, snapshot, chunkEmitter, turnModel } = params;
+/**
+ * The per-turn numbers every receipt prints — extracted (piece 2 I3a) so the
+ * REPL receipt and the one-shot receipt compute them the same way.
+ */
+export function computeTurnFacts(session, snapshot, turnModel) {
     const userTurns = session.messages.filter(isUserPrompt).length;
-    const lifetimeTokensAfter = session.usage.input_tokens + session.usage.output_tokens;
-    const lifetimeTokensBefore = snapshot.input + snapshot.output;
-    const turnTokens = Math.max(0, lifetimeTokensAfter - lifetimeTokensBefore);
-    const turnCostTokens = {
+    const lifetimeAfter = session.usage.input_tokens + session.usage.output_tokens;
+    const turnTokens = Math.max(0, lifetimeAfter - (snapshot.input + snapshot.output));
+    const turnCost = computeCost(turnModel ?? session.model, {
         input: session.usage.input_tokens - snapshot.input,
         output: session.usage.output_tokens - snapshot.output,
         cacheRead: session.usage.cache_read_input_tokens - snapshot.cacheRead,
         cacheCreate: (session.usage.cache_creation_input_tokens ?? 0) - snapshot.cacheCreate,
+    });
+    return {
+        userTurns,
+        turnTokens,
+        turnCost,
+        // F-L2-2: cost/session-cost.ts so the agent loop can push the SAME total mid-stream.
+        sessionCost: computeSessionCost(session),
+        elapsedMs: Date.now() - snapshot.startedAt,
     };
-    const turnCost = computeCost(turnModel ?? session.model, turnCostTokens);
-    // F-L2-2: extracted to cost/session-cost.ts so the agent loop can push the
-    // SAME total mid-stream. This call site is unchanged in behaviour.
-    const sessionCost = computeSessionCost(session);
+}
+export function pushPostTurnStatus(params) {
+    const { session, selectedAlias, snapshot, chunkEmitter, turnModel, cancelled } = params;
+    // Piece 2 (spec §4) — the plan's turn-end line lands just above the receipt.
+    emitPlanTurnEnd(session);
+    const { userTurns, turnTokens, turnCost, sessionCost, elapsedMs } = computeTurnFacts(session, snapshot, turnModel);
     // Task 9 (ux-wave1) — statusline spend wire. Honest semantics note: the
     // store field is named `dollarSpendToday` (legacy sidebar naming, kept to
     // avoid rename churn) but the value written is SESSION-scoped — the same
@@ -62,6 +75,10 @@ export function pushPostTurnStatus(params) {
     // stays as the authoritative end-of-turn settle (the loop's pushes are
     // gated to REPL turns; this one runs on every path that reaches here).
     globalStore.update({ dollarSpendToday: sessionCost });
+    // Round 6 item 4d — a cancelled turn that used no tokens has nothing to
+    // report ("/abap-explain · 0 tokens · <$0.01" read like a charge).
+    if (cancelled && turnTokens === 0)
+        return;
     const statusPayload = {
         sessionId: session.id,
         sapAlias: selectedAlias,
@@ -69,7 +86,7 @@ export function pushPostTurnStatus(params) {
         turnCount: userTurns,
         tokens: turnTokens,
         cachedTokens: session.usage.cache_read_input_tokens,
-        elapsedMs: Date.now() - snapshot.startedAt,
+        elapsedMs: elapsedMs,
         costThisTurn: turnCost,
         costSession: sessionCost,
         sessionInputTokens: session.usage.input_tokens,
@@ -95,3 +112,11 @@ export function pushPostTurnStatus(params) {
         printStatusFooter(statusPayload);
     }
 }
+/**
+ * Round 7 item 8c — seed the footer's live spend from a resumed session's own
+ * usage, so it does not read $0.00 until the first turn and then jump to the
+ * session total. A new session has no usage and stays at $0.00.
+ */
+export function seedFooterSpend(session) {
+    globalStore.update({ dollarSpendToday: computeSessionCost(session) });
+}

package/dist/repl/reroute-turn.js

@@ -0,0 +1,21 @@
+// src/repl/reroute-turn.ts
+//
+// The /reroute turn wrapper (final review, pre-existing gap). Both /reroute
+// handlers in repl.tsx (Ink + classic) run a turn outside the normal turn
+// path, and had no catch: the Ink loop runs `void handleSubmit(line)`, so a
+// provider error during /reroute became an unhandled rejection and crashed the
+// REPL. This wrapper renders the error with the same turn-error block the
+// normal turn paths use, then always runs the caller's turn-end step.
+import { renderTurnError } from '../agent/turn-error-ux.js';
+/** Never rejects because of the turn: a turn error is rendered, not thrown. */
+export async function runRerouteTurn(p) {
+    try {
+        await p.run();
+    }
+    catch (err) {
+        await renderTurnError({ err, session: p.session, userInterrupted: p.signal?.aborted ?? false, inSession: true, print: p.print });
+    }
+    finally {
+        p.onFinally();
+    }
+}

package/dist/repl/reset-tty-stdin.js

@@ -0,0 +1,44 @@
+/**
+ * resetTtyStdin — revive Windows console stdin after an @inquirer prompt.
+ *
+ * Live fix 2026-09-26: after the `cspeach --resume` session picker (an
+ * @inquirer/prompts `select`) closes, Windows console stdin delivers NO data
+ * to the Ink pipe even though the stream reports flowing:true / raw:true, so
+ * the Ink input box receives no keystrokes. pty experiments showed that
+ * `resume()`, `setRawMode(true)+resume()`, a 300 ms wait and
+ * pause/setImmediate/resume all fail; ONLY the full cycle
+ * `setRawMode(false) → pause() → setRawMode(true) → resume()` restores input.
+ *
+ * Called in runRepl immediately before `process.stdin.pipe(inkStdin)`, which
+ * runs after every pre-Ink inquirer prompt (resume picker, SAP system picker,
+ * API-key prompt, first-run choice, onboarding). On a plain start it is
+ * harmless: stdin ends raw + flowing and the pipe attaches synchronously
+ * right after, then Ink manages raw mode itself.
+ *
+ * Returns true when the cycle ran. Never throws.
+ */
+export function resetTtyStdin(stdin = process.stdin) {
+    if (stdin.isTTY !== true || typeof stdin.setRawMode !== 'function')
+        return false;
+    try {
+        stdin.setRawMode(false);
+        stdin.pause();
+        stdin.setRawMode(true);
+        stdin.resume();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Review I2 (2026-09-27): run the reset cycle, then pipe stdin into the REPL
+ * input. Used by BOTH runRepl branches — Ink (`inkStdin`) and classic
+ * (`pasteInput`) — because both are reached through the same pre-REPL
+ * inquirer prompts. The pipe happens even when the reset is a no-op
+ * (non-TTY / no setRawMode).
+ */
+export function pipeRevivedStdin(dest, stdin = process.stdin) {
+    resetTtyStdin(stdin);
+    return stdin.pipe(dest);
+}

package/dist/repl/restore-guard.js

@@ -0,0 +1,22 @@
+export function createRestoreGuard(hooks) {
+    let active = false;
+    let exitAfter = false;
+    return {
+        get active() { return active; },
+        requestExit() { exitAfter = true; },
+        async run(restore) {
+            active = true;
+            try {
+                await restore();
+            }
+            finally {
+                active = false;
+                hooks.resetDispatchState();
+                if (exitAfter) {
+                    exitAfter = false;
+                    hooks.exit();
+                }
+            }
+        },
+    };
+}

package/dist/repl/resume-standalone.js

@@ -0,0 +1,63 @@
+import { STANDALONE_ALIAS } from '../tools/index.js';
+import { formatInfo } from '../renderer/notice-shape.js';
+/**
+ * Round 6 item 2 + review I3 — standalone or not, for a start that may be a
+ * resume. `--no-sap` (or persisted standalone) always wins. A resumed session
+ * keeps its system — unless an explicit `--sap-alias` names a DIFFERENT one:
+ * then the flag wins and the session moves to it (standalone → SAP, or one
+ * SAP system to another). The same alias is a no-op.
+ */
+export function resumeStandaloneDecision(p) {
+    if (p.requestedStandalone) {
+        // Final batch 4 — standalone requested for a resumed SAP session: the
+        // session itself moves to standalone (consistently, and it says so).
+        return p.resumedSapSystem && p.resumedSapSystem !== STANDALONE_ALIAS
+            ? { standalone: true, switchedFrom: p.resumedSapSystem, switchedTo: STANDALONE_ALIAS, standaloneSource: p.standaloneSource ?? '--no-sap' }
+            : { standalone: true };
+    }
+    if (p.resumedSapSystem === STANDALONE_ALIAS) {
+        return p.sapAlias
+            ? { standalone: false, switchedFrom: STANDALONE_ALIAS, switchedTo: p.sapAlias }
+            : { standalone: true };
+    }
+    if (p.resumedSapSystem && p.sapAlias && p.sapAlias !== p.resumedSapSystem) {
+        return { standalone: false, switchedFrom: p.resumedSapSystem, switchedTo: p.sapAlias };
+    }
+    return { standalone: false };
+}
+/**
+ * Apply a switch decided above: the session moves to the selected system, is
+ * saved, and one line says so. No switch → nothing happens.
+ */
+export async function applySystemSwitch(p) {
+    const { decision } = p;
+    if (!decision.switchedTo)
+        return;
+    // Re-review (defence in depth) — never relabel a session whose SAP changes
+    // are unfinished: they belong to the system they were made on.
+    if ((p.session.toolCalls ?? []).some((c) => !c.completed))
+        return;
+    const from = decision.switchedFrom === STANDALONE_ALIAS ? 'standalone' : `on ${decision.switchedFrom}`;
+    if (decision.switchedTo === STANDALONE_ALIAS) {
+        // Final batch 4 — a SAP session resumed with --no-sap.
+        if (!decision.standalone)
+            return;
+        p.session.sap_system = STANDALONE_ALIAS;
+        p.session.systemSwitchNote =
+            `This session was ${from} until now. It is now standalone (no SAP system connected). `
+                + 'Do not read from or write to SAP; work from pasted code and hand changes over for manual implementation.';
+        await p.save(p.session);
+        p.notify(formatInfo(`This session was ${from} · now standalone (${decision.standaloneSource ?? '--no-sap'})`));
+        return;
+    }
+    if (decision.standalone)
+        return;
+    p.session.sap_system = p.selectedAlias;
+    // Round 6 review I4 — the model is told once, on the next turn.
+    p.session.systemSwitchNote =
+        `This session was ${decision.switchedFrom === STANDALONE_ALIAS ? 'standalone' : `on ${decision.switchedFrom}`} until now. `
+            + `It is now connected to ${p.selectedAlias}. Validate packages, transports and objects against the system; `
+            + 'standalone waivers no longer apply.';
+    await p.save(p.session);
+    p.notify(formatInfo(`This session was ${from} · now on ${p.selectedAlias} (--sap-alias)`));
+}

package/dist/repl/rule8-detector.js

@@ -76,12 +76,12 @@ export function renderPlanSummary(proposedNext) {
     const lines = [];
     lines.push(`Batch in progress (${writeOpsThisTurn.length + 1} write ops this turn):`);
     writeOpsThisTurn.forEach((op, i) => {
-        lines.push(`  ${i + 1}. ${op.tool} ${summarizeArgs(op.args)}`);
+        lines.push(`  ${i + 1}. ${op.tool} ${summarizeArgs(op.args, op.tool)}`);
     });
-    lines.push(`  ${writeOpsThisTurn.length + 1}. ${proposedNext.tool} ${summarizeArgs(proposedNext.args)} ← about to dispatch`);
+    lines.push(`  ${writeOpsThisTurn.length + 1}. ${proposedNext.tool} ${summarizeArgs(proposedNext.args, proposedNext.tool)} ← about to dispatch`);
     return lines.join('\n');
 }
-function summarizeArgs(args) {
+function summarizeArgs(args, tool) {
     // Best-effort one-line summary. Pulls the most useful identifier fields so a
     // customer reviewing the batch gate sees WHAT each op targets (Forge Rule 8
     // is unauditable theatre otherwise):
@@ -90,6 +90,14 @@ function summarizeArgs(args) {
     //   - SAP object writes       → type+name, class_name->method_name, transport
     const a = args;
     const parts = [];
+    // L1-6 R1-6: a preview start hands the stored SAP login to a local process.
+    // Say so in plain words — the approver must see it, not only the model.
+    if (tool === 'fiori_preview' && (a['action'] === undefined || a['action'] === 'start')) {
+        const alias = typeof a['alias'] === 'string' && a['alias'] ? a['alias'] : 'the session alias';
+        const dir = typeof a['appDir'] === 'string' && a['appDir'] ? `start ${a['appDir']} — ` : 'start — ';
+        return (`${dir}the SAP login for ${alias} is passed to the preview process through its environment ` +
+            `when the app's ui5 config names a backend (an app with no backend url starts without it)`);
+    }
     // Local-FS writes (the fiori-build path: 13× file_write + 2× shell_exec) —
     // the path / command is the only meaningful descriptor; surface it FIRST.
     if (typeof a['path'] === 'string' && a['path']) {