@cspeach/cli 1.1.18 → 1.1.20

package/dist/skills/preamble.js

@@ -0,0 +1,75 @@
+/**
+ * CLI copy of cspeach-proxy/src/skills/preamble.ts FORGE_PRINCIPLES_PREAMBLE.
+ *
+ * Task 5 (2026-09-27, ruling F3): BYOK, AI-hub and local build the system
+ * prompt client-side, so they need the same preamble the proxy prepends for
+ * managed turns. src/skills/__tests__/preamble-pin.test.ts asserts the two
+ * template literals stay byte-equal — edit both files together.
+ */
+export const FORGE_PRINCIPLES_PREAMBLE = `# CSPeach Principles
+
+You are operating inside CSPeach, an AI-assisted ABAP development tool with
+direct access to the user's SAP system via ADT. Follow these principles on
+every turn. The active skill may specialize your behavior; these principles
+take precedence if a skill's instruction conflicts with them.
+
+## Correctness over speed
+- Read before writing. Use sap_get_source and sap_object_structure to ground
+  your understanding in the real code before proposing changes.
+- Never hallucinate method names, field names, parameter types, or table
+  structures. If you're not sure, look it up.
+- When modifying method logic without changing the class definition
+  (no new/removed methods, no signature changes), use sap_update_method
+  per method. Do NOT rewrite the full class with sap_set_source.
+- Batch independent reads in one response.
+- When a result says it was saved to a file, read the slice you need with
+  tool_output_read(path, offset, limit); do not re-run the command.
+
+## Heavy reading
+- Send more than two source reads, any where-used scan, ATC-finding triage or
+  a package inventory to a reader: call read_agent with a precise brief (what
+  to read, what to report) and work from its report. Do not read those sources
+  yourself when the turn will keep working afterwards.
+- Do not use a reader for one or two reads, a small edit, or to check your own
+  work. Never more than three readers for one task unless the user asks. Send
+  independent readers in one response so they run at the same time.
+
+## Safety gates are mandatory
+- Mutating tools (sap_set_source, sap_update_method, sap_delete_object,
+  sap_activate, sap_create_object, sap_transport_*, sap_message_maintain,
+  sap_number_range_intervals, sap_service_binding_publish) require a valid
+  approval_id from request_approval. You cannot bypass this.
+- Snapshots are taken automatically before every write — do not ask the
+  user to confirm snapshots.
+- After every write, syntax is checked and activation is verified. You
+  will see results as tool_results. Do not activate if syntax errors exist.
+
+## Plan before batch
+- If you will modify more than one object, call request_approval with all
+  changes in a single changes[] array first. The user sees a holistic plan
+  before per-change prompts.
+- If a plan is rejected, ask the user what to change. Do not silently
+  revise and re-submit.
+
+## Transport discipline
+- All writes go into the active session transport. Do not ask the user
+  for a transport number per change.
+- Never use \$TMP unless the user explicitly requests local-only work.
+
+## Escalate, don't fail silently
+- If a tool returns an error you don't know how to recover from, surface
+  the error to the user with a clear explanation and ask how to proceed.
+- If ATC or syntax errors block activation, fix them or ask — never
+  suppress or hide.
+- Stop and ask the user before a 4th attempt on the same operation. Do not keep retrying silently.
+
+## Ask when unsure
+- For ambiguous requests, ask one clarifying question before acting.
+- For destructive operations on production-namespaced objects, confirm
+  intent in text even if approval_id is granted.
+
+## One skill per turn
+- If the user's request is better served by a different skill, call
+  switch_skill with a clear reason. Do not try to do the work of another
+  skill yourself.
+`;

package/dist/skills/source-manifest.js

@@ -2,6 +2,11 @@ import { ManifestClient } from './manifest-client.js';
 export function createManifestSkillSource(manifestUrl) {
     const client = new ManifestClient(manifestUrl);
     let cachedManifest = null;
+    // Task 5 (2026-09-27) — BYOK / AI-hub fetch the skill body on every model
+    // call (the system prompt is built client-side). Cache the sha-verified body
+    // for the source's lifetime, like the manifest, so each tool-loop round does
+    // not hit the network. Failures are not cached.
+    const bodyCache = new Map();
     async function getManifest() {
         if (!cachedManifest)
             cachedManifest = await client.fetchAndVerifyManifest();
@@ -13,7 +18,12 @@ export function createManifestSkillSource(manifestUrl) {
             const entry = m.skills.find(s => s.name === name);
             if (!entry)
                 throw new Error(`skill '${name}' not found in manifest (available: ${m.skills.map(s => s.name).join(', ')})`);
-            return client.fetchSkillBody(name, entry.body_url, { expectedSha256: entry.sha256 });
+            const cached = bodyCache.get(name);
+            if (cached && cached.sha256 === entry.sha256)
+                return cached;
+            const body = await client.fetchSkillBody(name, entry.body_url, { expectedSha256: entry.sha256 });
+            bodyCache.set(name, body);
+            return body;
         },
         async listAvailableSkills() {
             const m = await getManifest();

package/dist/standards/standards-init.js

@@ -156,7 +156,7 @@ export async function readStandardsSource(src) {
     return fs.readFile(src, 'utf8');
 }
 async function defaultPrompts() {
-    const { input, select } = await import('@inquirer/prompts');
+    const { input, select } = await import('../repl/themed-prompts.js');
     return {
         select: (opts) => select({ message: opts.message, choices: opts.choices, default: opts.default }),
         input: (opts) => input({ message: opts.message, default: opts.default }),

package/dist/test-helpers/answer-any.js

@@ -0,0 +1,46 @@
+// Channel-agnostic answerer for behaviour pins (piece 2, Part 4).
+//
+// Lives under src/ (not test/helpers/ as the plan named it): the pins that
+// use it sit in src/**/__tests__, which tsc type-checks with rootDir 'src',
+// so a helper outside src/ fails `pnpm typecheck` (TS6059).
+//
+// A confirm today goes through askQuestionEmitter (the v1 modal). After its
+// migration it goes through cardSlotEmitter ('confirm'). This helper listens
+// on BOTH and feeds the same logical answers in order, so a pin written before
+// the migration stays valid, unchanged, after it. `null` = Esc / cancelled.
+import { askQuestionEmitter } from '../ui/ask-question-emitter.js';
+import { cardSlotEmitter } from '../ui/card-slot.js';
+export function answerAny(...answers) {
+    const seen = [];
+    let i = 0;
+    const next = () => (i < answers.length ? (answers[i++] ?? null) : null);
+    const onAsk = (req) => {
+        seen.push({
+            id: req.id,
+            values: req.choices.map((c) => c.value),
+            initial: 0,
+            text: `${req.question}\n${req.context ?? ''}`,
+        });
+        const a = next();
+        req.resolve(a === null ? { answer: null, cancelled: true } : { answer: a });
+    };
+    const onCard = (req) => {
+        seen.push({
+            id: req.id,
+            values: req.choices.map((c) => c.value),
+            initial: req.initial ?? 0,
+            text: `${req.title}\n${(req.facts ?? []).join('\n')}`,
+        });
+        const a = next();
+        req.resolve(a === null ? { value: null, cancelled: true } : { value: a });
+    };
+    askQuestionEmitter.on('request', onAsk);
+    cardSlotEmitter.on('confirm', onCard);
+    return {
+        seen,
+        dispose: () => {
+            askQuestionEmitter.off('request', onAsk);
+            cardSlotEmitter.off('confirm', onCard);
+        },
+    };
+}

package/dist/tools/approval.js

@@ -1,7 +1,19 @@
 import chalk from 'chalk';
 import { registerTool } from './index.js';
-import { isHeadless } from '../renderer/tty.js';
-import { effectiveRisk } from '../approvals/risk-floor.js';
+import { isHeadless, shouldUseInk } from '../renderer/tty.js';
+import { effectiveRisk, riskReasonText } from '../approvals/risk-floor.js';
+import { objectsWithSyntaxErrors } from './syntax-state.js';
+import { noteWriteTransport } from '../repl/current-transport.js';
+/**
+ * Round 8 item 6 — the footer showed "no transport" while the approved card
+ * said "transport S4HK903731". An approval granted for an explicit transport
+ * is the transport chosen for this work: the footer shows it (display-only
+ * wire — the session transport pointer and write fallback are untouched).
+ */
+function noteApprovedTransport(t) {
+    if (typeof t === 'string' && /^[A-Z0-9]{3}K\d{6}$/i.test(t.trim()))
+        noteWriteTransport(t.trim().toUpperCase());
+}
 import { mintChangeApproval } from '../approvals/jwt.js';
 import { canonicalApprovalObject } from '../approvals/canonical.js';
 import { renderPlanGate, renderPerChangeApprovalV3 } from '../approvals/render.js';
@@ -26,7 +38,7 @@ import { isGuardedRunActive, getCurrentPhaseWrites, notePlanDeviation, PLAN_DEVI
  * unused — the prompt and render are sapAlias-agnostic.
  */
 export async function handleAdvisoryApproval(args, _ctx) {
-    const render = renderAdvisoryProposal(args);
+    const render = renderAdvisoryProposal(args, { interactiveHint: !shouldUseInk() });
     // B5 (2026-06-11) — headless: the advisory prompt blocks on stdin that
     // will never answer. Render the proposal (it IS the run's deliverable —
     // the developer reads the captured output and applies manually), skip
@@ -185,6 +197,7 @@ registerTool({
         const riskCtx = {
             sapAlias: ctx.sapAlias,
             autoApprovePolicy: sapCfg?.auto_approve ?? 'never',
+            syntaxErrorObjects: objectsWithSyntaxErrors(),
         };
         const changes = args.changes;
         const declared = args.risk;
@@ -233,18 +246,19 @@ registerTool({
             for (const c of changes) {
                 // Task A3: mint via the canonical path — the JWT stores the same
                 // object string the write tools' validators will compare against.
-                ids.push(await mintChangeApproval(c, ctx.session.id));
+                ids.push(await mintChangeApproval(c, ctx.session.id, { auto: true }));
             }
             // Tell Rule 8 the user has already covered this batch — they
             // configured auto-approve, so no per-dispatch re-prompts.
             markPlanGateApproved();
+            noteApprovedTransport(args.transport); // round 8 item 6
             return {
                 content: JSON.stringify({
                     approved: true,
                     auto_approved: true,
                     approval_ids: ids,
                     effective_risk: eff.level,
-                    raised_by: eff.raisedBy,
+                    raised_by: eff.raisedBy.map(riskReasonText), // round 8 item 4: plain words, never codes
                 }),
             };
         }
@@ -266,7 +280,7 @@ registerTool({
                         'No approval IDs were minted — do not attempt any write operations. ' +
                         'Summarise the proposed changes so the user can re-run interactively or switch write_mode to "advisory-only".',
                     effective_risk: eff.level,
-                    raised_by: eff.raisedBy,
+                    raised_by: eff.raisedBy.map(riskReasonText), // round 8 item 4: plain words, never codes
                 }),
                 is_error: true,
             };
@@ -278,14 +292,14 @@ registerTool({
         // gate. Cancel rejects the whole plan.
         let skipPerChangeGates = false;
         if (changes.length > 1) {
-            const mode = await renderPlanGate(args.summary, changes, planGateTransport, eff);
+            const mode = await renderPlanGate(args.summary, changes, planGateTransport, eff, ctx.sapAlias);
             if (mode === 'cancel') {
                 return {
                     content: JSON.stringify({
                         approved: false,
                         reason: 'plan_rejected',
                         effective_risk: eff.level,
-                        raised_by: eff.raisedBy,
+                        raised_by: eff.raisedBy.map(riskReasonText), // round 8 item 4: plain words, never codes
                     }),
                 };
             }
@@ -347,7 +361,7 @@ registerTool({
                             approved: false,
                             reason: 'user_cancelled_turn',
                             effective_risk: eff.level,
-                            raised_by: eff.raisedBy,
+                            raised_by: eff.raisedBy.map(riskReasonText), // round 8 item 4: plain words, never codes
                         }),
                     };
                 }
@@ -364,15 +378,17 @@ registerTool({
         // Tell Rule 8 the user has explicitly approved (some/all of) this
         // batch via the plan-gate / per-change flow. Suppresses the redundant
         // Rule 8 prompt at every subsequent dispatch this turn.
-        if (approvalIds.length > 0)
+        if (approvalIds.length > 0) {
             markPlanGateApproved();
+            noteApprovedTransport(args.transport); // round 8 item 6
+        }
         return {
             content: JSON.stringify({
                 approved: approvalIds.length > 0,
                 approval_ids: approvalIds,
                 skipped: rejections,
                 effective_risk: eff.level,
-                raised_by: eff.raisedBy,
+                raised_by: eff.raisedBy.map(riskReasonText), // round 8 item 4: plain words, never codes
             }),
         };
     },

package/dist/tools/ask-question.js

@@ -22,7 +22,7 @@
  * it just got back and can cross-reference the question id.
  *
  * UX Wave 2 — v2 batched `questions` shape (up to 4 related questions in
- * ONE call): Ink renders a single <AskForm> (Task 2); classic runs the
+ * ONE call): Ink renders a single <AskCard> (Task 2); classic runs the
  * questions as a sequential inquirer flow (Task 3). Both return
  * `{ formId, answers: [{id, answer, custom?}], cancelled? }`.
  */
@@ -32,8 +32,24 @@ import { input, select, checkbox } from '@inquirer/prompts';
 import { withInquirer } from '../repl/inquirer-guard.js';
 import { shouldUseInk, isHeadless } from '../renderer/tty.js';
 import { askQuestionEmitter } from '../ui/ask-question-emitter.js';
+import { emitTrace, formatAnswerTrace } from '../renderer/trace.js';
+import { truncateToWidth, uiWidth } from '../renderer/ui-width.js';
+import { answerDisplayText } from '../ui/ask-answer-text.js';
 /** Chip labels in the v2 form are capped at 12 chars (brief-binding). */
 const HEADER_MAX_CHARS = 12;
+/**
+ * Piece 2 / Q1c — scrollback trace labels (spec §3 "Scrollback trace").
+ * Ink only: classic inquirer already leaves its own answered line.
+ * v1 has no chip header, so the question is cut to a short label; v2 uses
+ * each question's header (the chip text the user saw).
+ */
+const TRACE_QUESTION_CELLS = 48;
+function v1TraceLabel(question) {
+    return truncateToWidth(question, TRACE_QUESTION_CELLS);
+}
+function formTraceLabel(form) {
+    return form.questions.map((q) => q.header ?? q.id).join(' · ');
+}
 /**
  * UX Wave 2 / Task 1 — validation failure for a v2 `questions` payload.
  * The handler converts this into an error RESULT (`ask_form_invalid`),
@@ -45,6 +61,17 @@ export class AskFormValidationError extends Error {
         this.name = 'AskFormValidationError';
     }
 }
+/**
+ * Fix round 3 (item 9c) — an option that plainly stops the flow ends a form
+ * even when the model forgot `ends_form`: asking the next question after
+ * "Stop here" was the live defect. Review I1: inferred ONLY from a "Stop" /
+ * "Stop here" label. "Cancel" / "Abort" can be real answers (a RAP action
+ * named Cancel), so they end the form only with an explicit `ends_form: true`.
+ */
+const STOP_LABEL = /^stop( here)?$/i;
+function isStopOption(o) {
+    return STOP_LABEL.test(o.label.trim());
+}
 function normalizeOptions(raw) {
     if (!Array.isArray(raw))
         return [];
@@ -54,6 +81,8 @@ function normalizeOptions(raw) {
             opt.description = String(o.description);
         if (o.recommended === true)
             opt.recommended = true;
+        if (o.ends_form === true || isStopOption(opt))
+            opt.endsForm = true;
         return opt;
     });
 }
@@ -167,7 +196,7 @@ export function pickHeadlessChoices(kind, choices) {
 }
 registerTool({
     name: 'ask_question',
-    description: "Ask the user a clarifying question and get their answer. Use this for ANY user-decision point in a skill conversation — object names, design choices, approval checkpoints, etc. The CLI renders a formatted prompt, waits for the user's answer, and returns it as the tool result. Prefer this over emitting a text question — it is the only reliable mechanism for mid-turn user interaction. When you have MULTIPLE related questions, batch up to 4 into ONE call via `questions` — the user answers them in a single form. Never ask more than 4 at once; never split related questions across calls.",
+    description: "Ask the user a clarifying question and get their answer. Use this for ANY user-decision point in a skill conversation — object names, design choices, approval checkpoints, etc. The CLI renders a formatted prompt, waits for the user's answer, and returns it as the tool result. Prefer this over emitting a text question — it is the only reliable mechanism for mid-turn user interaction. When you have MULTIPLE related questions, batch up to 4 into ONE call via `questions` — the user answers them in a single form. Never ask more than 4 at once; never split related questions across calls. Before asking the user to confirm a plan, write the plan out in your message first (objects, order, transport) — the form shows only the question, so a plan you have not written is a plan the user cannot see.",
     isMutating: false,
     input_schema: {
         type: 'object',
@@ -237,6 +266,10 @@ registerTool({
                                         type: 'boolean',
                                         description: 'Mark the option you would recommend. Auto-picked in headless runs.',
                                     },
+                                    ends_form: {
+                                        type: 'boolean',
+                                        description: 'Picking this option ends the form at once (e.g. "Stop here", or a Cancel that means stop asking); the remaining questions come back with answer null. Only a "Stop" / "Stop here" label is treated this way automatically — set this for any other stop option.',
+                                    },
                                 },
                                 required: ['value', 'label'],
                             },
@@ -300,17 +333,24 @@ registerTool({
                 };
             }
             // Interactive v2, INK path — wired by Task 2: requestForm emits the
-            // discriminated form request, App routes it to <AskForm> (v1 requests
-            // keep rendering the untouched AskQuestionModal), and the resolved
+            // discriminated form request, App routes it to <AskCard> (v1 requests
+            // render the same AskCard), and the resolved
             // AskFormResult comes back here. Cancel (Esc / no listener) mirrors
             // the v1 cancel contract: empty answers + cancelled: true.
             if (shouldUseInk()) {
                 const result = await askQuestionEmitter.requestForm(form);
                 if (result.cancelled) {
+                    emitTrace(formatAnswerTrace(formTraceLabel(form), 'cancelled', uiWidth()));
                     return {
                         content: JSON.stringify({ formId: form.formId, answers: [], cancelled: true }),
                     };
                 }
+                for (const a of result.answers) {
+                    const q = form.questions.find((qq) => qq.id === a.id);
+                    if (!q || a.answer === null)
+                        continue;
+                    emitTrace(formatAnswerTrace(q.header ?? q.id, answerDisplayText(a.answer, q.options, a.custom === true), uiWidth()));
+                }
                 return {
                     content: JSON.stringify({ formId: result.formId, answers: result.answers }),
                 };
@@ -322,7 +362,7 @@ registerTool({
             // the v1 building blocks: select + "(type a custom answer)" escape
             // for pick-one, checkbox for multiSelect, input for freeText.
             //
-            // Result shapes mirror the Ink AskForm EXACTLY (Task-2 contract):
+            // Result shapes mirror the Ink AskCard EXACTLY (Task-2 contract):
             //   success → { formId, answers: [{ id, answer, custom? }] }  — in
             //             question order; custom:true ONLY for the escape.
             //   Esc anywhere (ExitPromptError) → { formId, answers: [],
@@ -487,8 +527,10 @@ registerTool({
                 choices: choices ?? [],
             });
             if (result.cancelled || result.answer === null || result.answer.length === 0) {
+                emitTrace(formatAnswerTrace(v1TraceLabel(question), 'cancelled', uiWidth()));
                 return { content: JSON.stringify({ id, kind, answer: null, cancelled: true }) };
             }
+            emitTrace(formatAnswerTrace(v1TraceLabel(question), answerDisplayText(result.answer, kind === 'text' ? [] : (choices ?? [])), uiWidth()));
             return { content: JSON.stringify({ id, kind, answer: result.answer }) };
         }
         // Classic mode — inquirer path (unchanged from v0.6).

package/dist/tools/filesystem/file-read.js

@@ -11,6 +11,8 @@
 import { promises as fs } from 'node:fs';
 import { registerTool } from '../index.js';
 import { resolveSafePath, assertRealPathContained, PathOutsideRootError, DENYLIST_DESCRIPTION, isDenylistedPath } from '../_filesystem-shared.js';
+import { spillToolResult, isUnderSpillRoot } from '../result-spill.js';
+import { basename } from 'node:path';
 const MAX_LINES = 2000;
 export async function fileReadHandler(args, ctx) {
     // Validate offset and limit BEFORE clamping
@@ -68,7 +70,15 @@ export async function fileReadHandler(args, ctx) {
     const trailer = truncated
         ? `\n... (truncated, ${allLines.length - (offset + window.length)} more lines — re-read with offset=${offset + window.length})`
         : '';
-    return { content: numbered + trailer };
+    // Task 17 (spec D12) — a window above 8 000 chars is saved to the session
+    // spill file and previewed; today's trailer stays last, byte-identical. A
+    // file already under the spill root is a slice already: never re-spilled.
+    // The spill keeps the FILE's line numbers (a `.n.txt` spill, which
+    // tool_output_read shows unnumbered-again) — one numbering space.
+    const body = isUnderSpillRoot(realAbs)
+        ? numbered
+        : spillToolResult({ content: numbered }, ctx, 'file', { numbered: true, label: basename(realAbs) }).content;
+    return { content: body + trailer };
 }
 registerTool({
     name: 'file_read',

package/dist/tools/filesystem/file-write.js

@@ -17,7 +17,7 @@
  *
  * Flag-gated: invisible to listTools() unless CSPEACH_TOOL_FILE_WRITE=on.
  */
-import { promises as fs } from 'node:fs';
+import { promises as fs, readFileSync } from 'node:fs';
 import * as path from 'node:path';
 import { registerTool } from '../index.js';
 import { resolveSafePath, assertRealPathContained, PathOutsideRootError, DENYLIST_DESCRIPTION, isDenylistedPath, blockedExecutableExtension, } from '../_filesystem-shared.js';
@@ -30,13 +30,30 @@ import { resolveSafePath, assertRealPathContained, PathOutsideRootError, DENYLIS
  */
 let guideNoteShown = false;
 export function __resetGuideNoteForTests() { guideNoteShown = false; }
+/**
+ * Dry run 2026-09-25: a CAP app's GUIDE.md was announced as "applying these
+ * objects in SAP". A CAP project (package.json depending on @sap/cds) has no
+ * SAP objects — its guide is about running and checking the app.
+ */
+function isCapProject(cwd) {
+    try {
+        const pkg = JSON.parse(readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+        return Boolean(pkg?.dependencies?.['@sap/cds'] ?? pkg?.devDependencies?.['@sap/cds']);
+    }
+    catch {
+        return false;
+    }
+}
 function noteGuideWritten(relPath, ctx) {
     if (guideNoteShown)
         return;
     if (path.basename(relPath).toLowerCase() !== 'guide.md')
         return;
     guideNoteShown = true;
-    ctx.chunkEmitter?.emit('info', `${relPath} is your step-by-step list for applying these objects in SAP — `
+    const what = isCapProject(ctx.cwd)
+        ? 'step-by-step list for running and checking this app'
+        : 'step-by-step list for applying these objects in SAP';
+    ctx.chunkEmitter?.emit('info', `${relPath} is your ${what} — `
         + 'open it at https://cspeach.dev/guide, or in any text editor. '
         + 'If a step fails, come back here and say "step N failed" with the error.');
 }

package/dist/tools/fiori/fe-extend.js

@@ -36,6 +36,21 @@ function isMissingFeLibError(msg) {
  * flush the result to disk. Throws NotV4FeAppError when the target is not a V4
  * FE app; rethrows any other writer error unchanged.
  */
+/**
+ * A custom action must always get a working press handler. fe-fpm-writer reads
+ * `eventHandler` at the TOP level of the action config; a flag passed inside
+ * `settings` was silently ignored and the action was written with press "" — a
+ * button that does nothing (on UI5 1.136 without even an error). So: hoist a
+ * `settings.eventHandler` to the top level, and when no handler is given at all,
+ * generate one (true = a new ext/<Name> handler module).
+ */
+export function withActionHandler(params) {
+    const settings = { ...(params.settings ?? {}) };
+    const fromSettings = settings.eventHandler;
+    delete settings.eventHandler;
+    const eventHandler = params.eventHandler ?? fromSettings ?? true;
+    return { ...params, settings, eventHandler };
+}
 export async function feExtend(opts) {
     // Dynamic import: keep the heavy writer out of the cold-start path (mirrors
     // the engine's lazy-load convention; only paid when the tool actually runs).
@@ -50,7 +65,7 @@ export async function feExtend(opts) {
                 result = await fpm.generateCustomColumn(opts.basePath, opts.params, editor);
                 break;
             case 'custom-action':
-                result = await fpm.generateCustomAction(opts.basePath, opts.params, editor);
+                result = await fpm.generateCustomAction(opts.basePath, withActionHandler(opts.params), editor);
                 break;
             case 'custom-section':
                 result = await fpm.generateCustomSection(opts.basePath, opts.params, editor);

package/dist/tools/fiori/fe-scaffold.js

@@ -1,12 +1,108 @@
-// cspeach-cli/src/tools/fiori/fe-scaffold.ts
-import { generate, TemplateType, OdataVersion } from '@sap-ux/fiori-elements-writer';
 import { create } from 'mem-fs';
 import { create as createEditor } from 'mem-fs-editor';
 import { join } from 'node:path';
-const DEFAULT_UI5_VERSION = '1.120.0'; // same rationale as scaffold.ts (avoids the 1.71 blank-page trap)
+import { PINNED_UI5_VERSION } from './ui5-version.js';
+// The ONE pinned, CDN-hosted patch (ui5-version.ts) — never an x.y.0 guess.
+const DEFAULT_UI5_VERSION = PINNED_UI5_VERSION;
+/**
+ * F-4: a generated list report loads its rows when it opens. The writers leave
+ * the FE default, which on a draft service shows "To start, set the relevant
+ * filters and choose Go" and no data — a user sees an empty app and the render
+ * smoke's `rows` check has nothing to count.
+ *   V4 (sap.fe.templates.ListReport targets — LROP, Worklist, ALP): initialLoad "Enabled".
+ *   V2 (sap.ui.generic.app list pages): dataLoadSettings.loadDataOnAppLaunch "always".
+ * Object pages and OVP are untouched.
+ */
+/**
+ * The V4 `initialLoad` value for the target UI5 version. sap.fe's ListComponent
+ * typed it as a BOOLEAN up to 1.84 (S/4HANA 2020) and as
+ * sap.fe.core.InitialLoadMode ("Auto" | "Enabled" | "Disabled") from 1.96 —
+ * checked against the CDN sources 2026-09-24 (1.85–1.95 are not hosted and not
+ * shipped with an S/4 release). The wrong type throws during component creation
+ * and the list never renders.
+ */
+export function initialLoadSetting(ui5Version) {
+    const minor = Number(/^1\.(\d+)/.exec(ui5Version)?.[1] ?? NaN);
+    return Number.isFinite(minor) && minor < 96 ? true : 'Enabled';
+}
+/**
+ * 2026-09-25: UI5 tooling 4's dev server (`fiori run` for ABAP apps,
+ * cds-plugin-ui5 for CAP apps) runs the manifest enhancer, which derives
+ * supportedLocales from the i18n files an app ships — only i18n.properties, so
+ * [""] — but adds no fallbackLocale, and UI5's default fallback 'en' is then
+ * "not contained in the list of supported locales", a console error at every
+ * boot. Declaring both on every bundle is the fix the tooling's own warning
+ * names ("configure another available fallbackLocale").
+ */
+function declareBaseLocale(fs, manifestPath) {
+    if (!fs.exists(manifestPath))
+        return;
+    const manifest = fs.readJSON(manifestPath);
+    const locales = { supportedLocales: [''], fallbackLocale: '' };
+    const app = manifest?.['sap.app'];
+    if (app && typeof app.i18n === 'string')
+        app.i18n = { bundleUrl: app.i18n, ...locales };
+    else if (app?.i18n && typeof app.i18n === 'object')
+        Object.assign(app.i18n, locales);
+    const models = manifest?.['sap.ui5']?.models ?? {};
+    for (const m of Object.values(models)) {
+        if (m?.type === 'sap.ui.model.resource.ResourceModel')
+            m.settings = { ...(m.settings ?? {}), ...locales };
+    }
+    fs.writeJSON(manifestPath, manifest);
+}
+/**
+ * Dry run 2026-09-25: under cds-plugin-ui5 the app's ui5 middlewares run inside
+ * the CAP server process. fiori-tools-preview loads @sap/cds-dk's own nested
+ * @sap/cds — a second CAP copy — and every draft create then crashes the server
+ * ("no primary database" → lean-draft "Maximum call stack size exceeded"). The
+ * launchpad page is a real file (test/flpSandbox.html), so the preview
+ * middleware is not needed there. Exactly that entry goes; anything else
+ * unexpected in the writer's ui5.yaml fails loudly instead of shipping a crash.
+ */
+export function withoutFioriToolsPreview(yaml) {
+    const lines = yaml.split(/\r?\n/);
+    const start = lines.findIndex((l) => /^ {4}- name: fiori-tools-preview\s*$/.test(l));
+    if (start < 0)
+        throw new Error('ui5.yaml has no fiori-tools-preview middleware entry to remove');
+    // The entry is every following line indented deeper than its "- name:" line.
+    let end = start + 1;
+    while (end < lines.length && /^ {5,}\S/.test(lines[end]))
+        end++;
+    return [...lines.slice(0, start), ...lines.slice(end)].join('\n');
+}
+function loadListsOnOpen(fs, manifestPath, ui5Version) {
+    if (!fs.exists(manifestPath))
+        return;
+    const manifest = fs.readJSON(manifestPath);
+    let changed = false;
+    const targets = manifest?.['sap.ui5']?.routing?.targets ?? {};
+    for (const t of Object.values(targets)) {
+        if (t?.name === 'sap.fe.templates.ListReport') {
+            t.options ??= {};
+            t.options.settings ??= {};
+            t.options.settings.initialLoad = initialLoadSetting(ui5Version);
+            changed = true;
+        }
+    }
+    const pages = manifest?.['sap.ui.generic.app']?.pages ?? {};
+    for (const p of Object.values(pages)) {
+        const name = p?.component?.name;
+        if (name === 'sap.suite.ui.generic.template.ListReport' || name === 'sap.suite.ui.generic.template.AnalyticalListPage') {
+            p.component.settings ??= {};
+            p.component.settings.dataLoadSettings = { loadDataOnAppLaunch: 'always' };
+            changed = true;
+        }
+    }
+    if (changed)
+        fs.writeJSON(manifestPath, manifest);
+}
 /** Scaffold a Fiori Elements shell and FULLY flush it to disk. Relies on the
  *  service's backend @UI annotations — authors no local annotation.xml. */
 export async function scaffoldFioriElements(opts) {
+    // Loaded on use (fix round 3, item 11e): this writer's module graph alone
+    // cost ~2.8 s of every CLI start, Fiori work or not.
+    const { generate, TemplateType, OdataVersion } = await import('@sap-ux/fiori-elements-writer');
     const ui5Version = opts.ui5Version ?? DEFAULT_UI5_VERSION;
     const version = opts.service.version === '2.0' ? OdataVersion.v2 : OdataVersion.v4;
     // Per-template settings (spike §3): LROP/Worklist/ALP use
@@ -62,6 +158,12 @@ export async function scaffoldFioriElements(opts) {
         ui5: { minUI5Version: ui5Version, version: ui5Version },
     };
     await generate(opts.basePath, config, fs);
+    loadListsOnOpen(fs, join(opts.basePath, 'webapp', 'manifest.json'), ui5Version);
+    declareBaseLocale(fs, join(opts.basePath, 'webapp', 'manifest.json'));
+    if (opts.backend === 'cap') {
+        const ui5YamlPath = join(opts.basePath, 'ui5.yaml');
+        fs.write(ui5YamlPath, withoutFioriToolsPreview(fs.read(ui5YamlPath)));
+    }
     if (!opts.localAnnotations) {
         // @sap-ux writers force-inject a 'localAnnotationsName: annotation' dataSource for
         // EDMX services even when none was requested, but only write the XML file when

package/dist/tools/fiori/html-escapes.js

@@ -0,0 +1,28 @@
+// cspeach-cli/src/tools/fiori/html-escapes.ts
+//
+// Dry run 2026-09-25: an app header showed "Suppliers & Quality
+// Certificates". Two sources: the model sent the title already HTML-escaped,
+// and the freestyle writer HTML-escapes the main view title into
+// i18n.properties. i18n texts and titles are plain text — UI5 shows "&"
+// literally — so escapes are decoded, in ONE pass ("<" becomes "<").
+const NAMED = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" };
+export function decodeHtmlEscapes(text) {
+    return text.replace(/&(amp|lt|gt|quot|apos|#\d{1,7}|#x[0-9a-fA-F]{1,6});/g, (m, name) => {
+        if (name[0] !== '#')
+            return NAMED[name] ?? m;
+        const code = name[1] === 'x' ? parseInt(name.slice(2), 16) : parseInt(name.slice(1), 10);
+        return code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : m;
+    });
+}
+/** Decode the VALUE of every `key=value` line of a .properties file; comments and keys untouched. */
+export function decodePropertiesValues(properties) {
+    return properties
+        .split(/(\r?\n)/)
+        .map((part) => {
+        const eq = part.indexOf('=');
+        if (eq < 0 || /^\s*[#!]/.test(part))
+            return part;
+        return part.slice(0, eq + 1) + decodeHtmlEscapes(part.slice(eq + 1));
+    })
+        .join('');
+}