@cspeach/cli 1.1.27 → 1.1.28

package/dist/tools/text-elements/tools.js

@@ -0,0 +1,433 @@
+/**
+ * sap_get_text_elements / sap_set_text_elements — a program's text elements:
+ * selection texts (the labels of PARAMETERS / SELECT-OPTIONS), text symbols
+ * (TEXT-001) and list headings.
+ *
+ * Why (2026-10-04, S4H demo rehearsal): /abap-refactor added checkbox P_SUBTOT
+ * and the screen showed the raw name — CSPeach could not write selection texts
+ * and told the user to go to SE38. Owner rule: always descriptive selection
+ * texts on ABAP selection screens.
+ *
+ * The write runs the SAME gates as every other SAP write:
+ *   1 approval_id (request_approval; advisory-only never mints one)
+ *   2 write-mode clamp, defence in depth: advisory-only and a prd-tagged alias
+ *     refuse here too
+ *   3 owning-transport resolution (object locked in a request → that request;
+ *     else the supplied / session transport)
+ *   4 read the current part — HARD: no merge without it, a blind PUT would
+ *     drop every text already there
+ *   5 validate (names, lengths) + check names against the selection screen
+ *   6 merge — existing texts kept byte for byte
+ *   7 Rule 7 snapshot of the current part (PROG.TEXT_<KIND>) — HARD
+ *   8 WAL → lock textelements uri / PUT / unlock (sap-client)
+ *   9 activate the text pool (texts land inactive), then Rule 10 read-back:
+ *     every new text present AND no old text lost.
+ *
+ * The SAP calls live in @cspeach/sap-client >= 0.1.16 (getTextElementsSource,
+ * setTextElementsSource, activateTextElements). On an older pin the tools say
+ * so plainly instead of failing obscurely.
+ */
+import crypto from 'node:crypto';
+import { registerTool } from '../index.js';
+import { verifyAndSpendApprovalId } from '../../approvals/jwt.js';
+import { grantClaimMismatch, grantOwningTransportMismatch, grantOwningTransportDetail } from '../../approvals/grant-claims.js';
+import { appendPending, finalizeToolCall } from '../../session/pending.js';
+import { snapshots, auditLog } from '@cspeach/sap-client';
+import { ERR } from '../../errors/codes.js';
+import { resolveWriteTransport } from '../transport-resolution.js';
+import { noteWriteTransport } from '../../repl/current-transport.js';
+import { loadConfig } from '../../config/loader.js';
+import { getEffectiveWriteMode } from '../../repl/mode-cycle.js';
+import { buildWriteChainLine } from '../../renderer/verify-chain.js';
+import { TEXT_ELEMENT_KINDS, isTextElementKind, parseTextPool, formatTextPool, mergeTextPool, validateUpdates, selectionScreenNames, textElementsSnapshotType, canonicalKey, } from './pool.js';
+function textAdt(ctx) {
+    const a = ctx.adt;
+    return typeof a.getTextElementsSource === 'function'
+        && typeof a.setTextElementsSource === 'function'
+        && typeof a.activateTextElements === 'function'
+        ? a
+        : null;
+}
+const UNSUPPORTED = {
+    content: JSON.stringify({
+        error: 'text_elements_unsupported',
+        detail: 'This CSPeach build\'s SAP client cannot read or write text elements yet (needs @cspeach/sap-client 0.1.16 or later). '
+            + 'Tell the user the selection texts to add in SE38 → Goto → Text Elements, and list them.',
+    }),
+    is_error: true,
+};
+function errorEnvelope(body) {
+    return { content: JSON.stringify(body), is_error: true };
+}
+function httpStatusOf(err) {
+    const s = err?.httpStatus;
+    return typeof s === 'number' ? s : undefined;
+}
+function shortError(err) {
+    return (err instanceof Error ? err.message : String(err)).replace(/\s+/g, ' ').trim().slice(0, 400);
+}
+function programName(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const n = raw.trim().toUpperCase();
+    return /^[A-Z0-9_/]{1,40}$/.test(n) ? n : null;
+}
+/** Entries as the model sees them: texted only, compact. */
+function viewEntries(kind, entries) {
+    return entries
+        .filter((e) => !e.untexted && e.text !== '')
+        .map((e) => ({
+        key: e.key,
+        text: e.text,
+        ...(kind === 'symbols' && e.maxLength !== undefined ? { max_length: e.maxLength } : {}),
+        ...(e.annotations?.length ? { annotations: e.annotations } : {}),
+    }));
+}
+/**
+ * Selection-screen names of a program: the active source plus, best-effort,
+ * a pending inactive version (a field written but not yet activated is still
+ * a real field). Throws only when NO version could be read.
+ */
+async function screenNamesOf(ctx, name) {
+    const active = selectionScreenNames(await ctx.adt.getSource('PROG', name));
+    try {
+        const inactive = selectionScreenNames(await ctx.adt.getSource('PROG', name, 'inactive'));
+        for (const n of inactive.names)
+            active.names.add(n);
+        return { names: active.names, hasIncludes: active.hasIncludes || inactive.hasIncludes };
+    }
+    catch {
+        return active;
+    }
+}
+// ── sap_get_text_elements ─────────────────────────────────────────────────────
+registerTool({
+    name: 'sap_get_text_elements',
+    description: 'Read a program\'s text elements: selection texts (labels of PARAMETERS / SELECT-OPTIONS), '
+        + 'text symbols (TEXT-001) and list headings. Read-only. For selections it also lists '
+        + 'selection-screen fields that still have NO text (without_text) — those show their raw name '
+        + 'on the screen; give each one a text with sap_set_text_elements.',
+    isMutating: false,
+    requiresSap: true,
+    input_schema: {
+        type: 'object',
+        properties: {
+            name: { type: 'string', description: 'Program (report) name, e.g. ZFIN_DOC_JOURNAL' },
+            kind: { type: 'string', enum: ['selections', 'symbols', 'headings', 'all'], description: 'Which part (default all)' },
+        },
+        required: ['name'],
+    },
+    handler: async (args, ctx) => {
+        const adt = textAdt(ctx);
+        if (!adt)
+            return UNSUPPORTED;
+        const name = programName(args.name);
+        if (!name)
+            return errorEnvelope({ error: 'invalid_name', detail: 'name must be a program name' });
+        const kinds = args.kind === undefined || args.kind === 'all'
+            ? [...TEXT_ELEMENT_KINDS]
+            : isTextElementKind(args.kind) ? [args.kind] : [];
+        if (kinds.length === 0)
+            return errorEnvelope({ error: 'invalid_kind', detail: 'kind is selections, symbols, headings or all' });
+        const out = { program: name };
+        for (const kind of kinds) {
+            try {
+                const src = await adt.getTextElementsSource(name, kind);
+                const entries = parseTextPool(kind, src.body);
+                const part = { entries: viewEntries(kind, entries) };
+                if (kind === 'selections') {
+                    const without = new Set(entries.filter((e) => e.untexted || e.text === '').map((e) => e.key));
+                    try {
+                        const screen = await screenNamesOf(ctx, name);
+                        for (const n of screen.names)
+                            if (!entries.some((e) => e.key === n && !e.untexted && e.text !== ''))
+                                without.add(n);
+                    }
+                    catch { /* the text pool list alone still answers */ }
+                    part.without_text = [...without];
+                }
+                out[kind] = part;
+            }
+            catch (err) {
+                out[kind] = { error: httpStatusOf(err) === 404 ? 'not_found' : 'read_failed', detail: shortError(err) };
+            }
+        }
+        return { content: JSON.stringify(out) };
+    },
+});
+// ── sap_set_text_elements ─────────────────────────────────────────────────────
+registerTool({
+    name: 'sap_set_text_elements',
+    description: 'Add or change a program\'s text elements — one kind per call: selections (selection texts, max 30 chars, '
+        + 'key = the PARAMETERS / SELECT-OPTIONS name), symbols (text symbols, key = the 3-char id of TEXT-xxx, max 132) '
+        + 'or headings (listHeader max 70, columnHeader_1..4 max 132). MERGES with what is there: texts you do not name '
+        + 'are kept. Requires approval_id (request_approval, op modify, object = the program, type PROG). Snapshots the '
+        + 'current texts, writes, activates the text pool and reads it back. Whenever you add or change a selection-screen '
+        + 'field, give it a plain descriptive selection text with this tool. restore_snapshot_id (instead of texts) puts a '
+        + 'snapshot of this part back exactly.',
+    isMutating: true,
+    requiresSap: true,
+    input_schema: {
+        type: 'object',
+        properties: {
+            name: { type: 'string', description: 'Program (report) name' },
+            kind: { type: 'string', enum: ['selections', 'symbols', 'headings'], description: 'Which part to change' },
+            texts: {
+                type: 'array',
+                description: 'Entries to add or change. Selections: [{key:"P_SUBTOT", text:"Subtotals by aging bucket"}]',
+                items: {
+                    type: 'object',
+                    properties: {
+                        key: { type: 'string' },
+                        text: { type: 'string' },
+                        max_length: { type: 'number', description: 'symbols only — room for translations (default: text length)' },
+                    },
+                    required: ['key', 'text'],
+                },
+            },
+            restore_snapshot_id: { type: 'string', description: 'Put this snapshot of the part back (full replace). Not with texts.' },
+            transport: { type: 'string', description: 'Transport request (optional; auto-resolves to the owning request)' },
+            approval_id: { type: 'string', description: 'JWT from request_approval' },
+        },
+        required: ['name', 'kind', 'approval_id'],
+    },
+    handler: async (args, ctx) => {
+        const name = programName(args.name);
+        if (!name)
+            return errorEnvelope({ error: 'invalid_name', detail: 'name must be a program name' });
+        if (!isTextElementKind(args.kind))
+            return errorEnvelope({ error: 'invalid_kind', detail: 'kind is selections, symbols or headings' });
+        const kind = args.kind;
+        const restoreId = typeof args.restore_snapshot_id === 'string' && args.restore_snapshot_id.trim()
+            ? args.restore_snapshot_id.trim() : undefined;
+        const updates = Array.isArray(args.texts) ? args.texts : [];
+        if (restoreId && updates.length > 0) {
+            return errorEnvelope({ error: 'invalid_args', detail: 'pass texts OR restore_snapshot_id, not both' });
+        }
+        // ── Gate 1: approval ──────────────────────────────────────────────────────
+        const verify = await verifyAndSpendApprovalId(args.approval_id, name, 'modify');
+        if (!verify.ok)
+            return errorEnvelope({ error: ERR.APPROVAL_INVALID, reason: verify.reason });
+        // 2026-10-04 — a plan-grant id holds the write to its claims (type, transport).
+        {
+            const claim = grantClaimMismatch(verify.payload, { type: 'PROG', transport: args.transport ?? ctx.currentTransport?.get() ?? null });
+            if (claim)
+                return errorEnvelope({ error: ERR.APPROVAL_INVALID, reason: claim });
+        }
+        // ── Gate 2: write mode (defence in depth — prd pins advisory-only) ────────
+        try {
+            const cfg = await loadConfig();
+            const role = cfg.sap?.[ctx.sapAlias]?.role;
+            if (getEffectiveWriteMode(cfg.write_mode, role) === 'advisory-only') {
+                return errorEnvelope({
+                    error: 'write_mode_advisory',
+                    detail: role === 'prd'
+                        ? `${ctx.sapAlias} is a production system — CSPeach never writes there. List the texts for the user instead.`
+                        : 'Write mode is advisory-only — no SAP writes. List the texts for the user to add in SE38 → Goto → Text Elements.',
+                });
+            }
+        }
+        catch (err) {
+            return errorEnvelope({ error: 'write_mode_unknown', detail: `could not read the write mode: ${shortError(err)}` });
+        }
+        const adt = textAdt(ctx);
+        if (!adt)
+            return UNSUPPORTED;
+        // ── Validate the request before touching SAP ──────────────────────────────
+        if (!restoreId) {
+            const problems = validateUpdates(kind, updates);
+            if (problems.length > 0)
+                return errorEnvelope({ error: 'invalid_texts', problems });
+        }
+        // ── Gate 3: transport (Rule 9) ────────────────────────────────────────────
+        const sessionTransport = ctx.currentTransport?.get() ?? null;
+        if (args.transport && sessionTransport && args.transport !== sessionTransport) {
+            ctx.chunkEmitter?.emit('warn', `LLM passed transport=${args.transport} but session current-transport=${sessionTransport}`);
+        }
+        const resolved = await resolveWriteTransport(ctx, 'PROG', name, args.transport ?? sessionTransport ?? undefined);
+        // 2026-10-04 — a plan-grant id never writes into a transport other than the grant's.
+        if (grantOwningTransportMismatch(verify.payload, resolved.owning)) {
+            return errorEnvelope({ error: ERR.APPROVAL_INVALID, reason: 'transport_mismatch', detail: grantOwningTransportDetail(name, resolved.owning) });
+        }
+        // ── Gate 4: read the current part (HARD) ──────────────────────────────────
+        let currentBody;
+        try {
+            currentBody = (await adt.getTextElementsSource(name, kind)).body;
+        }
+        catch (err) {
+            return errorEnvelope({
+                error: 'text_elements_read_failed',
+                http_status: httpStatusOf(err),
+                detail: shortError(err),
+                recovery: 'The current texts could not be read, so they cannot be merged — writing now would drop them. Fix the connection or check the program exists (and is active), then retry.',
+            });
+        }
+        const existing = parseTextPool(kind, currentBody);
+        // ── Merge (or restore) ────────────────────────────────────────────────────
+        const warnings = [];
+        let newBody;
+        let merge;
+        if (restoreId) {
+            try {
+                newBody = await snapshots.read(textElementsSnapshotType(kind), name, restoreId);
+            }
+            catch (err) {
+                return errorEnvelope({ error: 'snapshot_read_failed', detail: shortError(err) });
+            }
+        }
+        else {
+            // ── Gate 5: names on the selection screen ──────────────────────────────
+            if (kind === 'selections') {
+                const known = new Set(existing.map((e) => e.key));
+                let hasIncludes = false;
+                let sourceRead = true;
+                try {
+                    const screen = await screenNamesOf(ctx, name);
+                    for (const n of screen.names)
+                        known.add(n);
+                    hasIncludes = screen.hasIncludes;
+                }
+                catch (err) {
+                    sourceRead = false;
+                    warnings.push(`could not read the program source to check the names (${shortError(err)})`);
+                }
+                const unknown = updates.map((u) => canonicalKey(kind, u.key)).filter((k) => !known.has(k));
+                if (unknown.length > 0) {
+                    if (sourceRead && !hasIncludes) {
+                        return errorEnvelope({
+                            error: 'not_on_selection_screen',
+                            unknown,
+                            screen_fields: [...known],
+                            detail: 'These names are not PARAMETERS / SELECT-OPTIONS of this program. Check the spelling (or write the source change first, then the texts).',
+                        });
+                    }
+                    if (sourceRead)
+                        warnings.push(`${unknown.join(', ')}: not found in the main source — the program has INCLUDEs, so the field may be declared there`);
+                }
+            }
+            merge = mergeTextPool(kind, existing, updates);
+            if (merge.added.length === 0 && merge.changed.length === 0) {
+                return { content: JSON.stringify({ written: false, no_change: true, program: name, kind, unchanged: merge.unchanged }) };
+            }
+            if (merge.dictionaryReferenceDropped.length > 0) {
+                warnings.push(`${merge.dictionaryReferenceDropped.join(', ')}: had a dictionary reference — your text replaces it`);
+            }
+            newBody = formatTextPool(kind, merge.entries);
+        }
+        // ── Gate 6: Rule 7 snapshot of the current part (HARD) ────────────────────
+        let snapshotId;
+        try {
+            const entry = await snapshots.take(textElementsSnapshotType(kind), name, currentBody, 'before_write');
+            snapshotId = entry.id;
+        }
+        catch (err) {
+            return errorEnvelope({ error: ERR.SNAPSHOT_FAILED, detail: shortError(err) });
+        }
+        ctx.chunkEmitter?.emit('info', `snapshot ✓ ${textElementsSnapshotType(kind)} ${name} ${snapshotId}`);
+        // ── WAL + write ───────────────────────────────────────────────────────────
+        const toolUseId = ctx.toolUseId ?? crypto.randomUUID();
+        const startedAt = Date.now();
+        await appendPending(ctx.session, {
+            tool_use_id: toolUseId,
+            tool: 'sap_set_text_elements',
+            args: { name, kind },
+            started_at: new Date().toISOString(),
+        });
+        let write;
+        try {
+            write = await adt.setTextElementsSource(name, kind, newBody, resolved.transport);
+        }
+        catch (err) {
+            await finalizeToolCall(ctx.session, toolUseId, shortError(err), true, Date.now() - startedAt);
+            return errorEnvelope({ error: 'text_elements_write_failed', detail: shortError(err), snapshot_id: snapshotId });
+        }
+        if (!write.written) {
+            await finalizeToolCall(ctx.session, toolUseId, JSON.stringify(write), true, Date.now() - startedAt);
+            return errorEnvelope({
+                error: 'text_elements_write_failed',
+                detail: write.error ?? `HTTP ${write.httpStatus}`,
+                http_status: write.httpStatus,
+                snapshot_id: snapshotId,
+                ...(write.lockedInTransport ? {
+                    locked_in_transport: write.lockedInTransport,
+                    recovery: `Retry this exact write with transport=${write.lockedInTransport} — that request already owns the program.`,
+                } : {}),
+            });
+        }
+        await auditLog('setTextElements', 'PROG', name, 'success', Date.now() - startedAt, `kind=${kind}`);
+        noteWriteTransport(resolved.transport);
+        // ── Gate 7: activate the text pool (Rule 10) ──────────────────────────────
+        const base = {
+            written: true,
+            program: name,
+            kind,
+            snapshot_id: snapshotId,
+            ...(restoreId ? { restored_from: restoreId } : {}),
+            ...(merge ? { added: merge.added, changed: merge.changed, kept: merge.kept } : {}),
+            ...(resolved.transport ? { transport_used: resolved.transport } : {}),
+            ...(resolved.note ? { transport_note: resolved.note } : {}),
+            ...(warnings.length ? { warnings } : {}),
+        };
+        let activation;
+        try {
+            activation = await adt.activateTextElements(name);
+        }
+        catch (err) {
+            activation = { success: false, hasErrors: true, messages: [{ severity: 'error', shortText: shortError(err) }] };
+        }
+        if (!activation.success) {
+            const detail = activation.messages.filter((m) => m.severity === 'error').map((m) => m.shortText).filter(Boolean).join('; ')
+                || 'activation did not succeed';
+            await finalizeToolCall(ctx.session, toolUseId, JSON.stringify({ written: true, activated: false }), false, Date.now() - startedAt);
+            emitChain(ctx, name, kind, resolved.transport, { state: 'failed', detail });
+            return errorEnvelope({
+                ...base,
+                activated: false,
+                error: 'text_elements_activation_failed',
+                detail,
+                next_step: 'The texts are saved but INACTIVE. Fix the cause and activate again, or put the old texts back with restore_snapshot_id.',
+            });
+        }
+        // ── Gate 8: read back (Rule 10) — new texts there, nothing lost ───────────
+        let after;
+        try {
+            after = parseTextPool(kind, (await adt.getTextElementsSource(name, kind)).body);
+        }
+        catch (err) {
+            await finalizeToolCall(ctx.session, toolUseId, JSON.stringify({ written: true, activated: true }), false, Date.now() - startedAt);
+            emitChain(ctx, name, kind, resolved.transport, { state: 'unverified' });
+            return errorEnvelope({ ...base, activated: true, verified: false, error: 'text_elements_not_verified', detail: `read-back failed: ${shortError(err)}` });
+        }
+        const intended = parseTextPool(kind, newBody).filter((e) => !e.untexted && (kind === 'headings' || e.text !== ''));
+        const textOf = (list, key) => list.find((e) => e.key === key && !e.untexted)?.text;
+        const mismatched = intended
+            .filter((e) => (merge ? [...merge.added, ...merge.changed].includes(e.key) : true))
+            .filter((e) => (textOf(after, e.key) ?? '').trimEnd() !== e.text.trimEnd())
+            .map((e) => e.key);
+        const lost = (merge ? merge.kept : []).filter((k) => textOf(after, k) === undefined || textOf(after, k) === '');
+        const verified = mismatched.length === 0 && lost.length === 0;
+        await finalizeToolCall(ctx.session, toolUseId, JSON.stringify({ written: true, activated: true, verified }), false, Date.now() - startedAt);
+        emitChain(ctx, name, kind, resolved.transport, verified ? { state: 'active' } : { state: 'unverified' });
+        if (!verified) {
+            return errorEnvelope({
+                ...base,
+                activated: true,
+                verified: false,
+                error: 'text_elements_not_verified',
+                ...(mismatched.length ? { mismatched } : {}),
+                ...(lost.length ? { lost } : {}),
+                detail: 'SAP accepted and activated the write, but reading the texts back does not show what was written.',
+            });
+        }
+        return { content: JSON.stringify({ ...base, activated: true, verified: true }) };
+    },
+});
+function emitChain(ctx, name, kind, transport, activation) {
+    ctx.chunkEmitter?.emit('chunk', buildWriteChainLine({
+        snapshot: 'taken',
+        written: true,
+        syntax: 'not_checked',
+        activation,
+        card: { object: name, what: `text elements (${kind})`, transport },
+    }) + '\n');
+}

package/dist/tools/tool-loading.js

@@ -75,6 +75,9 @@ export const SKILL_STARTERS = Object.freeze({
     'abap-upgrade-fix': ['sap_snapshot_take', 'glob'],
     'abap-upgrade-scan': ['sap_atc_run'],
     'abap-upgrade-verify': ['sap_atc_run'],
+    // Selection texts (2026-10-04): a new PARAMETERS / SELECT-OPTIONS gets its text in the same change.
+    'abap-refactor': ['sap_get_text_elements', 'sap_set_text_elements'],
+    'abap-generate': ['sap_get_text_elements', 'sap_set_text_elements'],
 });
 /** The starter tools for a skill; unknown skill (or none) ⇒ []. */
 export function startersForSkill(skill) {

package/dist/tools/transport.js

@@ -10,6 +10,7 @@
  *   transportRelease(transportNumber)             → Promise<TransportResult>      line 2546
  *     Released status string from SAP is 'released' (not a raw 'R' code).
  */
+import { bindGrantTransport, isPlanGrantInScope } from '../approvals/plan-grant.js';
 import { registerTool } from './index.js';
 import { verifyAndSpendApprovalId } from '../approvals/jwt.js';
 import { auditLog } from '@cspeach/sap-client';
@@ -103,9 +104,9 @@ registerTool({
             },
             approval_id: {
                 type: 'string',
-                description: 'JWT from request_approval. Reason field on request_approval should be '
-                    + 'IDENTICAL to the description argument here — same exact string — or the '
-                    + 'approval will fail with object_mismatch.',
+                description: 'JWT from request_approval, change {op:"create", object:"<description>", type:"CTS"}. '
+                    + 'The object should be IDENTICAL to the description argument here — same exact string — or the '
+                    + 'approval will fail with object_mismatch; a type other than CTS fails with type_mismatch.',
             },
         },
         required: ['description', 'approval_id'],
@@ -136,7 +137,13 @@ registerTool({
                     // Mirror the create success path: the owning TR becomes the session
                     // current-transport so subsequent writes pick it up via the 3-tier
                     // fallback. It is NOT marked created-this-session — it wasn't.
-                    setCurrentTransport(owning.transport);
+                    // 2026-10-04 — not while a plan object-list grant is in scope: no
+                    // approval was checked on this path, and the grant covers creates on
+                    // the session transport only when it is the grant's own. The owning
+                    // transport is reported; the session pointer stays as it was.
+                    const grantInScope = isPlanGrantInScope();
+                    if (!grantInScope)
+                        setCurrentTransport(owning.transport);
                     // Ownership-aware guidance (I1): "use it" is only honest advice when
                     // the connected user owns the lock — SAP rejects a foreign user's
                     // writes under someone else's request unless the owner adds a task.
@@ -147,7 +154,9 @@ registerTool({
                             + '— SAP only accepts changes under that request; ask the owner to add you as a '
                             + 'task user. Do NOT create a new transport either way.'
                         : `${args.for_object_name} is already locked in ${owning.transport} — use it; `
-                            + 'no new transport created. Set as session current transport for subsequent writes.';
+                            + (grantInScope
+                                ? 'no new transport created. The session transport was not changed — name this transport on each write.'
+                                : 'no new transport created. Set as session current transport for subsequent writes.');
                     ctx.chunkEmitter?.emit('info', note);
                     return {
                         content: JSON.stringify({
@@ -192,6 +201,15 @@ registerTool({
                 is_error: true,
             };
         }
+        // 2026-10-04 — only a transport approval creates a transport: an id minted
+        // for an object (a plan-grant `create ZBP_X CLAS`, reusable within its
+        // TTL) must never create transports.
+        if (String(verify.payload?.type ?? '').trim().toUpperCase().split('/')[0].trim() !== 'CTS') {
+            return {
+                content: JSON.stringify({ error: ERR.APPROVAL_INVALID, reason: 'type_mismatch' }),
+                is_error: true,
+            };
+        }
         const startedAt = Date.now();
         // ── Create transport ─────────────────────────────────────────────────────
         // transportCreate(description, targetPackage?)
@@ -208,6 +226,9 @@ registerTool({
             // subsequent write calls pick it up via the 3-tier fallback without the LLM
             // needing to pass it explicitly every time.
             setCurrentTransport(result.transportNumber);
+            // 2026-10-04 — the plan object-list grant covered this create ("a new
+            // one for this build"): its writes go to this number and no other.
+            bindGrantTransport(result.transportNumber, args.description);
             // Orphan-hint ledger: resolveWriteTransport warns later if this freshly
             // created TR ends up bypassed by an owning-transport force.
             markTransportCreatedThisSession(result.transportNumber);

package/dist/tools/write-mode.js

@@ -3,9 +3,9 @@
  * everything else (reads, quality checks, lock/snapshot control primitives)
  * runs normally.
  *
- * Source of truth: ZCSPEACH SICF pivot spec §6.4 rows marked "W" (write).
- * Does NOT include W-ctrl rows (lock/unlock/snapshot) because those are
- * state-management primitives, not SAP data writes.
+ * The list is every CLI tool that writes SAP data. It does NOT include the
+ * lock/unlock/snapshot control tools, because those manage state around a
+ * write and do not write SAP data themselves.
  */
 export const WRITE_TOOLS = new Set([
     'sap_create_object',
@@ -13,6 +13,7 @@ export const WRITE_TOOLS = new Set([
     'sap_create_data_element',
     'sap_set_source',
     'sap_set_class_include',
+    'sap_set_text_elements',
     'sap_update_method',
     'sap_delete_object',
     'sap_activate',