@cspeach/cli 1.1.27 → 1.1.28

package/dist/commands/plan-continue.js

@@ -11,17 +11,33 @@ import { existsSync } from 'node:fs';
 import { leasePathFor, acquireRunLease } from '../projects/run-lease.js';
 import { readProjectFile } from '../projects/status.js';
 import { parsePlanContent, phaseWrites } from '../projects/plan-schema.js';
-import { statusesFromItems } from '../projects/plan-run.js';
+import { statusesFromItems, phaseDisplayTitle } from '../projects/plan-run.js';
 import { findNewestVersion } from './plan-resume.js';
 import { collectTurnAssistantText } from '../agent/turn-assistant-text.js';
 import { finishPlanResume } from './plan-resume.js';
 import { runPostPhaseChain } from './plan-chain.js';
+import { DEFAULT_PLAN_MODE } from './plan-gate.js';
 import { loadPlanLaneForRun } from '../projects/plan-lane.js';
 /**
  * The same block shape loop.ts's manifest-on-interrupt hook scans for.
  * E2 dual-read: accept both the legacy `csforge:` and current `cspeach:` prefixes.
  */
 const MANIFEST_BLOCK_RE = /<!--\s*(?:csforge|cspeach):plan-manifest\s*\n([\s\S]*?)\n\s*-->/g;
+/** Task 13 — a step's display title from a plan envelope; a plain fallback, never the id. */
+function stepTitle(envelope, phaseId) {
+    const pc = parsePlanContent(envelope.content);
+    const p = pc.ok ? pc.content.phases.find((q) => q.id === phaseId) : undefined;
+    return p && pc.ok ? phaseDisplayTitle(p, pc.content.phases) : 'the interrupted step';
+}
+/** The one line shown when a bare "continue" re-attaches to an interrupted step. */
+export function continuationNotice(prepared) {
+    return `Continuing ${stepTitle(prepared.envelope, prepared.nextPhaseId)} where it stopped`;
+}
+/** The dim line after a continuation turn that saved nothing: the step is not finished. */
+export function stillInFlightLine(envelope, phaseId) {
+    const t = stepTitle(envelope, phaseId);
+    return `${t.charAt(0).toUpperCase()}${t.slice(1)} is not finished yet. Nothing was saved for it this turn.`;
+}
 /**
  * Build the marker from the prepared resume the phase turn is about to run.
  * `family` mirrors leasePathFor's family-base convention (version suffix
@@ -113,10 +129,8 @@ export async function preparePlanContinuation(args) {
     // the marker stays so the user can finish there or take over via --resume.
     const lease = acquireRunLease(path, args.sessionId, { log: (l) => args.log(l) });
     if (!lease.acquired) {
-        const holder = lease.holder;
-        args.log(`[plan] in-flight phase ${marker.phaseId} not re-attached — another session holds the run lease`
-            + (holder ? ` (session ${holder.sessionId}, pid ${holder.pid})` : '')
-            + '. Finish there or /abap-plan --resume here to take over.');
+        const title = phaseDisplayTitle(phase, parsed.content.phases);
+        args.log(`${title} was not picked up — another CSPeach window is running this plan. Finish there, or type /abap-plan --resume here to take over.`);
         return { prepared: null, stale: false };
     }
     const prepared = {
@@ -149,7 +163,7 @@ export async function finishPlanContinuation(args) {
     if (cls === 'none')
         return { kind: 'none' };
     if (cls === 'foreign') {
-        args.log(`[plan] this turn's manifest belongs to a different plan — NOT attached to in-flight phase ${args.marker.phaseId}.`);
+        args.log(`This turn's result belongs to a different plan — it was not added to ${stepTitle(args.prepared.envelope, args.marker.phaseId)}.`);
         return { kind: 'foreign' };
     }
     const outcome = await finishPlanResume({
@@ -177,7 +191,7 @@ export async function runContinuationChain(args) {
         sessionId: args.sessionId,
         cwd: args.cwd,
         ...(args.sapAlias ? { sapAlias: args.sapAlias } : {}),
-        mode: args.prepared.effectiveMode ?? 'step',
+        mode: args.prepared.effectiveMode ?? DEFAULT_PLAN_MODE,
         modeFlag: args.prepared.mode,
         auditMode: args.prepared.auditMode,
         auditFlag: args.prepared.auditFlag,

package/dist/commands/plan-gate.js

@@ -7,22 +7,17 @@
 // arrives as an argument, and the caller (Task 6 wiring in the REPL's
 // offerNextPhase path) renders the returned decision.
 //
-// Semantics (binding, from the design doc):
-//   step    ⇒ always `prompt` — today's behaviour, one consent per phase.
-//   guarded ⇒ `stop`  when the PREVIOUS phase's audit is unresolved
-//                     ('audit-infra' for infra_failed, else 'audit-failed');
-//             `prompt` with 'write-phase' when the NEXT phase writes to SAP
-//                     (phaseWrites is fail-safe: undeclared ⇒ writes). This
-//                     prompt IS the stop — consent to RUN the phase; it does
-//                     NOT pre-approve the writes inside it;
-//             `auto`  otherwise (declared non-write phase, clean prior audit).
-//
-// Precedence: the audit stop wins over the write-phase prompt when both
-// apply — a hard stop must never be downgraded to a consent prompt.
-// Legacy envelopes (phases with no audit field) never stop the chain:
-// isAuditResolved(undefined) === true.
-import { phaseWrites } from '../projects/plan-schema.js';
-import { isAuditResolved } from '../projects/plan-run.js';
+// Semantics (2026-10-04, continuous run — spec §3.1/§3.3):
+//   step    ⇒ always `prompt` — one consent per step (unchanged).
+//   guarded ⇒ `stop` when the PREVIOUS step's audit is unresolved for the run
+//             (a deferred 'pending' counts as fine; 'failed' / hand-edited do not);
+//             `auto` otherwise — write steps included. Writes are approved by the
+//             plan's object-list grant or by their own cards, never by a
+//             step-level prompt.
+// Guarded is the DEFAULT (DEFAULT_PLAN_MODE): one approval, then a continuous run.
+import { isAuditResolvedForRun } from '../projects/plan-run.js';
+/** 2026-10-04 — an absent plan_mode / flag means the continuous run. */
+export const DEFAULT_PLAN_MODE = 'guarded';
 /* ── guarded-run auto_approve override (Task 6, 2026-07-03) ────────────────
  * Module-level flag consulted by tools/approval.ts BEFORE its auto-approve
  * branch. The REPL sets it at guarded-chain start (right before the phase's
@@ -49,12 +44,21 @@ export function isGuardedRunActive() {
  * When the flag is off, agent_run's opt-in read_only behaviour is
  * byte-identical (skill-mode compatibility). */
 let planPhaseActive = false;
-export function setPlanPhaseActive(active) {
+/* 2026-10-04 (continuous run) — the id of the plan whose step is running. The
+ * plan object-list grant covers requests only for THIS plan; a step started
+ * without an id (null) is never covered. Cleared with the flag. */
+let activePlanId = null;
+export function setPlanPhaseActive(active, planId) {
     planPhaseActive = active;
+    activePlanId = active && typeof planId === 'string' && planId ? planId : null;
 }
 export function isPlanPhaseActive() {
     return planPhaseActive;
 }
+/** The plan whose step is running, or null (no step, or started without an id). */
+export function getActivePlanId() {
+    return planPhaseActive ? activePlanId : null;
+}
 /* Task 7 — per-phase subagent dispatch counter. agent_run increments it on
  * every dispatch made while a plan phase is active; the REPL reads it
  * (read+reset) in the runTurn finally that clears the plan-phase flag and
@@ -110,44 +114,19 @@ export function getAndResetPlanDeviation() {
     return d;
 }
 /**
- * Banner shown for every non-auto guarded outcome. The resume hint uses the
- * literal `@<plan>` placeholder on purpose — this module is pure and doesn't
- * know the saved path; the caller may substitute the real basename.
+ * Banner shown when a guarded run stops. The resume hint uses the literal
+ * `@<plan>` placeholder on purpose — this module is pure and doesn't know the
+ * saved path; the caller substitutes the real basename. Titles only, never ids.
  */
-const banner = (reason, next) => `\n■ STOPPED — ${reason}\n  Resume with: /abap-plan --resume @<plan>  (next phase: ${next})\n`;
+const banner = (reason, nextTitle) => `\n■ STOPPED — ${reason}\n  To continue: open CSPeach in this folder and choose Continue, or type /abap-plan --resume @<plan>  (next: ${nextTitle})\n`;
 export function decideNextPhaseGate(args) {
-    if (args.mode === 'step') {
-        // Step mode is today's behaviour verbatim — a plain consent prompt with
-        // no guarded decorations (no banner, no stopReason).
+    if (args.mode === 'step')
         return { action: 'prompt' };
-    }
-    // Guarded. Hard stop first: an unresolved prior audit must never be
-    // downgraded to a runnable prompt by the write-phase branch below.
-    if (!isAuditResolved(args.prevPhaseAudit)) {
-        if (args.prevPhaseAudit?.state === 'infra_failed') {
-            return {
-                action: 'stop',
-                stopReason: 'audit-infra',
-                banner: banner('auditor infrastructure failure — verdict unknown (not a code finding)', args.nextPhase.id),
-            };
-        }
+    if (!isAuditResolvedForRun(args.prevPhaseAudit)) {
         return {
             action: 'stop',
             stopReason: 'audit-failed',
-            banner: banner('prior phase audit is unresolved — fix the findings or explicitly waive them', args.nextPhase.id),
-        };
-    }
-    if (phaseWrites(args.nextPhase)) {
-        // The prompt IS the stop: consent to run the write phase. Writes inside
-        // the phase still go through their own approval flow — this never
-        // pre-approves them.
-        return {
-            action: 'prompt',
-            stopReason: 'write-phase',
-            // Task 3 review carry-over: the banner's resume hint already names the
-            // phase (`next phase: <id>`), so the reason string stays generic —
-            // naming it twice read as a rendering bug.
-            banner: banner('next phase writes to SAP — consent required to run it', args.nextPhase.id),
+            banner: banner('an earlier step failed its independent check — fix it or waive it', args.nextPhase.title ?? 'the next step'),
         };
     }
     return { action: 'auto' };

package/dist/commands/plan-reground.js

@@ -0,0 +1,174 @@
+import { isPhaseSatisfiedForRun } from '../projects/plan-run.js';
+import { OBJECT_TYPE_LABELS, collectPlannedObjects, normalizeObjectName, normalizeObjectType } from '../projects/plan-objects.js';
+import { recordedPlanTransport } from './plan-resume.js';
+import { SAP_PAUSE_LINE } from './plan-sap-pause.js';
+import { unreachableCode } from '../sap/unreachable.js';
+import { unreachableCodeInText } from '../sap/reachability-state.js';
+import { recordFullNotice } from '../renderer/notice-log.js';
+const LOCK_WAIT_MS = 10_000;
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Network code when SAP did not answer at all (an HTTP error means it answered). */
+function unreachableOf(err) {
+    return unreachableCode(err) ?? unreachableCodeInText(String(err));
+}
+function errText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Lock, then unlock at once. 'free' = the lock was taken (and released);
+ * 'held' = SAP refused the lock; 'unknown' = the probe itself failed (not a
+ * network failure) — never blocks the step. Unreachable SAP is rethrown.
+ */
+async function probeLock(deps, type, name) {
+    let l;
+    try {
+        l = await deps.lock(type, name);
+    }
+    catch (err) {
+        if (unreachableOf(err))
+            throw err;
+        recordFullNotice('plan', `Lock check before a plan step failed for ${type} ${name}: ${errText(err)}`);
+        return 'unknown';
+    }
+    if (l.status !== 'locked')
+        return 'held';
+    // Nothing runs between the lock and this unlock, so what was locked is
+    // always released (an unlock error is logged; the object still counts free).
+    try {
+        await deps.unlock(type, name, l.lockHandle);
+    }
+    catch (err) {
+        recordFullNotice('plan', `Unlock after a lock check failed for ${type} ${name}: ${errText(err)}`);
+        if (unreachableOf(err))
+            throw err;
+    }
+    return 'free';
+}
+export async function regroundPlan(a) {
+    const tries = Math.max(1, a.lockWaitTries ?? 6);
+    const sleep = a.deps.sleep ?? defaultSleep;
+    // What finished steps of this plan built (their recorded object names).
+    const built = [];
+    for (const p of a.content.phases) {
+        if (!isPhaseSatisfiedForRun(a.statuses[p.id], p.audit))
+            continue;
+        for (const g of p.work?.generated ?? []) {
+            const n = normalizeObjectName(String(g ?? ''));
+            if (n && !built.includes(n))
+                built.push(n);
+        }
+    }
+    // Which objects belong to this plan: the planned list (type + name) and the
+    // built names. A planned name only matches its planned type(s).
+    const plannedTypes = new Map();
+    for (const o of collectPlannedObjects(a.content)) {
+        const s = plannedTypes.get(o.name) ?? new Set();
+        s.add(o.type);
+        plannedTypes.set(o.name, s);
+    }
+    const ofThisPlan = (type, name) => {
+        if (!Object.hasOwn(OBJECT_TYPE_LABELS, type))
+            return false;
+        const types = plannedTypes.get(name);
+        if (types)
+            return types.has(type);
+        return built.includes(name);
+    };
+    const transport = recordedPlanTransport(a.content.phases);
+    try {
+        const inactive = [];
+        for (const raw of await a.deps.inactiveObjects()) {
+            const type = normalizeObjectType(raw.type);
+            const name = normalizeObjectName(raw.name);
+            if (!ofThisPlan(type, name))
+                continue;
+            if (inactive.some((o) => o.type === type && o.name === name))
+                continue;
+            inactive.push({ type, name });
+        }
+        const stillLocked = [];
+        for (const o of inactive) {
+            let state = await probeLock(a.deps, o.type, o.name);
+            for (let i = 1; i < tries && state === 'held'; i++) {
+                if (i === 1)
+                    a.log?.(`${o.name} is locked by another session. Waiting up to a minute for SAP to free it.`);
+                await sleep(LOCK_WAIT_MS);
+                state = await probeLock(a.deps, o.type, o.name);
+            }
+            if (state === 'held')
+                stillLocked.push(o.name);
+        }
+        let transportClosed = false;
+        if (transport) {
+            const t = await a.deps.openTransports();
+            transportClosed = t.complete && !t.list.some((x) => x.trim().toUpperCase() === transport.trim().toUpperCase());
+        }
+        // An object left inactive gets the inactive instruction only, never the
+        // "do not rewrite" one as well.
+        const inactiveNames = new Set(inactive.map((o) => o.name));
+        const builtActive = built.filter((n) => !inactiveNames.has(n));
+        const block = [
+            '<sap_state>',
+            'Checked live in SAP before this step (authoritative — never repeat finished writes):',
+            ...(builtActive.length > 0
+                ? [`- Already built by earlier steps of this plan: ${builtActive.join(', ')}. Do not create or rewrite these; read them if this step needs them.`]
+                : built.length > 0 ? [] : ['- No earlier step of this plan has built SAP objects yet.']),
+            inactive.length > 0
+                ? `- Left inactive by an interrupted run: ${inactive.map((o) => o.name).join(', ')}. Run the syntax check and activate them before anything else; rewrite one only if its check fails.`
+                : '- Nothing of this plan is left inactive.',
+            ...(stillLocked.length > 0
+                ? [`- Still locked by another session: ${stillLocked.join(', ')}. The developer chose to go on. If a write or activation meets the lock, stop and report it; do not retry in a loop.`]
+                : []),
+            '- If an object of THIS step already exists and is active, verify it (read it, check it) instead of writing it again.',
+            transport
+                ? (transportClosed
+                    ? `- The plan's transport ${transport} is no longer open. Do not write to it. Creating a new transport needs the developer's approval (it is not on the approved list).`
+                    : `- Transport ${transport} is still open: use it.`)
+                : '- No transport is recorded yet: the first writing step creates one.',
+            '</sap_state>',
+        ];
+        if (stillLocked.length > 0) {
+            const one = stillLocked.length === 1;
+            return {
+                ok: false, reason: 'locked',
+                lines: [`${stillLocked.join(', ')} ${one ? 'is' : 'are'} still locked by another session. SAP frees ${one ? 'it' : 'them'} when that session ends or times out, usually within a few minutes.`],
+                sapStateBlock: block,
+            };
+        }
+        const n = inactive.length;
+        const summary = `Checked SAP before continuing: ${n} object${n === 1 ? '' : 's'} left inactive`
+            + (transport ? `, transport ${transport} ${transportClosed ? 'no longer open' : 'still open'}` : '') + '.';
+        return { ok: true, summary, quiet: n === 0 && !transportClosed, sapStateBlock: block };
+    }
+    catch (err) {
+        const code = unreachableOf(err);
+        if (code) {
+            recordFullNotice('plan', `SAP unreachable before a plan step: ${code}`);
+            return { ok: false, reason: 'unreachable', lines: [SAP_PAUSE_LINE] };
+        }
+        // Any other SAP error never blocks: the step grounds itself (Mode 2 step 4).
+        recordFullNotice('plan', `SAP check before a plan step failed: ${errText(err)}`);
+        return {
+            ok: true,
+            summary: 'Could not check SAP before continuing; the step checks it itself.',
+            quiet: false,
+            sapStateBlock: [
+                '<sap_state>',
+                'CSPeach could not read the SAP state before this step. Ground on the live system first (Mode 2 step 4) and never repeat a write an earlier step finished.',
+                built.length > 0 ? `- Already built by earlier steps of this plan: ${built.join(', ')}.` : '- No earlier step of this plan has built SAP objects yet.',
+                '</sap_state>',
+            ],
+        };
+    }
+}
+export function makeRegroundDeps(adt) {
+    return {
+        inactiveObjects: () => adt.inactiveObjects(),
+        lock: (t, n) => adt.lock(t, n),
+        unlock: (t, n, h) => adt.unlock(t, n, h),
+        openTransports: async () => {
+            const r = await adt.transportList(undefined, 'modifiable');
+            return { list: r.transports.map((x) => x.transportNumber), complete: !r.note };
+        },
+    };
+}