@cspeach/cli 1.1.27 → 1.1.29

package/dist/agent/loop.js

@@ -12,6 +12,7 @@ import { settleSessionToolLoading } from './tool-loading-pin.js';
 import { resolveSkillAlias } from '../skill-catalog.js';
 import { retryWithBackoff } from './retry.js';
 import { renderChunk, initialBufferState, render } from '../renderer/pipeline.js';
+import { filterMachineBlocks, flushMachineBlocks, initialMachineBlockState } from '../renderer/machine-blocks.js';
 import { nextWritingActivity } from '../renderer/fence-state.js';
 import { renderToolCallTop, renderToolCallBottom, startToolSpinner, startThinkingSpinner, isWidgetSuppressedTool, toolActivityText, toolHeartbeatLabel } from '../renderer/tool-widget.js';
 import { formatToolErrorSummary } from '../sap-errors/parse-adt-exception.js';
@@ -317,6 +318,7 @@ export async function maybeOfferSave(p) {
             confirm: isHeadless() ? undefined : inkAwareConfirm,
             log: (...lines) => lines.forEach((l) => p.emit(l)),
             promotedFrom: p.promotedFrom ?? null,
+            ...(p.promotedFromPath ? { promotedFromPath: p.promotedFromPath } : {}),
             // Task 7 review round 2 — the app-flow lane only for the turn routed to
             // the skill it saves (the /abap-plan turn that got the lane block); a plan
             // found in another skill's output (detectArtifactSkill) never gets it.
@@ -530,6 +532,7 @@ export async function runTurn(params) {
         emit(STEP_3);
     }
     let promotedFromForSave = null;
+    let promotedFromPathForSave;
     let userMessageForLLM = params.userMessage;
     let userMessageForSave = params.userMessage;
     // Task 18 fix M2 — a reader's brief is plain text from the model: no
@@ -572,6 +575,7 @@ export async function runTurn(params) {
                 return;
             }
             promotedFromForSave = result.promotedFrom;
+            promotedFromPathForSave = result.sourcePath;
             // 2026-05-08: thread the original @<filename> token into the LLM
             // prompt so skills that need to dispatch a follow-up command (e.g.
             // dispatch_skill calling /abap-rap --from @<same-file>) can use the
@@ -916,6 +920,7 @@ ${imageExpansion.error}`));
             }
         }
         let buffer = initialBufferState();
+        let machineBlocks = initialMachineBlockState();
         let writingCode = false; // piece 2 §11.2 — "writing code…" while a fence is held back
         let stream;
         // 2026-05-06: paint a "thinking" spinner during the LLM round-trip
@@ -1056,7 +1061,11 @@ ${imageExpansion.error}`));
                 // Do NOT add `skill` to streamParams — it is not part of the Anthropic SDK body schema.
                 // v0.6 — forward the per-turn abort signal so Esc / SIGINT-during-turn
                 // tears down the in-flight stream cleanly.
-                const headers = { 'X-CSForge-Skill': params.skill, 'X-CSPeach-Model-Role': params.modelRole ?? 'session_default' };
+                const headers = {
+                    'X-CSForge-Skill': params.skill,
+                    'X-CSPeach-Model-Role': params.modelRole ?? 'session_default',
+                    ...(params.delegateSkill ? { 'X-CSPeach-Delegate-Skill': params.delegateSkill } : {}),
+                };
                 sentParams = streamParams;
                 sentHeaders = headers;
                 return params.provider.createStream(streamParams, {
@@ -1198,7 +1207,11 @@ ${imageExpansion.error}`));
                     const delta = event.delta;
                     const last = currentAssistantContent[currentAssistantContent.length - 1];
                     if (delta.type === 'text_delta') {
-                        const { output, state } = renderChunk(delta.text, buffer);
+                        // 1.1.28 — machine blocks (plan / cca / upgrade manifests) are parsed
+                        // from the raw content below, never shown (renderer/machine-blocks.ts).
+                        const shown = filterMachineBlocks(delta.text, machineBlocks);
+                        machineBlocks = shown.state;
+                        const { output, state } = renderChunk(shown.output, buffer);
                         buffer = state;
                         const wa = nextWritingActivity(writingCode, buffer.pending);
                         writingCode = wa.writingCode;
@@ -1334,6 +1347,20 @@ ${imageExpansion.error}`));
         }
         // Final flush: emit any pending partial line after the stream ends.
         // Runs on both clean completion and mid-stream interruption.
+        // First release prose the machine-block filter was still holding (an
+        // unterminated block releases nothing).
+        const heldProse = flushMachineBlocks(machineBlocks);
+        machineBlocks = initialMachineBlockState();
+        if (heldProse) {
+            const { output, state } = renderChunk(heldProse, buffer);
+            buffer = state;
+            if (output) {
+                if (params.chunkEmitter)
+                    params.chunkEmitter.emit('chunk', output);
+                else
+                    writeStdout(output);
+            }
+        }
         if (buffer.pending.length > 0) {
             const flushed = render(buffer.pending);
             if (params.chunkEmitter)
@@ -1583,6 +1610,7 @@ ${imageExpansion.error}`));
                         model: params.modelOverride ?? resolveModelRole('session_default', cfg) ?? session.model ?? 'unknown',
                         emit,
                         promotedFrom: promotedFromForSave,
+                        ...(promotedFromPathForSave ? { promotedFromPath: promotedFromPathForSave } : {}),
                         ...(() => {
                             const flowLane = getAppFlow(session)?.lane;
                             return flowLane ? { lane: { ...flowLane, cwd: params.ctx.cwd } } : {};
@@ -1593,6 +1621,7 @@ ${imageExpansion.error}`));
                                 session,
                                 cwd: params.ctx.cwd,
                                 ...(params.ctx.pendingDispatch ? { queueNext: (cmd) => params.ctx.pendingDispatch.set(cmd) } : {}),
+                                ...(params.ctx.sapAlias && params.ctx.sapAlias !== 'none' ? { sapAlias: params.ctx.sapAlias } : {}),
                             },
                         } : {}),
                     });
@@ -1683,7 +1712,7 @@ ${imageExpansion.error}`));
                 session.messages.push({
                     role: 'user',
                     content: 'Your previous response was cut off at the output-token limit. Continue exactly where you left off — do NOT repeat what you already wrote. '
-                        + 'If you were mid-way through a tool call, or (for /abap-plan) had not yet emitted the closing csforge:plan-manifest block, complete it now. '
+                        + 'If you were mid-way through a tool call, or (for /abap-plan) had not yet emitted the closing cspeach:plan-manifest block, complete it now. '
                         + 'Keep narration brief to stay within the limit.',
                 });
                 continue;
@@ -1828,7 +1857,7 @@ ${imageExpansion.error}`));
                     // modal for the Ink frame or raw-mode stdin.
                     const willTripBatchGate = (() => {
                         const t = getTool(block.name);
-                        return !!t?.isMutating && shouldGateRule8();
+                        return !!t?.isMutating && shouldGateRule8(t);
                     })();
                     const isInteractiveTool = block.name === 'ask_question' ||
                         block.name === 'request_approval' ||

package/dist/agent/provider-shape.js

@@ -1,4 +1,5 @@
 import { TOOL_CHANGES_BETA, isToolSearchEntry } from '../tools/tool-loading.js';
+import { DELEGATE_SKILL_HEADER } from './system-prompt.js';
 /** Betas the proxy sends on every managed turn (messages.ts `betas: [...]`). */
 export const BASE_BETAS = ['compact-2026-01-12'];
 /** Task 6 — beta that enables `fallbacks: 'default'` (server-side fallback). */
@@ -238,17 +239,23 @@ export function withoutInternalHeaders(headers) {
 }
 /**
  * Task 9 — the role header is new proxy plumbing; AI-hub keeps today's header
- * set, so only X-CSPeach-Model-Role is removed there.
+ * set, so X-CSPeach-Model-Role (and, 2026-10-04, the delegate header) are removed.
  */
 export function withoutRoleHeader(headers) {
     const out = {};
     for (const [k, v] of Object.entries(headers ?? {})) {
-        if (k.toLowerCase() === 'x-cspeach-model-role')
+        const lk = k.toLowerCase();
+        if (lk === 'x-cspeach-model-role' || lk === DELEGATE_SKILL_HEADER.toLowerCase())
             continue;
         out[k] = v;
     }
     return out;
 }
+/** 2026-10-04 — the plan phase's delegate skill, when the loop sent one. */
+export function delegateSkillName(options) {
+    const v = options.headers?.[DELEGATE_SKILL_HEADER];
+    return typeof v === 'string' && v.length > 0 ? v : undefined;
+}
 /**
  * The active skill travels as the X-CSForge-Skill header (coordination §1).
  * Direct providers need it to fetch the skill body; without it the model

package/dist/agent/providers/ai-hub-provider.js

@@ -2,7 +2,7 @@ import Anthropic from '@anthropic-ai/sdk';
 import keychain from '../../auth/keychain.js';
 import { createManifestSkillSource } from '../../skills/source-manifest.js';
 import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
-import { requireSkillName, toLegacyShape, withoutRoleHeader } from '../provider-shape.js';
+import { delegateSkillName, requireSkillName, toLegacyShape, withoutRoleHeader } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
 const KEYCHAIN_SERVICE = 'cspeach.ai-hub';
 const KEYCHAIN_ACCOUNT = 'token';
@@ -25,7 +25,7 @@ export function createAiHubProvider(cfg) {
             const skillName = requireSkillName(options, 'AI Hub');
             const token = await getToken();
             // Task 18 — the `_reader` header uses the pinned reader prompt, no lookup.
-            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: false });
+            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: false }, delegateSkillName(options));
             const request = {
                 ...toLegacyShape(params),
                 system,

package/dist/agent/providers/byok-provider.js

@@ -2,7 +2,7 @@ import Anthropic from '@anthropic-ai/sdk';
 import keychain from '../../auth/keychain.js';
 import { createManifestSkillSource } from '../../skills/source-manifest.js';
 import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
-import { modelAcceptsFallbacks, requiredBetas, requireSkillName, withoutInternalHeaders, withSkillPrompt } from '../provider-shape.js';
+import { delegateSkillName, modelAcceptsFallbacks, requiredBetas, requireSkillName, withoutInternalHeaders, withSkillPrompt } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
 const KEYCHAIN_SERVICE = 'cspeach.anthropic';
 const KEYCHAIN_ACCOUNT = 'api-key';
@@ -19,7 +19,7 @@ export function createByokProvider(_cfg) {
         const skillName = requireSkillName(options, 'BYOK');
         const key = await getKey();
         // Task 18 — the `_reader` header uses the pinned reader prompt, no lookup.
-        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: true });
+        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: true }, delegateSkillName(options));
         // Task 6 — opt into server-side fallback, only for the families probe
         // P3 proved (allow-list); requiredBetas adds its beta.
         const prompted = withSkillPrompt(params, system, { cacheMarkers: true });

package/dist/agent/providers/local-provider.js

@@ -5,8 +5,8 @@ import { sha256 } from '@noble/hashes/sha256';
 import { bytesToHex } from '@noble/hashes/utils';
 import { createBundledSkillSource } from '../../skills/source-bundled.js';
 import { BUNDLED_SKILLS } from '../../skills/bundled-skills.js';
-import { requireSkillName } from '../provider-shape.js';
-import { buildSystemPrompt } from '../system-prompt.js';
+import { delegateSkillName, requireSkillName } from '../provider-shape.js';
+import { systemPromptForSkill } from '../system-prompt.js';
 export function createLocalProvider(cfg) {
     if (!cfg.llm.local_base_url) {
         throw new Error('local mode requires llm.local_base_url — run: cspeach config set llm.local_base_url http://localhost:11434/v1');
@@ -26,10 +26,10 @@ export function createLocalProvider(cfg) {
             // message (no cache markers). anthropicParamsToOpenAI copies only
             // max_tokens / messages / system, so newer fields never reach the endpoint.
             const skillName = requireSkillName(options, 'Local');
-            const skill = await skillSource.getSkillBody(skillName);
+            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: false }, delegateSkillName(options));
             const OpenAI = await loadOpenAI();
             const sdk = new OpenAI({ apiKey: 'local-ignored', baseURL });
-            const openAiParams = anthropicParamsToOpenAI({ ...params, system: buildSystemPrompt(skill.body, { cacheMarkers: false }) }, model);
+            const openAiParams = anthropicParamsToOpenAI({ ...params, system }, model);
             // stream: true widens via object spread; the literal-true overload cannot be
             // selected by structural inference, so cast to the streaming return shape.
             // v0.6 — pass AbortSignal through OpenAI SDK request options.

package/dist/agent/system-prompt.js

@@ -9,11 +9,26 @@
  */
 import { FORGE_PRINCIPLES_PREAMBLE } from '../skills/preamble.js';
 import { READER_SKILL, READER_SYSTEM_PROMPT } from '../tools/subagent/reader-prompt.js';
-export function buildSystemPrompt(skillBody, opts) {
+/** 2026-10-04 (continuous run) — the phase's delegate skill travels as this header. */
+export const DELEGATE_SKILL_HEADER = 'X-CSPeach-Delegate-Skill';
+/** The line that tells the model how the two bodies relate. Same text in cspeach-proxy. */
+export function delegatePreface(name) {
+    return `This plan step is delegated to the ${name} playbook below. Follow it for HOW to build. `
+        + 'The abap-plan run contract above still decides WHAT this step does, how it ends and what it records. '
+        + 'The plan\'s one approval already covers this playbook\'s own "present the plan and wait for yes" step: do not ask it again. '
+        + 'Ask only a real question the spec and the system cannot answer.';
+}
+/** Skill body, plus the delegate playbook when one is given (one text block — no extra cache breakpoint). */
+export function skillSystemText(skillBody, delegate) {
+    if (!delegate)
+        return skillBody;
+    return `${skillBody}\n\n<delegate_skill name="${delegate.name}">\n${delegatePreface(delegate.name)}\n\n${delegate.body}\n</delegate_skill>`;
+}
+export function buildSystemPrompt(skillBody, opts, delegate) {
     const marker = opts.cacheMarkers ? { cache_control: { type: 'ephemeral' } } : {};
     return [
         { type: 'text', text: FORGE_PRINCIPLES_PREAMBLE, ...marker },
-        { type: 'text', text: skillBody, ...marker },
+        { type: 'text', text: skillSystemText(skillBody, delegate), ...marker },
     ];
 }
 /**
@@ -26,13 +41,25 @@ export function buildReaderSystemPrompt(opts) {
     return [{ type: 'text', text: READER_SYSTEM_PROMPT, ...marker }];
 }
 /**
- * The system prompt for the skill named in the X-CSForge-Skill header. The
- * internal `_reader` skill has no SKILL.md, so it never reaches the skill
- * source (a lookup would fail).
+ * The system prompt for the skill named in the X-CSForge-Skill header, plus —
+ * on a plan phase turn — the delegate playbook named in X-CSPeach-Delegate-Skill.
+ * A delegate that cannot be fetched degrades to the plain prompt (never throws);
+ * a delegate equal to the skill itself is ignored. The internal `_reader` skill
+ * has no SKILL.md, so it never reaches the skill source (a lookup would fail).
  */
-export async function systemPromptForSkill(skillName, skillSource, opts) {
+export async function systemPromptForSkill(skillName, skillSource, opts, delegateName) {
     if (skillName === READER_SKILL)
         return buildReaderSystemPrompt(opts);
     const skill = await skillSource.getSkillBody(skillName);
-    return buildSystemPrompt(skill.body, opts);
+    let delegate;
+    if (delegateName && delegateName !== skillName) {
+        try {
+            const d = await skillSource.getSkillBody(delegateName);
+            delegate = { name: delegateName, body: d.body };
+        }
+        catch {
+            delegate = undefined;
+        }
+    }
+    return buildSystemPrompt(skill.body, opts, delegate);
 }

package/dist/agent/tool-dispatch.js

@@ -1,6 +1,9 @@
 import path from 'node:path';
 import { getTool, isStandalone } from '../tools/index.js';
 import { NOT_CONNECTED_MESSAGE } from '../sap/offline-adt-client.js';
+import { unreachableCode } from '../sap/unreachable.js';
+import { noteSapUnreachable, unreachableCodeInText, SAP_UNREACHABLE_DIRECTIVE } from '../sap/reachability-state.js';
+import { isPlanPhaseActive } from '../commands/plan-gate.js';
 import { presentSafetyConfirmation } from '../repl/safety-confirm.js';
 import { shouldGateRule8, recordWriteOp, renderPlanSummary, getWriteOpsThisTurn, } from '../repl/rule8-detector.js';
 import { isCredentialHandoverApproved, markCredentialHandoverApproved, } from '../repl/credential-handover-gate.js';
@@ -79,7 +82,7 @@ export async function dispatchTool(name, args, ctx) {
     // refused the 2nd edit of a CAP schema and left it half-changed. SAP writes
     // are gated exactly as before.
     const scratchWrite = isLocalProjectWork(tool, args) || isScratchOutputWrite(tool, args, ctx.cwd);
-    if (tool.isMutating && !scratchWrite && shouldGateRule8()) {
+    if (tool.isMutating && !scratchWrite && shouldGateRule8(tool)) {
         const r = await presentSafetyConfirmation({
             rule: 'RULE_8_BATCH_PLAN',
             op: tool.name,
@@ -106,9 +109,25 @@ export async function dispatchTool(name, args, ctx) {
         if (tool.isMutating && !scratchWrite && !(result.is_error ?? false)) {
             recordWriteOp(tool.name, args);
         }
+        // 2026-10-04 (continuous run, spec §3.5) — a SAP tool that failed because
+        // SAP is not reachable from this machine: note it (the REPL pauses the
+        // plan after the turn) and tell the model to stop without a manifest.
+        // Only inside a plan step: elsewhere the error text stays as it is.
+        if (tool.requiresSap && (result.is_error ?? false) && isPlanPhaseActive()) {
+            const code = unreachableCodeInText(result.content);
+            if (code) {
+                noteSapUnreachable(code);
+                return { content: `${result.content}\n\n${SAP_UNREACHABLE_DIRECTIVE}`, is_error: true };
+            }
+        }
         return { content: result.content, is_error: result.is_error ?? false };
     }
     catch (err) {
+        const code = tool.requiresSap && isPlanPhaseActive() ? (unreachableCode(err) ?? unreachableCodeInText(String(err))) : null;
+        if (code) {
+            noteSapUnreachable(code);
+            return { content: JSON.stringify({ error: String(err), sap_unreachable: true, directive: SAP_UNREACHABLE_DIRECTIVE }), is_error: true };
+        }
         return { content: JSON.stringify({ error: String(err) }), is_error: true };
     }
 }

package/dist/agent/turn-error-ux.js

@@ -82,6 +82,33 @@ function describeApiError(err, msg) {
     const label = status ? `service error ${status}` : 'service error';
     return (text ? `${label}: ${text}` : label).slice(0, 200);
 }
+/**
+ * The proxy's `409 {"error":"upgrade_required",min_cli_version,current}`, from
+ * the SDK error's parsed `.error` body or, failing that, its message text.
+ */
+function upgradeRequired(err) {
+    const e = err;
+    let body = e && typeof e.error === 'object' ? e.error : null;
+    if (body?.error !== 'upgrade_required') {
+        const msg = typeof e?.message === 'string' ? e.message : '';
+        const brace = msg.indexOf('{');
+        if (!/^409\b/.test(msg) || brace < 0)
+            return null;
+        try {
+            body = JSON.parse(msg.slice(brace, msg.lastIndexOf('}') + 1));
+        }
+        catch {
+            return null;
+        }
+        if (body?.error !== 'upgrade_required')
+            return null;
+    }
+    if (e?.status != null && e.status !== 409)
+        return null;
+    const min = typeof body.min_cli_version === 'string' ? body.min_cli_version : 'a newer version';
+    const current = typeof body.current === 'string' ? body.current : 'an older version';
+    return { min, current };
+}
 /**
  * Write a full diagnostic log to ~/.cspeach/logs/<sessionId>-<ts>.log.
  * Best-effort — failure here is silent, the user-facing block still renders.
@@ -164,6 +191,19 @@ export async function renderTurnError(input) {
         print('');
         return;
     }
+    // 1.1.29 — the proxy's 409 upgrade_required (skill needs a newer CLI). It
+    // reaches here, not loop.ts's create-time check: the SDK raises it while
+    // the stream is read. "type continue" would only repeat the 409.
+    const upgrade = upgradeRequired(input.err);
+    if (upgrade) {
+        printBlock(print, formatFailure({
+            what: 'This needs a newer CSPeach',
+            detail: [`needs ${upgrade.min} or later · you have ${upgrade.current}`],
+            next: input.inSession ? 'type /exit, then run: cspeach --upgrade' : 'cspeach --upgrade',
+        }));
+        print('');
+        return;
+    }
     const reason = describeError(input.err);
     const logPath = await writeErrorLog(id, input.err);
     const detail = [reason, `Session: ${id}`];

package/dist/approvals/grant-claims.js

@@ -0,0 +1,70 @@
+// cspeach-cli/src/approvals/grant-claims.ts
+//
+// 2026-10-04 (continuous run) — the claims a plan-grant-minted approval id
+// carries, and the spend-side check the write tools run against them. Kept
+// apart from jwt.ts so the write tools' tests can mock jwt.ts and still run
+// the real check.
+import { approvalObjectMatches } from './canonical.js';
+const norm = (v) => String(v ?? '').trim().toUpperCase();
+const typeCode = (v) => norm(v).split('/')[0].trim();
+/**
+ * Spend-side check of a grant-minted id against what the tool is about to do.
+ * Ids without grant claims always pass (today's behaviour). Type is the ADT
+ * type code (`'DDLS/DF'` → `'DDLS'`); transport is the one the write uses
+ * (args, else the session transport).
+ */
+export function grantClaimMismatch(payload, actual) {
+    const g = payload?.grant;
+    if (!g)
+        return null;
+    if (typeCode(actual.type) !== norm(g.type))
+        return 'type_mismatch';
+    if (g.package && actual.package !== undefined && norm(actual.package) !== norm(g.package))
+        return 'package_mismatch';
+    // Every grant id for an object carries the grant's transport; one without it
+    // never writes (it could otherwise land on any transport).
+    if (!g.transport)
+        return 'transport_mismatch';
+    if (norm(actual.transport) !== norm(g.transport))
+        return 'transport_mismatch';
+    return null;
+}
+/**
+ * sap_activate with a grant-minted id: every object activated must be one the
+ * id names, and a single-object activate must match the listed type. Ids
+ * without grant claims always pass (today's behaviour: only the first object
+ * is checked).
+ */
+export function grantActivateMismatch(payload, objects) {
+    const g = payload?.grant;
+    if (!g)
+        return null;
+    const minted = String(payload?.object ?? '');
+    for (const o of objects) {
+        if (!o || !approvalObjectMatches(minted, String(o.name ?? '')))
+            return 'object_mismatch';
+    }
+    if (objects.length === 1) {
+        const o = objects[0];
+        const member = g.members?.find((m) => norm(m.name) === norm(o.name));
+        const want = member ? member.type : g.type;
+        if (typeCode(o.type) !== norm(want))
+            return 'type_mismatch';
+    }
+    return null;
+}
+/**
+ * The write was resolved to the transport that already holds the object. A
+ * grant id may only write there when that is the grant's transport.
+ */
+export function grantOwningTransportMismatch(payload, owning) {
+    const g = payload?.grant;
+    if (!g || !owning)
+        return false;
+    return norm(owning) !== norm(g.transport);
+}
+/** The plain message a refused owning-transport write returns. */
+export function grantOwningTransportDetail(objectName, owning) {
+    return `${objectName} is already in transport ${owning}, which is not this build's transport. `
+        + 'The plan approval does not cover it. Ask for approval for this change.';
+}

package/dist/approvals/jwt.js

@@ -62,6 +62,8 @@ export async function mintChangeApproval(change, sessionId, opts = {}) {
         op: change.op,
         session_id: sessionId,
         ...(opts.auto ? { auto: true } : {}),
+        ...(opts.oneShot ? { one_shot: true } : {}),
+        ...(opts.grant ? { grant: opts.grant } : {}),
     });
 }
 export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp) {
@@ -128,7 +130,7 @@ export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp)
     // Single-use only for one-shot destructive ops. create/modify approvals are
     // reusable for their object's lifecycle ops (create→modify→activate) within
     // TTL — that IS the change the user approved, so re-spending is not replay.
-    if (isOneShotOp(payload.op)) {
+    if (isOneShotOp(payload.op) || payload.one_shot === true) {
         if (usedNonces.has(payload.nonce))
             return { ok: false, reason: 'nonce_spent' };
         usedNonces.add(payload.nonce);
@@ -141,3 +143,21 @@ export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp)
     }
     return { ok: true, payload, matchKind };
 }
+export async function mintPlanGrantToken(p) {
+    return new SignJWT({ ...p, kind: 'plan-grant' })
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt()
+        // A whole build fits; the key is per CLI start, so a restart always asks again.
+        .setExpirationTime('12h')
+        .sign(sessionKey);
+}
+/** The signed payload, or null for a token that is forged, expired or not a plan grant. */
+export async function verifyPlanGrantToken(token) {
+    try {
+        const { payload } = await jwtVerify(String(token ?? '').trim(), sessionKey);
+        return payload.kind === 'plan-grant' ? payload : null;
+    }
+    catch {
+        return null;
+    }
+}