@cspeach/cli 1.1.29 → 1.1.31

package/dist/projects/migration.js

@@ -1,115 +1,14 @@
 /**
- * One-time workspace-default migration prompt.
+ * One-time `.abapforge/` → `.cspeach/` output-namespace migration offer.
  *
- * Why this exists: until 2026-05-07 the default workspace was `~/CSPeach/`
- * — a single global folder per user. As of 2026-05-08 the default is
- * project-rooted (`<git-root>/.cspeach/`), so a consultant working on
- * customer A and customer B no longer has both customers' artefacts
- * piling into one folder.
- *
- * For users with files already in `~/CSPeach/`, the switch needs to ask
- * once: keep the old global, move into the new project, or leave both
- * alone. The answer is recorded in `config.migration_prompted`; the
- * prompt fires exactly once.
- *
- * Three branches:
- *   - "move":         renameSync every artefact from ~/CSPeach/ into the
- *                     resolved project workspace. Old folder cleaned.
- *   - "keep_global":  set workspace_folder = '~/CSPeach', preserving the
- *                     pre-2026-05-08 behaviour for users who liked it.
- *   - "leave":        do nothing — old folder stays as-is, new artefacts
- *                     go to the project workspace. User can manually
- *                     copy whatever they want later.
- *
- * The prompt is interactive (via the supplied async prompt callback);
- * one-shot mode skips it entirely (caller passes a no-op).
+ * The old first-run workspace prompt (2026-05-08, which could pin
+ * `workspace_folder`) was removed 2026-10-08: files now save in the folder
+ * you start in. See workspace-retire.ts for the offer that retires the key.
  */
 import { existsSync, mkdirSync, readdirSync, renameSync, rmdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import os from 'node:os';
 import { loadConfig, saveConfig } from '../config/loader.js';
-import { defaultWorkspaceFor } from './workspace.js';
 import { OUTPUT_ROOT, LEGACY_ROOT } from './output-paths.js';
-/**
- * Run the migration prompt if and only if it hasn't run before AND
- * there's actually something to migrate. No-op otherwise. Always sets
- * `migration_prompted: true` after running so the next invocation
- * skips this whole module.
- */
-export async function maybePromptWorkspaceMigration(deps) {
-    const cfg = await loadConfig();
-    if (cfg.migration_prompted === true)
-        return;
-    // If user already pinned workspace_folder, they've already chosen —
-    // mark prompted, skip the dialog. The pin survives.
-    if (cfg.workspace_folder !== undefined && cfg.workspace_folder.trim().length > 0) {
-        await saveConfig({ ...cfg, migration_prompted: true });
-        return;
-    }
-    const oldWorkspace = join(os.homedir(), 'CSPeach');
-    if (!existsSync(oldWorkspace)) {
-        await saveConfig({ ...cfg, migration_prompted: true });
-        return;
-    }
-    let oldFiles;
-    try {
-        oldFiles = readdirSync(oldWorkspace).filter((f) => f.endsWith('.cspeach.json') || f.endsWith('.txt') || f.endsWith('.md'));
-    }
-    catch {
-        await saveConfig({ ...cfg, migration_prompted: true });
-        return;
-    }
-    if (oldFiles.length === 0) {
-        await saveConfig({ ...cfg, migration_prompted: true });
-        return;
-    }
-    const newWorkspace = defaultWorkspaceFor(process.cwd());
-    let choice;
-    try {
-        choice = await deps.prompt({
-            fileCount: oldFiles.length,
-            oldWorkspace,
-            newWorkspace,
-        });
-    }
-    catch {
-        // User Ctrl+C'd the prompt — leave migration_prompted unset so the
-        // dialog re-fires next session. Better than silently committing to
-        // a default they never saw.
-        return;
-    }
-    if (choice === 'move') {
-        try {
-            mkdirSync(newWorkspace, { recursive: true });
-            for (const f of oldFiles) {
-                const src = join(oldWorkspace, f);
-                const dst = join(newWorkspace, f);
-                if (existsSync(dst)) {
-                    deps.log(`(skipping ${f} — already exists in new workspace)`);
-                    continue;
-                }
-                renameSync(src, dst);
-            }
-            deps.log(`Moved ${oldFiles.length} file(s) → ${newWorkspace}`);
-        }
-        catch (err) {
-            deps.log(`Migration failed: ${err.message}. Old folder left untouched.`);
-        }
-    }
-    else if (choice === 'keep_global') {
-        await saveConfig({
-            ...cfg,
-            workspace_folder: oldWorkspace,
-            migration_prompted: true,
-        });
-        deps.log(`Workspace pinned to ${oldWorkspace}.`);
-        return; // saveConfig already done
-    }
-    else {
-        deps.log(`Leaving ${oldWorkspace} alone. New artefacts go to ${newWorkspace}.`);
-    }
-    await saveConfig({ ...cfg, migration_prompted: true });
-}
 /**
  * Recursively move every entry under `srcDir` into `dstDir`, MERGING into
  * existing directories rather than clobbering them. Files that already exist

package/dist/projects/plan-lane.js

@@ -10,10 +10,12 @@
 //   (Review Focus 4).
 // - renderLaneBlock is the <lane_decision> context block for the plan-creation
 //   turn and every resumed phase. It never carries the file path.
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
 import { cardLine } from '../lane/card.js';
 import { canonicalLanePath } from '../lane/paths.js';
 import { getAppFlow } from '../lane/app-flow.js';
-import { laneRootFor } from '../lane/roots.js';
+import { cliHomeRefusal, laneRootFor } from '../lane/roots.js';
 import { LaneShaMismatchError, readPinnedLaneDecision } from '../lane/store.js';
 /** Shown on the plan-creation turn (and at save) when the file no longer matches the card. */
 export const LANE_CHANGED_AT_CREATE = 'The lane decision file changed after you confirmed it. Run /abap-app again.';
@@ -37,24 +39,72 @@ export function validateLaneRecord(rec) {
     return null;
 }
 /**
- * Pinned read + re-validation. Never throws. `cwd` is the caller's folder;
- * the file is read relative to its lane root (I3: the folder that holds the
- * workspace `.cspeach`), the same root the lane card wrote it under.
+ * 2026-10-08 — the folder that holds the plan file's `.cspeach`: the root its
+ * relative pins (`from.lane.path`, `from.specGap.path`) were written against.
+ * Undefined when there is no plan path, or the plan does not sit directly in
+ * a `.cspeach` folder (then it adds no root). Task 14 — also undefined when
+ * that folder is the home folder, holds a CLI home as its `.cspeach`, or sits
+ * in a CLI home (`cspeachRoot()` or `~/.cspeach`), real paths compared —
+ * except exactly the seat working root `<cspeachRoot()>/work/<id>`
+ * (cliHomeRefusal, the lane root rule).
  */
-export async function readPlanLane(cwd, ref) {
-    let rec;
+export function planRootOf(planPath) {
+    if (!planPath)
+        return undefined;
+    const dir = path.dirname(path.resolve(planPath));
+    if (path.basename(dir).toLowerCase() !== '.cspeach')
+        return undefined;
+    const root = path.dirname(dir);
+    return cliHomeRefusal(root) === null ? root : undefined;
+}
+/** Candidate roots for a plan's pins: the plan's own root first, then the current rule. */
+export async function planPinRoots(cwd, planPath) {
+    const roots = [planRootOf(planPath), await laneRootFor(cwd)];
+    return roots.filter((r, i, a) => !!r && a.indexOf(r) === i);
+}
+/**
+ * Pinned read + re-validation. Never throws. `cwd` is the caller's folder.
+ * The file is read relative to the plan file's own root (`planPath`, the
+ * folder holding its `.cspeach`) first, then the lane root for cwd (the
+ * folder that holds the working `.cspeach`). The first root that HAS the file
+ * decides: a changed (sha mismatch) or refused file there is final — never
+ * fall through to another root past it.
+ */
+export async function readPlanLane(cwd, ref, planPath) {
+    const rel = canonicalLanePath(ref.path);
+    const roots = await planPinRoots(cwd, planPath);
+    let lastErr;
+    for (let i = 0; i < roots.length; i++) {
+        const root = roots[i];
+        const isLast = i === roots.length - 1;
+        // Only a root without the file is skipped; any other outcome there is final.
+        if (!isLast && !(await entryExists(path.resolve(root, rel))))
+            continue;
+        let rec;
+        try {
+            rec = await readPinnedLaneDecision(root, rel, ref.sha256);
+        }
+        catch (e) {
+            if (e instanceof LaneShaMismatchError)
+                return { ok: false, mismatch: true, message: e.message };
+            lastErr = e;
+            break;
+        }
+        const bad = validateLaneRecord(rec);
+        if (bad)
+            return { ok: false, mismatch: false, message: `The lane decision file ${cardLine(rel)} is not valid: ${bad}` };
+        return { ok: true, rec };
+    }
+    return { ok: false, mismatch: false, message: cardLine(lastErr instanceof Error ? lastErr.message : String(lastErr)) };
+}
+async function entryExists(abs) {
     try {
-        rec = await readPinnedLaneDecision(await laneRootFor(cwd), canonicalLanePath(ref.path), ref.sha256);
+        await fs.lstat(abs);
+        return true;
     }
-    catch (e) {
-        if (e instanceof LaneShaMismatchError)
-            return { ok: false, mismatch: true, message: e.message };
-        return { ok: false, mismatch: false, message: cardLine(e instanceof Error ? e.message : String(e)) };
+    catch {
+        return false;
     }
-    const bad = validateLaneRecord(rec);
-    if (bad)
-        return { ok: false, mismatch: false, message: `The lane decision file ${cardLine(canonicalLanePath(ref.path))} is not valid: ${bad}` };
-    return { ok: true, rec };
 }
 /**
  * Controller ruling R5 — per-lane whitelist of delegate x layer. A phase whose
@@ -160,11 +210,11 @@ export function checkRequiredDeploy(content, rec) {
  * re-validate it and check the stored phases against it. Lane-less plans pass
  * with no record. On failure, `lines` is what to print; the plan is paused.
  */
-export async function loadPlanLaneForRun(cwd, content) {
+export async function loadPlanLaneForRun(cwd, content, planPath) {
     const ref = content.from.lane;
     if (!ref)
         return { ok: true };
-    const lr = await readPlanLane(cwd, ref);
+    const lr = await readPlanLane(cwd, ref, planPath);
     if (!lr.ok) {
         return { ok: false, lines: [lr.mismatch ? laneChangedOnResume(ref.path) : `${lr.message} The plan is paused.`] };
     }

package/dist/projects/plan-sources.js

@@ -26,6 +26,7 @@ import { readProjectFile } from './status.js';
 import { buildPromotedFromSnapshot } from './promote.js';
 import { assertRealPathContained } from '../tools/_filesystem-shared.js';
 import { laneRootFor, workspaceFolderFor } from '../lane/roots.js';
+import { planRootOf } from './plan-lane.js';
 /** A spec-gap envelope file name (`...spec-gap-<4hex>-v<N>[-n].cspeach.json`). */
 const SPEC_GAP_FILE_RE = /-spec-gap-[0-9a-f]{4}-v\d+(?:-\d+)?\.cspeach\.json$/i;
 /** Path relative to `root` ('/'-separated) when inside it, else absolute. */
@@ -64,25 +65,30 @@ async function containedIn(abs, root) {
 }
 /**
  * Find and read the plan's spec-gap file. Candidates: `from.specGap.path`,
- * then the lane decision's `specGap.path`; each resolved against the project
+ * then the lane decision's `specGap.path`; each resolved against the plan
+ * file's own root (the folder holding its `.cspeach`, 2026-10-08), the project
  * folder and cwd. A candidate is used only when it is a spec-gap file name,
- * sits (real path) inside cwd or the workspace folder, parses as a spec-gap
+ * sits (real path) inside cwd, the workspace folder, the project folder or
+ * the plan's root, parses as a spec-gap
  * envelope, and — when the plan holds a promotedFrom snapshot — is the SAME
  * envelope (id match). Returns undefined when none qualifies.
  */
-async function readLiveSpecGap(cwd, content, promotedFrom, laneRecord) {
+async function readLiveSpecGap(cwd, content, promotedFrom, laneRecord, planPath) {
     const recorded = [content.from.specGap?.path, laneRecord?.specGap?.path]
         .filter((p) => typeof p === 'string' && p.trim() !== '');
     if (recorded.length === 0)
         return undefined;
     const root = await laneRootFor(cwd).catch(() => path.resolve(cwd));
     const ws = await workspaceFolderFor(cwd).catch(() => undefined);
+    const planRoot = planRootOf(planPath);
+    const bases = [planRoot, root, path.resolve(cwd)].filter((b, i, a) => !!b && a.indexOf(b) === i);
     for (const rec of recorded) {
         if (!SPEC_GAP_FILE_RE.test(path.basename(rec)))
             continue;
-        for (const base of [root, path.resolve(cwd)]) {
+        for (const base of bases) {
             const abs = path.resolve(base, rec);
-            if (!(await containedIn(abs, cwd)) && !(await containedIn(abs, ws)) && !(await containedIn(abs, root)))
+            if (!(await containedIn(abs, cwd)) && !(await containedIn(abs, ws)) && !(await containedIn(abs, root)) &&
+                !(await containedIn(abs, planRoot)))
                 continue;
             let env;
             try {
@@ -95,7 +101,7 @@ async function readLiveSpecGap(cwd, content, promotedFrom, laneRecord) {
                 continue;
             if (promotedFrom && promotedFrom.id !== env.id)
                 continue;
-            return { env, shownPath: relOrAbs(root, abs) };
+            return { env, shownPath: relOrAbs(base === planRoot ? planRoot : root, abs) };
         }
     }
     return undefined;
@@ -109,7 +115,7 @@ export async function resolvePlanSources(args) {
     const pf = args.envelope.promotedFrom && args.envelope.promotedFrom.artefactType === 'spec-gap'
         ? args.envelope.promotedFrom : null;
     try {
-        const live = await readLiveSpecGap(args.cwd, args.content, pf, args.laneRecord);
+        const live = await readLiveSpecGap(args.cwd, args.content, pf, args.laneRecord, args.planPath);
         if (live) {
             const snap = await buildPromotedFromSnapshot(live.env);
             const createdSha = args.content.from.specGap?.sha256 ?? pf?.sha256;

package/dist/projects/project-folder.js

@@ -0,0 +1,131 @@
+// src/projects/project-folder.ts
+/**
+ * The ONE rule for where a person's project files go (spec 2026-10-08 §3.1).
+ *
+ *   solo → <cwd>/.cspeach                         (the folder you start in)
+ *   team → <CSPEACH_HOME>/work/<projectId>/.cspeach (private to this seat; the
+ *          shared team files stay in the team folder, untouched)
+ *   home → ~/CSPeach/.cspeach                     (never the CLI home itself)
+ *
+ * No git walk. `workspace_folder` is ignored. Markers describe the folder;
+ * they never move the save location to another folder the person can see.
+ */
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, renameSync, realpathSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import toml from '@iarna/toml';
+import { cspeachRoot, configFile } from '../config/paths.js';
+export const SAFE_PROJECT_ID = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const TEAM_FILE = 'cspeach-team.json';
+const ID_FILE = 'project.json';
+const real = (p) => { try {
+    return realpathSync.native(p);
+}
+catch {
+    return path.resolve(p);
+} };
+const key = (p) => { const r = real(p).replace(/[\\/]+$/, ''); return process.platform === 'win32' ? r.toLowerCase() : r; };
+/** The team project id when `cwd` holds a valid cspeach-team.json, else null. */
+export function teamProjectId(cwd) {
+    try {
+        const raw = readFileSync(path.join(cwd, TEAM_FILE), 'utf8');
+        const p = JSON.parse(raw.charCodeAt(0) === 0xfeff ? raw.slice(1) : raw);
+        if (p?.kind !== 'team-project' || typeof p.projectId !== 'string')
+            return null;
+        return SAFE_PROJECT_ID.test(p.projectId) ? p.projectId : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function readSoloProjectId(cwd) {
+    try {
+        const p = JSON.parse(readFileSync(path.join(cwd, '.cspeach', ID_FILE), 'utf8'));
+        return typeof p?.id === 'string' && /^[0-9a-f]{8}$/.test(p.id) ? p.id : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveProjectFolderSync(cwd) {
+    const projectDir = path.resolve(cwd);
+    const teamId = existsSync(path.join(projectDir, TEAM_FILE)) ? teamProjectId(projectDir) : null;
+    if (teamId) {
+        const workRoot = path.join(cspeachRoot(), 'work', teamId);
+        return { kind: 'team', projectDir, workRoot, workDir: path.join(workRoot, '.cspeach'), projectId: teamId };
+    }
+    const isHome = key(projectDir) === key(os.homedir()) || key(path.join(projectDir, '.cspeach')) === key(cspeachRoot());
+    if (isHome) {
+        const workRoot = path.join(os.homedir(), 'CSPeach');
+        return { kind: 'home', projectDir, workRoot, workDir: path.join(workRoot, '.cspeach'), projectId: readSoloProjectId(workRoot) };
+    }
+    return { kind: 'solo', projectDir, workRoot: projectDir, workDir: path.join(projectDir, '.cspeach'), projectId: readSoloProjectId(projectDir) };
+}
+export async function resolveProjectFolder(cwd) {
+    return resolveProjectFolderSync(cwd);
+}
+/** Create `<workDir>/project.json` on first use (tmp + rename); return the id. */
+export function ensureProjectId(workDir, now = () => new Date(), rand = (n) => randomBytes(n).toString('hex')) {
+    const file = path.join(workDir, ID_FILE);
+    const existing = readSoloProjectId(path.dirname(workDir));
+    if (existing)
+        return existing;
+    mkdirSync(workDir, { recursive: true });
+    const id = rand(4);
+    writeFileSync(`${file}.tmp`, `${JSON.stringify({ id, createdAt: now().toISOString() }, null, 2)}\n`);
+    renameSync(`${file}.tmp`, file);
+    return id;
+}
+/** The pre-1.1.31 git-root walk — kept ONLY to find old files (read-only, this release). */
+function oldGitRoot(startDir) {
+    let dir = startDir;
+    for (let i = 0; i < 200; i++) {
+        if (existsSync(path.join(dir, '.git')))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+    return null;
+}
+const holdsEnvelopes = (dir) => {
+    try {
+        return readdirSync(dir).some((n) => n.endsWith('.cspeach.json'));
+    }
+    catch {
+        return false;
+    }
+};
+function oldWorkspaceFolder() {
+    try {
+        const parsed = toml.parse(readFileSync(configFile(), 'utf8'));
+        const v = parsed.workspace_folder?.trim();
+        if (!v)
+            return null;
+        return v === '~' || v.startsWith('~/') ? path.join(os.homedir(), v.slice(v === '~' ? 1 : 2)) : path.resolve(v);
+    }
+    catch {
+        return null;
+    }
+}
+/** Old save locations that still hold project files. Read-only use only. */
+export function legacyDirsFor(cwd) {
+    const pf = resolveProjectFolderSync(cwd);
+    const mine = key(pf.workDir);
+    const out = [];
+    const add = (d) => {
+        if (d && key(d) !== mine && holdsEnvelopes(d) && !out.some((o) => key(o) === key(d)))
+            out.push(d);
+    };
+    // A team folder's saves before this release went to <team>/.cspeach.
+    if (pf.kind === 'team')
+        add(path.join(pf.projectDir, '.cspeach'));
+    const g = oldGitRoot(pf.projectDir);
+    if (g && key(g) !== key(pf.projectDir))
+        add(path.join(g, '.cspeach'));
+    add(oldWorkspaceFolder());
+    add(cspeachRoot());
+    return out;
+}

package/dist/projects/promote-command.js

@@ -1,7 +1,42 @@
+import { realpathSync } from 'node:fs';
 import { readProjectFile } from './status.js';
 import { buildPromotedFromSnapshot, buildReviewDecisionsBlock, buildDetailPathHint, validatePromotionSource } from './promote.js';
 import { resolveAtTokenAsync, formatProjectFileList } from './workspace.js';
 import { askYesNo } from './yes-no.js';
+import path from 'node:path';
+import { cspeachRoot } from '../config/paths.js';
+import { isCliHomePath, isSeatReadOnlyFile } from '../tools/_filesystem-shared.js';
+/**
+ * Task 14 — a `--from` source inside the CLI home is read only in an explicit
+ * shape: the read-only seat shape (`<seat>/work/<id>/.cspeach/<name>.cspeach.json`)
+ * or an envelope directly in the CLI home (the earlier save location this
+ * release still lists). Config, keys, sessions, snapshots and every other
+ * file there stay out of reach. Spelled and real paths are both judged.
+ */
+function cliHomeSourceAllowed(abs) {
+    if (!isCliHomePath(abs))
+        return true;
+    if (isSeatReadOnlyFile(abs))
+        return true;
+    return directHomeEnvelope(abs) && directHomeEnvelope(realOr(abs));
+}
+function directHomeEnvelope(p) {
+    if (p === null)
+        return false;
+    const base = path.basename(p);
+    if (!/^[^:~]+\.cspeach\.json$/i.test(base) || /[. ]$/.test(base))
+        return false;
+    const k = (x) => (process.platform === 'win32' ? x.toLowerCase() : x);
+    return [cspeachRoot(), realOr(cspeachRoot())].some((h) => h !== null && k(path.dirname(p)) === k(h));
+}
+function realOr(p) {
+    try {
+        return realpathSync.native(p);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Per-skill predecessor map. v0.7 admits multi-source via array values —
  * e.g. /abap-upgrade-fix accepts BOTH upgrade-scan (the existing chain
@@ -66,6 +101,10 @@ export async function runPromoteCommand(args) {
         args.log(`Use a more specific @<fragment> to disambiguate.`);
         return null;
     }
+    if (!cliHomeSourceAllowed(path.resolve(args.cwd ?? process.cwd(), resolvedPath))) {
+        args.log(`--from: ${resolvedPath} is inside CSPeach's own folder and cannot be read.`);
+        return null;
+    }
     let env;
     try {
         env = readProjectFile(resolvedPath);