@cspeach/cli 1.1.29 → 1.1.31

package/dist/ui/approval-modal.js

@@ -1,6 +1,6 @@
-import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
-import { useState } from 'react';
-import { Box, Text, useInput } from 'ink';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useRef, useState } from 'react';
+import { Box, Text, useInput, useStdout } from 'ink';
 import { riskReasonText, shownRiskReasons } from '../approvals/risk-floor.js';
 import { verbLine, viewAffordance, toSourceLines } from '../approvals/op-labels.js';
 // BUG-1 (2026-07-05 live smoke): the interactive approval modal mounted
@@ -31,16 +31,75 @@ function diffLineColor(line, panels) {
         return roleProps(line.startsWith('+') ? 'ok' : line.startsWith('-') ? 'bad' : 'dim').color;
     return legacyInkColor(line.startsWith('+') ? 'green' : line.startsWith('-') ? 'red' : 'gray');
 }
+/** After the review view closes, an Esc this soon is ignored (a double press), like CONFIRM_INPUT_GUARD_MS. */
+export const BACK_GUARD_MS = 300;
+/** The review view's key line, always at its bottom: how to go back and how to answer from here. */
+export const viewKeysLine = (reviewKey) => `Esc or ${reviewKey}: back · a: approve · s: skip · c: cancel turn`;
 export function ApprovalModal({ change, effectiveRisk, transport, onApply, onSkip, onDiff, onCancel, onInterruptTurn }) {
     // BUG-1 — re-assert raw mode on mount so keypresses reach useInput even
     // when an inquirer gate ran earlier in the turn (see import block).
     useReclaimRawStdin();
     const [viewing, setViewing] = useState(false);
+    const [top, setTop] = useState(0);
     const aff = viewAffordance(change);
+    const { stdout } = useStdout();
+    // Recording fix 2 (2026-10-07): a long diff ran off the top of the screen
+    // with its "Esc to return" line, and the person could not get back. The
+    // review view shows at most this many lines and scrolls; its key line stays
+    // at the bottom. ink-testing-library reports no rows: 24, as App does.
+    // The whole live frame must stay strictly below the terminal's rows, or Ink
+    // clears the screen on every paint and leaves stale rows behind (Ink 5,
+    // outputHeight >= rows). Budget: this view's chrome 6 + the input footer 3 +
+    // the footer line 1 + the checklist 1 + 1 spare + the diff lines.
+    const viewRows = Math.max(3, (stdout?.rows ?? 24) - 14);
+    // Back from the view: an Esc in the next 300 ms is the second of a double
+    // press, never a cancel of the turn.
+    const backAt = useRef(0);
+    const back = () => { backAt.current = Date.now(); setViewing(false); };
+    const viewLines = viewing && aff && change.diff
+        ? (aff.key === 'd' ? change.diff.split('\n') : toSourceLines(change.diff))
+        : [];
+    const lastTop = Math.max(0, viewLines.length - viewRows);
     useInput((input, key) => {
         if (viewing) {
-            if (key.escape) {
-                setViewing(false);
+            // The review view answers the card too: Esc or the review key go back;
+            // a / s / c (and y / n, as on the card) answer it from here.
+            if (key.escape || (aff && input === aff.key)) {
+                back();
+                return;
+            }
+            if (key.ctrl && input === 'c') {
+                onCancel();
+                onInterruptTurn?.();
+                return;
+            }
+            if (key.upArrow || input === 'k') {
+                setTop((t) => Math.max(0, t - 1));
+                return;
+            }
+            if (key.downArrow || input === 'j') {
+                setTop((t) => Math.min(lastTop, t + 1));
+                return;
+            }
+            if (key.pageUp) {
+                setTop((t) => Math.max(0, t - viewRows));
+                return;
+            }
+            if (key.pageDown || input === ' ') {
+                setTop((t) => Math.min(lastTop, t + viewRows));
+                return;
+            }
+            if (input === 'a' || input === 'y') {
+                onApply();
+                return;
+            }
+            if (input === 's' || input === 'n') {
+                onSkip();
+                return;
+            }
+            if (input === 'c') {
+                onCancel();
+                return;
             }
             return;
         }
@@ -55,6 +114,7 @@ export function ApprovalModal({ change, effectiveRisk, transport, onApply, onSki
         // The review key is op-aware ([d] for modify, [v] for create/delete);
         // display-only — it never changes the resolve contract.
         if (aff && input === aff.key) {
+            setTop(0);
             setViewing(true);
             onDiff();
             return;
@@ -68,6 +128,8 @@ export function ApprovalModal({ change, effectiveRisk, transport, onApply, onSki
             onInterruptTurn?.();
             return;
         }
+        if (key.escape && Date.now() - backAt.current < BACK_GUARD_MS)
+            return;
         if (input === 'c' || key.escape) {
             onCancel();
             return;
@@ -78,7 +140,13 @@ export function ApprovalModal({ change, effectiveRisk, transport, onApply, onSki
         const isDiff = aff.key === 'd';
         const panels = getLook() === 'panels';
         const quiet = panels ? roleProps('dim').color : legacyInkColor('gray');
-        return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: panels ? roleProps('frame').color : quiet, paddingX: 1, children: [_jsxs(Text, { bold: true, children: [isDiff ? 'Diff' : aff.label, " \u2014 Esc to return"] }), change.diff ? (isDiff ? (change.diff.split('\n').map((line, i) => (_jsx(Text, { wrap: "truncate-end", color: diffLineColor(line, panels), children: line }, i)))) : (toSourceLines(change.diff).map((line, i) => (_jsxs(Text, { wrap: "truncate-end", children: [_jsxs(Text, { color: quiet, children: [String(i + 1).padStart(4), "  "] }), line] }, i))))) : (_jsx(Text, { dimColor: true, children: "(no source provided by the model)" }))] }));
+        const from = Math.min(top, lastTop);
+        const shownLines = viewLines.slice(from, from + viewRows);
+        const scrolls = viewLines.length > viewRows;
+        const where = scrolls
+            ? `  lines ${from + 1}–${from + shownLines.length} of ${viewLines.length} · ↑↓ scroll`
+            : '';
+        return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: panels ? roleProps('frame').color : quiet, paddingX: 1, children: [_jsxs(Text, { bold: true, wrap: "truncate-end", children: [isDiff ? 'Diff' : aff.label, _jsx(Text, { color: quiet, children: where })] }), change.diff ? (isDiff ? (shownLines.map((line, i) => (_jsx(Text, { wrap: "truncate-end", color: diffLineColor(line, panels), children: line }, from + i)))) : (shownLines.map((line, i) => (_jsxs(Text, { wrap: "truncate-end", children: [_jsxs(Text, { color: quiet, children: [String(from + i + 1).padStart(4), "  "] }), line] }, from + i))))) : (_jsx(Text, { dimColor: true, children: "(no source provided by the model)" })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { wrap: "truncate-end", children: viewKeysLine(aff.key) }) })] }));
     }
     const raisedLabel = shownRiskReasons(effectiveRisk.raisedBy).map(riskReasonText).join('; ');
     // Meta line: Package · Transport — each segment only when genuinely known.

package/dist/ui/widgets/confirm-card.js

@@ -28,10 +28,70 @@ export const CONFIRM_INPUT_GUARD_MS = 150;
  * The card's full rendered height for the live-area budget (F3 liveBudget
  * `cardRows`): top edge + title + one row per fact + the gap above the
  * choices + one row per choice + the hint + bottom edge. Every row is
- * truncate-end, so nothing wraps into extra rows.
+ * truncate-end, so nothing wraps into extra rows — except the facts of a
+ * card that asks for `wrapFacts`: with `width` given, each counts the rows
+ * it is drawn on.
  */
-export function estimateConfirmCardRows(req) {
-    return 5 + (req.facts?.length ?? 0) + req.choices.length;
+export function estimateConfirmCardRows(req, width, maxRows) {
+    const facts = req.facts ?? [];
+    const wrap = width === undefined ? 1 : fittedWrap(req, width, maxRows);
+    const factRowCount = width !== undefined && wrap > 1
+        ? facts.reduce((n, f) => n + factRows(f, Math.max(1, width - 4), wrap).length, 0)
+        : facts.length;
+    return 5 + factRowCount + req.choices.length;
+}
+/**
+ * The rows a long fact may wrap onto so the whole card stays within
+ * `maxRows` (App: rows − 6, so Ink never reaches its full-clear path): the
+ * card's own `wrapFacts`, one less each time it would not fit, down to one
+ * row (every fact cut with …, as on any card).
+ */
+export function fittedWrap(req, width, maxRows) {
+    let wrap = Math.max(1, req.wrapFacts ?? 1);
+    if (maxRows === undefined)
+        return wrap;
+    const cells = Math.max(1, width - 4);
+    const rowsAt = (w) => 5 + req.choices.length + (req.facts ?? []).reduce((n, f) => n + factRows(f, cells, w).length, 0);
+    while (wrap > 1 && rowsAt(wrap) > maxRows)
+        wrap -= 1;
+    return wrap;
+}
+const graphemes = new Intl.Segmenter(undefined, { granularity: 'grapheme' });
+/**
+ * One fact as the rows it is drawn on. `rows` 1 (the default): one row, cut
+ * with … — how every card looks. More: wrapped at spaces (a word wider than
+ * the row is cut where it must be) onto at most `rows` rows, the last one cut
+ * with … when there is still more. Control characters are neutralised first.
+ */
+export function factRows(text, cells, rows = 1) {
+    const flat = sanitizeControlChars(text).replace(/\t/g, '  ').replace(/\r?\n/g, ' ');
+    if (rows <= 1 || stringWidth(flat) <= cells)
+        return [truncateToWidth(flat, cells)];
+    const out = [];
+    let rest = flat;
+    while (out.length < rows - 1 && stringWidth(rest) > cells) {
+        let used = 0;
+        let space = -1;
+        let end = rest.length;
+        for (const { segment, index } of graphemes.segment(rest)) {
+            const w = stringWidth(segment);
+            if (used + w > cells) {
+                end = index;
+                if (segment === ' ')
+                    space = index;
+                break;
+            }
+            used += w;
+            if (segment === ' ')
+                space = index;
+        }
+        const at = space > 0 ? space : Math.max(1, end);
+        out.push(rest.slice(0, at).trimEnd());
+        rest = rest.slice(at).trimStart();
+    }
+    if (rest)
+        out.push(truncateToWidth(rest, cells));
+    return out;
 }
 /**
  * Owner decision (fix-round-3 deferred M1): a digit PICKS only on ordinary
@@ -107,7 +167,7 @@ export function CardFrame({ tag, footnote, width, children }) {
     const bottom = edgeSegments([box.bl, box.br], box.h, footnote, width);
     return (_jsxs(Box, { flexDirection: "column", flexShrink: 0, width: width, children: [_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...frame, children: top.lead }), _jsx(Text, { ...roleProps(TAG_ROLE[tag], { bold: true }), children: top.label }), _jsx(Text, { ...frame, children: top.tail })] }), _jsx(Box, { flexDirection: "column", width: width, paddingX: 1, borderStyle: inkBorder(box), borderTop: false, borderBottom: false, borderColor: frame.color, children: children }), _jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...frame, children: bottom.lead }), _jsx(Text, { ...roleProps('dim'), children: bottom.label }), _jsx(Text, { ...frame, children: bottom.tail })] })] }));
 }
-export function ConfirmCard({ request, width, onResolve, onInterruptTurn }) {
+export function ConfirmCard({ request, width, maxRows, onResolve, onInterruptTurn }) {
     // Re-assert raw stdin on mount: an earlier inquirer prompt can leave Ink's
     // raw-mode bookkeeping stale, and the card would then get no keys.
     useReclaimRawStdin();
@@ -175,6 +235,7 @@ export function ConfirmCard({ request, width, onResolve, onInterruptTurn }) {
             finish({ value: hit });
     });
     const inner = Math.max(1, width - 4);
+    const wrap = fittedWrap(request, width, maxRows);
     const dim = roleProps('dim');
     const titleProps = request.tag === 'CANNOT BE UNDONE' ? roleProps('bad', { bold: true }) : { bold: true };
     const letters = Object.keys(request.aliases ?? {}).filter((k) => k.length === 1);
@@ -183,7 +244,9 @@ export function ConfirmCard({ request, width, onResolve, onInterruptTurn }) {
         ? `1-${digits} picks · ↑↓ move · Enter chooses · Esc cancels`
         : `Enter chooses · Esc cancels · ↑↓ or 1-${digits} move`)
         + (letters.length > 0 ? ` · keys ${letters.join('/')}` : '');
-    return (_jsxs(CardFrame, { tag: request.tag, footnote: request.footnote, width: width, children: [_jsx(Text, { wrap: "truncate-end", ...titleProps, children: fit(request.title, inner) }), (request.facts ?? []).map((f, i) => (_jsx(Text, { wrap: "truncate-end", ...dim, children: fit(f, inner) }, `fact-${i}`))), _jsx(Box, { flexDirection: "column", marginTop: 1, children: request.choices.map((c, i) => {
+    return (_jsxs(CardFrame, { tag: request.tag, footnote: request.footnote, width: width, children: [_jsx(Text, { wrap: "truncate-end", ...titleProps, children: fit(request.title, inner) }), (request.facts ?? []).flatMap((f, i) => (wrap > 1
+                ? factRows(f, inner, wrap).map((row, j) => (_jsx(Text, { wrap: "truncate-end", ...dim, children: row }, `fact-${i}-${j}`)))
+                : [_jsx(Text, { wrap: "truncate-end", ...dim, children: fit(f, inner) }, `fact-${i}`)])), _jsx(Box, { flexDirection: "column", marginTop: 1, children: request.choices.map((c, i) => {
                     const on = i === cursor;
                     const main = fit(`${on ? g.cursor : ' '} ${i + 1}. ${c.label}`, inner);
                     const room = inner - stringWidth(main);

package/dist/util/open-in-browser.js

@@ -0,0 +1,143 @@
+/**
+ * Open a local file or an https link in the default browser — the guided
+ * clean-core journey's status page (Task 6) and the `cspeach login` link.
+ *
+ * SECURITY: nothing here goes through a shell. `cmd /c start "" <path>` re-parses
+ * its argument, so a folder or project name with & ^ | % " ( ) could run
+ * commands. Instead:
+ *   Windows  local file → rundll32.exe url.dll,FileProtocolHandler <file URL>
+ *            https link → rundll32.exe url.dll,FileProtocolHandler <url>
+ *   macOS    open <target>
+ *   Linux    xdg-open <target>
+ * always spawned with shell:false, the target as ONE argument, detached, stdio
+ * ignored. Local files must be absolute paths with no control characters; links
+ * must be https with no spaces, quotes or control characters (the login path
+ * also allows http://localhost and http://127.0.0.1). On Windows a local file
+ * must end in .html (defence in depth: FileProtocolHandler hands any other file
+ * to its own program, and a .bat or .exe runs). Nothing throws.
+ *
+ * Why not explorer.exe <path> for files: Explorer splits its command line on
+ * commas, and Node quotes only arguments with a space, tab or quote, so
+ * `C:\proj\tool.bat,x\…` would reach it unquoted and split. The encoded file
+ * URL has only [A-Za-z0-9%/._~-] after the drive, so nothing can split it.
+ * Fallback, NOT active: if a live check shows unicode paths fail through
+ * FileProtocolHandler, use explorer.exe with windowsVerbatimArguments:true and
+ * args [`"${p}"`], refusing any path containing ','.
+ */
+import nodePath from 'node:path';
+import { spawn as nodeSpawn } from 'node:child_process';
+export const BROWSER_FAILED_LINE = 'Could not open the browser — open the link above.';
+// eslint-disable-next-line no-control-regex
+const CONTROL = /[\u0000-\u001f\u007f]/;
+/** https only; a host; no spaces, quotes, backticks, angle brackets, backslashes or control characters. */
+export function isSafeHttpsUrl(url) {
+    if (typeof url !== 'string' || CONTROL.test(url))
+        return false;
+    if (!/^https:\/\/[A-Za-z0-9.-]+(:\d{1,5})?([/?#][^\s"'`<>\\]*)?$/.test(url))
+        return false;
+    try {
+        const u = new URL(url);
+        return u.protocol === 'https:' && u.hostname.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** http://localhost or http://127.0.0.1, any port; same character rules as https. */
+export function isLocalHttpUrl(url) {
+    if (typeof url !== 'string' || CONTROL.test(url))
+        return false;
+    if (!/^http:\/\/(localhost|127\.0\.0\.1)(:\d{1,5})?([/?#][^\s"'`<>\\]*)?$/.test(url))
+        return false;
+    try {
+        const u = new URL(url);
+        return u.protocol === 'http:' && (u.hostname === 'localhost' || u.hostname === '127.0.0.1') && !u.username && !u.password;
+    }
+    catch {
+        return false;
+    }
+}
+function isAbsoluteFile(p, platform) {
+    if (typeof p !== 'string' || p.length === 0 || CONTROL.test(p) || p.startsWith('-'))
+        return false;
+    return platform === 'win32' ? nodePath.win32.isAbsolute(p) && /^([A-Za-z]:\\|\\\\)/.test(p) : nodePath.posix.isAbsolute(p);
+}
+/** Percent-encode one path segment: everything but A–Z a–z 0–9 - . _ ~ */
+function encodeSegment(s) {
+    return encodeURIComponent(s).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** `file:///…` for a local absolute path: spaces as %20, other reserved characters percent-encoded. */
+export function fileUrlOf(p, platform = process.platform) {
+    if (platform === 'win32') {
+        const unc = /^\\\\([^\\]+)\\(.*)$/.exec(p);
+        if (unc)
+            return `file://${encodeSegment(unc[1])}/${unc[2].split(/[\\/]/).map(encodeSegment).join('/')}`;
+        const [drive, ...rest] = p.split(/[\\/]/);
+        return `file:///${drive.toUpperCase()}/${rest.map(encodeSegment).join('/')}`;
+    }
+    return `file://${p.split('/').map(encodeSegment).join('/')}`;
+}
+function commandFor(target, platform, allowLocalHttp) {
+    const isLink = /^[A-Za-z][A-Za-z0-9+.-]+:/.test(target); // a one-letter "scheme" is a drive letter
+    if (isLink) {
+        if (!isSafeHttpsUrl(target) && !(allowLocalHttp && isLocalHttpUrl(target)))
+            return null;
+        if (platform === 'win32')
+            return { cmd: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', target] };
+    }
+    else if (!isAbsoluteFile(target, platform)) {
+        return null;
+    }
+    else if (platform === 'win32') {
+        // Only a page: FileProtocolHandler would run a .bat, .cmd or .exe.
+        if (!/\.html$/i.test(target))
+            return null;
+        return { cmd: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', fileUrlOf(target, 'win32')] };
+    }
+    return { cmd: platform === 'darwin' ? 'open' : 'xdg-open', args: [target] };
+}
+/**
+ * Open `target` (an absolute local file path or an https link). Resolves true
+ * when the opener started, false when the target was refused or nothing could
+ * start. Never throws.
+ */
+export async function openInBrowser(target, deps = {}) {
+    const platform = deps.platform ?? process.platform;
+    const spawn = deps.spawn ?? nodeSpawn;
+    const c = commandFor(target, platform, deps.allowLocalHttp === true);
+    if (!c)
+        return false;
+    try {
+        const child = spawn(c.cmd, c.args, { shell: false, detached: true, stdio: 'ignore', windowsHide: true });
+        const started = await new Promise((resolve) => {
+            const timer = setTimeout(() => resolve(true), deps.settleMs ?? 1500);
+            child.once('spawn', () => { clearTimeout(timer); resolve(true); });
+            child.once('error', () => { clearTimeout(timer); resolve(false); });
+        });
+        // A late error must never crash the session.
+        child.on?.('error', () => { });
+        child.unref();
+        return started;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The journey's REPORT stage, after the person chose Yes: the page's file link
+ * (to paste when no browser opens), then open it. Only this one path is shown.
+ */
+export async function openStatusPage(file, deps = {}) {
+    const platform = deps.platform ?? process.platform;
+    const lines = [`  ${fileUrlOf(file, platform)}`];
+    if (!(await openInBrowser(file, deps)))
+        lines.push(`  ${BROWSER_FAILED_LINE}`);
+    return lines;
+}
+/** `cspeach login`'s opener (https, or http on localhost/127.0.0.1): rejects when nothing opened, so login prints its own "open it yourself" line. */
+export function loginOpener(deps = {}) {
+    return async (url) => {
+        if (!(await openInBrowser(url, { ...deps, allowLocalHttp: true })))
+            throw new Error('The browser did not open.');
+    };
+}

package/package.json

@@ -1,120 +1,120 @@
-{
-  "name": "@cspeach/cli",
-  "version": "1.1.29",
-  "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
-  "keywords": [
-    "abap",
-    "sap",
-    "ai",
-    "cli",
-    "ai-assisted-development",
-    "s4hana",
-    "abap-development",
-    "claude",
-    "anthropic"
-  ],
-  "homepage": "https://cspeach.dev",
-  "bugs": {
-    "email": "laeeq.siddique@cremencing.com"
-  },
-  "author": "Laeeq Siddique (Cremencing Solutions)",
-  "license": "SEE LICENSE IN LICENSE",
-  "private": false,
-  "publishConfig": {
-    "access": "public"
-  },
-  "type": "module",
-  "bin": {
-    "cspeach": "dist/index.js"
-  },
-  "scripts": {
-    "dev": "tsx src/index.ts",
-    "prebuild": "tsx scripts/prebuild.ts",
-    "build": "tsc && node scripts/make-bin-executable.js",
-    "install:global": "tsx scripts/install-global.ts",
-    "pretest": "tsx scripts/sync-signing-key.ts || node -e \"console.warn('WARN: sync-signing-key skipped — using stub')\"",
-    "start": "node dist/index.js",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:smoke-e2e": "vitest run --config vitest.smoke-e2e.config.ts",
-    "adt:smoke": "tsx scripts/adt-smoke.ts",
-    "smoke:all": "pnpm adt:smoke",
-    "bench:models": "tsx scripts/bench-models.ts",
-    "bench:audit": "tsx scripts/bench-audit-task.ts",
-    "bench:replay": "tsx bench/replay/run.ts",
-    "fiori": "tsx src/tools/fiori/bin.ts",
-    "prepare": "husky",
-    "prepublishOnly": "node -e \"const deps=require('./package.json').dependencies||{}; for (const n of ['@cspeach/sap-client','@cspeach/register-core']) { const d=deps[n]||''; if(d.startsWith('file:')||d.startsWith('link:')){console.error('publish blocked: '+n+' is a local link ('+d+') — point it at the published version before npm publish'); process.exit(1)} }\""
-  },
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "dependencies": {
-    "@anthropic-ai/sdk": "^0.90.0",
-    "@cspeach/register-core": "0.1.0",
-    "@cspeach/sap-client": "0.1.16",
-    "@iarna/toml": "^2.2.5",
-    "@inkjs/ui": "^2.0.0",
-    "@inquirer/prompts": "^7.0.0",
-    "@napi-rs/keyring": "2.1.0",
-    "@noble/ed25519": "2.1.0",
-    "@noble/hashes": "1.4.0",
-    "@sap-ux/annotation-converter": "0.10.21",
-    "@sap-ux/edmx-parser": "0.10.0",
-    "@sap-ux/fe-fpm-writer": "0.43.7",
-    "@sap-ux/fiori-elements-writer": "^3.0.39",
-    "@sap-ux/fiori-freestyle-writer": "3.0.12",
-    "@sap-ux/vocabularies-types": "0.15.0",
-    "adm-zip": "0.5.17",
-    "chalk": "^5.3.0",
-    "cli-highlight": "^2.1.11",
-    "cli-table3": "^0.6.5",
-    "clipboardy": "^5.3.1",
-    "cross-spawn": "^7.0.6",
-    "diff": "^9.0.0",
-    "ejs": "3.1.10",
-    "fuse.js": "^7.0.0",
-    "ink": "^5.0.0",
-    "ink-text-input": "^6.0.0",
-    "jose": "^5.9.0",
-    "mammoth": "^1.8.0",
-    "marked": "^11.2.0",
-    "marked-terminal": "^6.2.0",
-    "mem-fs": "2.1.0",
-    "mem-fs-editor": "9.4.0",
-    "node-machine-id": "^1.1.12",
-    "openai": "^6.49.0",
-    "puppeteer-core": "24.10.2",
-    "react": "^18.3.0",
-    "string-width": "^7.2.0",
-    "turndown": "^7.2.0",
-    "unpdf": "1.7.0",
-    "zod": "^3.23.0"
-  },
-  "devDependencies": {
-    "@sap-ux/ui5-middleware-fe-mockserver": "2.4.17",
-    "@types/adm-zip": "0.5.8",
-    "@types/cross-spawn": "^6.0.6",
-    "@types/diff": "^7.0.2",
-    "@types/ejs": "^3.1.5",
-    "@types/node": "^20.17.0",
-    "@types/react": "^18.3.0",
-    "@types/turndown": "^5.0.5",
-    "@ui5/builder": "4.3.2",
-    "@ui5/fs": "4.0.6",
-    "docx": "^9.0.2",
-    "husky": "^9.1.7",
-    "ink-testing-library": "^4.0.0",
-    "pdf-lib": "^1.17.1",
-    "strip-ansi": "6.0.1",
-    "tsx": "^4.19.0",
-    "typescript": "^5.7.0",
-    "vitest": "^2.1.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ]
-  }
-}
+{
+  "name": "@cspeach/cli",
+  "version": "1.1.31",
+  "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
+  "keywords": [
+    "abap",
+    "sap",
+    "ai",
+    "cli",
+    "ai-assisted-development",
+    "s4hana",
+    "abap-development",
+    "claude",
+    "anthropic"
+  ],
+  "homepage": "https://cspeach.dev",
+  "bugs": {
+    "email": "laeeq.siddique@cremencing.com"
+  },
+  "author": "Laeeq Siddique (Cremencing Solutions)",
+  "license": "SEE LICENSE IN LICENSE",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "bin": {
+    "cspeach": "dist/index.js"
+  },
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "prebuild": "tsx scripts/prebuild.ts",
+    "build": "tsc && node scripts/make-bin-executable.js",
+    "install:global": "tsx scripts/install-global.ts",
+    "pretest": "tsx scripts/sync-signing-key.ts || node -e \"console.warn('WARN: sync-signing-key skipped — using stub')\"",
+    "start": "node dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:smoke-e2e": "vitest run --config vitest.smoke-e2e.config.ts",
+    "adt:smoke": "tsx scripts/adt-smoke.ts",
+    "smoke:all": "pnpm adt:smoke",
+    "bench:models": "tsx scripts/bench-models.ts",
+    "bench:audit": "tsx scripts/bench-audit-task.ts",
+    "bench:replay": "tsx bench/replay/run.ts",
+    "fiori": "tsx src/tools/fiori/bin.ts",
+    "prepare": "husky",
+    "prepublishOnly": "node -e \"const deps=require('./package.json').dependencies||{}; for (const n of ['@cspeach/sap-client','@cspeach/register-core']) { const d=deps[n]||''; if(d.startsWith('file:')||d.startsWith('link:')){console.error('publish blocked: '+n+' is a local link ('+d+') — point it at the published version before npm publish'); process.exit(1)} }\""
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.90.0",
+    "@cspeach/register-core": "0.3.0",
+    "@cspeach/sap-client": "0.1.17",
+    "@iarna/toml": "^2.2.5",
+    "@inkjs/ui": "^2.0.0",
+    "@inquirer/prompts": "^7.0.0",
+    "@napi-rs/keyring": "2.1.0",
+    "@noble/ed25519": "2.1.0",
+    "@noble/hashes": "1.4.0",
+    "@sap-ux/annotation-converter": "0.10.21",
+    "@sap-ux/edmx-parser": "0.10.0",
+    "@sap-ux/fe-fpm-writer": "0.43.7",
+    "@sap-ux/fiori-elements-writer": "^3.0.39",
+    "@sap-ux/fiori-freestyle-writer": "3.0.12",
+    "@sap-ux/vocabularies-types": "0.15.0",
+    "adm-zip": "0.5.17",
+    "chalk": "^5.3.0",
+    "cli-highlight": "^2.1.11",
+    "cli-table3": "^0.6.5",
+    "clipboardy": "^5.3.1",
+    "cross-spawn": "^7.0.6",
+    "diff": "^9.0.0",
+    "ejs": "3.1.10",
+    "fuse.js": "^7.0.0",
+    "ink": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    "jose": "^5.9.0",
+    "mammoth": "^1.8.0",
+    "marked": "^11.2.0",
+    "marked-terminal": "^6.2.0",
+    "mem-fs": "2.1.0",
+    "mem-fs-editor": "9.4.0",
+    "node-machine-id": "^1.1.12",
+    "openai": "^6.49.0",
+    "puppeteer-core": "24.10.2",
+    "react": "^18.3.0",
+    "string-width": "^7.2.0",
+    "turndown": "^7.2.0",
+    "unpdf": "1.7.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@sap-ux/ui5-middleware-fe-mockserver": "2.4.17",
+    "@types/adm-zip": "0.5.8",
+    "@types/cross-spawn": "^6.0.6",
+    "@types/diff": "^7.0.2",
+    "@types/ejs": "^3.1.5",
+    "@types/node": "^20.17.0",
+    "@types/react": "^18.3.0",
+    "@types/turndown": "^5.0.5",
+    "@ui5/builder": "4.3.2",
+    "@ui5/fs": "4.0.6",
+    "docx": "^9.0.2",
+    "husky": "^9.1.7",
+    "ink-testing-library": "^4.0.0",
+    "pdf-lib": "^1.17.1",
+    "strip-ansi": "6.0.1",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
+  }
+}