@cspeach/cli 1.1.30 → 1.1.31

package/dist/session/store.js

@@ -7,6 +7,7 @@ import { sessionsDir, pinnedSessionsDir } from '../config/paths.js';
 import { SCHEMA_VERSION } from './schema.js';
 import { userPromptText, isUserPrompt, promptPreviewText } from './user-prompt.js';
 import { stripUnsignedThinking, dropTrailingThinkingOnly } from '../agent/repair-partial.js';
+import { normDir, sessionMatchesFolder } from './project-match.js';
 export function makeSessionId() {
     return crypto.randomBytes(4).toString('hex');
 }
@@ -71,6 +72,9 @@ function validateSchema(parsed) {
     // Phase 4 chunk 4A: agentMode defaults to 'skill' for sessions written
     // before this chunk landed. Mirrors the lastUserPrompt back-compat above.
     parsed.agentMode ??= 'skill';
+    // 2026-10-08: sessions are listed per folder. Older files have no folder.
+    parsed.project_dir ??= null;
+    parsed.project_id ??= null;
     // Phase 1 cost tracking (2026-05-16): cache_creation_input_tokens added
     // to usage. Pre-2026-05-16 sessions don't have it; default to 0 so the
     // cost calculator can safely treat usage as a TokenCounts shape.
@@ -130,11 +134,17 @@ export const RESUME_PICKER_LIMIT = 20;
 async function recentSessionFiles(dir, limit) {
     // Merge note — Task 18 reader-* child sessions are skipped by NAME here, so a
     // burst of reader files can never crowd real sessions out of the window.
-    const files = (await fs.readdir(dir).catch(() => []))
-        .filter((f) => f.endsWith('.json') && !f.includes('-reader-'));
+    const files = await sessionFileNames(dir);
     const cap = Math.max(limit * 3, 50);
     if (files.length <= cap)
         return files;
+    return (await newestFirst(dir, files)).slice(0, cap);
+}
+async function sessionFileNames(dir) {
+    return (await fs.readdir(dir).catch(() => []))
+        .filter((f) => f.endsWith('.json') && !f.includes('-reader-'));
+}
+async function newestFirst(dir, files) {
     const stamped = await Promise.all(files.map(async (f) => {
         try {
             return { f, t: (await fs.stat(path.join(dir, f))).mtimeMs };
@@ -144,78 +154,113 @@ async function recentSessionFiles(dir, limit) {
         }
     }));
     stamped.sort((a, b) => b.t - a.t);
-    return stamped.slice(0, cap).map((x) => x.f);
+    return stamped.map((x) => x.f);
+}
+/** 2026-10-08 — every session file, newest first by mtime (no cap): `--continue` / `--resume` scans. */
+async function allSessionFilesNewestFirst(dir) {
+    return newestFirst(dir, await sessionFileNames(dir));
+}
+/** One picker row from a session file; null for a reader child or a corrupt file. */
+async function summaryOf(file, filename) {
+    try {
+        const raw = await fs.readFile(file, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (isReaderSessionId(parsed.id))
+            return null; // Task 18 — internal child, never resumed
+        const messages = parsed.messages ?? [];
+        // First user message that's a plain string (not a tool_result array) — the
+        // most recent prompt text that initiated a turn. We pick the LAST such
+        // message because the picker wants the freshest turn's prompt, not the
+        // first one of the session.
+        let promptSnippet = null;
+        for (let i = messages.length - 1; i >= 0; i--) {
+            const m = messages[i];
+            const text = m ? userPromptText(m) : null;
+            if (text !== null) {
+                // Strip <session_context>...</session_context> wrapper that the
+                // first turn injects, leaving only the user-typed prompt visible
+                // in the picker.
+                // (fix round 3: every injected block, e.g. <project_context>, and
+                // newlines — they broke the picker's table row.)
+                const stripped = promptPreviewText(text);
+                promptSnippet = (stripped || '<empty>').slice(0, 80);
+                break;
+            }
+        }
+        const userTurnCount = messages.filter((m) => m && isUserPrompt(m)).length;
+        return {
+            id: parsed.id,
+            startedAt: parsed.started_at,
+            lastTurnAt: parsed.last_turn_at,
+            skill: parsed.skill,
+            sapSystem: parsed.sap_system,
+            filename,
+            interrupted: parsed.turnInterrupted === true,
+            interruptedReason: parsed.turnInterruptedReason ?? null,
+            promptSnippet,
+            userTurnCount,
+            projectDir: parsed.project_dir ?? null,
+            projectId: parsed.project_id ?? null,
+        };
+    }
+    catch {
+        return null; // skip corrupt
+    }
 }
+/**
+ * The most recent sessions, newest first by last_turn_at.
+ * - `here`: only the sessions of that folder (sessionMatchesFolder).
+ * - `scanAll` (with `here`): walk every file newest-first instead of the
+ *   startup window, stopping once `limit` matches are found
+ *   (`--continue`, `--resume`). Without `here` the window is always used.
+ */
 export async function listSessions(limit = 10, opts = {}) {
     // NOTE: bypasses validateSchema() for performance — reads JSON directly via
     // JSON.parse + cast. Any new SessionState field accessed here must be
     // defaulted at the read site (e.g. `?? 'skill'`) because pre-chunk-4A
     // serialised sessions on disk lack the field.
     const dir = sessionsDir();
-    const files = await recentSessionFiles(dir, limit);
+    const scanAll = !!opts.here && opts.scanAll === true;
+    const files = scanAll ? await allSessionFilesNewestFirst(dir) : await recentSessionFiles(dir, limit);
+    const hereDirNorm = opts.here ? normDir(opts.here.dir) : undefined; // once per call, not per file
     const results = [];
     for (const f of files) {
-        try {
-            const raw = await fs.readFile(path.join(dir, f), 'utf-8');
-            const parsed = JSON.parse(raw);
-            if (isReaderSessionId(parsed.id))
-                continue; // Task 18 — internal child, never resumed
-            const messages = parsed.messages ?? [];
-            // First user message that's a plain string (not a tool_result array) — the
-            // most recent prompt text that initiated a turn. We pick the LAST such
-            // message because the picker wants the freshest turn's prompt, not the
-            // first one of the session.
-            let promptSnippet = null;
-            for (let i = messages.length - 1; i >= 0; i--) {
-                const m = messages[i];
-                const text = m ? userPromptText(m) : null;
-                if (text !== null) {
-                    // Strip <session_context>...</session_context> wrapper that the
-                    // first turn injects, leaving only the user-typed prompt visible
-                    // in the picker.
-                    // (fix round 3: every injected block, e.g. <project_context>, and
-                    // newlines — they broke the picker's table row.)
-                    const stripped = promptPreviewText(text);
-                    promptSnippet = (stripped || '<empty>').slice(0, 80);
-                    break;
-                }
-            }
-            const userTurnCount = messages.filter((m) => m && isUserPrompt(m)).length;
-            results.push({
-                id: parsed.id,
-                startedAt: parsed.started_at,
-                lastTurnAt: parsed.last_turn_at,
-                skill: parsed.skill,
-                sapSystem: parsed.sap_system,
-                filename: f,
-                interrupted: parsed.turnInterrupted === true,
-                interruptedReason: parsed.turnInterruptedReason ?? null,
-                promptSnippet,
-                userTurnCount,
-            });
-        }
-        catch { /* skip corrupt */ }
+        const s = await summaryOf(path.join(dir, f), f);
+        if (!s)
+            continue;
+        if (opts.here && !sessionMatchesFolder(s, opts.here, hereDirNorm))
+            continue;
+        // Round 6 review M1 — the picker drops 0-turn sessions (unless interrupted)
+        // BEFORE the limit, so a pile of start-then-quit files cannot crowd out
+        // the sessions worth resuming.
+        if (opts.skipEmpty && !(s.userTurnCount > 0 || s.interrupted))
+            continue;
+        results.push(s);
+        if (scanAll && results.length >= limit)
+            break;
     }
     results.sort((a, b) => b.lastTurnAt.localeCompare(a.lastTurnAt));
-    // Round 6 review M1 — the picker drops 0-turn sessions (unless interrupted)
-    // BEFORE the limit, so a pile of start-then-quit files cannot crowd out
-    // the sessions worth resuming.
-    const kept = opts.skipEmpty ? results.filter((r) => r.userTurnCount > 0 || r.interrupted) : results;
-    return kept.slice(0, limit);
+    return results.slice(0, limit);
+}
+/** 2026-10-08 — the latest non-empty session of this folder (`--continue`), or null. */
+export async function latestSessionHere(here, opts = {}) {
+    const [s] = await listSessions(1, { here, skipEmpty: true, scanAll: opts.scanAll ?? false });
+    return s ?? null;
 }
 /**
  * Count interrupted sessions for the startup banner — among the sessions the
  * `--resume` picker can show (RESUME_PICKER_LIMIT most recent), so the
  * "! N unfinished sessions" notice never points at sessions the picker does
  * not list (fix round 3, item 11d). Returns 0 on any IO failure.
+ * 2026-10-08 — with `here`, only that folder's sessions count.
  */
-export async function countInterruptedSessions() {
+export async function countInterruptedSessions(here) {
     try {
         // Round 8 item 7 — a turn the USER stopped (Ctrl+C, /exit mid-turn) is
         // not unfinished work: counting it kept "! 1 unfinished session" on every
         // start until that session happened to finish a turn. The picker still
         // lists it as "Stopped by you".
-        return (await listSessions(RESUME_PICKER_LIMIT))
+        return (await listSessions(RESUME_PICKER_LIMIT, here ? { here } : {}))
             .filter((s) => s.interrupted && !isUserStopReason(s.interruptedReason)).length;
     }
     catch {

package/dist/skill-catalog.js

@@ -168,8 +168,8 @@ export const SKILL_CATALOG = [
     {
         name: 'abap-cca',
         category: 'Upgrade / Migrate',
-        description: 'Custom code analysis pipeline for S/4 upgrade — whole-estate inventory + tier classification + ATC findings + report. Multi-session project with state file.',
-        whenToUse: `pick this to discover + classify the whole custom estate (not /abap-migrate — that's per object)`,
+        description: 'Reads the estate inventory the lead pulled; proposes scope, areas, retire candidates and next commands; read-only.',
+        whenToUse: `pick this after cspeach team discover, to choose packages, lanes and a first focus (not /abap-migrate — that's per object)`,
         asks: 'which package or namespace? e.g. "Z*" or "package ZTEST_LAS"',
     },
     {

package/dist/skills/bundled-skills.js

@@ -1,6 +1,6 @@
 // GENERATED FILE — bundled skills for local mode.
 // Source: https://manifest.cspeach.dev/v1.json
-// Generated: 2026-10-06T20:59:01.468Z
+// Generated: 2026-10-09T00:51:14.599Z
 // Manifest signature verified at build time.
 export const BUNDLED_SKILLS = {
     "abap-app": {

package/dist/tools/_filesystem-shared.js

@@ -10,6 +10,7 @@
 import * as path from 'node:path';
 import { promises as fsPromises, realpathSync, existsSync } from 'node:fs';
 import { cspeachRoot, defaultCspeachRoot } from '../config/paths.js';
+import { SAFE_PROJECT_ID } from '../projects/project-folder.js';
 /**
  * Phase 3 sensitive in-root directory prefixes — refused by all filesystem
  * tools. Matched as `rel === prefix` or `rel` starts with `prefix + '/'`.
@@ -190,21 +191,21 @@ function relIsDenylisted(rel) {
  * so the caller must fail closed — `{ failClosed: true }`. Returns null only
  * when nothing up to the drive root exists.
  */
-function longNameAbs(absPath) {
-    let cur = path.win32.resolve(absPath);
+function longNameAbs(absPath, p = path.win32) {
+    let cur = p.resolve(absPath);
     const tail = [];
     for (;;) {
         try {
             const real = realpathSync.native(cur);
-            return { abs: tail.length ? path.win32.join(real, ...tail) : real };
+            return { abs: tail.length ? p.join(real, ...tail) : real };
         }
         catch (err) {
             if (err?.code !== 'ENOENT')
                 return { failClosed: true };
-            const parent = path.win32.dirname(cur);
+            const parent = p.dirname(cur);
             if (parent === cur)
                 return null;
-            tail.unshift(path.win32.basename(cur));
+            tail.unshift(p.basename(cur));
             cur = parent;
         }
     }
@@ -259,6 +260,140 @@ function isUnderCliHome(absPath, p, native) {
     }
     return false;
 }
+/**
+ * The segments of `abs` below `<cspeachRoot()>/work/<SAFE id>/.cspeach/`
+ * (lowercased on win32), or null when `abs` is not there under the spelled or
+ * the real seat. Null also for ANY segment below the seat that is empty, `.`,
+ * `..`, carries ':' (stream), '~' (possible 8.3 name), a trailing dot/space,
+ * is `.git`, or is a Windows device name — fail closed, never decoded.
+ * Pure string logic on the seat's two spellings; callers pass both the spelled
+ * and the real form of the path.
+ */
+function seatTail(abs, p, isWin) {
+    const cmp = seatSegs(abs, p, isWin);
+    if (!cmp || cmp.length < 4 || cmp[0] !== 'work' || !SAFE_PROJECT_ID.test(cmp[1]) || cmp[2] !== '.cspeach')
+        return null;
+    return cmp.slice(3);
+}
+/** The checked segments of `abs` below the seat (see seatTail), or null. */
+function seatSegs(abs, p, isWin) {
+    const seat = cspeachRoot();
+    const seats = [p.resolve(seat)];
+    const realSeat = realDirOrNull(seat);
+    if (realSeat && !seats.includes(realSeat))
+        seats.push(realSeat);
+    for (const s of seats) {
+        const rel = p.relative(s, abs).replace(/\\/g, '/');
+        if (rel === '' || !relIsInside(p, rel))
+            continue;
+        const segs = rel.split('/');
+        const bad = (seg) => seg === '' || seg === '.' || seg === '..' || seg.includes(':') || seg.includes('~')
+            || ntfsCanonicalSegment(seg) !== seg || seg.toLowerCase() === '.git' || (isWin && isWindowsReservedName(seg));
+        if (segs.some(bad))
+            return null;
+        return isWin ? segs.map((x) => x.toLowerCase()) : segs;
+    }
+    return null;
+}
+/**
+ * Fix round 1 (security review) — the anchor. The REAL path of `root`, and
+ * the real `absPath` relative to it ('/'-separated), when the real root is
+ * exactly a seat work root `<cspeachRoot()>/work/<SAFE id>` AND the real
+ * form of `absPath` sits inside it; else null. The seat opening applies only
+ * then: a session started in the home folder, its parent, a team folder or
+ * the seat itself never reaches a seat file through the file tools.
+ */
+function workRootFor(root, absPath, platform) {
+    const r = spelledAndReal(root, platform);
+    const a = spelledAndReal(absPath, platform);
+    if (!r || !a)
+        return null;
+    const realRoot = r.forms[1];
+    const segs = seatSegs(realRoot, r.p, r.isWin);
+    if (!segs || segs.length !== 2 || segs[0] !== 'work' || !SAFE_PROJECT_ID.test(segs[1]))
+        return null;
+    const rel = r.p.relative(realRoot, a.forms[1]).replace(/\\/g, '/');
+    return rel !== '' && relIsInside(r.p, rel) ? { root: realRoot, rel } : null;
+}
+/**
+ * Both forms of `absPath` — as spelled, and real (nearest existing ancestor
+ * realpath'd, which also expands 8.3 names; missing tail re-attached) — or
+ * null when the real form cannot be known (any lookup error but "does not
+ * exist", or a platform other than the one we run on): fail closed.
+ */
+function spelledAndReal(absPath, platform) {
+    if (platform !== process.platform)
+        return null;
+    const isWin = platform === 'win32';
+    const p = isWin ? path.win32 : path.posix;
+    const spelled = p.resolve(absPath);
+    const real = longNameAbs(spelled, p);
+    if (!real || 'failClosed' in real)
+        return null;
+    return { p, isWin, forms: [spelled, real.abs] };
+}
+/**
+ * Task 14 (2026-10-08) — the ONE opening in the CLI home for the file tools:
+ * true only when `absPath`, spelled AND real, is strictly inside
+ * `<cspeachRoot()>/work/<id>/.cspeach/<sub>/` with `<id>` matching
+ * SAFE_PROJECT_ID and `<sub>` in CSPEACH_WORK_SUBDIRS; no segment below the
+ * seat carries ':' / '~' / a trailing dot or space / `.git` / a device name;
+ * the basename is not a `*.cspeach.json` envelope and not `.env*`. A link
+ * anywhere on the way (a junction to the seat, to sessions, out of the seat)
+ * fails it, because the real form must match too. Only the seat CSPEACH_HOME
+ * chose opens — never `~/.cspeach` when CSPEACH_HOME names another seat.
+ */
+export function isSeatWorkPath(absPath, platform = process.platform) {
+    const both = spelledAndReal(absPath, platform);
+    if (!both)
+        return false;
+    return both.forms.every((form) => {
+        const tail = seatTail(form, both.p, both.isWin);
+        if (!tail || tail.length < 2 || !CSPEACH_WORK_SUBDIRS.includes(tail[0]))
+            return false;
+        const base = tail[tail.length - 1];
+        return !base.toLowerCase().endsWith('.cspeach.json') && !BLOCKED_BASENAME_RE.test(base);
+    });
+}
+/**
+ * Task 14 — the READ-ONLY seat shapes: a saved result directly in the seat
+ * working folder, `<cspeachRoot()>/work/<id>/.cspeach/<name>.cspeach.json`,
+ * or a lane decision, `<cspeachRoot()>/work/<id>/.cspeach/lane/<name>.json`.
+ * Same rules as isSeatWorkPath (spelled AND real, fail closed). The write
+ * tools never consult this.
+ */
+export function isSeatReadOnlyFile(absPath, platform = process.platform) {
+    const both = spelledAndReal(absPath, platform);
+    if (!both)
+        return false;
+    return both.forms.every((form) => {
+        const tail = seatTail(form, both.p, both.isWin);
+        if (!tail)
+            return false;
+        const base = tail[tail.length - 1];
+        if (BLOCKED_BASENAME_RE.test(base))
+            return false;
+        if (tail.length === 1)
+            return /\.cspeach\.json$/i.test(base);
+        return tail.length === 2 && tail[0] === 'lane' && /\.json$/i.test(base);
+    });
+}
+/**
+ * True when `absPath` — spelled or real (nearest existing ancestor) — is the
+ * CLI home (`cspeachRoot()` or `~/.cspeach`) or below it. Fails closed: a path
+ * whose real form cannot be known counts as inside.
+ */
+export function isCliHomePath(absPath, platform = process.platform) {
+    const isWin = platform === 'win32';
+    const p = isWin ? path.win32 : path.posix;
+    const native = platform === process.platform;
+    if (isUnderCliHome(p.resolve(absPath), p, native))
+        return true;
+    const both = spelledAndReal(absPath, platform);
+    if (!both)
+        return true;
+    return isUnderCliHome(both.forms[1], p, native);
+}
 /**
  * True if `realAbsPath` is denylisted relative to root — either it falls under
  * one of BLOCKED_PREFIXES (directory prefixes) or its basename is in the
@@ -286,6 +421,17 @@ function isUnderCliHome(absPath, p, native) {
  * also when the CLI runs from `C:\Users`, `C:\` or `/home`, where it is not a
  * root-level `.cspeach`. The carve-out does not apply there.
  *
+ * ONE ANCHORED EXCEPTION (Task 14, 2026-10-08): a team seat's working files,
+ * `<cspeachRoot()>/work/<SAFE id>/.cspeach/<cca|upgrades|modernize|tests>/…`
+ * (isSeatWorkPath: spelled AND real path, no stream / '~' / trailing dot or
+ * space / .git / device-name segment, no *.cspeach.json, no .env*), are
+ * readable and writable ONLY when the REAL root is exactly that path's work
+ * root `<cspeachRoot()>/work/<id>` (workRootFor). The path is then judged
+ * relative to the real work root alone, with every rule below still applied.
+ * Any other root — the home folder, its parent, a team folder, the seat, a
+ * sibling work root — keeps the whole CLI home blocked, so a project run from
+ * the home folder gets nothing.
+ *
  * WINDOWS NAME ALIASES (SEC fix, `.git::$INDEX_ALLOCATION`). NTFS opens the
  * same object under spellings that do not byte-match the denylist:
  *   - stream suffixes: `.git::$INDEX_ALLOCATION`, `.git:$I30:$INDEX_ALLOCATION`,
@@ -338,10 +484,19 @@ export function isDenylistedPath(realAbsPath, root, platform = process.platform)
                 relFromRoot = realRel;
         }
     }
+    // The CLI home is protected whatever the root — except exactly the seat
+    // working subfolders (isSeatWorkPath), and only when the real root IS that
+    // path's work root (workRootFor). Then the path is judged relative to the
+    // real work root alone (a root spelled through a link, on another drive or
+    // a share, cannot change the verdict).
+    if (isUnderCliHome(realAbsPath, p, native)) {
+        const work = isSeatWorkPath(realAbsPath, platform) ? workRootFor(root, realAbsPath, platform) : null;
+        if (work === null)
+            return { blocked: true, relFromRoot };
+        relFromRoot = work.rel;
+        rels.splice(0, rels.length, work.rel);
+    }
     const blocked = { blocked: true, relFromRoot };
-    // The CLI home is protected whatever the root.
-    if (isUnderCliHome(realAbsPath, p, native))
-        return blocked;
     for (const rel of rels) {
         const segments = rel.split('/');
         // (1) win32: an NTFS stream / stream-type suffix anywhere → refuse.
@@ -389,7 +544,11 @@ export function isDenylistedPath(realAbsPath, root, platform = process.platform)
  *
  * Narrow by construction — true only when ALL hold:
  *   - the path is NOT under the CLI home (`~/.cspeach`: auth, config, sessions),
- *     whatever the root (a project run from the home folder gets nothing);
+ *     whatever the root (a project run from the home folder gets nothing) —
+ *     with ONE anchored exception (Task 14): the seat shapes
+ *     `<cspeachRoot()>/work/<id>/.cspeach/<name>.cspeach.json` and
+ *     `.cspeach/lane/<name>.json` (isSeatReadOnlyFile), only when the REAL
+ *     root is exactly that file's work root `<cspeachRoot()>/work/<id>`;
  *   - it sits inside the spelled root, at exactly one of the two shapes above
  *     (no deeper nesting, no other `.cspeach` file such as conventions.toml);
  *   - no NTFS alias spelling: no ':' segment, no trailing dot/space segment,
@@ -401,8 +560,11 @@ export function isReadOnlyProjectFile(realAbsPath, root, platform = process.plat
     const isWin = platform === 'win32';
     const native = platform === process.platform;
     const p = isWin ? path.win32 : path.posix;
-    if (isUnderCliHome(realAbsPath, p, native))
-        return false;
+    // Under the CLI home only the two read-only seat shapes (Task 14), and only
+    // when the real root IS that file's work root (fix round 1).
+    if (isUnderCliHome(realAbsPath, p, native)) {
+        return isSeatReadOnlyFile(realAbsPath, platform) && workRootFor(root, realAbsPath, platform) !== null;
+    }
     const rel = p.relative(p.resolve(root), realAbsPath).replace(/\\/g, '/');
     if (!relIsInside(p, rel) || rel === '')
         return false;
@@ -483,7 +645,7 @@ export function isInsideRoot(target, root) {
  * Real form of a folder that may not exist yet: nearest existing ancestor
  * realpath'd, missing tail re-attached. null on any non-ENOENT error.
  */
-function realOfNearestOrNull(abs) {
+export function realOfNearestOrNull(abs) {
     let cur = abs;
     const tail = [];
     for (;;) {

package/dist/tools/_team-work-path.js

@@ -0,0 +1,133 @@
+// cspeach-cli/src/tools/_team-work-path.ts
+/**
+ * Task 15 (2026-10-08 sessions/folders) — in a TEAM folder (a shared folder
+ * holding cspeach-team.json) the skills' personal working files,
+ * `.cspeach/<cca|upgrades|modernize|tests>/…`, belong to the person's seat
+ * work root `<CSPEACH_HOME>/work/<projectId>`, not to the shared folder.
+ *
+ * teamWorkTarget is a PURE path mapper: it picks the root a file tool should
+ * work against and hands back the same relative path. It opens nothing on its
+ * own — every tool still runs its full pipeline (resolveSafePath containment,
+ * real-path checks, denylist, write checks) against the root it returns, and
+ * the seat opening in the denylist applies only when that root is exactly the
+ * work root.
+ *
+ *   solo / home folder           → { root: cwd, path: userPath } (unchanged)
+ *   team folder, `.cspeach/<sub>` → { root: workRoot, path: <same relative path> }
+ *   team folder, anything else   → { root: cwd, path: userPath } (unchanged)
+ *
+ * The `.cspeach/<sub>` test compares each segment the way Windows opens it
+ * (case-insensitive, `:stream` and trailing dots/spaces dropped), so an alias
+ * spelling never slips a working file into the shared folder; in the seat the
+ * denylist then refuses the alias outright.
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import * as path from 'node:path';
+import { CSPEACH_WORK_SUBDIRS } from './_filesystem-shared.js';
+import { resolveProjectFolderSync } from '../projects/project-folder.js';
+/** A segment as NTFS resolves it for a name compare, lowercased. */
+function nameKey(seg) {
+    const colon = seg.indexOf(':');
+    return (colon === -1 ? seg : seg.slice(0, colon)).replace(/[. ]+$/, '').toLowerCase();
+}
+/** The seat work root when `cwd` is a team folder, else null. */
+export function teamWorkRoot(cwd) {
+    try {
+        const pf = resolveProjectFolderSync(cwd);
+        return pf.kind === 'team' ? pf.workRoot : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function teamWorkTarget(cwd, userPath) {
+    const same = { root: cwd, path: userPath };
+    if (typeof userPath !== 'string' || userPath.includes('\0'))
+        return same;
+    const workRoot = teamWorkRoot(cwd);
+    if (workRoot === null)
+        return same;
+    const absRoot = path.resolve(cwd);
+    const abs = path.isAbsolute(userPath) ? path.resolve(userPath) : path.resolve(absRoot, userPath);
+    const rel = path.relative(absRoot, abs);
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel))
+        return same;
+    return isWorkRel(rel) ? { root: workRoot, path: rel } : same;
+}
+/**
+ * Ruling 27 — the READ twin of teamWorkTarget, for file_read and glob only.
+ * Besides the working files it maps the two read-only shapes a save leaves in
+ * the seat — `.cspeach/<name>.cspeach.json` and `.cspeach/lane/<name>.json` —
+ * so reading your own saved results looks where they were saved, as in a solo
+ * folder. Writes never use this: those shapes stay CLI-owned.
+ */
+export function teamReadTarget(cwd, userPath) {
+    const same = { root: cwd, path: userPath };
+    const work = teamWorkTarget(cwd, userPath);
+    if (work.root !== cwd || typeof userPath !== 'string' || userPath.includes('\0'))
+        return work;
+    const workRoot = teamWorkRoot(cwd);
+    if (workRoot === null)
+        return same;
+    const absRoot = path.resolve(cwd);
+    const abs = path.isAbsolute(userPath) ? path.resolve(userPath) : path.resolve(absRoot, userPath);
+    const rel = path.relative(absRoot, abs);
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel))
+        return same;
+    if (!isReadOnlyRel(rel))
+        return same;
+    // Final fix wave, item 1 — a save made before this release sits in the
+    // shared <team>/.cspeach. The seat copy comes first; only when the seat has
+    // none and the shared one exists is the shared one read (read-only: the
+    // write tools never use this function).
+    if (!existsSync(path.join(workRoot, rel)) && existsSync(path.join(absRoot, rel)))
+        return same;
+    return { root: workRoot, path: rel };
+}
+/** True for `.cspeach/<name>.cspeach.json` or `.cspeach/lane/<name>.json` (either separator). */
+export function isReadOnlyRel(rel) {
+    const segs = rel.split(/[\\/]+/);
+    if (nameKey(segs[0] ?? '') !== '.cspeach')
+        return false;
+    if (segs.length === 2)
+        return /\.cspeach\.json$/i.test(nameKey(segs[1]));
+    return segs.length === 3 && nameKey(segs[1]) === 'lane' && /\.json$/i.test(nameKey(segs[2]));
+}
+/** True when a root-relative path (either separator) is `.cspeach/<work-subdir>` or below. */
+export function isWorkRel(rel) {
+    const segs = rel.split(/[\\/]+/);
+    return segs.length >= 2 && nameKey(segs[0]) === '.cspeach'
+        && CSPEACH_WORK_SUBDIRS.includes(nameKey(segs[1]));
+}
+/** Final fix wave, item 3 — the refusal for a write into the shared `.cspeach`. */
+export const SHARED_CSPEACH_REFUSAL = 'In a team folder, working files go to your own folder; this path points into the shared .cspeach.';
+/**
+ * True when `cwd` is a team folder and the REAL landing path of a write
+ * (links followed, 8.3 names expanded) is inside the shared `<team>/.cspeach`
+ * — whatever spelling, junction or short name got it there. Only refuses;
+ * never maps anything.
+ */
+export function pointsIntoSharedCspeach(cwd, realTarget) {
+    if (teamWorkRoot(cwd) === null)
+        return false;
+    const absRoot = path.resolve(cwd);
+    const realOf = (p) => { try {
+        return realpathSync.native(p);
+    }
+    catch {
+        return null;
+    } };
+    const relUnder = (base) => {
+        const rel = path.relative(base, realTarget);
+        return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)) ? rel : null;
+    };
+    const realShared = realOf(path.join(absRoot, '.cspeach'));
+    if (realShared !== null && relUnder(realShared) !== null)
+        return true;
+    for (const base of new Set([absRoot, realOf(absRoot) ?? absRoot])) {
+        const rel = relUnder(base);
+        if (rel !== null && rel !== '' && nameKey(rel.split(/[\\/]+/)[0]) === '.cspeach')
+            return true;
+    }
+    return false;
+}

package/dist/tools/approval.js

@@ -284,8 +284,14 @@ registerTool({
             sapCfg = cfg.sap[ctx.sapAlias];
             riskCtx.autoApprovePolicy = sapCfg?.auto_approve ?? 'never';
         }
+        // 1.1.31 (owner, 2026-10-07): a package or transport always gets a person's
+        // yes. Live, auto_approve="low" let the model's own "low" create package
+        // ZCC_FIX_PROOF and request S4HK903757 with no card. The plan-grant path
+        // above is separate and unchanged (a plan the person approved may carry
+        // its one new transport).
+        const touchesInfra = changes.some((c) => INFRA_BASE_OBJECT_TYPES.has((c.type ?? '').trim().toUpperCase()));
         // Auto-approve caps — never auto-approve at high, cap change count per risk level.
-        const autoApproveAllowed = !guardedRun && !qasNoAutoApprove && ((sapCfg?.auto_approve === 'low' && eff.level === 'low' && changes.length <= 5) ||
+        const autoApproveAllowed = !guardedRun && !qasNoAutoApprove && !touchesInfra && ((sapCfg?.auto_approve === 'low' && eff.level === 'low' && changes.length <= 5) ||
             (sapCfg?.auto_approve === 'medium' && (eff.level === 'low' || eff.level === 'medium') && changes.length <= 2));
         if (autoApproveAllowed) {
             const ids = [];