@cspeach/cli 1.1.30 → 1.1.32

package/dist/projects/project-folder.js

@@ -0,0 +1,131 @@
+// src/projects/project-folder.ts
+/**
+ * The ONE rule for where a person's project files go (spec 2026-10-08 §3.1).
+ *
+ *   solo → <cwd>/.cspeach                         (the folder you start in)
+ *   team → <CSPEACH_HOME>/work/<projectId>/.cspeach (private to this seat; the
+ *          shared team files stay in the team folder, untouched)
+ *   home → ~/CSPeach/.cspeach                     (never the CLI home itself)
+ *
+ * No git walk. `workspace_folder` is ignored. Markers describe the folder;
+ * they never move the save location to another folder the person can see.
+ */
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, renameSync, realpathSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import toml from '@iarna/toml';
+import { cspeachRoot, configFile } from '../config/paths.js';
+export const SAFE_PROJECT_ID = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const TEAM_FILE = 'cspeach-team.json';
+const ID_FILE = 'project.json';
+const real = (p) => { try {
+    return realpathSync.native(p);
+}
+catch {
+    return path.resolve(p);
+} };
+const key = (p) => { const r = real(p).replace(/[\\/]+$/, ''); return process.platform === 'win32' ? r.toLowerCase() : r; };
+/** The team project id when `cwd` holds a valid cspeach-team.json, else null. */
+export function teamProjectId(cwd) {
+    try {
+        const raw = readFileSync(path.join(cwd, TEAM_FILE), 'utf8');
+        const p = JSON.parse(raw.charCodeAt(0) === 0xfeff ? raw.slice(1) : raw);
+        if (p?.kind !== 'team-project' || typeof p.projectId !== 'string')
+            return null;
+        return SAFE_PROJECT_ID.test(p.projectId) ? p.projectId : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function readSoloProjectId(cwd) {
+    try {
+        const p = JSON.parse(readFileSync(path.join(cwd, '.cspeach', ID_FILE), 'utf8'));
+        return typeof p?.id === 'string' && /^[0-9a-f]{8}$/.test(p.id) ? p.id : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveProjectFolderSync(cwd) {
+    const projectDir = path.resolve(cwd);
+    const teamId = existsSync(path.join(projectDir, TEAM_FILE)) ? teamProjectId(projectDir) : null;
+    if (teamId) {
+        const workRoot = path.join(cspeachRoot(), 'work', teamId);
+        return { kind: 'team', projectDir, workRoot, workDir: path.join(workRoot, '.cspeach'), projectId: teamId };
+    }
+    const isHome = key(projectDir) === key(os.homedir()) || key(path.join(projectDir, '.cspeach')) === key(cspeachRoot());
+    if (isHome) {
+        const workRoot = path.join(os.homedir(), 'CSPeach');
+        return { kind: 'home', projectDir, workRoot, workDir: path.join(workRoot, '.cspeach'), projectId: readSoloProjectId(workRoot) };
+    }
+    return { kind: 'solo', projectDir, workRoot: projectDir, workDir: path.join(projectDir, '.cspeach'), projectId: readSoloProjectId(projectDir) };
+}
+export async function resolveProjectFolder(cwd) {
+    return resolveProjectFolderSync(cwd);
+}
+/** Create `<workDir>/project.json` on first use (tmp + rename); return the id. */
+export function ensureProjectId(workDir, now = () => new Date(), rand = (n) => randomBytes(n).toString('hex')) {
+    const file = path.join(workDir, ID_FILE);
+    const existing = readSoloProjectId(path.dirname(workDir));
+    if (existing)
+        return existing;
+    mkdirSync(workDir, { recursive: true });
+    const id = rand(4);
+    writeFileSync(`${file}.tmp`, `${JSON.stringify({ id, createdAt: now().toISOString() }, null, 2)}\n`);
+    renameSync(`${file}.tmp`, file);
+    return id;
+}
+/** The pre-1.1.31 git-root walk — kept ONLY to find old files (read-only, this release). */
+function oldGitRoot(startDir) {
+    let dir = startDir;
+    for (let i = 0; i < 200; i++) {
+        if (existsSync(path.join(dir, '.git')))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+    return null;
+}
+const holdsEnvelopes = (dir) => {
+    try {
+        return readdirSync(dir).some((n) => n.endsWith('.cspeach.json'));
+    }
+    catch {
+        return false;
+    }
+};
+function oldWorkspaceFolder() {
+    try {
+        const parsed = toml.parse(readFileSync(configFile(), 'utf8'));
+        const v = parsed.workspace_folder?.trim();
+        if (!v)
+            return null;
+        return v === '~' || v.startsWith('~/') ? path.join(os.homedir(), v.slice(v === '~' ? 1 : 2)) : path.resolve(v);
+    }
+    catch {
+        return null;
+    }
+}
+/** Old save locations that still hold project files. Read-only use only. */
+export function legacyDirsFor(cwd) {
+    const pf = resolveProjectFolderSync(cwd);
+    const mine = key(pf.workDir);
+    const out = [];
+    const add = (d) => {
+        if (d && key(d) !== mine && holdsEnvelopes(d) && !out.some((o) => key(o) === key(d)))
+            out.push(d);
+    };
+    // A team folder's saves before this release went to <team>/.cspeach.
+    if (pf.kind === 'team')
+        add(path.join(pf.projectDir, '.cspeach'));
+    const g = oldGitRoot(pf.projectDir);
+    if (g && key(g) !== key(pf.projectDir))
+        add(path.join(g, '.cspeach'));
+    add(oldWorkspaceFolder());
+    add(cspeachRoot());
+    return out;
+}

package/dist/projects/promote-command.js

@@ -1,7 +1,42 @@
+import { realpathSync } from 'node:fs';
 import { readProjectFile } from './status.js';
 import { buildPromotedFromSnapshot, buildReviewDecisionsBlock, buildDetailPathHint, validatePromotionSource } from './promote.js';
 import { resolveAtTokenAsync, formatProjectFileList } from './workspace.js';
 import { askYesNo } from './yes-no.js';
+import path from 'node:path';
+import { cspeachRoot } from '../config/paths.js';
+import { isCliHomePath, isSeatReadOnlyFile } from '../tools/_filesystem-shared.js';
+/**
+ * Task 14 — a `--from` source inside the CLI home is read only in an explicit
+ * shape: the read-only seat shape (`<seat>/work/<id>/.cspeach/<name>.cspeach.json`)
+ * or an envelope directly in the CLI home (the earlier save location this
+ * release still lists). Config, keys, sessions, snapshots and every other
+ * file there stay out of reach. Spelled and real paths are both judged.
+ */
+function cliHomeSourceAllowed(abs) {
+    if (!isCliHomePath(abs))
+        return true;
+    if (isSeatReadOnlyFile(abs))
+        return true;
+    return directHomeEnvelope(abs) && directHomeEnvelope(realOr(abs));
+}
+function directHomeEnvelope(p) {
+    if (p === null)
+        return false;
+    const base = path.basename(p);
+    if (!/^[^:~]+\.cspeach\.json$/i.test(base) || /[. ]$/.test(base))
+        return false;
+    const k = (x) => (process.platform === 'win32' ? x.toLowerCase() : x);
+    return [cspeachRoot(), realOr(cspeachRoot())].some((h) => h !== null && k(path.dirname(p)) === k(h));
+}
+function realOr(p) {
+    try {
+        return realpathSync.native(p);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Per-skill predecessor map. v0.7 admits multi-source via array values —
  * e.g. /abap-upgrade-fix accepts BOTH upgrade-scan (the existing chain
@@ -66,6 +101,10 @@ export async function runPromoteCommand(args) {
         args.log(`Use a more specific @<fragment> to disambiguate.`);
         return null;
     }
+    if (!cliHomeSourceAllowed(path.resolve(args.cwd ?? process.cwd(), resolvedPath))) {
+        args.log(`--from: ${resolvedPath} is inside CSPeach's own folder and cannot be read.`);
+        return null;
+    }
     let env;
     try {
         env = readProjectFile(resolvedPath);

package/dist/projects/save-command.js

@@ -18,6 +18,7 @@ import { saveProject } from './save.js';
 import { formatSavedLines } from './saved-lines.js';
 import { writePlanHandover } from './handover-md.js';
 import { ensureWorkspace, resolveWorkspacePath } from './workspace.js';
+import { resolveProjectFolderSync, ensureProjectId } from './project-folder.js';
 import { askYesNo, isYes } from './yes-no.js';
 import { checkLaneConsistency, checkRequiredDeploy, LANE_CHANGED_AT_CREATE, readPlanLane } from './plan-lane.js';
 import { specGapRefForSave } from './plan-sources.js';
@@ -384,19 +385,57 @@ export async function runSaveCommand(args) {
     // run confirms no row. Any further question routed through `prompt` would
     // silently receive 'y' too: give maybeOfferSave's headless prompt a
     // question-aware answer first.
-    const answer = await askYesNo({ question: 'Save as project file?', confirm: args.confirm, prompt: args.prompt });
+    // Inside a journey a triage is saved without the question: the journey needs the rows.
+    const journey = spec.artefactType === 'clean-core-decision' ? args.journey : undefined;
+    const answer = journey ? 'y' : await askYesNo({ question: 'Save as project file?', confirm: args.confirm, prompt: args.prompt });
     if (!isYes(answer)) {
         args.onNotSaved?.('declined');
         return null;
     }
     // 2026-10-06 — a clean-core triage becomes team project decisions only row by
     // row, each on its own Yes. Without a joined team project nothing is asked.
+    let tally;
     if (spec.artefactType === 'clean-core-decision') {
-        const { confirmCleanCoreRows } = await import('./clean-core-confirm.js');
+        const { confirmCleanCoreRows, decideCleanCoreRows } = await import('./clean-core-confirm.js');
         const { activeProject } = await import('../register/store.js');
-        extract = await confirmCleanCoreRows(extract, {
-            ...(args.confirm ? { confirm: args.confirm } : {}), log: args.log, joined: activeProject() !== null,
-        });
+        const project = activeProject();
+        const joined = project !== null;
+        // Step 2 (D6): the rule that decides each row, said on its card. Never blocks a save: unreadable → no rule line.
+        let rules;
+        if (project) {
+            try {
+                const { ruleProposalsFor } = await import('../register/decision-rules.js');
+                const r = ruleProposalsFor(project.projectDir, project.outboxDir);
+                rules = r.lookup;
+                // Inside a journey no file name is said (Task 7); the triage tool carries the warning to the model.
+                if (r.warning && !journey)
+                    args.log(r.warning);
+            }
+            catch {
+                // No rule can be read: every row is CSPeach's judgement, so a "Rule <id>:" the model wrote is taken off (review 9 #2).
+                rules = () => null;
+            }
+        }
+        if (journey && joined) {
+            // Guided journey: [Yes] [Keep as is] [Skip] per row.
+            const r = await decideCleanCoreRows(extract, {
+                card: journey.card, ask: journey.ask, skip: journey.skip, log: args.log, ...(rules ? { rules } : {}),
+            });
+            extract = r.extract;
+            tally = r.tally;
+        }
+        else {
+            if (journey) {
+                // Inside a journey: no team words, no command to type (Task 7).
+                const { JOURNEY_NOT_IN_PROJECT_LINE } = await import('./clean-core-confirm.js');
+                args.log(JOURNEY_NOT_IN_PROJECT_LINE);
+            }
+            else {
+                extract = await confirmCleanCoreRows(extract, {
+                    ...(args.confirm ? { confirm: args.confirm } : {}), log: args.log, joined, ...(rules ? { rules } : {}),
+                });
+            }
+        }
     }
     let env;
     if (planExtract && prior) {
@@ -436,6 +475,17 @@ export async function runSaveCommand(args) {
     let outDir;
     try {
         outDir = await ensureWorkspace();
+        // 2026-10-08 — the first save writes .cspeach/project.json (solo/home);
+        // a team folder uses its team id. Never fails the save.
+        try {
+            const pf = resolveProjectFolderSync(process.cwd());
+            const projectId = pf.kind === 'team' ? pf.projectId : ensureProjectId(pf.workDir);
+            try {
+                args.onProjectId?.(projectId);
+            }
+            catch { /* tagging is best-effort */ }
+        }
+        catch { /* id file is best-effort */ }
     }
     catch {
         outDir = args.cwd;
@@ -450,7 +500,9 @@ export async function runSaveCommand(args) {
         writePlanHandover(path, args.log);
     // 1.1.28 — two plain lines; the old suggested-email block is gone (saved-lines.ts).
     const [savedLine, reviewLine] = formatSavedLines(path, args.cwd);
-    args.log(savedLine);
+    // Inside a journey the file is plumbing: the closing lines say what was recorded.
+    if (!journey)
+        args.log(savedLine);
     // Project Register (2026-09-18): when this laptop has joined a project, a
     // decision / fix record is written to the LOCAL outbox as a by-product of the
     // save. No project joined → `activeProject()` is one missing-file read and
@@ -460,27 +512,63 @@ export async function runSaveCommand(args) {
         const joined = activeProject();
         if (joined) {
             const { recordFromEnvelope } = await import('../register/records.js');
-            const res = recordFromEnvelope(env, path, joined, { name: joined.name ?? args.author.name }, args.cwd);
-            if (res?.file)
+            // Task 15 — detail files are read from where the skill wrote them: the
+            // seat work root in a team folder, the start folder otherwise. The
+            // record itself still goes to the shared outbox.
+            const res = recordFromEnvelope(env, path, joined, { name: joined.name ?? args.author.name }, resolveProjectFolderSync(args.cwd).workRoot);
+            if (tally) {
+                const { journeyRowLines } = await import('./clean-core-confirm.js');
+                for (const line of journeyRowLines(tally, res?.refused ?? []))
+                    args.log(line);
+            }
+            else if (res?.file)
                 args.log(`Recorded for team project ${joined.projectId}: ${res.written} objects → ${basename(res.file)}`);
             if (res?.file) {
                 const { regenerateWorkingList } = await import('../register/workbooks.js');
                 // The name the team project knows this laptop by (init --lead), as the team verbs use.
                 const sheet = regenerateWorkingList(joined, joined.name ?? args.author.name);
-                if (sheet.line)
+                if (journey) {
+                    const { journeyListLine } = await import('./clean-core-confirm.js');
+                    const line = journeyListLine(sheet.kind);
+                    if (line)
+                        args.log(line);
+                }
+                else if (sheet.line)
                     args.log(sheet.line.trimStart());
             }
             if (res?.refused.length) {
-                args.log(`Not recorded (${res.refused.length} not in the team project's object list): ${res.refused.slice(0, 5).join(', ')}${res.refused.length > 5 ? ', …' : ''}`);
+                args.log(`Not recorded (${res.refused.length} not in ${tally ? 'your project' : 'the team project'}'s object list): ${res.refused.slice(0, 5).join(', ')}${res.refused.length > 5 ? ', …' : ''}`);
             }
         }
     }
     catch (e) {
-        args.log(`(team project record not written: ${e instanceof Error ? e.message : String(e)})`);
+        if (journey) {
+            const { notRecordedLine } = await import('../journey/run.js');
+            args.log(notRecordedLine(e));
+        }
+        else
+            args.log(`(team project record not written: ${e instanceof Error ? e.message : String(e)})`);
     }
     if (planExtract && prior) {
         args.log(`(revision v${env.version} of the existing plan — version chain preserved, no new id)`);
     }
-    args.log(reviewLine);
+    if (!journey)
+        args.log(reviewLine);
+    if (journey && tally) {
+        if (tally.cancelled) {
+            journey.pause();
+        }
+        else if (journey.page?.length) {
+            // One triage per page: a row of the page the triage left out is put off
+            // until "carry on", so the journey moves on instead of asking it again — and says so.
+            const answered = new Set([...tally.yes, ...tally.kept.map((k) => k.key), ...tally.skipped]);
+            const left = journey.page.filter((k) => !answered.has(k.toUpperCase()));
+            if (left.length) {
+                journey.leaveForLater(left);
+                const { leftOutLine } = await import('./clean-core-confirm.js');
+                args.log(leftOutLine(left));
+            }
+        }
+    }
     return path;
 }

package/dist/projects/saved-lines.js

@@ -10,7 +10,8 @@
  *
  * Never prints a user name.
  */
-import { basename, dirname, join, resolve } from 'node:path';
+import { basename, dirname, resolve } from 'node:path';
+import { resolveProjectFolderSync } from './project-folder.js';
 function editorLabel() {
     const url = process.env.CSPEACH_EDITOR_URL?.trim();
     return url ? url : 'cspeach.dev/edit';
@@ -22,10 +23,23 @@ function sameDir(a, b) {
     };
     return norm(a) === norm(b);
 }
-/** `<file name> (in this project's .cspeach folder)` — or the folder, when elsewhere. */
+/**
+ * `<file name> (in <where>)` — names the folder kind (2026-10-08): this
+ * project's .cspeach folder (solo), your own working folder (team), or the
+ * home fallback folder with a hint. Anywhere else: the folder itself.
+ */
 export function savedLocation(savedPath, cwd) {
     const dir = dirname(savedPath);
-    const where = sameDir(dir, join(cwd, '.cspeach')) ? "this project's .cspeach folder" : dir;
+    const pf = resolveProjectFolderSync(cwd);
+    let where = dir;
+    if (sameDir(dir, pf.workDir)) {
+        if (pf.kind === 'solo')
+            where = "this project's .cspeach folder";
+        else if (pf.kind === 'team')
+            where = 'your own working folder for this team project, not shared';
+        else
+            where = `${dir} — start CSPeach in a project folder to keep projects apart`;
+    }
     return `${basename(savedPath)} (in ${where})`;
 }
 export function formatSavedLines(savedPath, cwd) {