@cspeach/cli 1.1.30 → 1.1.32

package/dist/tools/_filesystem-shared.js

@@ -10,6 +10,7 @@
 import * as path from 'node:path';
 import { promises as fsPromises, realpathSync, existsSync } from 'node:fs';
 import { cspeachRoot, defaultCspeachRoot } from '../config/paths.js';
+import { SAFE_PROJECT_ID } from '../projects/project-folder.js';
 /**
  * Phase 3 sensitive in-root directory prefixes — refused by all filesystem
  * tools. Matched as `rel === prefix` or `rel` starts with `prefix + '/'`.
@@ -190,21 +191,21 @@ function relIsDenylisted(rel) {
  * so the caller must fail closed — `{ failClosed: true }`. Returns null only
  * when nothing up to the drive root exists.
  */
-function longNameAbs(absPath) {
-    let cur = path.win32.resolve(absPath);
+function longNameAbs(absPath, p = path.win32) {
+    let cur = p.resolve(absPath);
     const tail = [];
     for (;;) {
         try {
             const real = realpathSync.native(cur);
-            return { abs: tail.length ? path.win32.join(real, ...tail) : real };
+            return { abs: tail.length ? p.join(real, ...tail) : real };
         }
         catch (err) {
             if (err?.code !== 'ENOENT')
                 return { failClosed: true };
-            const parent = path.win32.dirname(cur);
+            const parent = p.dirname(cur);
             if (parent === cur)
                 return null;
-            tail.unshift(path.win32.basename(cur));
+            tail.unshift(p.basename(cur));
             cur = parent;
         }
     }
@@ -259,6 +260,140 @@ function isUnderCliHome(absPath, p, native) {
     }
     return false;
 }
+/**
+ * The segments of `abs` below `<cspeachRoot()>/work/<SAFE id>/.cspeach/`
+ * (lowercased on win32), or null when `abs` is not there under the spelled or
+ * the real seat. Null also for ANY segment below the seat that is empty, `.`,
+ * `..`, carries ':' (stream), '~' (possible 8.3 name), a trailing dot/space,
+ * is `.git`, or is a Windows device name — fail closed, never decoded.
+ * Pure string logic on the seat's two spellings; callers pass both the spelled
+ * and the real form of the path.
+ */
+function seatTail(abs, p, isWin) {
+    const cmp = seatSegs(abs, p, isWin);
+    if (!cmp || cmp.length < 4 || cmp[0] !== 'work' || !SAFE_PROJECT_ID.test(cmp[1]) || cmp[2] !== '.cspeach')
+        return null;
+    return cmp.slice(3);
+}
+/** The checked segments of `abs` below the seat (see seatTail), or null. */
+function seatSegs(abs, p, isWin) {
+    const seat = cspeachRoot();
+    const seats = [p.resolve(seat)];
+    const realSeat = realDirOrNull(seat);
+    if (realSeat && !seats.includes(realSeat))
+        seats.push(realSeat);
+    for (const s of seats) {
+        const rel = p.relative(s, abs).replace(/\\/g, '/');
+        if (rel === '' || !relIsInside(p, rel))
+            continue;
+        const segs = rel.split('/');
+        const bad = (seg) => seg === '' || seg === '.' || seg === '..' || seg.includes(':') || seg.includes('~')
+            || ntfsCanonicalSegment(seg) !== seg || seg.toLowerCase() === '.git' || (isWin && isWindowsReservedName(seg));
+        if (segs.some(bad))
+            return null;
+        return isWin ? segs.map((x) => x.toLowerCase()) : segs;
+    }
+    return null;
+}
+/**
+ * Fix round 1 (security review) — the anchor. The REAL path of `root`, and
+ * the real `absPath` relative to it ('/'-separated), when the real root is
+ * exactly a seat work root `<cspeachRoot()>/work/<SAFE id>` AND the real
+ * form of `absPath` sits inside it; else null. The seat opening applies only
+ * then: a session started in the home folder, its parent, a team folder or
+ * the seat itself never reaches a seat file through the file tools.
+ */
+function workRootFor(root, absPath, platform) {
+    const r = spelledAndReal(root, platform);
+    const a = spelledAndReal(absPath, platform);
+    if (!r || !a)
+        return null;
+    const realRoot = r.forms[1];
+    const segs = seatSegs(realRoot, r.p, r.isWin);
+    if (!segs || segs.length !== 2 || segs[0] !== 'work' || !SAFE_PROJECT_ID.test(segs[1]))
+        return null;
+    const rel = r.p.relative(realRoot, a.forms[1]).replace(/\\/g, '/');
+    return rel !== '' && relIsInside(r.p, rel) ? { root: realRoot, rel } : null;
+}
+/**
+ * Both forms of `absPath` — as spelled, and real (nearest existing ancestor
+ * realpath'd, which also expands 8.3 names; missing tail re-attached) — or
+ * null when the real form cannot be known (any lookup error but "does not
+ * exist", or a platform other than the one we run on): fail closed.
+ */
+function spelledAndReal(absPath, platform) {
+    if (platform !== process.platform)
+        return null;
+    const isWin = platform === 'win32';
+    const p = isWin ? path.win32 : path.posix;
+    const spelled = p.resolve(absPath);
+    const real = longNameAbs(spelled, p);
+    if (!real || 'failClosed' in real)
+        return null;
+    return { p, isWin, forms: [spelled, real.abs] };
+}
+/**
+ * Task 14 (2026-10-08) — the ONE opening in the CLI home for the file tools:
+ * true only when `absPath`, spelled AND real, is strictly inside
+ * `<cspeachRoot()>/work/<id>/.cspeach/<sub>/` with `<id>` matching
+ * SAFE_PROJECT_ID and `<sub>` in CSPEACH_WORK_SUBDIRS; no segment below the
+ * seat carries ':' / '~' / a trailing dot or space / `.git` / a device name;
+ * the basename is not a `*.cspeach.json` envelope and not `.env*`. A link
+ * anywhere on the way (a junction to the seat, to sessions, out of the seat)
+ * fails it, because the real form must match too. Only the seat CSPEACH_HOME
+ * chose opens — never `~/.cspeach` when CSPEACH_HOME names another seat.
+ */
+export function isSeatWorkPath(absPath, platform = process.platform) {
+    const both = spelledAndReal(absPath, platform);
+    if (!both)
+        return false;
+    return both.forms.every((form) => {
+        const tail = seatTail(form, both.p, both.isWin);
+        if (!tail || tail.length < 2 || !CSPEACH_WORK_SUBDIRS.includes(tail[0]))
+            return false;
+        const base = tail[tail.length - 1];
+        return !base.toLowerCase().endsWith('.cspeach.json') && !BLOCKED_BASENAME_RE.test(base);
+    });
+}
+/**
+ * Task 14 — the READ-ONLY seat shapes: a saved result directly in the seat
+ * working folder, `<cspeachRoot()>/work/<id>/.cspeach/<name>.cspeach.json`,
+ * or a lane decision, `<cspeachRoot()>/work/<id>/.cspeach/lane/<name>.json`.
+ * Same rules as isSeatWorkPath (spelled AND real, fail closed). The write
+ * tools never consult this.
+ */
+export function isSeatReadOnlyFile(absPath, platform = process.platform) {
+    const both = spelledAndReal(absPath, platform);
+    if (!both)
+        return false;
+    return both.forms.every((form) => {
+        const tail = seatTail(form, both.p, both.isWin);
+        if (!tail)
+            return false;
+        const base = tail[tail.length - 1];
+        if (BLOCKED_BASENAME_RE.test(base))
+            return false;
+        if (tail.length === 1)
+            return /\.cspeach\.json$/i.test(base);
+        return tail.length === 2 && tail[0] === 'lane' && /\.json$/i.test(base);
+    });
+}
+/**
+ * True when `absPath` — spelled or real (nearest existing ancestor) — is the
+ * CLI home (`cspeachRoot()` or `~/.cspeach`) or below it. Fails closed: a path
+ * whose real form cannot be known counts as inside.
+ */
+export function isCliHomePath(absPath, platform = process.platform) {
+    const isWin = platform === 'win32';
+    const p = isWin ? path.win32 : path.posix;
+    const native = platform === process.platform;
+    if (isUnderCliHome(p.resolve(absPath), p, native))
+        return true;
+    const both = spelledAndReal(absPath, platform);
+    if (!both)
+        return true;
+    return isUnderCliHome(both.forms[1], p, native);
+}
 /**
  * True if `realAbsPath` is denylisted relative to root — either it falls under
  * one of BLOCKED_PREFIXES (directory prefixes) or its basename is in the
@@ -286,6 +421,17 @@ function isUnderCliHome(absPath, p, native) {
  * also when the CLI runs from `C:\Users`, `C:\` or `/home`, where it is not a
  * root-level `.cspeach`. The carve-out does not apply there.
  *
+ * ONE ANCHORED EXCEPTION (Task 14, 2026-10-08): a team seat's working files,
+ * `<cspeachRoot()>/work/<SAFE id>/.cspeach/<cca|upgrades|modernize|tests>/…`
+ * (isSeatWorkPath: spelled AND real path, no stream / '~' / trailing dot or
+ * space / .git / device-name segment, no *.cspeach.json, no .env*), are
+ * readable and writable ONLY when the REAL root is exactly that path's work
+ * root `<cspeachRoot()>/work/<id>` (workRootFor). The path is then judged
+ * relative to the real work root alone, with every rule below still applied.
+ * Any other root — the home folder, its parent, a team folder, the seat, a
+ * sibling work root — keeps the whole CLI home blocked, so a project run from
+ * the home folder gets nothing.
+ *
  * WINDOWS NAME ALIASES (SEC fix, `.git::$INDEX_ALLOCATION`). NTFS opens the
  * same object under spellings that do not byte-match the denylist:
  *   - stream suffixes: `.git::$INDEX_ALLOCATION`, `.git:$I30:$INDEX_ALLOCATION`,
@@ -338,10 +484,19 @@ export function isDenylistedPath(realAbsPath, root, platform = process.platform)
                 relFromRoot = realRel;
         }
     }
+    // The CLI home is protected whatever the root — except exactly the seat
+    // working subfolders (isSeatWorkPath), and only when the real root IS that
+    // path's work root (workRootFor). Then the path is judged relative to the
+    // real work root alone (a root spelled through a link, on another drive or
+    // a share, cannot change the verdict).
+    if (isUnderCliHome(realAbsPath, p, native)) {
+        const work = isSeatWorkPath(realAbsPath, platform) ? workRootFor(root, realAbsPath, platform) : null;
+        if (work === null)
+            return { blocked: true, relFromRoot };
+        relFromRoot = work.rel;
+        rels.splice(0, rels.length, work.rel);
+    }
     const blocked = { blocked: true, relFromRoot };
-    // The CLI home is protected whatever the root.
-    if (isUnderCliHome(realAbsPath, p, native))
-        return blocked;
     for (const rel of rels) {
         const segments = rel.split('/');
         // (1) win32: an NTFS stream / stream-type suffix anywhere → refuse.
@@ -389,7 +544,11 @@ export function isDenylistedPath(realAbsPath, root, platform = process.platform)
  *
  * Narrow by construction — true only when ALL hold:
  *   - the path is NOT under the CLI home (`~/.cspeach`: auth, config, sessions),
- *     whatever the root (a project run from the home folder gets nothing);
+ *     whatever the root (a project run from the home folder gets nothing) —
+ *     with ONE anchored exception (Task 14): the seat shapes
+ *     `<cspeachRoot()>/work/<id>/.cspeach/<name>.cspeach.json` and
+ *     `.cspeach/lane/<name>.json` (isSeatReadOnlyFile), only when the REAL
+ *     root is exactly that file's work root `<cspeachRoot()>/work/<id>`;
  *   - it sits inside the spelled root, at exactly one of the two shapes above
  *     (no deeper nesting, no other `.cspeach` file such as conventions.toml);
  *   - no NTFS alias spelling: no ':' segment, no trailing dot/space segment,
@@ -401,8 +560,11 @@ export function isReadOnlyProjectFile(realAbsPath, root, platform = process.plat
     const isWin = platform === 'win32';
     const native = platform === process.platform;
     const p = isWin ? path.win32 : path.posix;
-    if (isUnderCliHome(realAbsPath, p, native))
-        return false;
+    // Under the CLI home only the two read-only seat shapes (Task 14), and only
+    // when the real root IS that file's work root (fix round 1).
+    if (isUnderCliHome(realAbsPath, p, native)) {
+        return isSeatReadOnlyFile(realAbsPath, platform) && workRootFor(root, realAbsPath, platform) !== null;
+    }
     const rel = p.relative(p.resolve(root), realAbsPath).replace(/\\/g, '/');
     if (!relIsInside(p, rel) || rel === '')
         return false;
@@ -483,7 +645,7 @@ export function isInsideRoot(target, root) {
  * Real form of a folder that may not exist yet: nearest existing ancestor
  * realpath'd, missing tail re-attached. null on any non-ENOENT error.
  */
-function realOfNearestOrNull(abs) {
+export function realOfNearestOrNull(abs) {
     let cur = abs;
     const tail = [];
     for (;;) {

package/dist/tools/_team-work-path.js

@@ -0,0 +1,133 @@
+// cspeach-cli/src/tools/_team-work-path.ts
+/**
+ * Task 15 (2026-10-08 sessions/folders) — in a TEAM folder (a shared folder
+ * holding cspeach-team.json) the skills' personal working files,
+ * `.cspeach/<cca|upgrades|modernize|tests>/…`, belong to the person's seat
+ * work root `<CSPEACH_HOME>/work/<projectId>`, not to the shared folder.
+ *
+ * teamWorkTarget is a PURE path mapper: it picks the root a file tool should
+ * work against and hands back the same relative path. It opens nothing on its
+ * own — every tool still runs its full pipeline (resolveSafePath containment,
+ * real-path checks, denylist, write checks) against the root it returns, and
+ * the seat opening in the denylist applies only when that root is exactly the
+ * work root.
+ *
+ *   solo / home folder           → { root: cwd, path: userPath } (unchanged)
+ *   team folder, `.cspeach/<sub>` → { root: workRoot, path: <same relative path> }
+ *   team folder, anything else   → { root: cwd, path: userPath } (unchanged)
+ *
+ * The `.cspeach/<sub>` test compares each segment the way Windows opens it
+ * (case-insensitive, `:stream` and trailing dots/spaces dropped), so an alias
+ * spelling never slips a working file into the shared folder; in the seat the
+ * denylist then refuses the alias outright.
+ */
+import { existsSync, realpathSync } from 'node:fs';
+import * as path from 'node:path';
+import { CSPEACH_WORK_SUBDIRS } from './_filesystem-shared.js';
+import { resolveProjectFolderSync } from '../projects/project-folder.js';
+/** A segment as NTFS resolves it for a name compare, lowercased. */
+function nameKey(seg) {
+    const colon = seg.indexOf(':');
+    return (colon === -1 ? seg : seg.slice(0, colon)).replace(/[. ]+$/, '').toLowerCase();
+}
+/** The seat work root when `cwd` is a team folder, else null. */
+export function teamWorkRoot(cwd) {
+    try {
+        const pf = resolveProjectFolderSync(cwd);
+        return pf.kind === 'team' ? pf.workRoot : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function teamWorkTarget(cwd, userPath) {
+    const same = { root: cwd, path: userPath };
+    if (typeof userPath !== 'string' || userPath.includes('\0'))
+        return same;
+    const workRoot = teamWorkRoot(cwd);
+    if (workRoot === null)
+        return same;
+    const absRoot = path.resolve(cwd);
+    const abs = path.isAbsolute(userPath) ? path.resolve(userPath) : path.resolve(absRoot, userPath);
+    const rel = path.relative(absRoot, abs);
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel))
+        return same;
+    return isWorkRel(rel) ? { root: workRoot, path: rel } : same;
+}
+/**
+ * Ruling 27 — the READ twin of teamWorkTarget, for file_read and glob only.
+ * Besides the working files it maps the two read-only shapes a save leaves in
+ * the seat — `.cspeach/<name>.cspeach.json` and `.cspeach/lane/<name>.json` —
+ * so reading your own saved results looks where they were saved, as in a solo
+ * folder. Writes never use this: those shapes stay CLI-owned.
+ */
+export function teamReadTarget(cwd, userPath) {
+    const same = { root: cwd, path: userPath };
+    const work = teamWorkTarget(cwd, userPath);
+    if (work.root !== cwd || typeof userPath !== 'string' || userPath.includes('\0'))
+        return work;
+    const workRoot = teamWorkRoot(cwd);
+    if (workRoot === null)
+        return same;
+    const absRoot = path.resolve(cwd);
+    const abs = path.isAbsolute(userPath) ? path.resolve(userPath) : path.resolve(absRoot, userPath);
+    const rel = path.relative(absRoot, abs);
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel))
+        return same;
+    if (!isReadOnlyRel(rel))
+        return same;
+    // Final fix wave, item 1 — a save made before this release sits in the
+    // shared <team>/.cspeach. The seat copy comes first; only when the seat has
+    // none and the shared one exists is the shared one read (read-only: the
+    // write tools never use this function).
+    if (!existsSync(path.join(workRoot, rel)) && existsSync(path.join(absRoot, rel)))
+        return same;
+    return { root: workRoot, path: rel };
+}
+/** True for `.cspeach/<name>.cspeach.json` or `.cspeach/lane/<name>.json` (either separator). */
+export function isReadOnlyRel(rel) {
+    const segs = rel.split(/[\\/]+/);
+    if (nameKey(segs[0] ?? '') !== '.cspeach')
+        return false;
+    if (segs.length === 2)
+        return /\.cspeach\.json$/i.test(nameKey(segs[1]));
+    return segs.length === 3 && nameKey(segs[1]) === 'lane' && /\.json$/i.test(nameKey(segs[2]));
+}
+/** True when a root-relative path (either separator) is `.cspeach/<work-subdir>` or below. */
+export function isWorkRel(rel) {
+    const segs = rel.split(/[\\/]+/);
+    return segs.length >= 2 && nameKey(segs[0]) === '.cspeach'
+        && CSPEACH_WORK_SUBDIRS.includes(nameKey(segs[1]));
+}
+/** Final fix wave, item 3 — the refusal for a write into the shared `.cspeach`. */
+export const SHARED_CSPEACH_REFUSAL = 'In a team folder, working files go to your own folder; this path points into the shared .cspeach.';
+/**
+ * True when `cwd` is a team folder and the REAL landing path of a write
+ * (links followed, 8.3 names expanded) is inside the shared `<team>/.cspeach`
+ * — whatever spelling, junction or short name got it there. Only refuses;
+ * never maps anything.
+ */
+export function pointsIntoSharedCspeach(cwd, realTarget) {
+    if (teamWorkRoot(cwd) === null)
+        return false;
+    const absRoot = path.resolve(cwd);
+    const realOf = (p) => { try {
+        return realpathSync.native(p);
+    }
+    catch {
+        return null;
+    } };
+    const relUnder = (base) => {
+        const rel = path.relative(base, realTarget);
+        return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)) ? rel : null;
+    };
+    const realShared = realOf(path.join(absRoot, '.cspeach'));
+    if (realShared !== null && relUnder(realShared) !== null)
+        return true;
+    for (const base of new Set([absRoot, realOf(absRoot) ?? absRoot])) {
+        const rel = relUnder(base);
+        if (rel !== null && rel !== '' && nameKey(rel.split(/[\\/]+/)[0]) === '.cspeach')
+            return true;
+    }
+    return false;
+}

package/dist/tools/approval.js

@@ -284,8 +284,14 @@ registerTool({
             sapCfg = cfg.sap[ctx.sapAlias];
             riskCtx.autoApprovePolicy = sapCfg?.auto_approve ?? 'never';
         }
+        // 1.1.31 (owner, 2026-10-07): a package or transport always gets a person's
+        // yes. Live, auto_approve="low" let the model's own "low" create package
+        // ZCC_FIX_PROOF and request S4HK903757 with no card. The plan-grant path
+        // above is separate and unchanged (a plan the person approved may carry
+        // its one new transport).
+        const touchesInfra = changes.some((c) => INFRA_BASE_OBJECT_TYPES.has((c.type ?? '').trim().toUpperCase()));
         // Auto-approve caps — never auto-approve at high, cap change count per risk level.
-        const autoApproveAllowed = !guardedRun && !qasNoAutoApprove && ((sapCfg?.auto_approve === 'low' && eff.level === 'low' && changes.length <= 5) ||
+        const autoApproveAllowed = !guardedRun && !qasNoAutoApprove && !touchesInfra && ((sapCfg?.auto_approve === 'low' && eff.level === 'low' && changes.length <= 5) ||
             (sapCfg?.auto_approve === 'medium' && (eff.level === 'low' || eff.level === 'medium') && changes.length <= 2));
         if (autoApproveAllowed) {
             const ids = [];

package/dist/tools/dispatch-skill.js

@@ -15,8 +15,9 @@
  *     user's keypress to make.
  *   - The command argument MUST start with a known slash route. Free
  *     text without a leading `/` is rejected.
- *   - Set the slot via ctx.pendingDispatch.set(command). repl.tsx reads
- *     it after runTurn and routes as the next submission.
+ *   - Set the slot via ctx.pendingDispatch.set(command, { by: 'switch', … }).
+ *     repl.tsx reads it after runTurn and routes it as the next submission,
+ *     shown as "Auto-routed: <command>" — never as the person's own line.
  *   - Skill ends the turn naturally after this tool call. Do not also
  *     emit a "Type X at the next prompt" hint — the dispatch supersedes it.
  *
@@ -32,7 +33,7 @@
  * for every other dispatch (e.g. /abap-generate → /abap-rap switch).
  */
 import { registerTool } from './index.js';
-import { isPlanResumeCommand } from '../commands/plan-resume.js';
+import { autoRoutedNotice, isPlanResumeCommand } from '../commands/plan-resume.js';
 export const PLAN_RESUME_DISPATCH_REASON = 'Do not dispatch /abap-plan --resume. When your plan manifest is saved, CSPeach runs the next step itself with the exact saved file. Simply end the turn now.';
 registerTool({
     name: 'dispatch_skill',
@@ -91,7 +92,10 @@ registerTool({
                 }),
             };
         }
-        ctx.pendingDispatch.set(command);
+        // Must-fix follow-up (b): the person agreed to the switch, but the model
+        // wrote the command, so it is never shown as theirs ("You › …"). Tagged
+        // `switch`, both REPLs show its one "Auto-routed:" line (queuedStepView).
+        ctx.pendingDispatch.set(command, { by: 'switch', line: autoRoutedNotice(command) ?? `Auto-routed: ${command}` });
         return {
             content: JSON.stringify({
                 ok: true,

package/dist/tools/filesystem/extract-xlsx.js

@@ -43,10 +43,11 @@ export function colIndex(ref) {
     return n - 1;
 }
 /** One worksheet's cells as a rectangular grid of strings. */
-export function sheetRows(xml, strings, budget) {
+export function sheetRows(xml, strings, budget, opts = {}) {
+    const maxRows = opts.maxRows ?? MAX_SHEET_ROWS;
     const rows = [];
     for (const rowMatch of xml.matchAll(/<row[^>]*>([\s\S]*?)<\/row>/g)) {
-        if (rows.length >= MAX_SHEET_ROWS || budget.cells <= 0)
+        if (rows.length >= maxRows || budget.cells <= 0)
             break;
         const cells = [];
         for (const cell of rowMatch[1].matchAll(/<c\b([^>]*)>([\s\S]*?)<\/c>|<c\b([^>]*)\/>/g)) {
@@ -68,7 +69,7 @@ export function sheetRows(xml, strings, budget) {
             }
             while (cells.length < at)
                 cells.push('');
-            cells[at] = value.replace(/[\t\r\n]+/g, ' ').trim();
+            cells[at] = (opts.keepLines ? value.replace(/\r\n?/g, '\n') : value.replace(/[\t\r\n]+/g, ' ')).trim();
             budget.cells -= 1;
             if (budget.cells <= 0)
                 break;
@@ -137,3 +138,26 @@ export function extractXlsx(buffer) {
         warnings.push('no cell text found — the workbook may be empty or hold only charts/images');
     return { text, sheets: sheets.length, warnings };
 }
+/**
+ * Every sheet as rows of cell text, for a caller that reads a workbook back as
+ * data (the Plan sheet, spec 2026-10-06 §8). Numbers come back as their text
+ * (`2`, `46000`), shared and inline strings as written, line breaks inside a
+ * cell kept. No row cap: a Plan sheet holds one row per object. Throws on a
+ * file that is not a readable .xlsx.
+ */
+export function readSheets(buffer) {
+    const zip = new AdmZip(buffer);
+    const read = (p) => {
+        const entry = zip.getEntry(p);
+        return entry ? entry.getData().toString('utf-8') : null;
+    };
+    const strings = sharedStrings(read('xl/sharedStrings.xml'));
+    const budget = { cells: Number.POSITIVE_INFINITY };
+    const out = [];
+    for (const s of sheetOrder(read('xl/workbook.xml'), read('xl/_rels/workbook.xml.rels'))) {
+        const xml = read(s.path);
+        if (xml !== null)
+            out.push({ name: s.name, rows: sheetRows(xml, strings, budget, { maxRows: Number.POSITIVE_INFINITY, keepLines: true }) });
+    }
+    return out;
+}

package/dist/tools/filesystem/file-edit.js

@@ -15,6 +15,7 @@ import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
 import { registerTool } from '../index.js';
 import { resolveSafePath, assertRealPathContained, PathOutsideRootError, DENYLIST_DESCRIPTION, isDenylistedPath, blockedExecutableExtension, } from '../_filesystem-shared.js';
+import { pointsIntoSharedCspeach, SHARED_CSPEACH_REFUSAL, teamWorkTarget } from '../_team-work-path.js';
 export async function fileEditHandler(args, ctx) {
     // 1. Validate args before any IO
     if (args.old_string === args.new_string) {
@@ -24,9 +25,11 @@ export async function fileEditHandler(args, ctx) {
         };
     }
     // 2. Path containment — sync phase (pure string math)
+    //    Task 15 — in a team folder a skill working file is edited in the seat.
+    const t = teamWorkTarget(ctx.cwd, args.path);
     let abs;
     try {
-        abs = resolveSafePath(ctx.cwd, args.path);
+        abs = resolveSafePath(t.root, t.path);
     }
     catch (err) {
         if (err instanceof PathOutsideRootError) {
@@ -37,7 +40,7 @@ export async function fileEditHandler(args, ctx) {
     // 3. Path containment — async phase (follows symlinks)
     let realAbs;
     try {
-        realAbs = await assertRealPathContained(abs, ctx.cwd);
+        realAbs = await assertRealPathContained(abs, t.root);
     }
     catch (err) {
         if (err instanceof PathOutsideRootError) {
@@ -49,7 +52,7 @@ export async function fileEditHandler(args, ctx) {
         return { content: `error: ${err instanceof Error ? err.message : String(err)}`, is_error: true };
     }
     // 4. Denylist check: refuse sensitive in-root paths
-    const denylist = isDenylistedPath(realAbs, ctx.cwd);
+    const denylist = isDenylistedPath(realAbs, t.root);
     if (denylist.blocked) {
         return {
             content: `error: refusing to edit sensitive path "${denylist.relFromRoot}" (denylist: ${DENYLIST_DESCRIPTION})`,
@@ -66,6 +69,11 @@ export async function fileEditHandler(args, ctx) {
             is_error: true,
         };
     }
+    // 4c. Team folder: the real path never lies in the shared .cspeach
+    //     (an 8.3 name, a junction or an odd spelling would get it there).
+    if (pointsIntoSharedCspeach(ctx.cwd, realAbs)) {
+        return { content: `error: ${SHARED_CSPEACH_REFUSAL}`, is_error: true };
+    }
     // 5. Read the file
     let content;
     try {
@@ -114,7 +122,7 @@ export async function fileEditHandler(args, ctx) {
         return { content: `error: write failed — ${err.message}`, is_error: true };
     }
     const noun = replacementCount === 1 ? 'replacement' : 'replacements';
-    const relPath = path.relative(path.resolve(ctx.cwd), realAbs).replace(/\\/g, '/');
+    const relPath = path.relative(path.resolve(t.root), realAbs).replace(/\\/g, '/');
     return { content: `edited ${relPath} (${replacementCount} ${noun})` };
 }
 registerTool({

package/dist/tools/filesystem/file-read.js

@@ -11,6 +11,7 @@
 import { promises as fs } from 'node:fs';
 import { registerTool } from '../index.js';
 import { resolveSafePath, assertRealPathContained, PathOutsideRootError, DENYLIST_DESCRIPTION, isDenylistedPath, isReadOnlyProjectFile } from '../_filesystem-shared.js';
+import { teamReadTarget } from '../_team-work-path.js';
 import { spillToolResult, isUnderSpillRoot } from '../result-spill.js';
 import { basename } from 'node:path';
 const MAX_LINES = 2000;
@@ -22,9 +23,12 @@ export async function fileReadHandler(args, ctx) {
     if (args.limit !== undefined && args.limit < 1) {
         return { content: `error: limit must be a positive integer (got ${args.limit})`, is_error: true };
     }
+    // Task 15 — in a team folder a skill working file, a saved result
+    // (.cspeach/*.cspeach.json) or a lane decision is read from the seat.
+    const t = teamReadTarget(ctx.cwd, args.path);
     let abs;
     try {
-        abs = resolveSafePath(ctx.cwd, args.path);
+        abs = resolveSafePath(t.root, t.path);
     }
     catch (err) {
         if (err instanceof PathOutsideRootError) {
@@ -34,7 +38,7 @@ export async function fileReadHandler(args, ctx) {
     }
     let realAbs;
     try {
-        realAbs = await assertRealPathContained(abs, ctx.cwd);
+        realAbs = await assertRealPathContained(abs, t.root);
     }
     catch (err) {
         if (err instanceof PathOutsideRootError) {
@@ -48,8 +52,8 @@ export async function fileReadHandler(args, ctx) {
     // Denylist check: refuse sensitive in-root paths. The project's own saved
     // results (.cspeach/*.cspeach.json, .cspeach/lane/*.json) are readable —
     // isReadOnlyProjectFile; the write tools never get this carve-out.
-    const denylist = isDenylistedPath(realAbs, ctx.cwd);
-    if (denylist.blocked && !isReadOnlyProjectFile(realAbs, ctx.cwd)) {
+    const denylist = isDenylistedPath(realAbs, t.root);
+    if (denylist.blocked && !isReadOnlyProjectFile(realAbs, t.root)) {
         return {
             content: `error: refusing to read sensitive path "${denylist.relFromRoot}" (denylist: ${DENYLIST_DESCRIPTION})`,
             is_error: true,

package/dist/tools/filesystem/file-write.js

@@ -19,6 +19,7 @@ import { promises as fs, readFileSync } from 'node:fs';
 import * as path from 'node:path';
 import { registerTool } from '../index.js';
 import { resolveSafePath, realPathForWrite, PathOutsideRootError, DENYLIST_DESCRIPTION, isDenylistedPath, blockedExecutableExtension, } from '../_filesystem-shared.js';
+import { pointsIntoSharedCspeach, SHARED_CSPEACH_REFUSAL, teamWorkTarget } from '../_team-work-path.js';
 /**
  * 2026-09-23 (Glenn's first run) — a standalone run writes GUIDE.md and said
  * nothing about it. He opened it in a text editor, then tried to drop it into
@@ -57,9 +58,11 @@ function noteGuideWritten(relPath, ctx) {
 }
 export async function fileWriteHandler(args, ctx) {
     // 1. Path containment — sync phase (pure string math, catches .. traversals)
+    //    Task 15 — in a team folder a skill working file goes to the seat.
+    const t = teamWorkTarget(ctx.cwd, args.path);
     let abs;
     try {
-        abs = resolveSafePath(ctx.cwd, args.path);
+        abs = resolveSafePath(t.root, t.path);
     }
     catch (err) {
         if (err instanceof PathOutsideRootError) {
@@ -74,7 +77,7 @@ export async function fileWriteHandler(args, ctx) {
     //    `.git` behind a link (`docs -> .git`) or a short name (`GIT~1`).
     let target;
     try {
-        target = await realPathForWrite(abs, ctx.cwd);
+        target = await realPathForWrite(abs, t.root);
     }
     catch (err) {
         if (err instanceof PathOutsideRootError) {
@@ -83,7 +86,7 @@ export async function fileWriteHandler(args, ctx) {
         return { content: `error: ${err instanceof Error ? err.message : String(err)}`, is_error: true };
     }
     // 3. Denylist check: refuse sensitive in-root paths
-    const denylist = isDenylistedPath(target, ctx.cwd);
+    const denylist = isDenylistedPath(target, t.root);
     if (denylist.blocked) {
         return {
             content: `error: refusing to write sensitive path "${denylist.relFromRoot}" (denylist: ${DENYLIST_DESCRIPTION})`,
@@ -99,6 +102,11 @@ export async function fileWriteHandler(args, ctx) {
             is_error: true,
         };
     }
+    // 3c. Team folder: the real landing path never lies in the shared .cspeach
+    //     (an 8.3 name, a junction or an odd spelling would get it there).
+    if (pointsIntoSharedCspeach(ctx.cwd, target)) {
+        return { content: `error: ${SHARED_CSPEACH_REFUSAL}`, is_error: true };
+    }
     // 4. Ensure parent directory exists (no-op if it already does)
     try {
         await fs.mkdir(path.dirname(target), { recursive: true });
@@ -117,7 +125,7 @@ export async function fileWriteHandler(args, ctx) {
         await fs.unlink(tmpPath).catch(() => undefined);
         return { content: `error: write failed — ${err.message}`, is_error: true };
     }
-    const relPath = path.relative(path.resolve(ctx.cwd), target).replace(/\\/g, '/');
+    const relPath = path.relative(path.resolve(t.root), target).replace(/\\/g, '/');
     const bytes = Buffer.byteLength(args.content, 'utf-8');
     noteGuideWritten(relPath, ctx);
     return { content: `wrote ${relPath} (${bytes} bytes)` };