@cspeach/cli 1.1.38 → 1.1.40

package/dist/agent/loop.js

@@ -57,6 +57,8 @@ import { expandTextFileAttachments } from '../projects/workspace.js';
 import { expandImageAttachments, buildUserContent, trimHistoryImages } from '../projects/image-attachments.js';
 import { expandImageChips } from '../ui/clipboard-image.js';
 import { getSapSystemInfo, renderSapSystemBlock } from '../sap/system-info.js';
+import { getSystemProfile, renderSapProfileBlock } from '../sap/system-profile.js';
+import { pinHiddenTools, withoutTools } from '../sap/profile-gate.js';
 import { renderStandaloneContextBlock } from '../sap/standalone-profile.js';
 import { renderStandardsBlock } from '../standards/standards-file.js';
 import { composeSessionContextBlock } from './session-context.js';
@@ -820,6 +822,7 @@ ${imageExpansion.error}`));
     // SAP block is then empty and the rest of enrichment proceeds as
     // before — no behavioral regression.
     let sapSystemBlock = '';
+    let sapProfileBlock = '';
     let sapSystemInfo = null;
     const standaloneTurn = isStandalone(params.ctx);
     if (standaloneTurn) {
@@ -828,10 +831,15 @@ ${imageExpansion.error}`));
         // so skills read one element in both modes — plus the manual-
         // implementation hand-off note.
         sapSystemBlock = renderStandaloneContextBlock(cfg.standalone);
+        params.ctx.systemProfile = null;
     }
     else if (params.ctx.adt && params.ctx.sapAlias) {
         sapSystemInfo = await getSapSystemInfo(params.ctx.adt, params.ctx.sapAlias);
+        // ADT gap program, Part 1 — the system profile rides the same lazy probe.
+        // Null (kill switch, no discovery and no CVERS) = today's behaviour.
+        params.ctx.systemProfile = await getSystemProfile(params.ctx.adt, params.ctx.sapAlias, sapSystemInfo);
         sapSystemBlock = renderSapSystemBlock(sapSystemInfo);
+        sapProfileBlock = renderSapProfileBlock(params.ctx.systemProfile);
     }
     // Customer development standards — opt-in, both modes. Renders '' when the
     // user has no standards file, so the composed block (and therefore the whole
@@ -842,7 +850,7 @@ ${imageExpansion.error}`));
     const switchNote = session.systemSwitchNote
         ? `<system_switch>${session.systemSwitchNote}</system_switch>`
         : '';
-    const sessionContextBlock = composeSessionContextBlock([sapSystemBlock, standardsBlock, switchNote]);
+    const sessionContextBlock = composeSessionContextBlock([sapSystemBlock, sapProfileBlock, standardsBlock, switchNote]);
     // Deterministically extract structured facts from the user's prompt
     // (package, transport, object names, environment hint, create intent)
     // and prepend them as an XML `<session_context>` block. The model reads
@@ -926,7 +934,14 @@ ${imageExpansion.error}`));
         env: process.env,
         served: servedToolLoading(),
     });
-    const contextTools = toolsForContext(listTools(), params.ctx);
+    // Part 1 (D4, R7) — the hidden set is pinned per alias on the first
+    // connected turn and reused, so tools[] stays byte-stable; [] pinned = same
+    // array as today. A standalone or unconnected turn pins nothing.
+    const connectedTurn = !standaloneTurn && !!params.ctx.adt && !!params.ctx.sapAlias;
+    const hiddenSapTools = connectedTurn
+        ? pinHiddenTools(session, params.ctx.sapAlias, listTools(), params.ctx.systemProfile ?? null)
+        : [];
+    const contextTools = withoutTools(toolsForContext(listTools(), params.ctx), hiddenSapTools);
     // Task 18 fixes M4 / M5 — no read_agent for an agent_run child, and none
     // when a reader would have no real read tool (standalone, file tools off).
     const visibleTools = params.ctx.subagent || !hasReaderReadTools(new Set(contextTools.map((t) => t.name)))

package/dist/agent/tool-dispatch.js

@@ -9,6 +9,7 @@ import { shouldGateRule8, recordWriteOp, renderPlanSummary, getWriteOpsThisTurn,
 import { isCredentialHandoverApproved, markCredentialHandoverApproved, } from '../repl/credential-handover-gate.js';
 import { READER_TOOLS } from '../tools/subagent/reader-prompt.js';
 import { riskOf } from './risk-gate.js';
+import { NOT_ON_THIS_RELEASE, profileGate } from '../sap/profile-gate.js';
 const READER_TOOL_SET = new Set(READER_TOOLS);
 export async function dispatchTool(name, args, ctx) {
     const tool = getTool(name);
@@ -36,6 +37,16 @@ export async function dispatchTool(name, args, ctx) {
             is_error: true,
         };
     }
+    // ADT gap program, Part 1 (D4) — a definite "not on this release" is
+    // answered here, before any SAP call, as a normal tool error. Unknown or
+    // no profile: today's path, untouched.
+    const gate = profileGate(tool, args, ctx.systemProfile ?? null);
+    if (gate) {
+        return {
+            content: JSON.stringify({ error: NOT_ON_THIS_RELEASE, feature: gate.feature, message: gate.message }),
+            is_error: true,
+        };
+    }
     // L1-6 R1-6 (owner decision 2026-09-21) — a call that hands the stored SAP
     // login to a local child process ALWAYS asks a human, once per session per
     // alias, even as the first mutating call of a turn (where Rule 8 below stays

package/dist/sap/profile-features.js

@@ -0,0 +1,42 @@
+const A = '/sap/bc/adt';
+export const FEATURES = Object.freeze({
+    'cds.ddls': { label: 'CDS data definitions', collection: `${A}/ddic/ddl/sources`, since: { basis: 740, sp: 5, label: 'ABAP 7.40 SP05' }, provenOnOurBox: true },
+    'cds.viewEntity': { label: 'CDS view entities (define view entity)', since: { basis: 755, label: 'S/4HANA 2020 (ABAP 7.55)' }, provenOnOurBox: true },
+    'cds.tableEntity': { label: 'CDS table entities (define table entity)', since: { basis: 816, label: 'S/4HANA 2025 (ABAP 8.16)' }, provenOnOurBox: false },
+    'cds.ddlx': { label: 'CDS metadata extensions', collection: `${A}/ddic/ddlx/sources`, since: { basis: 751, label: 'ABAP 7.51' }, provenOnOurBox: true },
+    'cds.dcls': { label: 'CDS access controls (DCL)', collection: `${A}/acm/dcl/sources`, since: { basis: 740, sp: 10, label: 'ABAP 7.40 SP10' }, provenOnOurBox: true },
+    'rap.bdef': { label: 'Behavior definitions (RAP)', collection: `${A}/bo/behaviordefinitions`, since: { basis: 753, label: 'S/4HANA 1809 (ABAP 7.53)' }, provenOnOurBox: true },
+    // Final review I1 (owner rule: a wrong no is worse than unknown): the next six
+    // rows had release floors with no cited source (gap table §3.1 gives one date
+    // for five RAP/CDS objects; "1709" for table/structure; "1610 / 7.50" for
+    // domain/data element). Dropped: listed = yes, else unknown, never no. Add a
+    // floor back only with a citation (SAP Help release line or ADT feature matrix).
+    'rap.srvd': { label: 'Service definitions', collection: `${A}/ddic/srvd/sources`, provenOnOurBox: true },
+    'rap.srvb': { label: 'Service bindings', collection: `${A}/businessservices/bindings`, provenOnOurBox: true },
+    'ddic.tables': { label: 'Tables in ADT', collection: `${A}/ddic/tables`, provenOnOurBox: true },
+    'ddic.structures': { label: 'Structures in ADT', collection: `${A}/ddic/structures`, provenOnOurBox: true },
+    'ddic.domains': { label: 'Domains in ADT', collection: `${A}/ddic/domains`, provenOnOurBox: true },
+    'ddic.dataelements': { label: 'Data elements in ADT', collection: `${A}/ddic/dataelements`, provenOnOurBox: true },
+    'generator.repository': { label: "SAP's RAP generator", collection: `${A}/repository/generators`, since: { basis: 757, label: 'S/4HANA 2022 (ABAP 7.57)' }, absentMeansNo: true, provenOnOurBox: true },
+    'atc.worklists': { label: 'ATC checks', collection: `${A}/atc/worklists`, since: { basis: 740, label: 'ABAP 7.40' }, provenOnOurBox: true },
+    'unit.testruns': { label: 'ABAP Unit runs', collection: `${A}/abapunit/testruns`, provenOnOurBox: true },
+    'text.programs': { label: 'Text elements of programs', collection: `${A}/textelements/programs`, since: { basis: 740, sp: 8, label: 'ABAP 7.40 SP08' }, provenOnOurBox: true },
+    // No `since` (R4): the profile's own CVERS reads use this endpoint, so a
+    // release-based `no` could only ever be wrong. Listed = yes, else unknown.
+    'datapreview.freestyle': { label: 'SQL data preview', collection: `${A}/datapreview/freestyle`, provenOnOurBox: true },
+    'msag': { label: 'Message classes', collection: `${A}/messageclass`, provenOnOurBox: true },
+    'nrob': { label: 'Number range objects', collection: `${A}/numberranges/objects`, provenOnOurBox: true },
+});
+export const FEATURE_IDS = Object.freeze(Object.keys(FEATURES));
+export function isFeatureId(s) {
+    return Object.prototype.hasOwnProperty.call(FEATURES, s);
+}
+/** url-mapper type token (upper case) → the feature it needs. Unlisted types need nothing. */
+export const OBJECT_TYPE_FEATURE = Object.freeze({
+    BDEF: 'rap.bdef', SRVD: 'rap.srvd', SRVB: 'rap.srvb',
+    DDLS: 'cds.ddls', CDS: 'cds.ddls', DDLX: 'cds.ddlx', DCLS: 'cds.dcls',
+    TABL: 'ddic.tables', STRU: 'ddic.structures', DOMA: 'ddic.domains', DTEL: 'ddic.dataelements',
+    MSAG: 'msag', NROB: 'nrob',
+});
+/** The RAP/CDS subset: the only types a READ is ever refused for (R6). */
+export const READ_GATED_TYPES = new Set(['BDEF', 'SRVD', 'SRVB', 'DDLS', 'CDS', 'DDLX', 'DCLS']);

package/dist/sap/profile-gate.js

@@ -0,0 +1,67 @@
+import { FEATURES, OBJECT_TYPE_FEATURE, READ_GATED_TYPES } from './profile-features.js';
+import { supports, systemLabel } from './system-profile.js';
+export const NOT_ON_THIS_RELEASE = 'not_on_this_release';
+/** For tools whose `type` argument names an object type (url-mapper token). */
+export function byObjectType(args) {
+    const t = typeof args?.type === 'string' ? args.type.trim().toUpperCase() : '';
+    return t && Object.prototype.hasOwnProperty.call(OBJECT_TYPE_FEATURE, t) ? OBJECT_TYPE_FEATURE[t] : null;
+}
+/**
+ * R6 — reads refuse only RAP/CDS types (they cannot exist below their release).
+ * DDIC types carry no release floor at all (final review I1); a DDIC read was never proven to fail, and a
+ * wrong read costs one 404 while a wrong `no` costs the user's work.
+ */
+export function byObjectTypeForRead(args) {
+    const t = typeof args?.type === 'string' ? args.type.trim().toUpperCase() : '';
+    return READ_GATED_TYPES.has(t) ? byObjectType(args) : null;
+}
+export function requiredFeature(tool, args) {
+    const r = tool.requires;
+    if (!r)
+        return null;
+    return typeof r === 'function' ? r(args) : r;
+}
+export function profileGate(tool, args, profile) {
+    if (!profile)
+        return null;
+    const feature = requiredFeature(tool, args);
+    if (!feature)
+        return null;
+    const v = supports(profile, feature);
+    if (v.answer !== 'no')
+        return null;
+    // I2 — name when the facts were read: the profile is kept up to 30 days.
+    return { feature, message: `${FEATURES[feature].label}: ${v.reason}. This system: ${systemLabel(profile)}, read ${profile.builtAt.slice(0, 10)}.` };
+}
+/** Names of the tools whose FIXED feature is a definite no. [] for no profile. */
+export function hiddenByProfile(tools, profile) {
+    if (!profile)
+        return [];
+    return tools.filter((t) => typeof t.requires === 'string' && supports(profile, t.requires).answer === 'no').map((t) => t.name);
+}
+/** Drop the named tools. Same array back when nothing changes (byte-identical path). */
+export function withoutTools(tools, hidden) {
+    if (hidden.length === 0)
+        return tools;
+    const set = new Set(hidden);
+    const kept = tools.filter((t) => !set.has(t.name));
+    return kept.length === tools.length ? tools : kept;
+}
+export function toolsForProfile(tools, profile) {
+    return withoutTools(tools, hiddenByProfile(tools, profile));
+}
+/**
+ * R7 / D4 — tools[] must be byte-stable for the session (prompt cache,
+ * preserved thinking), but it is rebuilt every turn. The hidden set is pinned
+ * on the session the first time an alias is seen — whatever the profile was
+ * on that turn (null pins []) — and reused after that. Another alias re-pins.
+ * A profile that arrives later refuses per call at dispatch instead.
+ */
+export function pinHiddenTools(session, alias, tools, profile) {
+    const pinned = session.profile_hidden_tools;
+    if (pinned && pinned.alias === alias)
+        return pinned.names;
+    const names = hiddenByProfile(tools, profile);
+    session.profile_hidden_tools = { alias, names };
+    return names;
+}

package/dist/sap/system-info.js

@@ -535,6 +535,6 @@ export function renderSapSystemBlock(info) {
     ].join(' ');
     return `<sap_system ${attrs} />`;
 }
-function escapeAttr(s) {
+export function escapeAttr(s) {
     return s.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 }

package/dist/sap/system-profile.js

@@ -0,0 +1,312 @@
+// cspeach-cli/src/sap/system-profile.ts
+/**
+ * System profile (ADT gap program, Part 1; spec §2.1).
+ *
+ * One profile per connected SAP system, built from the facts the CLI already
+ * has (system-info: CVERS release) plus two reads cached for 30 days: the ADT
+ * discovery document and the SAP_BASIS support pack. `supports()` answers
+ * yes / no / unknown with a plain reason. Unknown changes nothing: tools run
+ * as today and fail at HTTP time if the feature is missing. Only a definite
+ * `no` stops a call before it reaches SAP.
+ *
+ * Evidence rules (owner decision D1): a collection LISTED by discovery is a
+ * yes; an unlisted one proves nothing (our S/4HANA 2023 box omits endpoints
+ * that work). A `no` comes from the release table alone, except the generator,
+ * which keeps today's getGeneratorFact reading (absent = no = CSPeach writer).
+ */
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { auditLog } from '@cspeach/sap-client';
+import { cspeachRoot } from '../config/paths.js';
+import { escapeAttr } from './system-info.js';
+import { FEATURES, FEATURE_IDS } from './profile-features.js';
+export function releaseAtLeast(p, min) {
+    if (p.basis === null)
+        return null;
+    if (p.basis > min.basis)
+        return true;
+    if (p.basis < min.basis)
+        return false;
+    if (min.sp === undefined)
+        return true;
+    if (p.sp === null)
+        return null;
+    return p.sp >= min.sp;
+}
+export function systemLabel(p) {
+    if (p.basis === null && p.release === 'unknown')
+        return 'unknown release';
+    const sp = p.sp === null ? '' : ` SP${String(p.sp).padStart(2, '0')}`;
+    const abap = p.abapVersion === 'unknown' ? '' : ` (ABAP ${p.abapVersion})`;
+    return `${p.release}${sp}${abap}`;
+}
+export function supports(p, id) {
+    const rule = FEATURES[id];
+    if (!p)
+        return { answer: 'unknown', reason: 'system profile not available' };
+    const listed = !!rule.collection && p.discovery.read && p.discovery.collections.includes(rule.collection);
+    if (listed)
+        return { answer: 'yes', reason: 'listed by this system' };
+    const byRelease = rule.since ? releaseAtLeast(p, rule.since) : null;
+    if (rule.since && byRelease === false)
+        return { answer: 'no', reason: `needs ${rule.since.label} or later` };
+    // R3 — the generator must agree with getGeneratorFact for the same body:
+    // list unread = fact unknown (HTTP ≥ 400) or no (HTML page), never a yes by release.
+    if (rule.absentMeansNo && rule.collection && !p.discovery.read)
+        return { answer: 'unknown', reason: 'the system list could not be read' };
+    if (rule.absentMeansNo && rule.collection && p.discovery.read)
+        return { answer: 'no', reason: 'not offered by this system' };
+    if (rule.since && byRelease === true)
+        return { answer: 'yes', reason: `${systemLabel(p)} has it` };
+    if (rule.since && p.basis !== null && p.basis === rule.since.basis && p.sp === null) {
+        return { answer: 'unknown', reason: `needs ${rule.since.label}; this system is ${p.abapVersion} with an unknown support pack` };
+    }
+    if (!p.discovery.read && rule.collection)
+        return { answer: 'unknown', reason: 'the system list could not be read' };
+    return { answer: 'unknown', reason: 'no release fact covers it' };
+}
+function basisOf(info) {
+    const raw = info?.components?.['SAP_BASIS'];
+    if (!raw || !/^\d{3}$/.test(raw.trim()))
+        return null;
+    return Number(raw.trim());
+}
+export function profileFrom(i) {
+    if (!i.info && !i.discovery)
+        return null;
+    const basis = basisOf(i.info);
+    return {
+        alias: i.alias,
+        baseUrl: i.baseUrl,
+        platform: i.info?.platform ?? 'unknown',
+        release: i.info?.release ?? 'unknown',
+        abapVersion: i.info?.abapVersion ?? 'unknown',
+        basis,
+        sp: basis === null ? null : i.sp,
+        cloud: i.info && Object.keys(i.info.components).length > 0 ? 'no' : 'unknown',
+        discovery: i.discovery
+            ? { read: true, collections: Object.keys(i.discovery.collections).sort() }
+            : { read: false, collections: [] },
+        builtAt: i.now.toISOString(),
+    };
+}
+const CACHE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** Bump when the stored shape or its meaning changes. */
+const CACHE_VERSION = 1;
+const SP_SQL = "SELECT COMPONENT, RELEASE, EXTRELEASE FROM CVERS WHERE COMPONENT = 'SAP_BASIS'";
+/**
+ * Final review I4 — an incomplete build (list or SP not read) is never written
+ * as a profile (R2), so without this it would cost both reads on every CLI
+ * start. The ATTEMPT is remembered per alias for a day (when, and against
+ * which system — no answers), and each read is bounded in time.
+ */
+const ATTEMPT_TTL_MS = 24 * 60 * 60 * 1000;
+const READ_TIMEOUT_MS = 15_000;
+/** Last build per alias for this process — null included (X3: a failed turn is not retried every turn). */
+const memCache = new Map();
+export function _resetSystemProfileCache() {
+    memCache.clear();
+}
+/**
+ * The SAP_BASIS support pack from the column-major data preview ('0002' → 2).
+ * Sibling of parseCvers (system-info.ts), which reads the same shape into
+ * component → release; that function and its SQL stay untouched (D2).
+ */
+export function parseExtRelease(xml) {
+    const colsRe = /<(?:[\w:]+:)?columns\b[^>]*>([\s\S]*?)<\/(?:[\w:]+:)?columns\s*>/g;
+    let m;
+    while ((m = colsRe.exec(xml)) !== null) {
+        const block = m[1];
+        const name = /<(?:[\w:]+:)?metadata\b[^>]*?\b(?:[\w:]+:)?name="([^"]+)"/i.exec(block)?.[1];
+        if (!name || name.toUpperCase() !== 'EXTRELEASE')
+            continue;
+        const value = /<(?:[\w:]+:)?data\b(?:\s[^>]*?)?>([\s\S]*?)<\/(?:[\w:]+:)?data\s*>/.exec(block)?.[1]?.trim() ?? '';
+        const digits = /(\d+)\s*$/.exec(value)?.[1];
+        return digits ? Number(digits) : null;
+    }
+    return null;
+}
+export async function getSystemProfile(adt, alias, info, opts = {}) {
+    const env = opts.env ?? process.env;
+    if ((env['CSPEACH_SYSTEM_PROFILE'] ?? '').trim().toLowerCase() === 'off')
+        return null;
+    const now = opts.now ?? (() => new Date());
+    const conn = adt.connection;
+    const baseUrl = conn?.getBaseUrl?.() ?? '';
+    if (!opts.fresh) {
+        if (memCache.has(alias)) {
+            const hit = memCache.get(alias) ?? null;
+            if (hit === null || sameSystem(hit, baseUrl, info))
+                return hit;
+        }
+        const fromDisk = readDiskCache(alias, now());
+        if (fromDisk && sameSystem(fromDisk, baseUrl, info)) {
+            memCache.set(alias, fromDisk);
+            return fromDisk;
+        }
+        // I4 — an incomplete build was tried for this system within the day: no
+        // profile this start (unknown everywhere = today's behaviour), no requests.
+        if (recentAttempt(alias, baseUrl, info, now())) {
+            memCache.set(alias, null);
+            return null;
+        }
+    }
+    const timeoutMs = opts.readTimeoutMs ?? READ_TIMEOUT_MS;
+    const startedAt = Date.now();
+    try {
+        let discovery = null;
+        try {
+            discovery = await bounded(adt.discovery(), timeoutMs);
+        }
+        catch {
+            discovery = null;
+        }
+        let sp = null;
+        if (info?.components?.['SAP_BASIS'] && conn?.post) {
+            try {
+                const resp = await bounded(conn.post('/sap/bc/adt/datapreview/freestyle?rowNumber=5', SP_SQL, 'text/plain', 'application/vnd.sap.adt.datapreview.table.v1+xml'), timeoutMs);
+                if (resp && resp.status === 200)
+                    sp = parseExtRelease(resp.body);
+            }
+            catch {
+                sp = null;
+            }
+        }
+        const profile = profileFrom({ alias, baseUrl, info, sp, discovery, now: now() });
+        if (!profile) {
+            memCache.set(alias, null);
+            writeAttempt(alias, baseUrl, info, now());
+            await auditLog('sapProfile', 'ALIAS', alias, 'error', Date.now() - startedAt, 'no discovery and no system info');
+            return null;
+        }
+        memCache.set(alias, profile);
+        // R2 — same rule as system-info's failed probe: never persist what was not
+        // read. Complete = list read, and the SP read (or no SAP_BASIS to read it for).
+        const complete = profile.discovery.read && (profile.sp !== null || profile.basis === null);
+        if (complete) {
+            writeDiskCache(alias, profile);
+            clearAttempt(alias);
+        }
+        else
+            writeAttempt(alias, baseUrl, info, now());
+        await auditLog('sapProfile', 'ALIAS', alias, 'success', Date.now() - startedAt, `release=${profile.release} sp=${profile.sp ?? 'unknown'} discovery=${profile.discovery.read ? profile.discovery.collections.length : 'not read'} cached=${complete ? 'disk' : 'memory'}`);
+        return profile;
+    }
+    catch (err) {
+        memCache.set(alias, null);
+        writeAttempt(alias, baseUrl, info, now());
+        await auditLog('sapProfile', 'ALIAS', alias, 'error', Date.now() - startedAt, `threw: ${err.message}`);
+        return null;
+    }
+}
+function sameSystem(p, baseUrl, info) {
+    if (baseUrl && p.baseUrl && p.baseUrl !== baseUrl)
+        return false;
+    if (!info)
+        return true;
+    return p.release === info.release && p.abapVersion === info.abapVersion;
+}
+function cacheFile(alias, kind = 'profile') {
+    const safe = alias.replace(/[^A-Za-z0-9._-]/g, '_');
+    return join(cspeachRoot(), 'sap-cache', `${safe}.${kind}.json`);
+}
+/** Resolves to null when the read takes longer than `ms` (the request itself is left to finish). */
+function bounded(p, ms) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), ms);
+        timer.unref?.();
+    });
+    return Promise.race([p, timeout]).finally(() => { if (timer)
+        clearTimeout(timer); });
+}
+function recentAttempt(alias, baseUrl, info, now) {
+    try {
+        const path = cacheFile(alias, 'profile-attempt');
+        if (!existsSync(path))
+            return false;
+        const a = JSON.parse(readFileSync(path, 'utf8'));
+        const at = new Date(a.attemptedAt).getTime();
+        if (!Number.isFinite(at) || now.getTime() - at > ATTEMPT_TTL_MS || now.getTime() < at)
+            return false;
+        if (a.baseUrl !== baseUrl)
+            return false;
+        return a.release === (info?.release ?? 'unknown') && a.abapVersion === (info?.abapVersion ?? 'unknown');
+    }
+    catch {
+        return false;
+    }
+}
+function writeAttempt(alias, baseUrl, info, now) {
+    try {
+        const dir = join(cspeachRoot(), 'sap-cache');
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        const a = { attemptedAt: now.toISOString(), baseUrl, release: info?.release ?? 'unknown', abapVersion: info?.abapVersion ?? 'unknown' };
+        writeFileSync(cacheFile(alias, 'profile-attempt'), JSON.stringify(a, null, 2), 'utf8');
+    }
+    catch {
+        // best effort — at worst the next start tries the build again
+    }
+}
+function clearAttempt(alias) {
+    try {
+        rmSync(cacheFile(alias, 'profile-attempt'), { force: true });
+    }
+    catch { /* best effort */ }
+}
+function readDiskCache(alias, now) {
+    try {
+        const path = cacheFile(alias);
+        if (!existsSync(path))
+            return null;
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        if (raw.cacheVersion !== CACHE_VERSION || !raw.builtAt)
+            return null;
+        if (now.getTime() - new Date(raw.builtAt).getTime() > CACHE_TTL_MS)
+            return null;
+        const { cacheVersion: _v, ...profile } = raw;
+        return profile;
+    }
+    catch {
+        return null;
+    }
+}
+function writeDiskCache(alias, profile) {
+    try {
+        const dir = join(cspeachRoot(), 'sap-cache');
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        writeFileSync(cacheFile(alias), JSON.stringify({ ...profile, cacheVersion: CACHE_VERSION }, null, 2), 'utf8');
+    }
+    catch {
+        // best effort — the memory result is still returned
+    }
+}
+/** The one-line summary for <session_context>; '' when there is no profile. */
+export function renderSapProfileBlock(p) {
+    if (!p)
+        return '';
+    const answer = (id) => supports(p, id).answer;
+    const viewEntity = answer('cds.viewEntity');
+    const cdsSyntax = viewEntity === 'yes' ? 'define view entity' : viewEntity === 'no' ? 'define view' : 'unknown';
+    const notAvailable = FEATURE_IDS
+        .map((id) => ({ id, v: supports(p, id) }))
+        .filter((x) => x.v.answer === 'no')
+        .map((x) => `${FEATURES[x.id].label}: ${x.v.reason}`)
+        .join('; ') || 'none known';
+    const attrs = [
+        `release="${escapeAttr(p.release)}"`,
+        `sp="${p.sp === null ? 'unknown' : `SP${String(p.sp).padStart(2, '0')}`}"`,
+        `abap="${escapeAttr(p.abapVersion)}"`,
+        `cloud="${p.cloud}"`,
+        `cds_view_syntax="${cdsSyntax}"`,
+        `rap="${answer('rap.bdef')}"`,
+        `rap_generator="${answer('generator.repository')}"`,
+        `table_entity="${answer('cds.tableEntity')}"`,
+        `discovery="${p.discovery.read ? 'read' : 'not read'}"`,
+        `built="${p.builtAt.slice(0, 10)}"`,
+        `not_available="${escapeAttr(notAvailable)}"`,
+    ];
+    return `<sap_profile ${attrs.join(' ')} />`;
+}

package/dist/tools/rap/finish-check.js

@@ -96,6 +96,7 @@ export async function rapFinishCheckHandler(args, ctx) {
 }
 registerTool({
     name: 'rap_finish_check',
+    requires: 'rap.bdef',
     description: 'Check the Finish items F1–F5 of a RAP app against its live sources (authorization, access control, '
         + 'read-only admin fields, labels, coded fields). Read-only. Run it after the Finish step and before the UI. '
         + 'A failed item lists what to fix; fix only those and run it again.',

package/dist/tools/rap/generate-objects.js

@@ -294,6 +294,7 @@ export async function sapGenerateObjectsHandler(args, ctx, deps = {}) {
 }
 registerTool({
     name: 'sap_generate_objects',
+    requires: 'generator.repository',
     description: "Run SAP's RAP generator for a skeleton phase whose Plan block says sap-generator. Pass the decision path and "
         + 'sha256 from the plan block, and one approval_id per planned object in the same order (request_approval with '
         + 'op create for each). CSPeach validates, previews, generates, then checks every object is active and on the '

package/dist/tools/sap-read.js

@@ -22,6 +22,7 @@
  *   badiList(query, enhancementSpot?, maxResults?)
  */
 import { registerTool } from './index.js';
+import { byObjectTypeForRead } from '../sap/profile-gate.js';
 import { normaliseSyntaxResult, checkSyntax } from './verify.js';
 import { recordSyntaxCheck } from './syntax-state.js';
 import { spillToolResult } from './result-spill.js';
@@ -71,6 +72,7 @@ export function formatSearchHits(hits) {
 // -----------------------------------------------------------------------
 registerTool({
     name: 'sap_get_source',
+    requires: byObjectTypeForRead,
     description: 'Read the source code of an ABAP object by name and type. '
         + 'Optional `version` selects active or inactive source explicitly; '
         + 'omitting it lets SAP choose (usually active). When the object has '
@@ -174,6 +176,7 @@ registerTool({
 // -----------------------------------------------------------------------
 registerTool({
     name: 'sap_object_structure',
+    requires: byObjectTypeForRead,
     description: 'Retrieve metadata and structural information for an ABAP repository object (package, description, lock state, etc.).',
     isMutating: false,
     requiresSap: true,
@@ -281,6 +284,7 @@ export function arsColumnErrorHint(query, err) {
 }
 registerTool({
     name: 'sap_sql_query',
+    requires: 'datapreview.freestyle',
     description: 'Execute a read-only SQL SELECT against the SAP database via ADT Data Preview. Security-sensitive tables are blocked automatically. '
         + 'Dialect limits (violations return an opaque "SAP HTTP 400: sqlQuery"): no IN-lists and at most one LIKE per WHERE clause '
         + '(multi-OR LIKE chains are rejected) — use a single LIKE or split into separate queries. '
@@ -376,6 +380,7 @@ registerTool({
 // -----------------------------------------------------------------------
 registerTool({
     name: 'sap_atc_run',
+    requires: 'atc.worklists',
     description: 'Run ABAP Test Cockpit (ATC) checks on a specific object and return all findings.',
     isMutating: false,
     requiresSap: true,
@@ -394,8 +399,29 @@ registerTool({
     handler: async (args, ctx) => {
         // atcRun(type, name, variant?) — type first
         // Review fix round 1, M-3: Esc / Ctrl+C stops a long ATC run.
-        const result = await ctx.adt.atcRun(args.type, args.name, args.variant ?? 'DEFAULT', ctx.signal ? { signal: ctx.signal } : {});
-        return { content: JSON.stringify(result, null, 2) };
+        const variant = args.variant ?? 'DEFAULT';
+        const result = await ctx.adt.atcRun(args.type, args.name, variant, ctx.signal ? { signal: ctx.signal } : {});
+        // Fable review 2026-10-15, I-1: a finished run whose worklist never named
+        // the object did not check it (the variant has no check for that type).
+        // Say so plainly; "0 findings" there is not a measurement. Every other
+        // result is the same JSON as before (the coverage key is not added).
+        const { coverage, ...shown } = result;
+        if (coverage === 'absent' && result.totalFindings === 0) {
+            const objectName = `${String(args.type).toUpperCase()} ${String(args.name).toUpperCase()}`;
+            return {
+                content: [
+                    `ATC did not check ${objectName}.`,
+                    'SAP finished the run, but its worklist never listed this object.',
+                    'This is not a measurement. Do not report it as 0 findings or as clean.',
+                    'Likely causes:',
+                    `- the ${String(variant).toUpperCase()} check variant may have no check for this object type (seen on S4H for DDLS, DDLX, SRVD, DOMA);`,
+                    '- the name may be wrong, or the object may not exist or not be active.',
+                    'Use sap_search_object to confirm the object exists.',
+                    `(ATC worklist ${result.worklistId || 'unknown'})`,
+                ].join('\n'),
+            };
+        }
+        return { content: JSON.stringify(shown, null, 2) };
     },
 });
 // -----------------------------------------------------------------------
@@ -631,6 +657,7 @@ registerTool({
 // -----------------------------------------------------------------------
 registerTool({
     name: 'sap_run_unit_test',
+    requires: 'unit.testruns',
     description: 'Execute ABAP Unit tests for an object and return a structured pass/fail report with method-level results.',
     isMutating: false,
     requiresSap: true,

package/dist/tools/sap-write.js

@@ -24,6 +24,7 @@
 import crypto from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { registerTool } from './index.js';
+import { byObjectType } from '../sap/profile-gate.js';
 import { verifyAndSpendApprovalId } from '../approvals/jwt.js';
 import { grantClaimMismatch, grantActivateMismatch, grantOwningTransportMismatch, grantOwningTransportDetail } from '../approvals/grant-claims.js';
 import { autoSnapshot, autoSnapshotClassInclude, autoSnapshotMessageClass } from './snapshot.js';
@@ -172,6 +173,7 @@ function snapshotSource(snap) {
 }
 registerTool({
     name: 'sap_set_source',
+    requires: byObjectType,
     description: 'Overwrite the full source of an ABAP object. Requires approval_id. '
         + 'Use for class-definition changes, new methods, or any change not confined to '
         + 'a single method body. For method-body-only edits use sap_update_method (Rule 7a). '
@@ -567,6 +569,7 @@ registerTool({
 // autoSnapshot here for belt-and-suspenders consistency with the CLI gate model.
 registerTool({
     name: 'sap_delete_object',
+    requires: byObjectType,
     description: 'Delete an ABAP object. Requires approval_id. '
         + 'A snapshot is taken automatically before deletion. '
         + 'Post-check: confirms the object no longer exists. '
@@ -692,6 +695,7 @@ registerTool({
 // No snapshot needed: new object has no prior source.
 registerTool({
     name: 'sap_create_object',
+    requires: byObjectType,
     description: 'Create a new ABAP object shell. '
         + 'Requires approval_id. No snapshot needed (new object). '
         + 'Write source separately via sap_set_source, then call sap_activate. '
@@ -1125,6 +1129,7 @@ registerTool({
 // No snapshot needed: new object has no prior source.
 registerTool({
     name: 'sap_create_domain',
+    requires: 'ddic.domains',
     description: 'Create a DDIC domain (DOMA), then activate and verify it. '
         + 'Requires approval_id. No snapshot needed (new object). '
         + 'Use the domain in a data element via sap_create_data_element.',
@@ -1266,6 +1271,7 @@ registerTool({
 // No snapshot needed: new object has no prior source.
 registerTool({
     name: 'sap_create_data_element',
+    requires: 'ddic.dataelements',
     description: 'Create a DDIC data element (DTEL) bound to an existing domain, then '
         + 'activate and verify it. Requires approval_id. No snapshot needed (new object). '
         + 'Use the data element as a table/structure field type.',
@@ -1617,6 +1623,7 @@ registerTool({
 // Signature: serviceBindingPublish(name) → Promise<{ status: number; error?: string }>
 registerTool({
     name: 'sap_service_binding_publish',
+    requires: 'rap.srvb',
     description: 'Publish an ADT service binding so its OData endpoint becomes active and reachable.',
     isMutating: true,
     requiresSap: true,
@@ -1640,6 +1647,7 @@ registerTool({
 // NOTE: the unpublishjobs endpoint is inferred-not-yet-live-verified (VPN down).
 registerTool({
     name: 'sap_service_binding_unpublish',
+    requires: 'rap.srvb',
     description: 'Unpublish an ADT service binding so its OData endpoint is removed. '
         + 'Required before deleting a published binding (SAP returns HTTP 412 "is published" otherwise).',
     isMutating: true,
@@ -1713,6 +1721,7 @@ function messageRowsProblem(rows) {
 }
 registerTool({
     name: 'sap_message_maintain',
+    requires: 'msag',
     description: 'Add or change messages in an existing message class (MSAG, the T100 texts behind SE91). '
         + 'Create the class first with sap_create_object type MSAG. One call takes many messages. '
         + 'Each message: msgno (three digits, 000-999) and text (up to 73 characters, &1-&4 placeholders allowed). '
@@ -1915,6 +1924,7 @@ registerTool({
 // in @cspeach/sap-client.
 registerTool({
     name: 'sap_number_range_intervals',
+    requires: 'nrob',
     description: 'STUB — not currently implemented; do not call. '
         + 'Writing NROB number-range intervals via ADT requires NR-object XML format '
         + 'not yet implemented in @cspeach/sap-client.',

package/dist/tools/text-elements/tools.js

@@ -103,6 +103,7 @@ async function screenNamesOf(ctx, name) {
 // ── sap_get_text_elements ─────────────────────────────────────────────────────
 registerTool({
     name: 'sap_get_text_elements',
+    requires: 'text.programs',
     description: 'Read a program\'s text elements: selection texts (labels of PARAMETERS / SELECT-OPTIONS), '
         + 'text symbols (TEXT-001) and list headings. Read-only. For selections it also lists '
         + 'selection-screen fields that still have NO text (without_text) — those show their raw name '
@@ -158,6 +159,7 @@ registerTool({
 // ── sap_set_text_elements ─────────────────────────────────────────────────────
 registerTool({
     name: 'sap_set_text_elements',
+    requires: 'text.programs',
     description: 'Add or change a program\'s text elements — one kind per call: selections (selection texts, max 30 chars, '
         + 'key = the PARAMETERS / SELECT-OPTIONS name), symbols (text symbols, key = the 3-char id of TEXT-xxx, max 132) '
         + 'or headings (listHeader max 70, columnHeader_1..4 max 132). MERGES with what is there: texts you do not name '

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cspeach/cli",
-  "version": "1.1.38",
+  "version": "1.1.40",
   "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, signed skills, safety gates.",
   "keywords": [
     "abap",
@@ -54,7 +54,7 @@
     "@anthropic-ai/sdk": "^0.90.0",
     "@azure/msal-node": "6.0.1",
     "@cspeach/register-core": "0.4.0",
-    "@cspeach/sap-client": "0.1.23",
+    "@cspeach/sap-client": "0.1.25",
     "@iarna/toml": "^2.2.5",
     "@inkjs/ui": "^2.0.0",
     "@inquirer/prompts": "^7.0.0",