@cspeach/cli 1.1.40 → 1.1.42

package/.cspeach/project.json

@@ -0,0 +1,4 @@
+{
+  "id": "1a6ac3e6",
+  "createdAt": "2026-10-16T13:54:35.800Z"
+}

package/dist/agent/loop.js

@@ -837,7 +837,9 @@ ${imageExpansion.error}`));
         sapSystemInfo = await getSapSystemInfo(params.ctx.adt, params.ctx.sapAlias);
         // ADT gap program, Part 1 — the system profile rides the same lazy probe.
         // Null (kill switch, no discovery and no CVERS) = today's behaviour.
-        params.ctx.systemProfile = await getSystemProfile(params.ctx.adt, params.ctx.sapAlias, sapSystemInfo);
+        // Part 2a D14: the turn's signal cancels the build's reads on Esc (null
+        // for this turn, nothing cached).
+        params.ctx.systemProfile = await getSystemProfile(params.ctx.adt, params.ctx.sapAlias, sapSystemInfo, { signal: params.signal });
         sapSystemBlock = renderSapSystemBlock(sapSystemInfo);
         sapProfileBlock = renderSapProfileBlock(params.ctx.systemProfile);
     }

package/dist/agent/tool-dispatch.js

@@ -9,7 +9,8 @@ import { shouldGateRule8, recordWriteOp, renderPlanSummary, getWriteOpsThisTurn,
 import { isCredentialHandoverApproved, markCredentialHandoverApproved, } from '../repl/credential-handover-gate.js';
 import { READER_TOOLS } from '../tools/subagent/reader-prompt.js';
 import { riskOf } from './risk-gate.js';
-import { NOT_ON_THIS_RELEASE, profileGate } from '../sap/profile-gate.js';
+import { NOT_ON_THIS_RELEASE, gateWithVerify } from '../sap/profile-gate.js';
+import { INTERRUPTED_TOOL_RESULT } from './repair-partial.js';
 const READER_TOOL_SET = new Set(READER_TOOLS);
 export async function dispatchTool(name, args, ctx) {
     const tool = getTool(name);
@@ -39,14 +40,19 @@ export async function dispatchTool(name, args, ctx) {
     }
     // ADT gap program, Part 1 (D4) — a definite "not on this release" is
     // answered here, before any SAP call, as a normal tool error. Unknown or
-    // no profile: today's path, untouched.
-    const gate = profileGate(tool, args, ctx.systemProfile ?? null);
+    // no profile: today's path, untouched. Part 2a D11 — a `no` is verified
+    // against a fresh profile once per alias before it is believed.
+    const gate = await gateWithVerify(tool, args, ctx);
     if (gate) {
         return {
             content: JSON.stringify({ error: NOT_ON_THIS_RELEASE, feature: gate.feature, message: gate.message }),
             is_error: true,
         };
     }
+    // Final review I-3 — the D11 re-check can take seconds of SAP reads; an Esc
+    // in that window must stop the call here, not let the handler run "as unknown".
+    if (ctx.signal?.aborted)
+        return { content: INTERRUPTED_TOOL_RESULT, is_error: true };
     // L1-6 R1-6 (owner decision 2026-09-21) — a call that hands the stored SAP
     // login to a local child process ALWAYS asks a human, once per session per
     // alias, even as the first mutating call of a turn (where Rule 8 below stays

package/dist/approvals/op-labels.js

@@ -1,3 +1,5 @@
+import { typeCode } from './risk-floor.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
 /**
  * Human-readable operation + object labels for the approval surfaces.
  *
@@ -36,7 +38,8 @@ const TYPE_WORDS = {
     TTYP: 'table type',
     MSAG: 'message class',
     DEVC: 'package',
-    ENHO: 'enhancement',
+    ENHO: 'BAdI implementation',
+    ENHS: 'BAdI enhancement spot',
     XSLT: 'transformation',
     SHLP: 'search help',
 };
@@ -49,6 +52,11 @@ export function humanType(type) {
     const key = type.trim().toUpperCase();
     if (TYPE_WORDS[key])
         return TYPE_WORDS[key];
+    // Part 2b D7 — the BAdI types read the same with a subtype ('ENHO/XHB').
+    // Every other type keeps today's label.
+    const code = typeCode(type);
+    if (code === 'ENHO' || code === 'ENHS')
+        return TYPE_WORDS[code];
     // Already a word (has a lowercase letter or a space)? use it verbatim.
     if (/[a-z ]/.test(type))
         return type;
@@ -60,6 +68,15 @@ export function verbLine(change) {
         .filter(Boolean)
         .join(' ');
 }
+/**
+ * Part 2b D7 — "Affects: <process>" for a change that names the standard SAP
+ * process it runs in (a BAdI implementation); null when it names none. The
+ * text comes from the model: control characters are removed.
+ */
+export function affectsLine(change) {
+    const t = sanitizeControlChars(String(change.affects ?? '')).trim();
+    return t ? `Affects: ${t}` : null;
+}
 /**
  * The transport to DISPLAY on the approval surface for one change — mirrors
  * how the write tools actually resolve it (traced in sap-write.ts, 2026-07-05

package/dist/approvals/render.js

@@ -1,7 +1,7 @@
 import { select, input } from '@inquirer/prompts';
 import chalk from 'chalk';
 import { riskReasonText, shownRiskReasons } from './risk-floor.js';
-import { verbLine, viewAffordance, toSourceLines } from './op-labels.js';
+import { verbLine, viewAffordance, toSourceLines, affectsLine } from './op-labels.js';
 import { shouldUseInk } from '../renderer/tty.js';
 import { approvalEmitter } from '../ui/approval-emitter.js';
 import { withInquirer } from '../repl/inquirer-guard.js';
@@ -114,15 +114,29 @@ export async function renderPlanGate(summary, changes, transport, effectiveRisk,
         if (shownReasons.length > 0) {
             facts.push(`Risk raised to ${effectiveRisk.level}: ${shownReasons.map(riskReasonText).join('; ')}`);
         }
-        const steps = visibleChanges.map((c, i) => `${i + 1}. ${verbLine(c)}`);
-        if (steps.length > MAX_STEPS) {
+        // Part 2b D7 — a step that names the process it runs in (a BAdI
+        // implementation) carries its "Affects:" row right under it. The card's
+        // step budget counts rows, and a step is never shown without its row.
+        // No affects anywhere: one row per step, exactly as before.
+        const steps = visibleChanges.map((c, i) => {
+            const affects = affectsLine(c);
+            return [`${i + 1}. ${verbLine(c)}`, ...(affects ? [`   ${affects}`] : [])];
+        });
+        const totalRows = steps.reduce((n, s) => n + s.length, 0);
+        if (totalRows > MAX_STEPS) {
             // Object names are model-supplied: neutralise control characters
             // before they reach scrollback (the card sanitises its own rows).
-            emitTrace(sanitizeControlChars(['Plan', ...steps.map((s) => `  ${s}`)].join('\n')));
-            facts.push(...steps.slice(0, MAX_STEPS), `${getGlyphs().more} ${steps.length - MAX_STEPS} more steps, listed above`);
+            emitTrace(sanitizeControlChars(['Plan', ...steps.flat().map((s) => `  ${s}`)].join('\n')));
+            let shown = 0;
+            let rows = 0;
+            while (shown < steps.length && (shown === 0 || rows + steps[shown].length <= MAX_STEPS)) {
+                rows += steps[shown].length;
+                shown += 1;
+            }
+            facts.push(...steps.slice(0, shown).flat(), `${getGlyphs().more} ${steps.length - shown} more steps, listed above`);
         }
         else {
-            facts.push(...steps);
+            facts.push(...steps.flat());
         }
         const res = await askConfirm({
             id: 'plan-gate',
@@ -162,6 +176,10 @@ async function classicPlanGate(summary, visibleChanges, transport, effectiveRisk
     }
     visibleChanges.forEach((c, i) => {
         console.log(`        ${chalk.dim(`${i + 1}.`)} ${verbLine(c)}`);
+        // Part 2b D7 — the process a BAdI implementation runs in, under its line.
+        const affects = affectsLine(c);
+        if (affects)
+            console.log(`           ${chalk.dim(affects)}`);
     });
     console.log('');
     const choice = await withInquirer(() => select({
@@ -193,8 +211,10 @@ export async function renderPerChangeApproval(change, effectiveRisk, transport)
     if (aff)
         choices.push({ value: 'diff', name: aff.label });
     choices.push({ value: 'skip', name: 'Skip (tell model why)' }, { value: 'cancel', name: 'Cancel turn' });
+    // Part 2b D7 — the process a BAdI implementation runs in, under the verb line.
+    const affects = affectsLine(change);
     const choice = await withInquirer(() => select({
-        message: `${objLabel} — apply?`,
+        message: `${objLabel} — apply?${affects ? `\n  ${chalk.dim(affects)}` : ''}`,
         default: 'apply',
         theme: inquirerTheme,
         choices,

package/dist/approvals/risk-floor.js

@@ -1,3 +1,11 @@
+/**
+ * Part 2b D7 — the type code of a change or id: trimmed, upper case, without a
+ * `/subtype` ('enho/xhb' → 'ENHO'). The ENHO risk floor, the affects_required
+ * refusal and the write tool's type binding all use it, so they always agree.
+ */
+export function typeCode(type) {
+    return String(type ?? '').trim().toUpperCase().split('/')[0].trim();
+}
 export function effectiveRisk(declared, changes, ctx) {
     let floor = declared;
     const raisedBy = [];
@@ -28,6 +36,13 @@ export function effectiveRisk(declared, changes, ctx) {
                 raisedBy.push('syntax_errors');
         }
     }
+    // Part 2b D7 — a BAdI implementation runs inside a standard SAP process:
+    // high (never auto-approved), and the reason is always shown.
+    if (changes.some((c) => typeCode(c.type) === 'ENHO')) {
+        raise('high', 'standard_process');
+        if (!raisedBy.includes('standard_process'))
+            raisedBy.push('standard_process');
+    }
     if (changes.some((c) => c.op === 'delete'))
         raise('medium', 'delete_op');
     // Round 4 item 8a — these were both labelled 'shared_transport', so a plan
@@ -58,6 +73,7 @@ const RISK_REASON_TEXT = {
     escalated_in_session: 'more than 5 changes in one plan',
     prod_namespace: 'the object is in a production namespace',
     syntax_errors: 'the last syntax check of this object found errors',
+    standard_process: 'this code runs inside a standard SAP process (a BAdI implementation)',
 };
 /** Round 8 item 4 — every code the floor can raise (each has plain words above). */
 export const RISK_REASON_CODES = Object.keys(RISK_REASON_TEXT);

package/dist/renderer/tool-labels.js

@@ -167,6 +167,9 @@ const RULES = {
     rules_propose: () => ({ verb: 'Check a proposed decision rule', object: 'nothing is saved' }),
     team_estate: (a) => ({ verb: 'Read estate inventory', object: str(a['packages']) ?? 'all packages' }),
     sap_badi_list: (a) => ({ verb: 'Searched BAdIs', object: shortRight(`"${str(a['query']) ?? ''}"`) }),
+    sap_badi_read: (a) => ({ verb: 'Read BAdI', object: shortRight([str(a['kind']), str(a['name'])].filter(Boolean).join(' ')) }),
+    sap_enhancement_options: (a) => ({ verb: 'Read enhancement options', object: shortRight([str(a['type']), str(a['name'])].filter(Boolean).join(' ')) }),
+    sap_create_badi_implementation: sapObject('Created BAdI implementation'),
     sap_snapshot_list: (a) => ({ verb: 'Listed snapshots', object: shortRight(str(a['name']) ?? '') }),
     sap_snapshot_read: sapObject('Read snapshot'),
     sap_snapshot_cleanup: () => ({ verb: 'Cleaned snapshots', object: '' }),
@@ -265,7 +268,7 @@ const PRESENT = {
     'Read snapshot': 'Reading snapshot of', 'Cleaned snapshots': 'Cleaning snapshots',
     'Created transport': 'Creating transport', 'Transport for': 'Finding transport for',
     'Listed transports': 'Listing transports', Released: 'Releasing', 'Created domain': 'Creating domain',
-    'Created data element': 'Creating data element', Locked: 'Locking', Unlocked: 'Unlocking',
+    'Created data element': 'Creating data element', 'Read BAdI': 'Reading BAdI', 'Read enhancement options': 'Reading enhancement options of', 'Created BAdI implementation': 'Creating BAdI implementation', Locked: 'Locking', Unlocked: 'Unlocking',
     Published: 'Publishing', Unpublished: 'Unpublishing', Messages: 'Maintaining messages in',
     'Number range': 'Maintaining number range', Question: 'Asking', 'Updated todos': 'Updating todos',
     'Ran skill': 'Running skill', 'Read document': 'Reading document', Fetched: 'Fetching',

package/dist/sap/profile-features.js

@@ -26,6 +26,10 @@ export const FEATURES = Object.freeze({
     'datapreview.freestyle': { label: 'SQL data preview', collection: `${A}/datapreview/freestyle`, provenOnOurBox: true },
     'msag': { label: 'Message classes', collection: `${A}/messageclass`, provenOnOurBox: true },
     'nrob': { label: 'Number range objects', collection: `${A}/numberranges/objects`, provenOnOurBox: true },
+    // Part 2b: no `since`. The gap table's "enhancement editor 1809, BAdI editor
+    // 2020" has no cited source (Part 1 I1 rule): listed = yes, else unknown.
+    'enh.badiImplementations': { label: 'BAdI implementations', collection: `${A}/enhancements/enhoxhb`, provenOnOurBox: true },
+    'enh.badiSpots': { label: 'BAdI enhancement spots', collection: `${A}/enhancements/enhsxsb`, provenOnOurBox: true },
 });
 export const FEATURE_IDS = Object.freeze(Object.keys(FEATURES));
 export function isFeatureId(s) {
@@ -37,6 +41,7 @@ export const OBJECT_TYPE_FEATURE = Object.freeze({
     DDLS: 'cds.ddls', CDS: 'cds.ddls', DDLX: 'cds.ddlx', DCLS: 'cds.dcls',
     TABL: 'ddic.tables', STRU: 'ddic.structures', DOMA: 'ddic.domains', DTEL: 'ddic.dataelements',
     MSAG: 'msag', NROB: 'nrob',
+    ENHO: 'enh.badiImplementations', ENHS: 'enh.badiSpots',
 });
 /** The RAP/CDS subset: the only types a READ is ever refused for (R6). */
 export const READ_GATED_TYPES = new Set(['BDEF', 'SRVD', 'SRVB', 'DDLS', 'CDS', 'DDLX', 'DCLS']);

package/dist/sap/profile-gate.js

@@ -1,5 +1,6 @@
 import { FEATURES, OBJECT_TYPE_FEATURE, READ_GATED_TYPES } from './profile-features.js';
-import { supports, systemLabel } from './system-profile.js';
+import { getSystemProfile, supports, systemLabel } from './system-profile.js';
+import { getSapSystemInfo } from './system-info.js';
 export const NOT_ON_THIS_RELEASE = 'not_on_this_release';
 /** For tools whose `type` argument names an object type (url-mapper token). */
 export function byObjectType(args) {
@@ -65,3 +66,40 @@ export function pinHiddenTools(session, alias, tools, profile) {
     session.profile_hidden_tools = { alias, names };
     return names;
 }
+// ── Part 2a — the three profile gates (owner decisions D11–D13) ────────────
+const verifiedThisProcess = new Set(); // alias → a fresh rebuild returned a profile after a `no`
+export function _resetVerifiedForTests() { verifiedThisProcess.clear(); }
+/**
+ * D11 — a definite `no` is checked against a fresh profile once per alias per
+ * process before it is believed: the cache is up to 30 days old and the system
+ * may have been upgraded. The pinned tool list is not touched (R7).
+ */
+export async function gateWithVerify(tool, args, ctx) {
+    const first = profileGate(tool, args, ctx.systemProfile ?? null);
+    if (!first || verifiedThisProcess.has(ctx.sapAlias))
+        return first;
+    const info = await getSapSystemInfo(ctx.adt, ctx.sapAlias, { fresh: true });
+    ctx.systemProfile = await getSystemProfile(ctx.adt, ctx.sapAlias, info, { fresh: true, signal: ctx.signal });
+    // Only a rebuild that returned a profile counts as verified. An aborted or
+    // failed one leaves the alias unmarked (this call runs as unknown), so the
+    // next refusal of a stale cached `no` re-checks: one attempt per refusal.
+    if (ctx.systemProfile)
+        verifiedThisProcess.add(ctx.sapAlias);
+    return profileGate(tool, args, ctx.systemProfile ?? null);
+}
+/** D12 — the changes of a request_approval call whose type's feature is a definite no (after verify). */
+export async function approvalRefusedByProfile(changes, ctx) {
+    const out = [];
+    for (const c of changes) {
+        if (!['create', 'modify', 'delete'].includes(c.op))
+            continue;
+        const g = await gateWithVerify({ name: 'request_approval', requires: byObjectType }, { type: c.type }, ctx);
+        if (g)
+            out.push({ object: c.object, type: String(c.type ?? ''), message: g.message });
+    }
+    return out;
+}
+/** D13 — a resumed session pins its hidden tools again on its first turn. */
+export function clearProfilePin(session) {
+    delete session.profile_hidden_tools;
+}

package/dist/sap/system-info.js

@@ -30,16 +30,21 @@ const memCache = new Map();
  * Top-level entry point. Returns cached info when available, queries
  * CVERS once otherwise, persists the result, returns null on any error.
  */
-export async function getSapSystemInfo(adt, alias) {
-    // Layer 1 — process memory
-    const cached = memCache.get(alias);
-    if (cached)
-        return cached;
-    // Layer 2 — disk
-    const fromDisk = readDiskCache(alias);
-    if (fromDisk) {
-        memCache.set(alias, fromDisk);
-        return fromDisk;
+export async function getSapSystemInfo(adt, alias, opts = {}) {
+    // Part 2a D11 — `fresh` skips layers 1 and 2 (a definite "no" is checked
+    // against the live system before it is believed); the live path below is
+    // unchanged and refreshes both caches on success.
+    if (!opts.fresh) {
+        // Layer 1 — process memory
+        const cached = memCache.get(alias);
+        if (cached)
+            return cached;
+        // Layer 2 — disk
+        const fromDisk = readDiskCache(alias);
+        if (fromDisk) {
+            memCache.set(alias, fromDisk);
+            return fromDisk;
+        }
     }
     // Layer 3 — live query
     const startedAt = Date.now();

package/dist/sap/system-profile.js

@@ -152,25 +152,46 @@ export async function getSystemProfile(adt, alias, info, opts = {}) {
         }
     }
     const timeoutMs = opts.readTimeoutMs ?? READ_TIMEOUT_MS;
+    // Part 2a D14 — an abort is not a result. Esc during the build returns null
+    // and touches NOTHING (no memory cache, no disk cache, no attempt marker,
+    // no audit row), so the next turn builds again. Any other failure keeps the
+    // path below exactly.
+    const signal = opts.signal;
+    if (signal?.aborted)
+        return null;
     const startedAt = Date.now();
     try {
         let discovery = null;
+        // The GET carries a socket timeout and the turn's signal, so Esc (or a
+        // dead socket) frees the connection's request slot; `bounded` stays as the
+        // outer wall-clock guard for an adt that does not honour either.
         try {
-            discovery = await bounded(adt.discovery(), timeoutMs);
+            discovery = await bounded(adt.discovery({ timeoutMs, signal }), timeoutMs);
         }
-        catch {
+        catch (err) {
+            if (isAbort(err, signal))
+                return null;
             discovery = null;
         }
+        if (signal?.aborted)
+            return null;
         let sp = null;
         if (info?.components?.['SAP_BASIS'] && conn?.post) {
             try {
-                const resp = await bounded(conn.post('/sap/bc/adt/datapreview/freestyle?rowNumber=5', SP_SQL, 'text/plain', 'application/vnd.sap.adt.datapreview.table.v1+xml'), timeoutMs);
+                // The signal rides post's 6th argument with no timeoutMs (the default
+                // socket timeout, as before). Without a signal the call is unchanged.
+                const spArgs = ['/sap/bc/adt/datapreview/freestyle?rowNumber=5', SP_SQL, 'text/plain', 'application/vnd.sap.adt.datapreview.table.v1+xml'];
+                const resp = await bounded(signal ? conn.post(...spArgs, undefined, signal) : conn.post(...spArgs), timeoutMs);
                 if (resp && resp.status === 200)
                     sp = parseExtRelease(resp.body);
             }
-            catch {
+            catch (err) {
+                if (isAbort(err, signal))
+                    return null;
                 sp = null;
             }
+            if (signal?.aborted)
+                return null;
         }
         const profile = profileFrom({ alias, baseUrl, info, sp, discovery, now: now() });
         if (!profile) {
@@ -199,6 +220,10 @@ export async function getSystemProfile(adt, alias, info, opts = {}) {
         return null;
     }
 }
+/** True for an `AbortError` from the request, or once the turn's signal has fired. */
+function isAbort(err, signal) {
+    return signal?.aborted === true || err?.name === 'AbortError';
+}
 function sameSystem(p, baseUrl, info) {
     if (baseUrl && p.baseUrl && p.baseUrl !== baseUrl)
         return false;

package/dist/session/resume.js

@@ -14,6 +14,7 @@ import { interruptedPickerLine } from './interrupt-reason.js';
 import stringWidth from 'string-width';
 import { STANDALONE_ALIAS } from '../tools/index.js';
 import { loadConfig, resolveStandalone } from '../config/loader.js';
+import { clearProfilePin } from '../sap/profile-gate.js';
 /** inquirer's Ctrl+C / force-close rejection. */
 function isPromptCancel(err) {
     return err?.name === 'ExitPromptError';
@@ -99,6 +100,8 @@ export async function runResume(id, opts = {}) {
     let session;
     try {
         session = await loadSession(targetId);
+        // Part 2a D13 — re-pin the hidden tools on the first connected turn.
+        clearProfilePin(session);
     }
     catch (err) {
         console.error('\n' + formatFailure({ what: 'Could not load the session', detail: [err.message], next: 'cspeach --resume  (pick from the list)' }));

package/dist/tools/approval.js

@@ -1,7 +1,7 @@
 import chalk from 'chalk';
 import { registerTool } from './index.js';
 import { isHeadless, shouldUseInk } from '../renderer/tty.js';
-import { effectiveRisk, riskReasonText } from '../approvals/risk-floor.js';
+import { effectiveRisk, riskReasonText, typeCode } from '../approvals/risk-floor.js';
 import { objectsWithSyntaxErrors } from './syntax-state.js';
 import { noteWriteTransport } from '../repl/current-transport.js';
 /**
@@ -27,6 +27,7 @@ import { markPlanGateApproved } from '../repl/rule8-detector.js';
 import { getEffectiveWriteMode } from '../repl/mode-cycle.js';
 import { getCurrentTransport } from '../repl/current-transport.js';
 import { displayTransport } from '../approvals/op-labels.js';
+import { NOT_ON_THIS_RELEASE, approvalRefusedByProfile } from '../sap/profile-gate.js';
 import { isGuardedRunActive, getCurrentPhaseWrites, notePlanDeviation, PLAN_DEVIATION_DETAIL, } from '../commands/plan-gate.js';
 /**
  * Advisory-only replacement for the per-change approval gauntlet.
@@ -139,6 +140,7 @@ registerTool({
                         type: { type: 'string' },
                         diff: { type: 'string', description: 'For a CREATE op this MUST be the exact, complete source that will be written — verbatim, character-for-character, NOT a description, summary, or paraphrase. It is shown to the developer in the approval box as the exact thing they are approving, so a one-line summary here means they approve a write they cannot inspect. For a MODIFY op, the real unified diff of the change (again verbatim, not a description).' },
                         package: { type: 'string', description: 'Target package (development class) for the object, if known — shown on the approval box' },
+                        affects: { type: 'string', description: 'The standard SAP process this change runs inside, in plain words — REQUIRED for type ENHO (a BAdI implementation): name the BAdI, its spot and what calls it, e.g. "purchase order check before save (BAdI ME_PROCESS_PO_CUST, spot ES_MM_PO)". Shown on the approval card.' },
                     },
                     required: ['op', 'object', 'type'],
                 },
@@ -184,6 +186,23 @@ registerTool({
                 is_error: true,
             };
         }
+        // Part 2a D12 — never draw a card for a write this release cannot take.
+        if (ctx.systemProfile) {
+            const refused = await approvalRefusedByProfile(args.changes ?? [], ctx);
+            if (refused.length > 0) {
+                return {
+                    content: JSON.stringify({ error: NOT_ON_THIS_RELEASE, approved: false, changes: refused,
+                        message: `This system cannot take ${refused.length === 1 ? 'this change' : 'these changes'}: ${refused.map((r) => `${r.type} ${r.object} — ${r.message}`).join('; ')}` }),
+                    is_error: true,
+                };
+            }
+        }
+        // Part 2b D7 — an enhancement change never reaches a card without naming the process it runs in.
+        const unnamed = (args.changes ?? []).filter((c) => typeCode(c.type) === 'ENHO' && !String(c.affects ?? '').trim());
+        if (unnamed.length > 0) {
+            return { content: JSON.stringify({ error: 'affects_required', approved: false, changes: unnamed.map((c) => c.object),
+                    message: 'A BAdI implementation changes a standard SAP process. Say which one in changes[].affects (the BAdI, its spot and what calls it), then ask again.' }), is_error: true };
+        }
         let cfg = await loadConfig();
         // Task 2 (ux-wave1) — the approval flow reads the EFFECTIVE write mode:
         // config overlaid by the session override, clamped to the active alias's

package/dist/tools/sap-read.js

@@ -20,12 +20,15 @@
  *   runUnitTest(type, name)
  *   odataTest(servicePath, entity?, method?)
  *   badiList(query, enhancementSpot?, maxResults?)
+ *   readBadiSpot(name) / readBadiImplementation(name)   (Part 2b)
+ *   enhancementOptions(type, name)                      (Part 2b)
  */
 import { registerTool } from './index.js';
 import { byObjectTypeForRead } from '../sap/profile-gate.js';
 import { normaliseSyntaxResult, checkSyntax } from './verify.js';
 import { recordSyntaxCheck } from './syntax-state.js';
 import { spillToolResult } from './result-spill.js';
+import { SapError } from '@cspeach/sap-client';
 // -----------------------------------------------------------------------
 // Task 17 (spec D12, ruling F18) — model-facing formats.
 // -----------------------------------------------------------------------
@@ -746,7 +749,7 @@ registerTool({
 // -----------------------------------------------------------------------
 registerTool({
     name: 'sap_badi_list',
-    description: 'Search for BAdI definitions and enhancement spots by name pattern (supports * wildcard), with optional enhancement-spot drill-down.',
+    description: 'Search for BAdI definitions and enhancement spots by name pattern (supports * wildcard), with optional enhancement-spot drill-down. Classic SE19 implementations are not available through ADT.',
     isMutating: false,
     requiresSap: true,
     input_schema: {
@@ -772,3 +775,78 @@ registerTool({
         return { content: JSON.stringify(result, null, 2) };
     },
 });
+// -----------------------------------------------------------------------
+// 19. sap_badi_read (Part 2b) — one new-style spot or implementation
+// -----------------------------------------------------------------------
+const isSapNotFound = (e) => e instanceof SapError && e.httpStatus === 404;
+const notFound = (detail) => ({ content: JSON.stringify({ error: 'not_found', detail }), is_error: true });
+registerTool({
+    name: 'sap_badi_read',
+    description: 'Read one new-style BAdI enhancement spot (its BAdI definitions and their interfaces) or one BAdI implementation '
+        + '(its spot, BAdI definition and implementing class). Classic SE18/SE19 objects are not available through ADT.',
+    isMutating: false,
+    requiresSap: true,
+    input_schema: {
+        type: 'object',
+        properties: {
+            kind: { type: 'string', enum: ['spot', 'implementation'], description: 'spot = an enhancement spot; implementation = a BAdI implementation' },
+            name: { type: 'string', description: 'Name of the spot or implementation' },
+        },
+        required: ['kind', 'name'],
+    },
+    handler: async (args, ctx) => {
+        const name = String(args.name ?? '').trim().toUpperCase();
+        const spot = args.kind === 'spot';
+        try {
+            const info = spot ? await ctx.adt.readBadiSpot(args.name) : await ctx.adt.readBadiImplementation(args.name);
+            return { content: JSON.stringify(info, null, 2) };
+        }
+        catch (e) {
+            if (!isSapNotFound(e))
+                throw e;
+            return notFound(spot
+                ? `${name} is not a new-style BAdI enhancement spot. Classic BAdI definitions (SE18 without an enhancement spot) are not available through ADT.`
+                : `${name} is not a new-style BAdI implementation. A classic SE19 implementation is not available through ADT; CSPeach does not create or change those.`);
+        }
+    },
+});
+// -----------------------------------------------------------------------
+// 20. sap_enhancement_options (Part 2b) — implicit enhancement options, read only
+// -----------------------------------------------------------------------
+registerTool({
+    name: 'sap_enhancement_options',
+    description: 'List the implicit enhancement options of a program, class or function group (full name, description, mode). '
+        + 'Read only: CSPeach does not write implicit enhancements.',
+    isMutating: false,
+    requiresSap: true,
+    input_schema: {
+        type: 'object',
+        properties: {
+            type: { type: 'string', enum: ['PROG', 'CLAS', 'FUGR'], description: 'Object type: PROG, CLAS or FUGR' },
+            name: { type: 'string', description: 'Object name' },
+            max: { type: 'number', description: 'Most options to return (default 200)' },
+        },
+        required: ['type', 'name'],
+    },
+    handler: async (args, ctx) => {
+        const type = String(args.type ?? '').trim().toUpperCase();
+        const name = String(args.name ?? '').trim().toUpperCase();
+        const max = Number.isFinite(args.max) && args.max >= 1 ? Math.floor(args.max) : 200;
+        let all;
+        try {
+            all = await ctx.adt.enhancementOptions(type, args.name);
+        }
+        catch (e) {
+            if (!isSapNotFound(e))
+                throw e;
+            return notFound(`${type} ${name} does not exist.`);
+        }
+        return {
+            content: JSON.stringify({
+                object: name, type, count: all.length,
+                options: all.slice(0, max).map((o) => ({ full_name: o.fullName, description: o.description, mode: o.mode })),
+                ...(all.length > max ? { truncated: true } : {}),
+            }),
+        };
+    },
+});