@cspeach/cli 1.1.47 → 1.1.49

package/dist/agent/level.js

@@ -26,7 +26,7 @@ export function parseLevel(raw) {
 export const LEVEL_INVARIANT = `The level changes how much you explain, never what you found: findings, numbers, object names, warnings, risks, approvals, plan and safety prompts stay exact. It does not change what this person is allowed to do in SAP.`;
 export const LEVEL_SENTENCES = Object.freeze({
     learning: 'You\'re talking to a developer who is still building experience. Explain the why, not just the what. The first time a technical term comes up, say in a few words what it means. When you show a fix, point out the pattern behind it so they can use it again. Stay encouraging and concrete; never talk down. Just before you ask them to approve anything or answer a yes/no question, say in one or two plain sentences what will happen, what could go wrong and how it can be undone, then ask. Keep it short; don\'t lecture.',
-    functional: 'You\'re talking to someone who knows SAP and the business process well but is not a developer. Start with what it means for the business: which documents, amounts, users or reports are affected. Avoid code and technical terms unless they are needed; when one is needed, explain it in plain words. Show code only when they ask for it. When a code change is needed, don\'t hand it to a workflow: write a developer request to the project folder as cspeach-out/developer-request-<object-or-topic>.md (if that name is taken, add -2, -3 and so on) with the sections Summary, What we found, Proposed change, How to test and Open questions, written so a developer can act on it without asking anything; then tell them where it is and that a developer can open it in CSPeach and continue from it. Hand off to a workflow only if they clearly ask to make the change themselves. Just before you ask them to approve anything or answer a yes/no question, say in one or two plain sentences what will happen, what could go wrong and how it can be undone, then ask. Keep it short; don\'t lecture.',
+    functional: 'You\'re talking to a developer who wants the business view first. Start with what it means for the business: which documents, amounts, users or reports are affected. Avoid technical terms unless they are needed; when one is needed, explain it in plain words. Show code only when they ask for it. If they ask you to write it up for a developer, write cspeach-out/developer-request-<object-or-topic>.md (if that name is taken, add -2, -3 and so on) with the sections Summary, What we found, Proposed change, How to test and Open questions. Just before you ask them to approve anything or answer a yes/no question, say in one or two plain sentences what will happen, what could go wrong and how it can be undone, then ask. Keep it short; don\'t lecture.',
 });
 // ---- pinned: level text composition ----
 /** The text appended under a "Who you're talking to" heading; null for developer (today's behaviour). */

package/dist/agent/loop.js

@@ -72,6 +72,7 @@ import { loadWatchdogConfig, evaluateWatchdog } from './turn-watchdog.js';
 import { maybeBuildProjectContext } from './maybe-build-project-context.js';
 import { buildSapConnectionContext } from './sap-connection-adapter.js';
 import { getCurrentTransport } from '../repl/current-transport.js';
+import { projectTransport } from '../register/project-transport.js';
 import { collectTurnAssistantText } from './turn-assistant-text.js';
 import { checkAndMark, newGuardState } from './parallel-write-guard.js';
 import { userPromptText } from '../session/user-prompt.js';
@@ -116,12 +117,10 @@ const SAVE_HOOK_SKILLS = new Set([
     'abap-upgrade-fix',
     'abap-upgrade-verify',
     'abap-upgrade-merge',
-    // 2026-05-09: CCA pipeline manifest envelopes. /abap-cca-merge produces
-    // a consolidated cca-assessment from N parallel consultant slices.
     // 2026-10-06: the thin /abap-cca (1.1.31) reads the estate inventory and
     // writes no envelope, so it is no longer a save-hook skill. An old
     // cca-manifest in a turn is still offered through detectArtifactSkill.
-    'abap-cca-merge',
+    // 2026-10-20: /abap-cca-merge cut (drift spec §3.6); its name aliases to abap-cca.
     // 2026-05-10: v0.7 trio chain. /abap-modernize emits modernize-result;
     // /abap-test emits test-coverage. Both accept cca-assessment via --from
     // and can fan out into further chains after their own envelope saves.
@@ -408,7 +407,7 @@ export async function maybeOfferSave(p) {
     // the output carried a complete csforge:plan-manifest block. The label
     // stays the primary trigger — it is authoritative for prose-extracted
     // artefacts with no inline marker (spec-gap / design / estimate) and keeps
-    // merge-skill provenance exact (abap-cca-merge saves as abap-cca-merge).
+    // merge-skill provenance exact (abap-upgrade-merge saves as abap-upgrade-merge).
     // When the label would NOT fire, a recognizable manifest block in the
     // output resolves the registry skill instead (detectArtifactSkill), so a
     // misroute can no longer silently lose the artifact.
@@ -925,6 +924,8 @@ ${imageExpansion.error}`));
         const sapConnection = params.ctx.sapAlias
             ? buildSapConnectionContext(params.ctx.sapAlias, sapSystemInfo, {
                 currentTransport: getCurrentTransport() ?? null,
+                // Task 6 (project view): the project request of this folder; null outside a project.
+                projectTransport: projectTransport(params.ctx.cwd),
             })
             : null;
         projectContextBlock = await maybeBuildProjectContext({
@@ -1106,7 +1107,7 @@ ${imageExpansion.error}`));
     session.turn_seq = (session.turn_seq ?? Math.max(turnNumber - 1, session.lastAutoCompactTurn ?? 0)) + 1;
     // Snapshot session.messages.length at turn start so the save hook can
     // walk every assistant message added during this turn — not just the
-    // final one. Skills like /abap-cca-merge emit their manifest in an early
+    // final one. Skills like /abap-upgrade-merge emit their manifest in an early
     // message before a closing ask_question widget; the final wrap-up
     // message ends the turn but doesn't carry the manifest. See
     // ./turn-assistant-text.ts for the full rationale.
@@ -1932,7 +1933,7 @@ ${imageExpansion.error}`));
             // a background block on the next REPL prompt.
             //
             // 2026-05-12: collect text from ALL assistant messages added during
-            // this turn, not just the final one. Skills like /abap-cca-merge emit
+            // this turn, not just the final one. Skills like /abap-upgrade-merge emit
             // their manifest in an early message before a closing ask_question
             // widget; the final wrap-up message ends the turn but doesn't
             // carry the manifest. See ./turn-assistant-text.ts for details.

package/dist/agent/sap-connection-adapter.js

@@ -34,6 +34,8 @@ export function buildSapConnectionContext(alias, systemInfo, state = {}) {
         alias,
         system: toSummary(systemInfo),
         currentTransport: state.currentTransport ?? null,
+        // Only in a project folder: a context without one stays as it was, key for key.
+        ...(state.projectTransport ? { projectTransport: state.projectTransport } : {}),
         activeScope: toActiveScope(state),
         recentObjects: state.recentObjects ?? [],
     };

package/dist/agent/system-prompt.js

@@ -47,7 +47,7 @@ export function buildReaderSystemPrompt(opts) {
  * Chat lane (spec 2026-10-17 D3) — one block, the pinned chat prompt, as the
  * proxy sends it for the `_chat` skill header. The coding-workflow preamble is
  * NOT sent on chat turns. A non-professional style is appended to that block;
- * a non-developer level (§10 D14) follows the style text.
+ * a non-default level (§10 D14) follows the style text.
  */
 export function buildChatSystemPrompt(opts, style = DEFAULT_STYLE, level = DEFAULT_LEVEL) {
     const marker = opts.cacheMarkers ? { cache_control: { type: 'ephemeral' } } : {};
@@ -62,7 +62,7 @@ export function buildChatSystemPrompt(opts, style = DEFAULT_STYLE, level = DEFAU
  * has no SKILL.md, so it never reaches the skill source (a lookup would fail);
  * nor does the built-in `_chat` (D3). A non-professional `style` (D9) is
  * appended to the END of the last block — professional changes nothing, and a
- * reader (which reports facts) never gets style. A non-developer `level`
+ * reader (which reports facts) never gets style. A non-default `level`
  * (§10 D14) follows the style text; developer changes nothing; a reader never
  * gets it.
  */

package/dist/agent/tool-dispatch.js

@@ -21,17 +21,24 @@ export const CHAT_UNIT_TEST_REASON = 'This chat reads but never runs code on SAP
 export const CHAT_DISPATCH_SKILL_REASON = 'In this chat, dispatch_skill is not available. To start a guided workflow, call hand_off with the workflow name and a clear request.';
 /** A call carrying an approval_id in chat — approvals belong to workflows, never to chat. */
 export const CHAT_APPROVAL_ID_REASON = 'This chat never uses an approval. To make this change, call hand_off with the right workflow and a clear request — the workflow asks before it writes.';
+/**
+ * team_lane_move in chat (Task 4, 2026-10-20) — listed like every tool, refused
+ * here. Moving packages between people is a lead's decision with its own card;
+ * in chat the lead is given the command instead.
+ */
+export const CHAT_LANE_MOVE_REASON = 'In this chat, packages are not moved between people. The lead runs: cspeach team lane move --packages <names> --to <name> --reason "<why>"';
 /**
  * Tools refused in chat beyond the generic rule: the two smokes write SAP
  * data over OData although requiresSap is false; sap_run_unit_test runs code
  * that can COMMIT; dispatch_skill could queue any slash command (hand_off is
- * chat's switch, D5).
+ * chat's switch, D5); team_lane_move writes the team project's lanes (Task 4).
  */
 const CHAT_EXTRA_REFUSED = new Map([
     ['fiori_draft_smoke', CHAT_READ_ONLY_REASON],
     ['cap_link_smoke', CHAT_READ_ONLY_REASON],
     ['sap_run_unit_test', CHAT_UNIT_TEST_REASON],
     ['dispatch_skill', CHAT_DISPATCH_SKILL_REASON],
+    ['team_lane_move', CHAT_LANE_MOVE_REASON],
 ]);
 /**
  * Chat lane refusal set (D-F): WRITE_TOOLS ∪ {request_approval} ∪ every tool
@@ -256,6 +263,11 @@ function declined(r) {
 export function isLocalProjectWork(tool, args) {
     if (tool.category === 'filesystem')
         return true;
+    // Task 4 (2026-10-20) — every project tool writes project files behind its
+    // own card (team_lane_move) or reads only: a second lane move in one turn
+    // never gets a batch card on top of its own card. No project tool reaches SAP.
+    if (tool.category === 'project')
+        return true;
     // 2026-10-02 — fiori_deploy mode "test" (the default) writes nothing to SAP:
     // the backend validates the upload and keeps nothing. Not a batch write, so
     // a deploy phase shows ONE approval (the real deploy's request_approval),

package/dist/approvals/op-labels.js

@@ -1,5 +1,8 @@
 import { typeCode } from './risk-floor.js';
 import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { wrapRows } from '../renderer/wrap-rows.js';
+import { shownUpTo } from '../register/atc-file.js';
+import { transportForWrite } from '../register/project-transport.js';
 /**
  * Human-readable operation + object labels for the approval surfaces.
  *
@@ -89,6 +92,32 @@ export function affectsLine(change) {
     const t = sanitizeControlChars(String(change.affects ?? '')).trim();
     return t ? `Affects: ${t}` : null;
 }
+/** Task 7 — the longest behaviour text a card shows, and the most rows it takes. */
+const BEHAVIOUR_MAX = 240;
+/** Words that mean "nothing changes": no row. */
+const NOTHING_CHANGES = /^(none|no change|n\/a)\.?$/i;
+export const BEHAVIOUR_MAX_ROWS = 3;
+/**
+ * Task 7 — "Behaviour: <text>" for a change that says what callers or users
+ * will see differently; null when absent, empty, or 'none' / 'no change' /
+ * 'n/a'. The text is the model's: escape sequences and control characters
+ * go, whitespace collapses, cut at 240 code points.
+ */
+export function behaviourText(change) {
+    // shownUpTo drops whole escape sequences first (a lone sanitizeControlChars
+    // pass would leave their '[31m' tails), then every control character.
+    // The cut counts code points, so it never leaves half a surrogate pair.
+    const flat = Array.from(shownUpTo(String(change.behaviour ?? ''), Number.POSITIVE_INFINITY));
+    const t = flat.length > BEHAVIOUR_MAX ? `${flat.slice(0, BEHAVIOUR_MAX).join('')}…` : flat.join('');
+    if (!t || NOTHING_CHANGES.test(t))
+        return null;
+    return `Behaviour: ${t}`;
+}
+/** Task 7 — the behaviour text as the rows it is drawn on at `width` cells (at most 3); [] when none. */
+export function behaviourLines(change, width) {
+    const t = behaviourText(change);
+    return t ? wrapRows(t, width, BEHAVIOUR_MAX_ROWS) : [];
+}
 /** Part 3 D12 — the longest request description a release card shows. */
 const RELEASE_DESCRIPTION_MAX = 60;
 const RELEASE_LAST_LINE = 'Cannot be undone. Once released, the request can move to the other systems on the transport route.';
@@ -136,17 +165,27 @@ export function releaseLines(change) {
  *     show a Transport segment.
  * When nothing is resolvable, return undefined and the caller OMITS the
  * segment — no "new (session)" promise (a $TMP write never creates one).
+ *
+ * Task 8 (B11) — two more facts, both absent → today's result:
+ *   - `owning`: the request that already holds the object (request_approval's
+ *     lookup). A modify/delete is forced into it by resolveWriteTransport, so
+ *     it wins and says why: "(object already locked here)" — never worded as
+ *     if the person chose it.
+ *   - `project`: the request of the project joined in this folder. Every
+ *     write tool uses it when the change names none (before the session
+ *     transport), so it shows as "<id> (project)" — one order for card and write:
+ *     owning lock (modify/delete) ?? explicit ?? project ?? session.
+ *
+ * Task 6 (project view): the choice itself is `transportForWrite`
+ * (register/project-transport.ts), the one the write tools call too. This
+ * card hands it the session request for a create only. 'resolve' writes
+ * (set_source, update_method, delete) never use the session request; the
+ * class-include, message and text-elements writes do fall back to it when no
+ * project request is set, and their modify card does not show it — today's
+ * card, kept byte for byte.
  */
-export function displayTransport(op, explicit, session) {
-    switch (op) {
-        case 'create':
-            return explicit ?? session ?? undefined;
-        case 'modify':
-        case 'delete':
-            return explicit;
-        default: // activate / release / run
-            return undefined;
-    }
+export function displayTransport(op, explicit, session, owning, project) {
+    return transportForWrite({ op, explicit, owning, project, session: op === 'create' ? session : undefined }).label;
 }
 /**
  * A create/delete "diff" is really a source dump (all-adds, or plain source).

package/dist/approvals/render.js

@@ -1,7 +1,8 @@
 import { select, input } from '@inquirer/prompts';
 import chalk from 'chalk';
 import { riskReasonText, shownRiskReasons } from './risk-floor.js';
-import { verbLine, viewAffordance, toSourceLines, affectsLine, releaseLines } from './op-labels.js';
+import { verbLine, viewAffordance, toSourceLines, affectsLine, releaseLines, behaviourText, behaviourLines } from './op-labels.js';
+import { uiWidth } from '../renderer/ui-width.js';
 import { shouldUseInk } from '../renderer/tty.js';
 import { approvalEmitter } from '../ui/approval-emitter.js';
 import { withInquirer } from '../repl/inquirer-guard.js';
@@ -11,6 +12,7 @@ import { emitTrace } from '../renderer/trace.js';
 import { getGlyphs } from '../renderer/glyphs.js';
 import { paint } from '../renderer/theme.js';
 import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { collapseImplicitActivates, looksLikeUnifiedDiff } from './visible-changes.js';
 import { withSpinnerSuspended } from '../renderer/tool-widget.js';
 // Piece 2 §1.1 — the brand accent comes from the theme role, not a legacy hex.
 const peach = (s) => paint('brand', s);
@@ -73,19 +75,7 @@ function colorizeDiff(diff) {
  * compressed. This is what fixes the "what 2 changes?" complaint when the
  * model declares modify+activate of the same object.
  */
-function collapseImplicitActivates(changes) {
-    const writeKeys = new Set();
-    for (const c of changes) {
-        if (c.op === 'modify' || c.op === 'create') {
-            writeKeys.add(`${c.type}:${c.object}`);
-        }
-    }
-    return changes.filter((c) => {
-        if (c.op !== 'activate')
-            return true;
-        return !writeKeys.has(`${c.type}:${c.object}`);
-    });
-}
+// collapseImplicitActivates lives in ./visible-changes.ts (Task 9: request_approval uses it too).
 export async function renderPlanGate(summary, changes, transport, effectiveRisk, system) {
     const visibleChanges = collapseImplicitActivates(changes);
     const visibleCount = visibleChanges.length;
@@ -122,7 +112,9 @@ export async function renderPlanGate(summary, changes, transport, effectiveRisk,
         // "Apply all" mints it without its per-change card.
         const steps = visibleChanges.map((c, i) => {
             const affects = affectsLine(c);
-            return [`${i + 1}. ${verbLine(c)}`, ...(affects ? [`   ${affects}`] : []), ...releaseLines(c).map((l) => `   ${l}`)];
+            // Task 7 — "Behaviour: …" is one fact (the card wraps it) and one row of the budget.
+            const behaviour = behaviourText(c);
+            return [`${i + 1}. ${verbLine(c)}`, ...(affects ? [`   ${affects}`] : []), ...(behaviour ? [`   ${behaviour}`] : []), ...releaseLines(c).map((l) => `   ${l}`)];
         });
         // Fix round 1 (owner ruling) — a release step is ALWAYS on the card, with
         // its fact lines, wherever it sits: its rows have their own budget and
@@ -202,6 +194,9 @@ async function classicPlanGate(summary, visibleChanges, transport, effectiveRisk
         const affects = affectsLine(c);
         if (affects)
             console.log(`           ${chalk.dim(affects)}`);
+        // Task 7 — what callers or users will see differently, under its line.
+        for (const l of behaviourLines(c, uiWidth() - 11))
+            console.log(`           ${chalk.dim(l)}`);
         // Part 3 D12 / F-13 — a release row's facts, under its line.
         for (const l of releaseLines(c))
             console.log(`           ${chalk.dim(l)}`);
@@ -240,8 +235,10 @@ export async function renderPerChangeApproval(change, effectiveRisk, transport)
     const affects = affectsLine(change);
     // Part 3 D12 — a release card's facts, under the verb line.
     const release = releaseLines(change).map((l) => `\n  ${chalk.dim(l)}`).join('');
+    // Task 7 — "Behaviour: …" rows, after Affects and before the release lines.
+    const behaviour = behaviourLines(change, uiWidth() - 2).map((l) => `\n  ${chalk.dim(l)}`).join('');
     const choice = await withInquirer(() => select({
-        message: `${objLabel} — apply?${affects ? `\n  ${chalk.dim(affects)}` : ''}${release}`,
+        message: `${objLabel} — apply?${affects ? `\n  ${chalk.dim(affects)}` : ''}${behaviour}${release}`,
         default: 'apply',
         theme: inquirerTheme,
         choices,
@@ -305,13 +302,7 @@ export async function renderPerChangeApproval(change, effectiveRisk, transport)
  * option doesn't return useless dim grey text when the model passed a
  * one-paragraph description in the `diff` field.
  */
-function looksLikeUnifiedDiff(s) {
-    return s.split('\n').some((line) => {
-        if (line.startsWith('+++') || line.startsWith('---'))
-            return false;
-        return line.startsWith('+') || line.startsWith('-') || line.startsWith('@@');
-    });
-}
+// looksLikeUnifiedDiff lives in ./visible-changes.ts (next to collapseImplicitActivates).
 /**
  * v0.3 dispatcher: routes to Ink modal (via approvalEmitter) when running
  * under Ink, else delegates to the existing inquirer-based flow.

package/dist/approvals/risk-floor.js

@@ -6,15 +6,159 @@
 export function typeCode(type) {
     return String(type ?? '').trim().toUpperCase().split('/')[0].trim();
 }
+const DECLARATION_OPENER = /^\s*(CLASS-)?METHODS\b/i;
+/** A line that may be a parameter of a declaration whose opener is outside the hunk. */
+const PARAMETER_LIKE = /\b(TYPE|LIKE)\b/i;
+const PARAMETER_KEYWORD = /^\s*(IMPORTING|EXPORTING|CHANGING|RETURNING|RAISING)\b/i;
+const LOCAL_DECLARATION = /^\s*(DATA|FIELD-SYMBOLS|TYPES|CONSTANTS|STATICS)\b/i;
+/**
+ * A context line shaped like one parameter: a name (or VALUE(…) /
+ * REFERENCE(…)) right before TYPE or LIKE. Two words before TYPE (`RAISE
+ * EXCEPTION TYPE`, `DATA lv TYPE`) are not this shape.
+ */
+const PARAMETER_LINE = /^\s*(!?[a-z_/][\w/]*|(VALUE|REFERENCE)\(\s*!?[\w/]+\s*\))\s+(TYPE|LIKE)\b/i;
+/** A bare identifier list ending in `,` or `.` — e.g. exception classes under RAISING. */
+const BARE_LIST = /^\s*[a-z_/][\w/]*(\s*,\s*[a-z_/][\w/]*)*\s*[,.]\s*$/i;
+/** Single-word statements that are never part of a signature. */
+const BARE_STATEMENT = /^\s*(END\w*|ELSE|RETURN|EXIT|CONTINUE|CLEANUP)\s*\.\s*$/i;
+/**
+ * Task 7 (R2) — a statement that opens or ends a processing block. Its
+ * statement holds no signature (METHOD, FUNCTION, MODULE, END…) — FORM is the
+ * one exception: its USING / CHANGING / TABLES / RAISING parameters follow it,
+ * so a FORM settles the hunk only once its statement has ended in `.`.
+ * METHODS does not match (the `\b` stops at METHOD).
+ */
+const BLOCK_STATEMENT = /^\s*(METHOD|ENDMETHOD|FORM|ENDFORM|FUNCTION|ENDFUNCTION|MODULE|ENDMODULE)\b/i;
+const FORM_STATEMENT = /^\s*FORM\b/i;
+/** Fix round 1 — a parameter named like a keyword (`method TYPE string`, `form LIKE x`). */
+const TYPED_AFTER_FIRST_WORD = /^\s*\S+\s+(TYPE|LIKE)\b/i;
+/**
+ * Task 7 (R2) — the state a hunk header's text (between or after the `@@`
+ * marks) or a context line sets, when it is a block statement: 'out' (the
+ * lines after it are body), 'in' for a FORM that goes on (its parameters
+ * follow), undefined when it is not a block statement. Fix round 1 — a line
+ * shaped like a parameter is never a block statement.
+ */
+function blockState(code) {
+    if (!BLOCK_STATEMENT.test(code))
+        return undefined;
+    if (PARAMETER_LINE.test(code) || TYPED_AFTER_FIRST_WORD.test(code))
+        return undefined;
+    if (FORM_STATEMENT.test(code) && !code.trimEnd().endsWith('.'))
+        return 'in';
+    return 'out';
+}
+/** The text of a hunk header: `@@ -1,2 +1,2 @@ METHOD x.` or `@@ METHOD x. @@` → `METHOD x.`. */
+function hunkHeaderText(raw) {
+    const m = /^@@(.*?)@@(.*)$/.exec(raw);
+    if (!m)
+        return raw.replace(/^@@/, '');
+    const inner = m[1].replace(/^\s*-\d+(,\d+)?\s+\+\d+(,\d+)?\s*$/, '');
+    return (m[2].trim() !== '' ? m[2] : inner);
+}
+/** The code part of an ABAP line: a `*` line is all comment; a `"` starts a trailing comment. */
+function codeOf(line) {
+    if (line.startsWith('*'))
+        return '';
+    return line.replace(/".*$/, '');
+}
+/**
+ * Task 7 (B10) — might a unified diff change a method signature? This is a
+ * risk-floor input: it errs toward true (over-raising is accepted) and it
+ * can only ever raise risk, never lower it. True when:
+ *   - any changed (`+`/`-`, not `+++`/`---`) METHODS / CLASS-METHODS line —
+ *     an added, removed or renamed method, with or without parameters;
+ *   - any changed line with code inside a declaration that a context
+ *     `METHODS x` line opened (until its code ends in `.`; comments do not
+ *     count) — a parameter, a type, an exception class on its own line;
+ *   - from a hunk start until a context line ending a statement settles it
+ *     (e.g. `METHOD x.`), a changed line that looks like part of a
+ *     declaration whose opener sits outside the hunk's context: TYPE or LIKE
+ *     (or a leading IMPORTING … RAISING), no `=`, not a local DATA,
+ *     FIELD-SYMBOLS, TYPES, CONSTANTS or STATICS; or a bare identifier list
+ *     ending in `,` or `.` (exception classes), not END… / RETURN / EXIT;
+ *   - in that hunk-start state, an unchanged IMPORTING … RAISING line or an
+ *     unchanged `name TYPE x` parameter line opens the declaration, so the
+ *     changed lines after it count as above.
+ * A body line after `METHOD x.` (`CALL FUNCTION … EXPORTING`, `DATA … TYPE`)
+ * stays false.
+ * Task 7 (R2) — an unchanged METHOD / FORM / FUNCTION / MODULE / END… line
+ * (not one shaped like a parameter) settles the state to 'out' before any
+ * other rule reads it: the lines after it are body. A FORM whose statement
+ * goes on (no `.`) sets 'in' instead: its USING / CHANGING lines are its
+ * signature. A changed FORM line is a signature change.
+ * Fix round 1 — a hunk header is model text, so it never sets 'out'. A
+ * header naming a block (`@@ METHOD to_internal. @@`,
+ * `@@ -1,2 +1,2 @@ METHOD x.`) sets 'hint': only the bare hunk-start guess
+ * on a changed line is off, so a bare `EXPORTING` of a CALL FUNCTION is not
+ * taken for a parameter list. Unchanged IMPORTING … RAISING, `name TYPE x`
+ * and METHODS lines still open a declaration. Known gap (pinned in a test):
+ * changed parameter lines alone, with no context, under such a header.
+ */
+export function signatureChange(diff) {
+    if (!diff)
+        return false;
+    let state = 'unknown';
+    for (const raw of diff.split('\n')) {
+        if (raw.startsWith('+++') || raw.startsWith('---'))
+            continue;
+        if (raw.startsWith('@@')) {
+            // Task 7 (R2) / fix round 1 — a header naming the block
+            // (`@@ METHOD to_internal. @@`) hints that the hunk starts in its body.
+            // It is model text: a hint, never 'out'.
+            // A FORM header never hints: its USING lines are its signature, so the
+            // hunk-start guess stays on (as before Task 7).
+            const text = codeOf(hunkHeaderText(raw).trim());
+            const block = blockState(text);
+            state = block === 'in' ? 'in' : block === 'out' && !FORM_STATEMENT.test(text) ? 'hint' : 'unknown';
+            continue;
+        }
+        const changed = raw.startsWith('+') || raw.startsWith('-');
+        const code = codeOf(/^[+\- ]/.test(raw) ? raw.slice(1) : raw);
+        // Task 7 (R2) — an unchanged block statement settles the state before any
+        // other rule reads it. A changed one goes through every rule below.
+        if (!changed) {
+            const block = blockState(code);
+            if (block) {
+                state = block;
+                continue;
+            }
+        }
+        // A changed FORM line is a changed FORM signature (or name), like a changed METHODS line.
+        if (changed && FORM_STATEMENT.test(code))
+            return true;
+        if (DECLARATION_OPENER.test(code)) {
+            if (changed)
+                return true;
+            state = 'in';
+        }
+        // Round 3 — at a hunk start, an unchanged parameter line (IMPORTING …
+        // RAISING, or `name TYPE x`) means the hunk starts inside a declaration.
+        if (!changed && (state === 'unknown' || state === 'hint') && !code.includes('=') && !LOCAL_DECLARATION.test(code)
+            && (PARAMETER_KEYWORD.test(code) || PARAMETER_LINE.test(code)))
+            state = 'in';
+        if (changed && state === 'in' && code.trim() !== '')
+            return true;
+        if (changed && state === 'unknown' && !code.includes('=') && !LOCAL_DECLARATION.test(code)
+            && (PARAMETER_LIKE.test(code) || PARAMETER_KEYWORD.test(code)
+                || (BARE_LIST.test(code) && !BARE_STATEMENT.test(code))))
+            return true;
+        if (code.trimEnd().endsWith('.') && (state === 'in' || !changed))
+            state = 'out';
+    }
+    return false;
+}
 export function effectiveRisk(declared, changes, ctx) {
-    let floor = declared;
-    const raisedBy = [];
     const rank = (r) => ({ low: 0, medium: 1, high: 2 }[r]);
-    const raise = (r, label) => {
-        if (rank(r) > rank(floor)) {
-            floor = r;
-            raisedBy.push(label);
-        }
+    // Task 7 (R2) — every rule that applies is noted, in rule order. The shown
+    // reasons are each rule that on its own justifies the final level (at or
+    // above it, and above what the model declared), plus the reasons that are
+    // always shown. Before, only the first rule to cross a level was kept, so
+    // a body-only change read "may alter a method signature" when activation
+    // was the true reason.
+    const applied = [];
+    const raise = (r, label, always = false) => {
+        applied.push({ r, label, always });
     };
     if (ctx.autoApprovePolicy === 'never')
         raise('high', 'non_prod_override');
@@ -29,19 +173,20 @@ export function effectiveRisk(declared, changes, ctx) {
         const badNames = new Set(ctx.syntaxErrorObjects.map((k) => k.slice(k.lastIndexOf(':') + 1).toUpperCase()));
         const hit = (c) => badNames.has(c.object.trim().split(/\s+/)[0].toUpperCase());
         if (changes.some(hit)) {
-            raise('high', 'syntax_errors');
             // Final review A M-4 — the reason is always shown, even when the floor
             // was already high (policy never, or declared high).
-            if (!raisedBy.includes('syntax_errors'))
-                raisedBy.push('syntax_errors');
+            raise('high', 'syntax_errors', true);
         }
     }
     // Part 2b D7 — a BAdI implementation runs inside a standard SAP process:
     // high (never auto-approved), and the reason is always shown.
     if (changes.some((c) => typeCode(c.type) === 'ENHO')) {
-        raise('high', 'standard_process');
-        if (!raisedBy.includes('standard_process'))
-            raisedBy.push('standard_process');
+        raise('high', 'standard_process', true);
+    }
+    // Task 7 (B10) — a changed method signature on a class or interface can
+    // break its callers: medium, and the reason is always shown.
+    if (changes.some((c) => c.op === 'modify' && ['CLAS', 'INTF'].includes(typeCode(c.type)) && signatureChange(c.diff))) {
+        raise('medium', 'signature_change', true);
     }
     if (changes.some((c) => c.op === 'delete'))
         raise('medium', 'delete_op');
@@ -51,14 +196,10 @@ export function effectiveRisk(declared, changes, ctx) {
     // Part 3 D2 — a release cannot be undone, and a run executes code on the
     // system: both are high (never auto-approved), and the reason is always shown.
     if (changes.some((c) => c.op === 'release')) {
-        raise('high', 'transport_release');
-        if (!raisedBy.includes('transport_release'))
-            raisedBy.push('transport_release');
+        raise('high', 'transport_release', true);
     }
     if (changes.some((c) => c.op === 'run')) {
-        raise('high', 'code_run');
-        if (!raisedBy.includes('code_run'))
-            raisedBy.push('code_run');
+        raise('high', 'code_run', true);
     }
     if (changes.some((c) => c.op === 'activate'))
         raise('medium', 'activation');
@@ -70,6 +211,26 @@ export function effectiveRisk(declared, changes, ctx) {
         raise('medium', 'escalated_in_session');
     if (ctx.prodNamespaces && changes.some((c) => ctx.prodNamespaces.some((p) => c.object.startsWith(p))))
         raise('medium', 'prod_namespace');
+    // The level is the highest rule (never below what the model declared).
+    let floor = declared;
+    for (const a of applied)
+        if (rank(a.r) > rank(floor))
+            floor = a.r;
+    const raisedBy = [];
+    for (const a of applied) {
+        const justifies = rank(a.r) >= rank(floor) && rank(a.r) > rank(declared);
+        if ((justifies || a.always) && !raisedBy.includes(a.label))
+            raisedBy.push(a.label);
+    }
+    // Task 7 (R2) / fix round 1 — when activation and a signature change are
+    // both shown, activation leads (it is the sure reason; the signature one is
+    // a reading of the diff). Otherwise the rule order stands.
+    const sig = raisedBy.indexOf('signature_change');
+    const act = raisedBy.indexOf('activation');
+    if (sig >= 0 && act > sig) {
+        raisedBy.splice(act, 1);
+        raisedBy.splice(sig, 0, 'activation');
+    }
     return { level: floor, raisedBy };
 }
 /** Plain words for each risk reason code — the codes stay in audit data only. */
@@ -85,7 +246,23 @@ const RISK_REASON_TEXT = {
     syntax_errors: 'the last syntax check of this object found errors',
     standard_process: 'this code runs inside a standard SAP process (a BAdI implementation)',
     code_run: 'this runs code on the SAP system',
+    signature_change: 'the change may alter a method signature, so callers may be affected',
 };
+/**
+ * Task 7 (R2) — one sentence on every request_approval result (and once in
+ * the journey fix block): the risk line is CSPeach's reading of the diff, so
+ * the model relays it rather than telling the person it is wrong.
+ */
+export const RISK_NOTE = "The risk line is CSPeach's reading of the diff; relay it, and if you think it is off, say why.";
+/**
+ * Task 7 (R2) — the risk fields of every request_approval result:
+ * effective_risk and raised_by as before (older readers), plus risk { level,
+ * reasons } in plain words and the note.
+ */
+export function riskResultFields(eff) {
+    const reasons = eff.raisedBy.map(riskReasonText); // round 8 item 4: plain words, never codes
+    return { effective_risk: eff.level, raised_by: reasons, risk: { level: eff.level, reasons: [...reasons] }, note: RISK_NOTE };
+}
 /** Round 8 item 4 — every code the floor can raise (each has plain words above). */
 export const RISK_REASON_CODES = Object.keys(RISK_REASON_TEXT);
 /** Round 4 item 8a — never show an internal reason code raw. */

package/dist/approvals/visible-changes.js

@@ -0,0 +1,35 @@
+/**
+ * Collapse the changes list to what a person sees — `activate` is the
+ * implicit follow-on of a `modify`/`create` on the same object, so the
+ * activate row is hidden when its sibling write is already in the list. The
+ * underlying `changes[]` (which drives approval-id minting) is unchanged.
+ * This is what fixes the "what 2 changes?" complaint when the model declares
+ * modify+activate of the same object. Used by the plan gate's display
+ * (render.ts) and, Task 9 (C8), by request_approval to decide whether the
+ * plan gate opens at all (only for more than one visible change).
+ */
+export function collapseImplicitActivates(changes) {
+    const writeKeys = new Set();
+    for (const c of changes) {
+        if (c.op === 'modify' || c.op === 'create') {
+            writeKeys.add(`${c.type}:${c.object}`);
+        }
+    }
+    return changes.filter((c) => {
+        if (c.op !== 'activate')
+            return true;
+        return !writeKeys.has(`${c.type}:${c.object}`);
+    });
+}
+/**
+ * Heuristic: a real unified diff has at least one line starting with `+`,
+ * `-`, or `@@`. A summary or change description won't. Used to gate
+ * colorizeDiff vs the "model didn't supply a diff" warning (render.ts).
+ */
+export function looksLikeUnifiedDiff(s) {
+    return s.split('\n').some((line) => {
+        if (line.startsWith('+++') || line.startsWith('---'))
+            return false;
+        return line.startsWith('+') || line.startsWith('-') || line.startsWith('@@');
+    });
+}

package/dist/commands/config-set.js

@@ -598,17 +598,17 @@ export async function runConfigSet(args) {
             break;
         }
         case 'show_cogs': {
-            // Operator escape hatch — render OUR Anthropic COGS in USD even on a
-            // managed, metered account (where the customer-facing unit is credits).
-            // Off/absent is the product default; see cost/display-mode.ts.
+            // Operator view — our cost in USD on a managed account. Works only when
+            // the server also grants the account `cost_view` (2026-10-19); on its
+            // own this setting changes nothing. See cost/display-mode.ts.
             const b = coerceBool(value);
             if (b === null) {
                 err(`${key} must be on/off (also accepts true/false, 1/0).`);
             }
             cfg.show_cogs = b;
             console.log(chalk.dim(b
-                ? '  → cost figures will show USD (our Anthropic cost), not credits.'
-                : '  → cost figures will show credits on a managed, metered account.'));
+                ? '  → applies only to accounts allowed to see costs; everyone else keeps credits.'
+                : '  → cost figures show credits.'));
             break;
         }
         case 'word_copy': {

package/dist/commands/cost.js

@@ -141,6 +141,7 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     emit('');
     if (inCredits)
         emit(formatInfo('This month and your top skills: /usage').trimEnd());
-    emit(formatInfo(`Detailed JSONL: ~/.cspeach/sessions/${sessionId}-cost.jsonl`).trimEnd());
+    if (!inCredits)
+        emit(formatInfo(`Detailed JSONL: ~/.cspeach/sessions/${sessionId}-cost.jsonl`).trimEnd());
     emit('');
 }