@cspeach/cli 1.1.49 → 1.1.50

package/dist/projects/merge-cca.js

@@ -1,292 +0,0 @@
-/**
- * Deterministic merge of N parallel /abap-cca assessment slices into ONE
- * consolidated cca-assessment (the /abap-cca-merge skill's engine).
- *
- * WHY CODE, NOT PROSE: battery scenario S4 (docs/research/battery/
- * s4-cca-scorecard.md, defects D6/D7) proved the model cannot keep
- * manifest counts consistent with manifest rows when reconciling by
- * hand — `retire: 0` next to 7 retire rows, 27/104 rows silently
- * dropped. This module does the arithmetic; the model presents the
- * result and adds judgment commentary, nothing else.
- *
- * Rules implemented (mirrors .claude/skills/abap-cca-merge/SKILL.md):
- *   - identity: same projectId across inputs, or opts.allowCrossProject
- *   - atcVariant must match across inputs (hard error — classifications
- *     produced under different ATC variants are not comparable)
- *   - scope-overlap detection: intersecting scope patterns AND duplicate
- *     object names across inputs both produce warnings
- *   - per-object union keyed by objectName|objectType (item ids are
- *     PER-INPUT local — item-001 exists in every slice — so ids cannot
- *     be the union key; merged rows are re-numbered)
- *   - conflict rule: most-restrictive wins (retire > redesign > fix >
- *     keep), recorded BOTH as a warning AND on the merged row
- *     (`conflict: { values: {label: cls}, rule: 'most-restrictive' }`)
- *   - counts RECOMPUTED from merged rows — never trusted from inputs
- *   - truncation-aware: an input marked classificationsTruncated yields
- *     a warning that the merge covers manifest rows only and the detail
- *     file must be consulted for full coverage
- */
-import { OUTPUT_ROOT } from './output-paths.js';
-/** Higher = more restrictive. Conflict resolution picks the max. */
-const RESTRICTIVENESS = {
-    retire: 3,
-    redesign: 2,
-    fix: 1,
-    keep: 0,
-};
-/**
- * Manifest row-priority sort (matches abap-cca SKILL.md: "redesign first,
- * then fix, then retire, then keep, ordered by confidence DESC within
- * each group"). This is WORK priority, not restrictiveness.
- */
-const ROW_PRIORITY = {
-    redesign: 0,
-    fix: 1,
-    retire: 2,
-    keep: 3,
-};
-const CONFIDENCE_RANK = {
-    high: 0,
-    medium: 1,
-    low: 2,
-};
-/* ── scope expression helpers ───────────────────────────────────────────── */
-/**
- * Split a scope expression like "ZFI* + ZSD*" or "ZFI*, ZSD*" into
- * individual patterns. Exported for tests.
- */
-export function parseScopePatterns(scope) {
-    return scope
-        .split(/[+,]/)
-        .map((s) => s.trim())
-        .filter((s) => s.length > 0);
-}
-/**
- * Conservative intersection check for the prefix-glob patterns the
- * --scope flag accepts (`ZFI*`, exact names). Two prefix globs intersect
- * when one stem is a prefix of the other (`ZF*` ⊇ `ZFI*`). Patterns we
- * cannot reason about (internal `*`) only match when identical —
- * deliberately under-reports rather than spamming false overlaps.
- * Exported for tests.
- */
-export function scopePatternsIntersect(a, b) {
-    const A = a.trim().toUpperCase();
-    const B = b.trim().toUpperCase();
-    if (A === B)
-        return true;
-    const aStar = A.endsWith('*') && !A.slice(0, -1).includes('*');
-    const bStar = B.endsWith('*') && !B.slice(0, -1).includes('*');
-    const aStem = aStar ? A.slice(0, -1) : A;
-    const bStem = bStar ? B.slice(0, -1) : B;
-    if (A.includes('*') && !aStar)
-        return false; // unparseable — identical-only
-    if (B.includes('*') && !bStar)
-        return false;
-    if (aStar && bStar)
-        return aStem.startsWith(bStem) || bStem.startsWith(aStem);
-    if (aStar)
-        return B.startsWith(aStem);
-    if (bStar)
-        return A.startsWith(bStem);
-    return false; // two distinct exact names
-}
-/* ── merge ──────────────────────────────────────────────────────────────── */
-function todayUtc() {
-    return new Date().toISOString().slice(0, 10);
-}
-export function mergeCcaAssessments(inputs, opts = {}) {
-    if (inputs.length < 2) {
-        throw new Error(`cca merge requires at least 2 inputs (got ${inputs.length}) — a single assessment needs no merge`);
-    }
-    const warnings = [];
-    const first = inputs[0];
-    // ── identity validation ──
-    for (const inp of inputs.slice(1)) {
-        if (inp.content.projectId !== first.content.projectId && !opts.allowCrossProject) {
-            throw new Error(`projectId mismatch: '${inp.label}' is project '${inp.content.projectId}' but '${first.label}' is '${first.content.projectId}'. `
-                + `Merging different projects silently corrupts the estate view — pass allowCrossProject only for disjoint-scope slices of the same system.`);
-        }
-    }
-    for (const inp of inputs.slice(1)) {
-        if (inp.content.atcVariant !== first.content.atcVariant) {
-            throw new Error(`atcVariant mismatch: '${inp.label}' was classified under '${inp.content.atcVariant}' but '${first.label}' under '${first.content.atcVariant}'. `
-                + `Classifications from different ATC variants are not comparable — re-run one slice with the matching variant.`);
-        }
-    }
-    // ── scope-overlap detection (warning, not blocker) ──
-    for (let i = 0; i < inputs.length; i++) {
-        for (let j = i + 1; j < inputs.length; j++) {
-            const a = inputs[i];
-            const b = inputs[j];
-            for (const pa of parseScopePatterns(a.content.scope)) {
-                for (const pb of parseScopePatterns(b.content.scope)) {
-                    if (scopePatternsIntersect(pa, pb)) {
-                        warnings.push(`SCOPE OVERLAP: '${a.label}' scope '${pa}' intersects '${b.label}' scope '${pb}' — slices were not disjoint; duplicate objects are reconciled most-restrictive.`);
-                    }
-                }
-            }
-        }
-    }
-    // ── truncation awareness ──
-    for (const inp of inputs) {
-        if (inp.content.classificationsTruncated) {
-            const shown = inp.content.classificationsShown ?? inp.content.classifications.length;
-            const total = inp.content.classificationsTotal ?? '?';
-            warnings.push(`TRUNCATED INPUT: '${inp.label}' manifest carries only ${shown} of ${total} classifications — `
-                + `this merge covers the manifest rows only. For full coverage merge from the detail file at ${inp.content.detailPath}.`);
-        }
-    }
-    // ── per-object union (key: objectName|objectType) ──
-    const byKey = new Map();
-    const keyOrder = [];
-    for (const inp of inputs) {
-        for (const row of inp.content.classifications) {
-            const key = `${row.objectName.toUpperCase()}|${row.objectType.toUpperCase()}`;
-            if (!byKey.has(key)) {
-                byKey.set(key, []);
-                keyOrder.push(key);
-            }
-            byKey.get(key).push({
-                label: inp.label,
-                classification: row.classification,
-                confidence: row.confidence,
-                objectName: row.objectName,
-                objectType: row.objectType,
-            });
-        }
-    }
-    const mergedRows = [];
-    for (const key of keyOrder) {
-        const sources = byKey.get(key);
-        const base = sources[0];
-        const distinct = new Set(sources.map((s) => s.classification));
-        if (sources.length > 1 && distinct.size === 1) {
-            warnings.push(`DUPLICATE OBJECT: ${base.objectName} (${base.objectType}) appears in ${sources.length} inputs `
-                + `(${sources.map((s) => s.label).join(', ')}) with the same classification '${base.classification}' — overlapping slices, merged into one row.`);
-        }
-        if (distinct.size > 1) {
-            // conflict — most-restrictive wins
-            const winner = sources.reduce((best, s) => RESTRICTIVENESS[s.classification] > RESTRICTIVENESS[best.classification] ? s : best);
-            const values = {};
-            for (const s of sources)
-                values[s.label] = s.classification;
-            warnings.push(`CLASSIFICATION CONFLICT: ${base.objectName} (${base.objectType}) — `
-                + sources.map((s) => `${s.label}: ${s.classification} [${s.confidence}]`).join('; ')
-                + ` → resolved: ${winner.classification} (most-restrictive rule). Review with the consultants who classified before remediation planning.`);
-            mergedRows.push({
-                id: '', // re-numbered after sort
-                objectName: base.objectName,
-                objectType: base.objectType,
-                classification: winner.classification,
-                confidence: winner.confidence,
-                conflict: { values, rule: 'most-restrictive' },
-            });
-        }
-        else {
-            mergedRows.push({
-                id: '',
-                objectName: base.objectName,
-                objectType: base.objectType,
-                classification: base.classification,
-                confidence: base.confidence,
-            });
-        }
-    }
-    // ── manifest row-priority sort + re-number ──
-    mergedRows.sort((a, b) => {
-        const p = ROW_PRIORITY[a.classification] - ROW_PRIORITY[b.classification];
-        if (p !== 0)
-            return p;
-        const c = CONFIDENCE_RANK[a.confidence] - CONFIDENCE_RANK[b.confidence];
-        if (c !== 0)
-            return c;
-        return a.objectName.localeCompare(b.objectName);
-    });
-    mergedRows.forEach((row, i) => {
-        row.id = `item-${String(i + 1).padStart(3, '0')}`;
-    });
-    // ── counts RECOMPUTED from rows — never trusted from inputs ──
-    const tally = { keep: 0, fix: 0, retire: 0, redesign: 0 };
-    for (const row of mergedRows)
-        tally[row.classification]++;
-    // uncategorized objects have no classification rows, so they cannot be
-    // recomputed — summed across inputs (slices are disjoint by contract;
-    // overlap is already warned about above).
-    const uncategorized = inputs.reduce((sum, inp) => sum + (inp.content.summary.uncategorized || 0), 0);
-    const date = opts.mergedDate ?? todayUtc();
-    const mergedProjectId = `${first.content.projectId}_merged_${date}`;
-    const scopes = [];
-    for (const inp of inputs) {
-        const s = inp.content.scope.trim();
-        if (s.length > 0 && !scopes.includes(s))
-            scopes.push(s);
-    }
-    const merged = {
-        detailPath: `${OUTPUT_ROOT}/cca/projects/${mergedProjectId}/project.json`,
-        projectId: mergedProjectId,
-        scope: scopes.join(', '),
-        atcVariant: first.content.atcVariant,
-        summary: {
-            totalObjects: mergedRows.length + uncategorized,
-            keep: tally.keep,
-            fix: tally.fix,
-            retire: tally.retire,
-            redesign: tally.redesign,
-            uncategorized,
-        },
-        classifications: mergedRows,
-    };
-    return { merged, warnings };
-}
-/* ── manifest rendering ─────────────────────────────────────────────────── */
-/** Manifest table cap — full rows live in the merged detail data. */
-export const CCA_MANIFEST_ROW_CAP = 50;
-function renderConflictCell(conflict) {
-    const pairs = Object.entries(conflict.values)
-        .map(([label, cls]) => `${label.replace(/[|;:]/g, '_')}:${cls}`)
-        .join(';');
-    return `conflict=${pairs}`;
-}
-/**
- * Render the EXACT `<!-- csforge:cca-manifest ... -->` block for a merged
- * assessment. The model must paste this VERBATIM — every number is
- * computed here, and extract-cca.ts re-validates counts-vs-rows on save,
- * so a hand-edited block fails loudly instead of saving silently wrong.
- *
- * `omitDetailPath` is for the detail-write-failed path in cca_merge:
- * a manifest must never point at a file that does not exist, so the
- * line is dropped (the extractor then refuses the save loudly).
- */
-export function renderCcaMergeManifest(merged, title, opts = {}) {
-    const rows = merged.classifications.slice(0, CCA_MANIFEST_ROW_CAP);
-    const truncated = merged.classifications.length > CCA_MANIFEST_ROW_CAP;
-    const lines = [
-        '<!-- csforge:cca-manifest',
-        'artefact: cca-assessment',
-        `title: ${title}`,
-        ...(opts.omitDetailPath ? [] : [`detail_path: ${merged.detailPath}`]),
-        `project_id: ${merged.projectId}`,
-        `scope: ${merged.scope}`,
-        `atc_variant: ${merged.atcVariant}`,
-        `total_objects: ${merged.summary.totalObjects}`,
-        `keep: ${merged.summary.keep}`,
-        `fix: ${merged.summary.fix}`,
-        `retire: ${merged.summary.retire}`,
-        `redesign: ${merged.summary.redesign}`,
-        `uncategorized: ${merged.summary.uncategorized}`,
-    ];
-    if (truncated) {
-        lines.push('classifications_truncated: true');
-        lines.push(`classifications_shown: ${rows.length}`);
-        lines.push(`classifications_total: ${merged.classifications.length}`);
-    }
-    lines.push('classifications:');
-    for (const row of rows) {
-        const cells = [row.id, row.objectName, row.objectType, row.classification, row.confidence];
-        if (row.conflict)
-            cells.push(renderConflictCell(row.conflict));
-        lines.push(`  ${cells.join(' | ')}`);
-    }
-    lines.push('-->');
-    return lines.join('\n');
-}

package/dist/tools/local-files.js

@@ -1,31 +0,0 @@
-// cspeach-cli/src/tools/local-files.ts
-/**
- * Startup wiring for the persisted `local_files` config toggle.
- *
- * When `cfg.local_files === true`, the otherwise flag-gated filesystem tools
- * (file_read/file_write/file_edit/glob/grep) are force-enabled via the
- * in-memory override in `_flag.ts`, BEFORE the first listTools()/turn. This is
- * what makes /abap-fiori-build runnable — it writes local app files.
- *
- * The toggle is PERSISTED (config.toml), not re-consented each session, so
- * `applyLocalFilesConfig` returns an announce line the entry point prints
- * whenever the tools are live — the user must always see that local file
- * access is on this session (trust-visibility requirement). The FS tools'
- * own cwd-sandbox (writes confined to the project root; .cspeach/.env/.git
- * denylisted) still applies regardless of this toggle.
- */
-import { enableToolFlags } from './_flag.js';
-/** The exact tool NAMEs the flag uses (file_read → CSPEACH_TOOL_FILE_READ). */
-export const LOCAL_FILE_TOOLS = ['file_read', 'file_write', 'file_edit', 'glob', 'grep'];
-/**
- * Apply the persisted `local_files` toggle. When on, force-enables the FS
- * tools and returns a one-line announce string (undefined when off, so the
- * caller prints nothing). `cwd` is surfaced so the user sees exactly which
- * directory tree read/write/edit operate under.
- */
-export function applyLocalFilesConfig(localFiles, cwd) {
-    if (localFiles !== true)
-        return undefined;
-    enableToolFlags([...LOCAL_FILE_TOOLS]);
-    return `local file tools enabled (read/write/edit under ${cwd}) — cspeach config set local_files off to disable`;
-}

package/dist/tools/project/cca_merge.js

@@ -1,164 +0,0 @@
-/**
- * cca_merge — deterministic reconciliation of N parallel /abap-cca
- * assessment envelopes (the /abap-cca-merge skill's execution seam).
- *
- * DESIGN (2026-06-12, team-chain): the skill used to ask the MODEL to
- * reconcile envelopes by hand; battery S4 (D6/D7) proved models can't
- * keep counts consistent with rows. This tool runs
- * src/projects/merge-cca.ts and returns the merged content, warnings,
- * AND a pre-rendered manifest block the model pastes VERBATIM. The
- * normal save hook then persists the envelope — persistence
- * deliberately stays on the one existing save path (confirm prompt,
- * workspace resolution, validation, version semantics) instead of the
- * tool minting envelopes through a second door. A merge is a NEW
- * artefact superseding its inputs (new identity is correct — there is
- * no prior chain to extend, unlike the plan-revision case in
- * save-command.ts), and the extractor's counts-vs-rows validation acts
- * as a tamper backstop if the model edits the pasted block.
- *
- * NOT flag-gated: the abap-cca-merge skill depends on this tool; gating
- * it off would silently break the multi-consultant chain.
- *
- * Stays isMutating: false despite writing the merged detail file: the
- * write is the merge's own local artifact under .cspeach/ (derived
- * purely from envelopes the user supplied), the same trust level as the
- * save hook persisting the envelope — no SAP or user-file mutation.
- */
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { dirname, isAbsolute, join } from 'node:path';
-import { registerTool } from '../index.js';
-import { mergeCcaAssessments, renderCcaMergeManifest, } from '../../projects/merge-cca.js';
-import { loadEnvelope, MANIFEST_PASTE_INSTRUCTIONS } from './_merge-shared.js';
-export async function ccaMergeHandler(args, ctx) {
-    if (!Array.isArray(args.inputs) || args.inputs.some((i) => typeof i !== 'string')) {
-        return { content: 'error: inputs must be an array of envelope paths / @-tokens.', is_error: true };
-    }
-    const tokens = args.inputs;
-    if (tokens.length === 1) {
-        return {
-            content: 'error: only one input supplied — a single assessment needs no merge. Use the file directly.',
-            is_error: true,
-        };
-    }
-    if (tokens.length < 2) {
-        return { content: 'error: at least 2 input envelopes are required.', is_error: true };
-    }
-    if (args.allow_cross_project !== undefined && typeof args.allow_cross_project !== 'boolean') {
-        return { content: 'error: allow_cross_project must be a boolean.', is_error: true };
-    }
-    // load + type-check every input before merging — fail with the precise file
-    const inputs = [];
-    const perInput = [];
-    for (const token of tokens) {
-        let resolved;
-        try {
-            resolved = await loadEnvelope(token, ctx.cwd, 'cca-assessment');
-        }
-        catch (e) {
-            return { content: `error: ${e instanceof Error ? e.message : String(e)}`, is_error: true };
-        }
-        const content = resolved.envelope.content;
-        inputs.push({ label: resolved.label, content });
-        perInput.push({
-            file: resolved.path,
-            label: resolved.label,
-            project_id: content.projectId,
-            scope: content.scope,
-            total_objects: content.summary.totalObjects,
-            keep: content.summary.keep,
-            fix: content.summary.fix,
-            retire: content.summary.retire,
-            redesign: content.summary.redesign,
-            uncategorized: content.summary.uncategorized,
-            truncated: content.classificationsTruncated === true,
-        });
-    }
-    let merged;
-    let warnings;
-    try {
-        ({ merged, warnings } = mergeCcaAssessments(inputs, {
-            allowCrossProject: args.allow_cross_project === true,
-        }));
-    }
-    catch (e) {
-        return { content: `error: ${e instanceof Error ? e.message : String(e)}`, is_error: true };
-    }
-    const title = `${inputs[0].content.projectId} — Merged (${inputs.length} slices)`;
-    // ── write the merged detail file BEFORE emitting the manifest ──────────
-    // The manifest's detail_path must point at a REAL file (the rule this
-    // branch added for /abap-cca emitters applies to the merge too). The
-    // manifest table caps at 50 rows; this file always carries every merged
-    // row. Minimal documented shape (a merge supersedes its inputs, so this
-    // is a fresh consolidated detail, not a phase-state project.json):
-    //   {
-    //     generatedAt:  ISO timestamp of the merge
-    //     projectId / scope / atcVariant / summary: as in the manifest
-    //     objects:      ALL merged classification rows (uncapped)
-    //     mergedFrom:   the input envelopes [{ file, label }]
-    //   }
-    let detailWritten = true;
-    const detailAbs = isAbsolute(merged.detailPath) ? merged.detailPath : join(ctx.cwd, merged.detailPath);
-    try {
-        mkdirSync(dirname(detailAbs), { recursive: true });
-        writeFileSync(detailAbs, JSON.stringify({
-            generatedAt: new Date().toISOString(),
-            projectId: merged.projectId,
-            scope: merged.scope,
-            atcVariant: merged.atcVariant,
-            summary: merged.summary,
-            objects: merged.classifications,
-            mergedFrom: perInput.map((p) => ({ file: p.file, label: p.label })),
-        }, null, 2), 'utf8');
-    }
-    catch (e) {
-        detailWritten = false;
-        warnings.push(`DETAIL WRITE FAILED: could not write the merged detail file '${merged.detailPath}' `
-            + `(${e instanceof Error ? e.message : String(e)}). The manifest block omits detail_path — `
-            + `a manifest must never point at a file that does not exist — so the save will refuse it. `
-            + `Fix the path/permissions and re-run the merge.`);
-    }
-    const manifestBlock = renderCcaMergeManifest(merged, title, { omitDetailPath: !detailWritten });
-    return {
-        content: JSON.stringify({
-            merged_summary: merged.summary,
-            merged_project_id: merged.projectId,
-            merged_scope: merged.scope,
-            atc_variant: merged.atcVariant,
-            ...(detailWritten ? { detail_path: merged.detailPath } : {}),
-            per_input: perInput,
-            warnings,
-            // full merged rows — the manifest block caps at 50; nothing is lost
-            // from the transcript even for large estates.
-            merged_classifications: merged.classifications,
-            manifest_block: manifestBlock,
-            instructions: MANIFEST_PASTE_INSTRUCTIONS,
-        }, null, 2),
-    };
-}
-registerTool({
-    name: 'cca_merge',
-    description: 'Deterministically merge 2+ parallel /abap-cca assessment envelopes (.cspeach.json) into one consolidated '
-        + 'cca-assessment. Validates project identity and ATC variant, detects scope overlaps and classification '
-        + 'conflicts (most-restrictive wins: retire > redesign > fix > keep), recomputes all counts from the merged '
-        + 'rows, writes the full merged rows to a new detail file under .cspeach/cca/projects/, and returns warnings '
-        + 'plus a ready-made csforge:cca-manifest block to paste verbatim. '
-        + 'Inputs accept absolute/relative paths or bare workspace @-tokens.',
-    isMutating: false,
-    category: 'project',
-    input_schema: {
-        type: 'object',
-        properties: {
-            inputs: {
-                type: 'array',
-                items: { type: 'string' },
-                description: '2+ cca-assessment envelope references (path or @-token), one per consultant slice.',
-            },
-            allow_cross_project: {
-                type: 'boolean',
-                description: 'Accept inputs with different projectId (disjoint --scope slices of the same system). Default false.',
-            },
-        },
-        required: ['inputs'],
-    },
-    handler: (args, ctx) => ccaMergeHandler(args, ctx),
-});

package/dist/tools/subagent/schedule_create.js

@@ -1,131 +0,0 @@
-// cspeach-cli/src/tools/subagent/schedule_create.ts
-/**
- * schedule_create — Phase 3 / Chunk 3E.
- *
- * Persists a schedule envelope to ~/.cspeach/schedules/<uuid>.json.
- * Filename is ALWAYS crypto.randomUUID — never derived from user
- * input. Closes the path-injection class of attack on the schedules
- * directory.
- *
- * IMPORTANT: this tool persists schedules. It does NOT execute them.
- * A future chunk (Phase 4 or later) ships the actual runner. The
- * tool description and the response body both surface this caveat
- * so the agent doesn't assume the schedule will fire.
- *
- * Flag-gated: invisible to listTools() unless
- * CSPEACH_TOOL_SCHEDULE_CREATE=on. isMutating: true (writes filesystem).
- */
-import { promises as fs } from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { registerTool } from '../index.js';
-const NOT_EXECUTED_NOTE = 'Persisted only — the schedule runner has not shipped yet. ' +
-    'See Phase 4+ for execution.';
-// Test-overridable. Default to ~/.cspeach/schedules. Set null to reset.
-let schedulesDirOverride = null;
-/** Test-only: redirect the schedules dir so tests don't pollute the real home dir. */
-export function __setSchedulesDirForTests(dir) {
-    schedulesDirOverride = dir;
-}
-function getSchedulesDir() {
-    return schedulesDirOverride ?? path.join(os.homedir(), '.cspeach', 'schedules');
-}
-// Strict ISO-8601 UTC: YYYY-MM-DDTHH:MM:SS(.sss)?Z
-const ISO_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
-export async function scheduleCreateHandler(args, _ctx) {
-    if (args.kind !== 'oneoff' && args.kind !== 'cron') {
-        return { content: `error: kind must be 'oneoff' or 'cron' — got '${args.kind}'`, is_error: true };
-    }
-    if (!args.when || typeof args.when !== 'string' || args.when.trim().length === 0) {
-        return { content: 'error: when is required (non-empty string)', is_error: true };
-    }
-    if (!args.command || typeof args.command !== 'string' || args.command.trim().length === 0) {
-        return { content: 'error: command is required (non-empty string)', is_error: true };
-    }
-    if (args.kind === 'oneoff') {
-        if (!ISO_PATTERN.test(args.when)) {
-            return { content: `error: when must be an ISO-8601 UTC timestamp (e.g. 2099-06-01T10:00:00Z) — got '${args.when}'`, is_error: true };
-        }
-        const t = Date.parse(args.when);
-        if (Number.isNaN(t)) {
-            return { content: `error: when is not a parseable ISO timestamp: '${args.when}'`, is_error: true };
-        }
-        // Belt-and-braces against silent month/day rollover. Date.parse('2099-02-30T00:00:00Z')
-        // returns a valid timestamp that round-trips to March 2 — without this check, the
-        // envelope persists '2099-02-30' but the runner fires on March 2 (phantom job).
-        const roundTrip = new Date(t).toISOString();
-        // Normalise both sides: lowercase 'z', strip optional fractional seconds, compare.
-        const norm = (s) => s.replace(/\.\d+Z$/, 'Z').toUpperCase();
-        if (norm(roundTrip) !== norm(args.when)) {
-            return { content: `error: when is not a valid calendar date: '${args.when}' (rolls to ${roundTrip})`, is_error: true };
-        }
-        if (t <= Date.now()) {
-            return { content: `error: when is in the past — schedule must be in the future`, is_error: true };
-        }
-    }
-    else {
-        // cron: just check it has 5 whitespace-separated fields.
-        const fields = args.when.trim().split(/\s+/);
-        if (fields.length !== 5) {
-            return { content: `error: cron expression must have 5 fields (min hour dom mon dow) — got ${fields.length}`, is_error: true };
-        }
-    }
-    const dir = getSchedulesDir();
-    await fs.mkdir(dir, { recursive: true });
-    // Defence-in-depth: resolve the directory and verify it sits inside
-    // the cspeach home (or the test override). Refuses if a symlink
-    // points the dir at /etc/, /tmp/host-controlled/, etc.
-    const realDir = await fs.realpath(dir);
-    // In test mode the override dir IS the root (self-containment is trivial —
-    // mkdtemp gives us a unique dir that acts as both schedules-dir and its own
-    // root). In prod the schedules dir must sit UNDER ~/.cspeach/, so the root
-    // is the parent. Asymmetric on purpose.
-    const expectedRoot = schedulesDirOverride !== null
-        ? path.resolve(schedulesDirOverride)
-        : path.join(os.homedir(), '.cspeach');
-    const rel = path.relative(expectedRoot, realDir);
-    if (rel.startsWith('..') || path.isAbsolute(rel)) {
-        return { content: `error: schedules directory '${realDir}' resolves outside expected root`, is_error: true };
-    }
-    const id = randomUUID();
-    const envelope = {
-        id,
-        kind: args.kind,
-        when: args.when,
-        command: args.command,
-        createdAt: new Date().toISOString(),
-        note: NOT_EXECUTED_NOTE,
-    };
-    const target = path.join(realDir, `${id}.json`);
-    await fs.writeFile(target, JSON.stringify(envelope, null, 2), { encoding: 'utf-8', mode: 0o600 });
-    return {
-        content: `schedule persisted (NOT YET EXECUTED — runner ships in a later chunk).\n` +
-            `path: ${target}\n` +
-            `id: ${id}\n` +
-            `kind: ${args.kind}\n` +
-            `when: ${args.when}\n` +
-            `command: ${args.command}\n` +
-            `note: ${NOT_EXECUTED_NOTE}`,
-    };
-}
-registerTool({
-    name: 'schedule_create',
-    description: 'Persist a oneoff or cron schedule envelope to ~/.cspeach/schedules/<uuid>.json. ' +
-        'Filename is a fresh UUID — never derived from input. NOTE: this tool only PERSISTS the ' +
-        'schedule. No runner is shipped yet — the agent should not assume the command will fire ' +
-        'automatically. A future chunk will ship the runner.',
-    isMutating: true,
-    category: 'subagent',
-    flagGated: true,
-    input_schema: {
-        type: 'object',
-        properties: {
-            kind: { type: 'string', enum: ['oneoff', 'cron'], description: 'oneoff = single ISO timestamp; cron = 5-field expression' },
-            when: { type: 'string', description: 'ISO-8601 UTC timestamp for oneoff, or 5-field cron expression' },
-            command: { type: 'string', description: 'The command the runner WOULD execute (free-form string for now)' },
-        },
-        required: ['kind', 'when', 'command'],
-    },
-    handler: (args, ctx) => scheduleCreateHandler(args, ctx),
-});

package/dist/ui/error-emitter.js

@@ -1,21 +0,0 @@
-import { EventEmitter } from 'node:events';
-import { shouldUseInk } from '../renderer/tty.js';
-import chalk from 'chalk';
-export const errorEmitter = new EventEmitter();
-/**
- * Emit an error. In Ink mode, the main App subscribes and pushes the error
- * into its errorStack state for overlay rendering. In non-TTY / one-shot,
- * we fall back to chalk.red on stderr — never mount a second Ink root.
- */
-export function emitError(err) {
-    if (shouldUseInk()) {
-        errorEmitter.emit('error', err);
-    }
-    else {
-        console.error(chalk.red(`[${err.code}] ${err.title}`));
-        if (err.body)
-            console.error(chalk.red(`  ${err.body}`));
-        if (err.hint)
-            console.error(chalk.dim(`  ${err.hint}`));
-    }
-}