@cspeach/cli 1.1.50 → 1.1.52

package/dist/tools/method-only-change.js

@@ -0,0 +1,241 @@
+/**
+ * Rule 7a in code (2026-10-22, owner go).
+ *
+ * sap_set_source on an existing class replaces the whole source. When the
+ * only thing that changed is the inside of one or more method bodies, the
+ * write must go through sap_update_method instead (one call per method): a
+ * whole-class rewrite can silently drop parameters, alter untouched methods
+ * or lose local definitions.
+ *
+ * `methodOnlyChange(current, proposed)` splits both sources into
+ *   - the frame: every line outside method bodies (definition part(s), the
+ *     IMPLEMENTATION header, the `METHOD x.` / `ENDMETHOD.` lines, ENDCLASS);
+ *   - each method body: the lines strictly between `METHOD x.` and `ENDMETHOD.`.
+ * It returns the names of the changed methods ONLY when the frame is
+ * identical, the methods are the same (names, order) and at least one body
+ * differs. Anything else returns undefined, and the write goes on as today.
+ *
+ * Normalised: line endings (CRLF / LF / CR) and trailing whitespace (per
+ * line, and blank lines at the end of the source). Nothing else.
+ *
+ * Conservative: when the split is not certain, return undefined (never
+ * refuse). That covers unbalanced METHOD / ENDMETHOD, a METHOD statement with
+ * more than its name (AMDP `BY DATABASE PROCEDURE …`), the words METHOD /
+ * ENDMETHOD anywhere else in code, macros (DEFINE), INCLUDE programs, an
+ * unterminated literal, and any changed method that sap_update_method could
+ * not address exactly (its name appears more than once as `METHOD name.`, or
+ * its body holds the text `ENDMETHOD.`).
+ *
+ * Never guarded, by design: a pragma or anything else after the name on the
+ * METHOD line (e.g. ADT's ZCX exception-class template), AMDP methods, a
+ * component or parameter named "method", and a class with a pending inactive
+ * version (anyone's: sap_update_method would refuse it with 409).
+ */
+/** The audit-line detail: at most 5 names, then "+N more" (the audit log keeps 200 chars). */
+export function methodOnlyAuditDetail(methods) {
+    const shown = methods.slice(0, 5).join(',');
+    const more = methods.length > 5 ? ` +${methods.length - 5} more` : '';
+    return `refused: method_only_change (Rule 7a) methods=${shown}${more}`;
+}
+/** The model-facing refusal for a method-only change. */
+export function methodOnlyRefusal(methods) {
+    return {
+        error: 'method_only_change',
+        detail: `Only the bodies of these methods changed: ${methods.join(', ')}. `
+            + 'Use sap_update_method once per method instead of rewriting the whole class (Rule 7a). '
+            + 'The class definition and the other methods stay untouched that way. '
+            + 'Your approval id still works for those calls.',
+    };
+}
+const METHOD_START = /^METHOD\s+([^\s.]+)\s*\.$/i;
+const METHOD_END = /^ENDMETHOD\s*\.$/i;
+/** METHOD / ENDMETHOD as a word: not part of a longer name (METHODS, ls_x-method, lo->method, if~method). */
+const KEYWORD = /(?<![\w\-~>\/=%$])(END)?METHOD(?![\w\-~\/%$])/gi;
+const DEFINE_STMT = /(^|\.)\s*DEFINE\s/i;
+/** An INCLUDE program; `INCLUDE TYPE` / `INCLUDE STRUCTURE` inside TYPES / DATA are not. */
+const INCLUDE_STMT = /(^|\.)\s*INCLUDE\s+(?!(TYPE|STRUCTURE)\s)/i;
+/** Names (upper case) of the methods whose bodies alone changed; undefined when the write must go on. */
+export function methodOnlyChange(current, proposed) {
+    const a = splitClassSource(current);
+    const b = splitClassSource(proposed);
+    if (!a || !b)
+        return undefined;
+    if (a.methods.length === 0 || a.methods.length !== b.methods.length)
+        return undefined;
+    if (!sameLines(a.frame, b.frame))
+        return undefined;
+    const changed = [];
+    for (let i = 0; i < a.methods.length; i++) {
+        const ma = a.methods[i];
+        const mb = b.methods[i];
+        if (ma.name.toUpperCase() !== mb.name.toUpperCase())
+            return undefined;
+        if (!sameLines(ma.body, mb.body))
+            changed.push(ma.name.toUpperCase());
+    }
+    if (changed.length === 0)
+        return undefined;
+    for (const name of changed) {
+        if (!updateMethodCanAddress(current, name) || !updateMethodCanAddress(proposed, name))
+            return undefined;
+    }
+    return changed;
+}
+/**
+ * sap_update_method (sap-client replaceMethodBlock) takes the FIRST
+ * `METHOD name.` match anywhere in the source and the body up to the first
+ * `ENDMETHOD.` after it. Only point at it when that lands on our block.
+ */
+function updateMethodCanAddress(source, name) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const starts = source.match(new RegExp(`\\bMETHOD\\s+${escaped}\\s*\\.`, 'gi')) ?? [];
+    if (starts.length !== 1)
+        return false;
+    const split = splitClassSource(source);
+    const block = split?.methods.find((m) => m.name.toUpperCase() === name);
+    return !!block && !block.body.some((l) => /\bENDMETHOD\s*\./i.test(l));
+}
+function sameLines(x, y) {
+    return x.length === y.length && x.every((l, i) => l === y[i]);
+}
+/** The frame / body split, or undefined when it is not certain. Exported for tests. */
+export function splitClassSource(source) {
+    const lines = source.replace(/\s+$/, '').split(/\r\n|\r|\n/).map((l) => l.replace(/\s+$/, ''));
+    const frame = [];
+    const methods = [];
+    let open;
+    for (const line of lines) {
+        if (line.startsWith('*') || line.trimStart().startsWith('"')) {
+            (open ? open.body : frame).push(line);
+            continue;
+        }
+        const code = codeOf(line);
+        if (code === undefined)
+            return undefined;
+        if (DEFINE_STMT.test(code) || INCLUDE_STMT.test(code))
+            return undefined;
+        const stmt = code.trim();
+        const start = METHOD_START.exec(stmt);
+        if (start) {
+            if (open)
+                return undefined;
+            frame.push(line);
+            open = { name: start[1], body: [] };
+            continue;
+        }
+        if (METHOD_END.test(stmt)) {
+            if (!open)
+                return undefined;
+            methods.push(open);
+            open = undefined;
+            frame.push(line);
+            continue;
+        }
+        if (hasStrayKeyword(code))
+            return undefined;
+        (open ? open.body : frame).push(line);
+    }
+    if (open)
+        return undefined;
+    return { frame, methods };
+}
+/** METHOD / ENDMETHOD in code other than a whole `METHOD x.` / `ENDMETHOD.` line. `CALL METHOD` is a call. */
+function hasStrayKeyword(code) {
+    for (const m of code.matchAll(KEYWORD)) {
+        const isEnd = !!m[1];
+        if (!isEnd && /\bCALL\s+$/i.test(code.slice(0, m.index)))
+            continue;
+        return true;
+    }
+    return false;
+}
+/**
+ * The code part of one line: literal contents blanked, a trailing `"`
+ * comment dropped. Undefined when a literal does not close on the line.
+ */
+function codeOf(line) {
+    let out = '';
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === '"')
+            break;
+        if (ch === "'" || ch === '`') {
+            let j = i + 1;
+            for (; j < line.length; j++) {
+                if (line[j] === ch) {
+                    if (line[j + 1] === ch) {
+                        j++;
+                        continue;
+                    } // doubled quote = escaped
+                    break;
+                }
+            }
+            if (j >= line.length)
+                return undefined;
+            out += ch + ' '.repeat(j - i - 1) + ch;
+            i = j;
+            continue;
+        }
+        if (ch === '|') {
+            let j = i + 1;
+            for (; j < line.length; j++) {
+                if (line[j] === '\\') {
+                    j++;
+                    continue;
+                }
+                if (line[j] === '|')
+                    break;
+            }
+            if (j >= line.length)
+                return undefined;
+            out += '|' + ' '.repeat(j - i - 1) + '|';
+            i = j;
+            continue;
+        }
+        out += ch;
+    }
+    return out;
+}
+/**
+ * Runs the guard for one sap_set_source call. Classes only (the caller checks
+ * the type). Returns `refuse` with the changed methods, or `go` with the read
+ * outcome for the snapshot to reuse (undefined when nothing was read).
+ *
+ * Before refusing, the class must have NO pending inactive version — the same
+ * check sap-client's updateMethod makes (it refuses with 409 when the class is
+ * listed). Otherwise refusing would leave no way to write the class at all.
+ * That second read happens only on the refusal path; if it fails, never refuse.
+ */
+export async function runMethodOnlyGuard(adt, g) {
+    if (typeof adt?.getSource !== 'function')
+        return { go: undefined };
+    let outcome;
+    try {
+        outcome = { source: await adt.getSource(g.type, g.name) };
+    }
+    catch (error) {
+        outcome = { error };
+    }
+    if (!('source' in outcome) || typeof outcome.source !== 'string')
+        return { go: outcome };
+    const changed = methodOnlyChange(outcome.source, g.source);
+    if (!changed)
+        return { go: outcome };
+    if (await classIsInactive(adt, g.name) !== false)
+        return { go: outcome };
+    return { refuse: changed };
+}
+/** true / false from the inactive-objects list; undefined when it could not be checked. */
+async function classIsInactive(adt, name) {
+    if (typeof adt.inactiveObjects !== 'function')
+        return undefined;
+    try {
+        const upper = name.toUpperCase();
+        const list = await adt.inactiveObjects();
+        return list.some((o) => String(o.name ?? '').toUpperCase() === upper
+            && (o.type === '' || String(o.type ?? '').toUpperCase().startsWith('CLAS')));
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/tools/rap/skeleton-resolve.js

@@ -24,6 +24,7 @@ import { PKG_RE } from '../../projects/plan-objects.js';
 import { askConfirm } from '../../ui/confirm-request.js';
 import { cardSlotEmitter } from '../../ui/card-slot.js';
 import { isHeadless } from '../../renderer/tty.js';
+import { STOPPED_BEFORE_START_RESULT } from '../../agent/repair-partial.js';
 const fail = (m) => ({ content: `error: ${m}`, is_error: true });
 const NOT_CHOSEN = 'Skeleton not chosen. Nothing was saved.';
 const TABLE_RE = /^[ZY][A-Z0-9_]{1,15}$/;
@@ -200,6 +201,9 @@ export async function rapSkeletonResolveHandler(args, ctx, deps = {}) {
         ctx.chunkEmitter?.emit('info', `RAP skeleton chosen by the rules (no confirm card here): ${SKELETON_WHO[decision.by]}.`);
     }
     else {
+        // LT-15 D6 (review M2) — stopped during the reads above: no card, nothing saved.
+        if (ctx.signal?.aborted)
+            return { content: STOPPED_BEFORE_START_RESULT, is_error: true };
         const card = skeletonCardRequest(decision, blocked?.reason ?? null, names, objects9);
         const res = await (deps.confirm ?? ((r) => askConfirm(r)))(card);
         const value = res.value;

package/dist/tools/sap-write.js

@@ -25,13 +25,14 @@ import crypto from 'node:crypto';
 import { registerTool } from './index.js';
 import { byObjectType } from '../sap/profile-gate.js';
 import { verifyAndSpendApprovalId } from '../approvals/jwt.js';
+import { writtenObjectName } from '../approvals/op-labels.js';
 import { grantActivateMismatch } from '../approvals/grant-claims.js';
 import { getLook } from '../renderer/look.js';
 import { verifyActive } from './verify.js';
 import { hasRecordedSyntaxErrorsByName, clearSyntaxErrorsAfterActivation } from './syntax-state.js';
 import { teamFixOffers, cspeachWritesThisSession } from '../register/offer.js';
 import { appendPending, finalizeToolCall } from '../session/pending.js';
-import { checkTransportFit, reusedRequestRefusal } from './transport-fit-check.js';
+import { checkTransportFit, checkTransportNeeded, reusedRequestRefusal, noteTransportNeededAsked, takeTransportNeededAsked, } from './transport-fit-check.js';
 import { typeCode } from '../approvals/risk-floor.js';
 import { auditLog, SapError, hasClassicParameterBlock } from '@cspeach/sap-client';
 import { ERR } from '../errors/codes.js';
@@ -56,6 +57,9 @@ const SET_SOURCE_SPEC = {
     beforeApproval: (a) => (typeCode(a.type) === 'FUNC' && hasClassicParameterBlock(String(a.source ?? ''))
         ? { error: 'classic_parameter_block', detail: FUNC_CLASSIC_BLOCK_TEXT }
         : undefined),
+    // Rule 7a in code (2026-10-22): on an existing class, a rewrite whose only
+    // change is inside method bodies is refused — sap_update_method per method.
+    methodOnlyGuard: (a) => ({ type: a.type, name: a.name, source: String(a.source ?? '') }),
     approval: {
         object: (a) => a.name,
         op: 'modify',
@@ -94,7 +98,7 @@ const SET_SOURCE_SPEC = {
             syntax: { ok: syntax.ok, errors: syntax.errors },
             activation: chainActivation(act),
             card: {
-                object: a.name,
+                object: writtenObjectName(a.type, a.name), // LT-11: DDLX / DCLS / BDEF name their kind
                 what: 'source',
                 transport: pre.transport,
                 oldSource,
@@ -163,10 +167,26 @@ const UPDATE_METHOD_SPEC = {
             methodSource: a.method_source,
             transport: pre.transport ?? ctx.currentTransport?.get() ?? '',
         };
+        // LT-15 D6 — a stop (Esc / Ctrl+C) during the class read below opens no
+        // preview card: the hook is not called and the pipeline returns INTERRUPTED.
+        // No signal on the ctx: the hook is passed through as before.
+        const previewHook = ctx.previewHook;
+        let stoppedBeforeCard = false;
+        const hook = ctx.signal
+            ? (input) => {
+                if (ctx.signal?.aborted) {
+                    stoppedBeforeCard = true;
+                    return Promise.resolve({ confirmed: false });
+                }
+                return previewHook(input);
+            }
+            : previewHook;
         try {
-            await interceptUpdateMethod(minimal, call, ctx.previewHook);
+            await interceptUpdateMethod(minimal, call, hook);
         }
         catch (err) {
+            if (stoppedBeforeCard)
+                return { interrupted: true };
             if (err instanceof CancelledByUserError)
                 return { error: { error: 'cancelled_by_user', detail: err.message } };
             return { error: { error: 'preview_failed', detail: String(err) } };
@@ -302,6 +322,42 @@ registerTool({
 });
 const isDevcCreate = (a) => String(a.type ?? '').toUpperCase().split('/')[0].trim() === 'DEVC';
 const devcTransportCreated = (pre) => pre.extra['devc_transport_created'];
+/** LT-1 — no request resolved for a create (explicit, project and session all empty, or blank). */
+const noTransportChosen = (pre) => !String(pre.transport ?? '').trim();
+/**
+ * LT-1 — the transportability check for a create with no request chosen. A
+ * refusal in the REPL session arms the adoption below (fix round 1, M-3); a
+ * sub-agent ctx (no currentTransport, agent_run.ts) never arms it.
+ */
+async function transportNeededGate(ctx, o) {
+    const need = await checkTransportNeeded(ctx.adt, o);
+    if (need.ok)
+        return undefined;
+    if (ctx.currentTransport)
+        noteTransportNeededAsked();
+    return need.refusal;
+}
+/**
+ * LT-1 — a create that landed on a request the model named right after a
+ * transport_needed question (the person's pick of an open request) makes it
+ * the session transport, as sap_transport_create does for a new one.
+ *  - Fix round 1, M-3: only after that question; any other explicit request
+ *    is used for that create only, as before. The next landed create uses the
+ *    question up, whichever request it went to.
+ *  - Fix round 1, I-1: a ctx without currentTransport (a sub-agent) never
+ *    writes the process-wide session transport and never uses the question up.
+ *  - Never when the session already holds a request.
+ */
+function adoptExplicitTransport(transport, ctx) {
+    if (!ctx.currentTransport)
+        return;
+    if (!takeTransportNeededAsked())
+        return;
+    const t = String(transport ?? '').trim().toUpperCase();
+    if (!t || (ctx.currentTransport.get() ?? null) !== null)
+        return;
+    setCurrentTransport(t);
+}
 const CREATE_OBJECT_SPEC = {
     tool: 'sap_create_object',
     // Part 2c D6 (review I-4): a module or include needs its group — refused
@@ -323,9 +379,15 @@ const CREATE_OBJECT_SPEC = {
     snapshot: { kind: 'none', reason: 'a new object has no prior source' },
     // 1.1.31: does the chosen request fit the package? (see transport-fit-check.ts)
     // A package create decides its own transport in the walGate (§10a), so only objects.
+    // LT-1: no request chosen at all → refused when SAP says the package is transportable.
     preGate: async (a, ctx, pre) => {
         if (isDevcCreate(a))
             return { ok: true };
+        if (noTransportChosen(pre)) {
+            const refusal = await transportNeededGate(ctx, { type: a.type, name: a.name, pkg: a.package });
+            if (refusal)
+                return { error: refusal };
+        }
         const fit = await checkTransportFit(ctx.adt, { type: a.type, name: a.name, pkg: a.package, transport: pre.transport });
         return fit.ok ? { ok: true } : { error: fit.refusal };
     },
@@ -397,6 +459,9 @@ const CREATE_OBJECT_SPEC = {
     audit: { method: 'createObject', type: (a) => a.type, name: (a) => a.name },
     verify: { syntax: false, activation: false },
     walResult: (_a, r) => r,
+    // LT-1: the request the person picked becomes the session transport (only when none is set).
+    after: (a, _r, _pre, ctx) => { if (!isDevcCreate(a))
+        adoptExplicitTransport(a.transport, ctx); },
     envelope: (a, r, pre) => {
         if (isDevcCreate(a)) {
             const pkgName = r.objectName || String(a.name).toUpperCase();
@@ -666,6 +731,14 @@ function ddicCreateSpec(tool, type, auditType, create) {
         },
         transport: { mode: 'three-tier' },
         snapshot: { kind: 'none', reason: 'a new object has no prior source' },
+        // LT-1: no request chosen at all → refused when SAP says the package is
+        // transportable. No fit check for a chosen request (as before).
+        preGate: async (a, ctx, pre) => {
+            if (!noTransportChosen(pre))
+                return { ok: true };
+            const refusal = await transportNeededGate(ctx, { type, name: a.name, pkg: a.package });
+            return refusal ? { error: refusal } : { ok: true };
+        },
         walArgs: (a) => ({ name: a.name, type, package: a.package }),
         call: async (a, ctx, pre) => {
             const r = await create(a, ctx, pre.transport);
@@ -694,6 +767,8 @@ function ddicCreateSpec(tool, type, auditType, create) {
         audit: { method: 'createObject', type: () => auditType, name: (a) => a.name },
         verify: { syntax: false, activation: false },
         walResult: (_a, r) => r,
+        // LT-1: the request the person picked becomes the session transport (only when none is set).
+        after: (a, _r, _pre, ctx) => adoptExplicitTransport(a.transport, ctx),
         envelope: (_a, r) => ({
             created: true,
             active: true,

package/dist/tools/snapshot.js

@@ -62,10 +62,15 @@ registerTool({
         return { content: JSON.stringify({ snapshot: entry, size: source.length }) };
     },
 });
-export async function autoSnapshot(objectName, objectType, adt) {
+export async function autoSnapshot(objectName, objectType, adt, preRead) {
     let src;
     try {
-        src = await adt.getSource(objectType, objectName);
+        if (preRead === undefined)
+            src = await adt.getSource(objectType, objectName);
+        else if ('source' in preRead)
+            src = preRead.source;
+        else
+            throw preRead.error;
     }
     catch (err) {
         if (isNotFound(err))

package/dist/tools/subagent/agent_run.js

@@ -34,6 +34,8 @@ import { collectTurnAssistantText } from '../../agent/turn-assistant-text.js';
 export const MAX_AGENT_DEPTH = 3;
 export const DEFAULT_MAX_TOKENS = 100_000;
 export const HARD_MAX_TOKENS = 200_000;
+/** LT-15 F3 — the result of a child turn the person stopped (Esc / Ctrl+C). */
+export const SUBAGENT_INTERRUPTED_LINE = 'interrupted: the subagent was stopped before it finished. What it did before the stop is unknown: check before relying on it.';
 // Same NAME_PATTERN shape playbook_get uses — alphanumerics + `:_-`, ≤64.
 const SKILL_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9:_-]{0,63}$/;
 export async function agentRunHandler(args, ctx) {
@@ -124,6 +126,9 @@ export async function agentRunHandler(args, ctx) {
         skillSource: ctx.skillSource,
         // Task 18 fix M4 — an agent_run child never starts reader subagents.
         subagent: true,
+        // LT-15 F3 — the parent's stop (Esc / Ctrl+C) reaches the child: its tool
+        // dispatch and the D6 card guards see it. No parent signal: no key.
+        ...(ctx.signal ? { signal: ctx.signal } : {}),
         // previewHook + pendingDispatch + currentTransport + todoEmitter
         // intentionally omitted.
     };
@@ -166,9 +171,18 @@ export async function agentRunHandler(args, ctx) {
             chunkEmitter: nullSinkEmitter,
             maxTokensOverride,
             toolFilter,
+            // LT-15 F3 — the child turn stops at its own next safe point.
+            ...(ctx.signal ? { signal: ctx.signal } : {}),
         });
     }
     catch (err) {
+        // LT-15 F3 — stopped by the person: say so plainly, with what the child
+        // said before the stop. Every child tool_use is already paired (the loop
+        // records results before its next round, where the abort ends the turn).
+        if (ctx.signal?.aborted) {
+            const partial = collectTurnAssistantText(childSession.messages, 0).trim();
+            return { content: partial ? `${SUBAGENT_INTERRUPTED_LINE}\n\nWhat it said before the stop:\n${partial}` : SUBAGENT_INTERRUPTED_LINE, is_error: true };
+        }
         const msg = err instanceof Error ? err.message : String(err);
         return { content: `error: subagent failed — ${msg}`, is_error: true };
     }

package/dist/tools/tool-loading.js

@@ -43,6 +43,11 @@ const FIORI_FAMILY = [
 const TRANSPORT_FAMILY = [
     'sap_transport_create', 'sap_transport_for_object', 'sap_transport_list', 'sap_transport_read', 'sap_transport_release',
 ];
+// LT-9 (1A fix wave, 2026-10-24): the build skills create the session transport
+// in place. Live: /abap-rap's search for "transport" came back with loaded
+// tools only (the ATC crowd-out again), so it offered SE09 and handed off to
+// /abap-transport. Release and read stay with /abap-transport.
+const SESSION_TRANSPORT = ['sap_transport_create', 'sap_transport_list', 'sap_transport_for_object'];
 /**
  * Per-skill starter tools: the non-core tools a skill's body names as its
  * working set (counted from `.claude/skills/<skill>/SKILL.md`). A tool left
@@ -51,7 +56,8 @@ const TRANSPORT_FAMILY = [
  */
 export const SKILL_STARTERS = Object.freeze({
     'abap-fiori-build': FIORI_FAMILY,
-    'abap-transport': TRANSPORT_FAMILY,
+    // ATC fix (2026-10-23): the body runs sap_atc_run before release; the API's search for "atc" is crowded out.
+    'abap-transport': [...TRANSPORT_FAMILY, 'sap_atc_run'],
     'abap-transport-analysis': [...TRANSPORT_FAMILY, 'sap_atc_run', 'sap_usage_references'],
     'abap-cap': ['fiori_scaffold_fe', 'fiori_render_smoke', 'fiori_draft_smoke'],
     // Both flag-gated (LOCAL_BUILD_TOOLS / STANDALONE_FILE_TOOLS): skipped when off.
@@ -59,7 +65,7 @@ export const SKILL_STARTERS = Object.freeze({
     'abap-atc-fix': ['sap_atc_run'],
     'abap-cca': ['team_estate', 'sap_atc_run', 'sap_usage_references', 'sap_api_state'],
     'abap-clean-core': ['sap_api_state', 'sap_atc_run', 'sap_usage_references', 'team_findings', 'team_lane_move'],
-    'abap-data-model': ['sap_create_domain', 'sap_create_data_element'],
+    'abap-data-model': ['sap_create_domain', 'sap_create_data_element', ...SESSION_TRANSPORT],
     'abap-document': ['sap_usage_references'],
     'abap-handover': ['sap_usage_references'],
     'abap-impact': ['sap_usage_references', 'sap_atc_run'],
@@ -70,22 +76,24 @@ export const SKILL_STARTERS = Object.freeze({
     'abap-incident': ['sap_short_dump', 'sap_snapshot_take', 'sap_atc_run', 'sap_run_unit_test', 'sap_api_state', 'sap_diff', 'sap_run'],
     'abap-eml': ['sap_run_unit_test', 'sap_run'],
     'abap-test': ['sap_run_unit_test', 'sap_set_class_include', 'sap_run'],
-    'abap-extend-model': ['extend_model_insert', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_set_class_include'],
+    'abap-extend-model': ['extend_model_insert', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_set_class_include', ...SESSION_TRANSPORT],
     // RAP generator (2026-10-14): SAP's generator writes the stack; the finish check proves F1–F5.
     // Final review M5 — standalone /abap-rap calls rap_skeleton_resolve before it builds.
-    'abap-rap': ['sap_set_class_include', 'sap_service_binding_publish', 'sap_class_includes', 'rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check', 'sap_run'],
+    'abap-rap': ['sap_set_class_include', 'sap_service_binding_publish', 'sap_class_includes', 'rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check', 'sap_run', ...SESSION_TRANSPORT],
     // Plan steps load tools by the PLAN skill (session.tool_set_skill / params.skill), not the
     // delegate (which only rides as the X-CSPeach-Delegate-Skill header), so the RAP
     // skeleton + finish phases need the generator and the finish check here too.
-    'abap-plan': ['rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check'],
-    'abap-modernize': ['sap_api_state', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_atc_run', 'sap_transport_create'],
+    // ATC fix (2026-10-23): abap-plan writes "ATC clean" into exit gates; the API's tool search for
+    // "atc" is crowded out by loaded tools ("batch", "dispatch"), so the plan step loads sap_atc_run.
+    'abap-plan': ['rap_skeleton_resolve', 'sap_generate_objects', 'rap_finish_check', 'sap_atc_run', ...SESSION_TRANSPORT],
+    'abap-modernize': ['sap_api_state', 'sap_snapshot_take', 'sap_service_binding_publish', 'sap_atc_run', ...SESSION_TRANSPORT],
     'abap-segw': ['sap_snapshot_take', 'sap_odata_test'],
     'abap-upgrade-fix': ['sap_snapshot_take', 'glob'],
     'abap-upgrade-scan': ['sap_atc_run'],
     'abap-upgrade-verify': ['sap_atc_run'],
     // Selection texts (2026-10-04): a new PARAMETERS / SELECT-OPTIONS gets its text in the same change.
-    'abap-refactor': ['sap_get_text_elements', 'sap_set_text_elements'],
-    'abap-generate': ['sap_get_text_elements', 'sap_set_text_elements', 'sap_run'],
+    'abap-refactor': ['sap_get_text_elements', 'sap_set_text_elements', ...SESSION_TRANSPORT],
+    'abap-generate': ['sap_get_text_elements', 'sap_set_text_elements', 'sap_run', ...SESSION_TRANSPORT],
     // Chat lane (D5): the hand-off tool is loaded on chat turns; flag-gated, so a skills-lane session never lists it.
     // `_chat` is the one SKILL_STARTERS key that is not a catalog skill (pinned in tool-loading.test.ts).
     '_chat': ['hand_off'],

package/dist/tools/transport-fit-check.js

@@ -111,6 +111,76 @@ export async function checkTransportFit(adt, o) {
         },
     };
 }
+/** The person's LOCAL calendar date as YYYY-MM-DD (fix round 1, M-1: never UTC). */
+export function localIsoDate(date = new Date()) {
+    const p = (n) => String(n).padStart(2, '0');
+    return `${date.getFullYear()}-${p(date.getMonth() + 1)}-${p(date.getDate())}`;
+}
+/** The suggested session-transport description (owner ruling 2026-10-24), editable by the person. */
+export function cspeachTransportDefault(date = new Date()) {
+    return `CSPeach ${localIsoDate(date)}: <work summary>`;
+}
+/**
+ * Fix round 1, M-3 ruling: only the person's pick after a transport_needed
+ * question becomes the session transport. A refusal in the REPL session arms
+ * this; the next landed create uses it up. Not persisted (a new CLI process
+ * starts unarmed), like the created-this-session ledger in transport.ts.
+ */
+let transportNeededAsked = false;
+export function noteTransportNeededAsked() { transportNeededAsked = true; }
+/** True once, then false: the next landed create consumes the question. */
+export function takeTransportNeededAsked() {
+    const was = transportNeededAsked;
+    transportNeededAsked = false;
+    return was;
+}
+/** Test hook — module-scope state would otherwise leak across Vitest tests. */
+export function clearTransportNeededAsked() { transportNeededAsked = false; }
+export async function checkTransportNeeded(adt, o) {
+    const pkg = String(o.pkg ?? '').trim().toUpperCase();
+    if (!pkg || pkg.startsWith('$'))
+        return { ok: true };
+    if (typeof adt.transportCheck !== 'function')
+        return { ok: true };
+    const object = String(o.type ?? '').toUpperCase().split('/')[0].trim();
+    const objectName = String(o.name ?? '').trim().toUpperCase();
+    if (NO_FIT_CHECK_TYPES.has(object))
+        return { ok: true };
+    let uri;
+    try {
+        uri = toObjectUrl(object, objectName).toLowerCase();
+    }
+    catch {
+        debug(`no object URI for ${object} ${objectName}, no transport-needed check`);
+        return { ok: true };
+    }
+    let check;
+    try {
+        check = await adt.transportCheck({ pgmid: 'R3TR', object, objectName, devclass: pkg, operation: 'I', uri });
+    }
+    catch (err) {
+        debug(`transport-needed check failed, create goes ahead: ${(err instanceof Error ? err.message : String(err)).slice(0, 200)}`);
+        return { ok: true };
+    }
+    if (!check.ok) {
+        debug(`transport-needed check gave no answer, create goes ahead: ${(check.error ?? '').slice(0, 200)}`);
+        return { ok: true };
+    }
+    if (!check.requestRequired || !check.transportLayer)
+        return { ok: true };
+    const shown = (check.requests ?? []).slice(0, MAX_FITTING_SHOWN).map((r) => ({ number: r.number, description: r.text ?? '' }));
+    const list = shown.map((r) => (r.description ? `${r.number} ('${r.description}')` : r.number)).join(', ');
+    const message = `Package ${pkg} is transportable, so creating ${objectName} needs a transport request, and no session transport is set yet. `
+        + 'Nothing was created. Ask the person once with ask_question: '
+        + `create a new session transport (recommended; sap_transport_create, proposing the description "${cspeachTransportDefault()}", which they can edit)`
+        + (shown.length ? `, or use one of the open requests SAP lists for the package: ${list}` : '')
+        + '. Their answer becomes the session transport for the rest of this work. '
+        + 'Then call this tool again with the same approval_id (and the chosen request as transport, if it is an existing one).';
+    return {
+        ok: false,
+        refusal: { error: 'transport_needed', message, ...(shown.length ? { fitting_requests: shown } : {}) },
+    };
+}
 /**
  * 1.1.31 — SAP answered a create with an existing request (the user's newest
  * open one, which may belong to other work). It is never used silently, and