@cspeach/cli 1.1.51 → 1.1.53

package/dist/skills/source-authed.js

@@ -14,6 +14,7 @@ import { sha256 } from '@noble/hashes/sha256';
 import { bytesToHex } from '@noble/hashes/utils';
 import { ManifestClient, DEFAULT_MANIFEST_URL, SkillIntegrityError, ManifestUnavailableError, } from './manifest-client.js';
 import { fileSkillsCache } from './skills-cache.js';
+import { fetchWithConnectRetry } from '../util/connect-retry.js';
 // Defined next to the client that throws it (Task 8 (a): typed, never string-matched).
 export { SkillIntegrityError };
 export class SkillNotInPlanError extends Error {
@@ -69,10 +70,10 @@ async function fetchSignedInBody(baseUrl, name, expectedSha, getBearer, doFetch)
         throw new SkillSignInError();
     let r;
     try {
-        r = await doFetch(`${baseUrl}/v1/skills/${encodeURIComponent(name)}`, {
+        r = await fetchWithConnectRetry(`${baseUrl}/v1/skills/${encodeURIComponent(name)}`, () => ({
             headers: { Authorization: `Bearer ${bearer}` },
             signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-        });
+        }), { fetchImpl: doFetch });
     }
     catch {
         throw new SkillsUnavailableError('could not reach CSPeach');

package/dist/tools/approval.js

@@ -6,6 +6,14 @@ import { isHeadless, shouldUseInk } from '../renderer/tty.js';
 import { effectiveRisk, riskResultFields, typeCode } from '../approvals/risk-floor.js';
 import { objectsWithSyntaxErrors } from './syntax-state.js';
 import { noteWriteTransport } from '../repl/current-transport.js';
+import { STOPPED_BEFORE_START_RESULT } from '../agent/repair-partial.js';
+/**
+ * LT-15 D6 (F6) — after a stop (Esc or Ctrl+C set the same turn abort) no new
+ * card opens and no approval id is minted. The shape dispatchTool returns for
+ * a tool that never started (the tool_use stays paired), with a text that says
+ * nothing ran.
+ */
+const stoppedBeforeCard = (ctx) => (ctx.signal?.aborted ? { content: STOPPED_BEFORE_START_RESULT, is_error: true } : null);
 /**
  * Round 8 item 6 — the footer showed "no transport" while the approved card
  * said "transport S4HK903731". An approval granted for an explicit transport
@@ -29,7 +37,7 @@ import { promptAdvisory } from '../approvals/advisory-prompt.js';
 import { markPlanGateApproved } from '../repl/rule8-detector.js';
 import { getEffectiveWriteMode } from '../repl/mode-cycle.js';
 import { getCurrentTransport } from '../repl/current-transport.js';
-import { displayTransport } from '../approvals/op-labels.js';
+import { displayTransport, knownTypeWord } from '../approvals/op-labels.js';
 import { canonicalApprovalObject as bareObjectName } from '../approvals/canonical.js';
 import { projectTransport, SEVERAL_REQUESTS_LABEL, transportForWrite, TRANSPORT_REQUEST } from '../register/project-transport.js';
 import { NOT_ON_THIS_RELEASE, approvalRefusedByProfile } from '../sap/profile-gate.js';
@@ -223,7 +231,8 @@ registerTool({
                     type: 'object',
                     properties: {
                         op: { type: 'string', enum: ['create', 'modify', 'delete', 'activate', 'release', 'run'] },
-                        object: { type: 'string' },
+                        // P-2 (1A fix wave): a group word ('DCLs') is not an object the plan grant can match.
+                        object: { type: 'string', description: "One real object name per row (comma-join several only in an activate row), never a group word such as 'DCLs'." },
                         type: { type: 'string' },
                         diff: { type: 'string', description: 'For a CREATE op this MUST be the exact, complete source that will be written — verbatim, character-for-character, NOT a description, summary, or paraphrase. It is shown to the developer in the approval box as the exact thing they are approving, so a one-line summary here means they approve a write they cannot inspect. For a MODIFY op, the real unified diff of the change (again verbatim, not a description).' },
                         package: { type: 'string', description: 'Target package (development class) for the object, if known — shown on the approval box' },
@@ -298,6 +307,10 @@ registerTool({
         // no role configured and no session override this is exactly
         // cfg.write_mode — byte-identical behavior.
         const role = cfg.sap[ctx.sapAlias]?.role;
+        // LT-15 D6 — stopped during the profile read above: no advisory card, no card.
+        const stopA = stoppedBeforeCard(ctx);
+        if (stopA)
+            return stopA;
         // Advisory-only short-circuit — never mint approval_ids.
         // The developer applies the change manually in ADT; the AI gets an
         // ai_directive telling it not to attempt any SAP write tools.
@@ -313,11 +326,17 @@ registerTool({
             return { content: JSON.stringify(releaseRefusal), is_error: true };
         // Task 8 (B11) — the request that already holds each modified object, before any card.
         await attachOwningTransport(args.changes ?? [], ctx);
+        // LT-15 D6 — stopped during the reads above: no card, no nag, no id minted
+        // (the plan-grant and auto-approve paths below mint without a card).
+        const stopB = stoppedBeforeCard(ctx);
+        if (stopB)
+            return stopB;
         let sapCfg = cfg.sap[ctx.sapAlias];
         const riskCtx = {
             sapAlias: ctx.sapAlias,
             autoApprovePolicy: sapCfg?.auto_approve ?? 'never',
             syntaxErrorObjects: objectsWithSyntaxErrors(),
+            typeWord: knownTypeWord, // LT-10: the syntax-errors reason names the kind of object
         };
         const changes = args.changes;
         const declared = args.risk;
@@ -421,6 +440,10 @@ registerTool({
             sapCfg = cfg.sap[ctx.sapAlias];
             riskCtx.autoApprovePolicy = sapCfg?.auto_approve ?? 'never';
         }
+        // LT-15 D6 (review M3) — stopped while the nag was up: no card after it, no id.
+        const stopC = stoppedBeforeCard(ctx);
+        if (stopC)
+            return stopC;
         // 1.1.31 (owner, 2026-10-07): a package or transport always gets a person's
         // yes. Live, auto_approve="low" let the model's own "low" create package
         // ZCC_FIX_PROOF and request S4HK903757 with no card. The plan-grant path
@@ -478,12 +501,14 @@ registerTool({
         // for one task" complaint. Review-each falls back to the per-change
         // gate. Cancel rejects the whole plan.
         //
-        // Task 9 (C8): only for more than one VISIBLE change — the same count the
-        // plan gate shows (an activate whose write is in the list is not a change
-        // a person sees). A modify + its activate on one class gets the
-        // per-change card only; the activate follows its approved write below.
+        // Task 9 (C8): only for more than one VISIBLE change (an activate whose
+        // write is in the list is not a change a person sees). A modify + its
+        // activate on one class gets the per-change card only; the activate
+        // follows its approved write below. LT-12: the plan gate's LIST also
+        // hides a modify that a create of the same object covers (planRows), so
+        // it may show fewer rows than this count; this count is unchanged.
         let skipPerChangeGates = false;
-        // Raw keys on purpose: the same collapse (and count) the plan gate displays.
+        // Raw keys on purpose: activates collapsed, nothing else.
         const visibleCount = collapseImplicitActivates(changes).length;
         if (visibleCount > 1) {
             const mode = await renderPlanGate(args.summary, changes, planGateTransport, eff, ctx.sapAlias);
@@ -549,7 +574,23 @@ registerTool({
                 outcome = { approved: false, reason: 'sibling_write_skipped' };
             }
             else {
-                outcome = await renderPerChangeApprovalV3(c, eff, displayTransport(c.op, args.transport, sessionTransport, c.owningTransport, project));
+                // LT-15 D6 (review M3) — stopped during the mint after the card before:
+                // the next card does not open; ids minted so far are dropped unused.
+                const stopD = stoppedBeforeCard(ctx);
+                if (stopD)
+                    return stopD;
+                // 1.1.53 item 8 (live F-C): the batch risk put another object's reason
+                // on this card. Each card shows the risk of its own change, plus the
+                // activate of the same object that this card approves with it. One
+                // visible change keeps the batch risk, exactly as before. Display only:
+                // the gates above and the result fields keep `eff`.
+                const cardRisk = visibleCount <= 1 ? eff : effectiveRisk(declared, [
+                    c,
+                    ...((c.op === 'modify' || c.op === 'create')
+                        ? changes.filter((a) => a.op === 'activate' && `${a.type}:${canonicalApprovalObject(a.object)}` === objKey)
+                        : []),
+                ], riskCtx);
+                outcome = await renderPerChangeApprovalV3(c, cardRisk, displayTransport(c.op, args.transport, sessionTransport, c.owningTransport, project));
             }
             if (outcome.approved) {
                 if (c.op === 'modify' || c.op === 'create')

package/dist/tools/dispatch-skill.js

@@ -44,7 +44,7 @@ registerTool({
         properties: {
             command: {
                 type: 'string',
-                description: 'Full slash command including arguments. Must start with `/`. Example: `/abap-rap --from @order-approval-system-design-2924-v1.cspeach.json`.',
+                description: 'Full slash command including arguments. Must start with `/`. Example: `/abap-rap --from @order-approval-system-design-2924-v1.cspeach.json`. Never put a transport description in it unless the person typed it.',
             },
         },
         required: ['command'],

package/dist/tools/hand-off.js

@@ -5,6 +5,9 @@
  * chat turn then ends and the workflow runs with its own plan + approvals.
  * No extra consent card (D5): the workflow asks before any write.
  * Refused outside the chat lane; dispatch_skill stays the skills' own switch.
+ * Stage 1A (T1A.4): in an inline session (`ctx.inlineSkills`) a playbook turn
+ * may hand off too — still only queues — except while a plan is in charge or
+ * the slot already holds a step (the harness's next-phase hop wins).
  *
  * Flag-gated: only a chat-lane process enables it (Task 11), so a skills-lane
  * session never lists it and its tools array stays byte-identical to today.
@@ -14,7 +17,37 @@ import { isPlanResumeCommand } from '../commands/plan-resume.js';
 import { SKILL_CATALOG, resolveSkillAlias } from '../skill-catalog.js';
 /** Longest request hand_off queues (after whitespace is collapsed). */
 export const HAND_OFF_REQUEST_MAX = 500;
+/**
+ * I3 (owner, 2026-10-22) — one hand-off per person message. Refusal code when
+ * the running turn was itself started by a hand_off: no workflow-to-workflow
+ * chain of reads and credits without a new person message. A new person
+ * message resets it (the REPL passes who started each turn as `ctx.turnBy`).
+ * dispatch_skill after the person's pick is not capped.
+ */
+export const HAND_OFF_CHAIN_CAPPED = 'HAND_OFF_CHAIN_CAPPED';
 export const HAND_OFF_LINE = (skill) => `→ /${skill}`;
+/** The success note when the model wrote nothing before the call in this turn. */
+export const HAND_OFF_NOTE = 'The workflow runs next and asks before it writes. End the turn now. If you wrote a line before the call, add nothing. If you wrote nothing, add one short line saying the workflow takes it from here. Do not print the command.';
+/**
+ * LT-3 (live check 2026-10-26) — the model often skipped the "if you wrote a
+ * line" test and announced the hand-off twice. The loop knows whether text
+ * came first in this turn and then gives this plain note instead.
+ */
+export const HAND_OFF_NOTE_ALREADY_SAID = 'The workflow runs next and asks before it writes. You already told the developer in this turn, so end the turn now and write nothing more. Do not print the command.';
+/** The hand_off success content with the note for a turn that already said its line. Anything else unchanged. */
+export function settleHandOffNote(content, saidBefore) {
+    if (!saidBefore)
+        return content;
+    try {
+        const r = JSON.parse(content);
+        if (r.ok !== true || r.note !== HAND_OFF_NOTE)
+            return content;
+        return JSON.stringify({ ...r, note: HAND_OFF_NOTE_ALREADY_SAID });
+    }
+    catch {
+        return content;
+    }
+}
 export const buildHandOffCommand = (skill, request) => `/${skill} ${request}`;
 const CATALOG_NAMES = new Set(SKILL_CATALOG.map((s) => s.name));
 /**
@@ -45,15 +78,25 @@ registerTool({
         type: 'object',
         properties: {
             skill: { type: 'string', description: 'Workflow name without the slash, e.g. "abap-refactor".' },
-            request: { type: 'string', description: 'What the workflow should do, with object names. One sentence, at most 500 characters, no flags.' },
+            request: { type: 'string', description: 'What the workflow should do, with object names. One sentence, at most 500 characters, no flags. Never put a transport description in it unless the person typed it.' },
         },
         required: ['skill', 'request'],
     },
     handler: async (args, ctx) => {
         const bad = (error, reason) => ({ is_error: true, content: JSON.stringify({ error, reason }) });
-        if (ctx.session?.lane !== 'chat') {
+        // Stage 1A (T1A.4) — in an inline session a playbook turn may hand off too.
+        const playbookTurn = ctx.session?.lane !== 'chat';
+        if (playbookTurn && !ctx.inlineSkills) {
             return bad('HAND_OFF_OUTSIDE_CHAT', 'hand_off is only for the chat; in a workflow, continue with the workflow (dispatch_skill switches workflows after the person agreed).');
         }
+        // The plan harness queues its next phase through the same slot; never race it.
+        if (playbookTurn && (ctx.session?.plan_in_flight || ctx.session?.skill === 'abap-plan')) {
+            return bad('HAND_OFF_PLAN_IN_FLIGHT', 'finish this step; after the plan, the person can ask for that in chat');
+        }
+        // I3 — one hand-off per person message.
+        if (ctx.turnBy === 'hand_off') {
+            return bad(HAND_OFF_CHAIN_CAPPED, "this workflow was already handed off from the person's message; one hand-off per message. Finish this workflow's answer, then let the person decide the next step: offer that workflow as a suggestion in your answer instead of calling hand_off. Do not call dispatch_skill either unless the person picks it.");
+        }
         const skill = normaliseSkill(args.skill);
         if (!skill) {
             return bad('HAND_OFF_UNKNOWN_SKILL', `unknown workflow "${String(args.skill ?? '')}". Use one of: ${SKILL_CATALOG.map((s) => s.name).join(', ')}`);
@@ -74,13 +117,12 @@ registerTool({
         if (!ctx.pendingDispatch) {
             return bad('DISPATCH_UNSUPPORTED', 'no dispatch slot in this context (one-shot or test); tell the developer which /abap-… command to run instead');
         }
+        if (playbookTurn && ctx.pendingDispatch.get() !== null) {
+            return bad('HAND_OFF_SLOT_TAKEN', 'a step is already queued; end the turn');
+        }
         ctx.pendingDispatch.set(command, { by: 'hand_off', line: HAND_OFF_LINE(skill) });
         return {
-            content: JSON.stringify({
-                ok: true,
-                queued: command,
-                note: 'The workflow runs next and asks before it writes. End the turn now with at most one short line; do not print the command.',
-            }),
+            content: JSON.stringify({ ok: true, queued: command, note: HAND_OFF_NOTE }),
         };
     },
 });

package/dist/tools/lane/app-lane-resolve.js

@@ -36,6 +36,9 @@ import { askConfirm } from '../../ui/confirm-request.js';
 import { isHeadless } from '../../renderer/tty.js';
 import { loadConfig } from '../../config/loader.js';
 import { getSapSystemInfo } from '../../sap/system-info.js';
+import { STOPPED_BEFORE_START_RESULT } from '../../agent/repair-partial.js';
+/** LT-15 D6 (review M2) — after a stop (Esc / Ctrl+C) no card opens and nothing is saved. */
+const stopped = (ctx) => (ctx.signal?.aborted ? { content: STOPPED_BEFORE_START_RESULT, is_error: true } : null);
 const fail = (message) => ({ content: `error: ${message}`, is_error: true });
 const NOT_CHOSEN = 'Lane not chosen. Nothing was saved.';
 const STOP = 'STOP — lane needs your choice.';
@@ -200,6 +203,9 @@ export async function appLaneResolveHandler(args, ctx, deps = {}) {
     }
     else {
         // 7. The lane card.
+        const stopLane = stopped(ctx);
+        if (stopLane)
+            return stopLane;
         const confirm = deps.confirm ?? ((req) => askConfirm(req));
         const card = laneCardRequest(decision);
         const res = await confirm({ ...card, facts: [...(card.facts ?? []), ...cardFacts] });
@@ -224,6 +230,9 @@ export async function appLaneResolveHandler(args, ctx, deps = {}) {
         }
         // 8. A CAP lane needs a runtime.
         if (finalLane.backend === 'cap' && !runtime) {
+            const stopRuntime = stopped(ctx);
+            if (stopRuntime)
+                return stopRuntime;
             const rr = await confirm(runtimeCardRequest());
             const answer = rr.value;
             if (!answer || !RUNTIMES.includes(answer))

package/dist/tools/method-only-change.js

@@ -0,0 +1,241 @@
+/**
+ * Rule 7a in code (2026-10-22, owner go).
+ *
+ * sap_set_source on an existing class replaces the whole source. When the
+ * only thing that changed is the inside of one or more method bodies, the
+ * write must go through sap_update_method instead (one call per method): a
+ * whole-class rewrite can silently drop parameters, alter untouched methods
+ * or lose local definitions.
+ *
+ * `methodOnlyChange(current, proposed)` splits both sources into
+ *   - the frame: every line outside method bodies (definition part(s), the
+ *     IMPLEMENTATION header, the `METHOD x.` / `ENDMETHOD.` lines, ENDCLASS);
+ *   - each method body: the lines strictly between `METHOD x.` and `ENDMETHOD.`.
+ * It returns the names of the changed methods ONLY when the frame is
+ * identical, the methods are the same (names, order) and at least one body
+ * differs. Anything else returns undefined, and the write goes on as today.
+ *
+ * Normalised: line endings (CRLF / LF / CR) and trailing whitespace (per
+ * line, and blank lines at the end of the source). Nothing else.
+ *
+ * Conservative: when the split is not certain, return undefined (never
+ * refuse). That covers unbalanced METHOD / ENDMETHOD, a METHOD statement with
+ * more than its name (AMDP `BY DATABASE PROCEDURE …`), the words METHOD /
+ * ENDMETHOD anywhere else in code, macros (DEFINE), INCLUDE programs, an
+ * unterminated literal, and any changed method that sap_update_method could
+ * not address exactly (its name appears more than once as `METHOD name.`, or
+ * its body holds the text `ENDMETHOD.`).
+ *
+ * Never guarded, by design: a pragma or anything else after the name on the
+ * METHOD line (e.g. ADT's ZCX exception-class template), AMDP methods, a
+ * component or parameter named "method", and a class with a pending inactive
+ * version (anyone's: sap_update_method would refuse it with 409).
+ */
+/** The audit-line detail: at most 5 names, then "+N more" (the audit log keeps 200 chars). */
+export function methodOnlyAuditDetail(methods) {
+    const shown = methods.slice(0, 5).join(',');
+    const more = methods.length > 5 ? ` +${methods.length - 5} more` : '';
+    return `refused: method_only_change (Rule 7a) methods=${shown}${more}`;
+}
+/** The model-facing refusal for a method-only change. */
+export function methodOnlyRefusal(methods) {
+    return {
+        error: 'method_only_change',
+        detail: `Only the bodies of these methods changed: ${methods.join(', ')}. `
+            + 'Use sap_update_method once per method instead of rewriting the whole class (Rule 7a). '
+            + 'The class definition and the other methods stay untouched that way. '
+            + 'Your approval id still works for those calls.',
+    };
+}
+const METHOD_START = /^METHOD\s+([^\s.]+)\s*\.$/i;
+const METHOD_END = /^ENDMETHOD\s*\.$/i;
+/** METHOD / ENDMETHOD as a word: not part of a longer name (METHODS, ls_x-method, lo->method, if~method). */
+const KEYWORD = /(?<![\w\-~>\/=%$])(END)?METHOD(?![\w\-~\/%$])/gi;
+const DEFINE_STMT = /(^|\.)\s*DEFINE\s/i;
+/** An INCLUDE program; `INCLUDE TYPE` / `INCLUDE STRUCTURE` inside TYPES / DATA are not. */
+const INCLUDE_STMT = /(^|\.)\s*INCLUDE\s+(?!(TYPE|STRUCTURE)\s)/i;
+/** Names (upper case) of the methods whose bodies alone changed; undefined when the write must go on. */
+export function methodOnlyChange(current, proposed) {
+    const a = splitClassSource(current);
+    const b = splitClassSource(proposed);
+    if (!a || !b)
+        return undefined;
+    if (a.methods.length === 0 || a.methods.length !== b.methods.length)
+        return undefined;
+    if (!sameLines(a.frame, b.frame))
+        return undefined;
+    const changed = [];
+    for (let i = 0; i < a.methods.length; i++) {
+        const ma = a.methods[i];
+        const mb = b.methods[i];
+        if (ma.name.toUpperCase() !== mb.name.toUpperCase())
+            return undefined;
+        if (!sameLines(ma.body, mb.body))
+            changed.push(ma.name.toUpperCase());
+    }
+    if (changed.length === 0)
+        return undefined;
+    for (const name of changed) {
+        if (!updateMethodCanAddress(current, name) || !updateMethodCanAddress(proposed, name))
+            return undefined;
+    }
+    return changed;
+}
+/**
+ * sap_update_method (sap-client replaceMethodBlock) takes the FIRST
+ * `METHOD name.` match anywhere in the source and the body up to the first
+ * `ENDMETHOD.` after it. Only point at it when that lands on our block.
+ */
+function updateMethodCanAddress(source, name) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const starts = source.match(new RegExp(`\\bMETHOD\\s+${escaped}\\s*\\.`, 'gi')) ?? [];
+    if (starts.length !== 1)
+        return false;
+    const split = splitClassSource(source);
+    const block = split?.methods.find((m) => m.name.toUpperCase() === name);
+    return !!block && !block.body.some((l) => /\bENDMETHOD\s*\./i.test(l));
+}
+function sameLines(x, y) {
+    return x.length === y.length && x.every((l, i) => l === y[i]);
+}
+/** The frame / body split, or undefined when it is not certain. Exported for tests. */
+export function splitClassSource(source) {
+    const lines = source.replace(/\s+$/, '').split(/\r\n|\r|\n/).map((l) => l.replace(/\s+$/, ''));
+    const frame = [];
+    const methods = [];
+    let open;
+    for (const line of lines) {
+        if (line.startsWith('*') || line.trimStart().startsWith('"')) {
+            (open ? open.body : frame).push(line);
+            continue;
+        }
+        const code = codeOf(line);
+        if (code === undefined)
+            return undefined;
+        if (DEFINE_STMT.test(code) || INCLUDE_STMT.test(code))
+            return undefined;
+        const stmt = code.trim();
+        const start = METHOD_START.exec(stmt);
+        if (start) {
+            if (open)
+                return undefined;
+            frame.push(line);
+            open = { name: start[1], body: [] };
+            continue;
+        }
+        if (METHOD_END.test(stmt)) {
+            if (!open)
+                return undefined;
+            methods.push(open);
+            open = undefined;
+            frame.push(line);
+            continue;
+        }
+        if (hasStrayKeyword(code))
+            return undefined;
+        (open ? open.body : frame).push(line);
+    }
+    if (open)
+        return undefined;
+    return { frame, methods };
+}
+/** METHOD / ENDMETHOD in code other than a whole `METHOD x.` / `ENDMETHOD.` line. `CALL METHOD` is a call. */
+function hasStrayKeyword(code) {
+    for (const m of code.matchAll(KEYWORD)) {
+        const isEnd = !!m[1];
+        if (!isEnd && /\bCALL\s+$/i.test(code.slice(0, m.index)))
+            continue;
+        return true;
+    }
+    return false;
+}
+/**
+ * The code part of one line: literal contents blanked, a trailing `"`
+ * comment dropped. Undefined when a literal does not close on the line.
+ */
+function codeOf(line) {
+    let out = '';
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === '"')
+            break;
+        if (ch === "'" || ch === '`') {
+            let j = i + 1;
+            for (; j < line.length; j++) {
+                if (line[j] === ch) {
+                    if (line[j + 1] === ch) {
+                        j++;
+                        continue;
+                    } // doubled quote = escaped
+                    break;
+                }
+            }
+            if (j >= line.length)
+                return undefined;
+            out += ch + ' '.repeat(j - i - 1) + ch;
+            i = j;
+            continue;
+        }
+        if (ch === '|') {
+            let j = i + 1;
+            for (; j < line.length; j++) {
+                if (line[j] === '\\') {
+                    j++;
+                    continue;
+                }
+                if (line[j] === '|')
+                    break;
+            }
+            if (j >= line.length)
+                return undefined;
+            out += '|' + ' '.repeat(j - i - 1) + '|';
+            i = j;
+            continue;
+        }
+        out += ch;
+    }
+    return out;
+}
+/**
+ * Runs the guard for one sap_set_source call. Classes only (the caller checks
+ * the type). Returns `refuse` with the changed methods, or `go` with the read
+ * outcome for the snapshot to reuse (undefined when nothing was read).
+ *
+ * Before refusing, the class must have NO pending inactive version — the same
+ * check sap-client's updateMethod makes (it refuses with 409 when the class is
+ * listed). Otherwise refusing would leave no way to write the class at all.
+ * That second read happens only on the refusal path; if it fails, never refuse.
+ */
+export async function runMethodOnlyGuard(adt, g) {
+    if (typeof adt?.getSource !== 'function')
+        return { go: undefined };
+    let outcome;
+    try {
+        outcome = { source: await adt.getSource(g.type, g.name) };
+    }
+    catch (error) {
+        outcome = { error };
+    }
+    if (!('source' in outcome) || typeof outcome.source !== 'string')
+        return { go: outcome };
+    const changed = methodOnlyChange(outcome.source, g.source);
+    if (!changed)
+        return { go: outcome };
+    if (await classIsInactive(adt, g.name) !== false)
+        return { go: outcome };
+    return { refuse: changed };
+}
+/** true / false from the inactive-objects list; undefined when it could not be checked. */
+async function classIsInactive(adt, name) {
+    if (typeof adt.inactiveObjects !== 'function')
+        return undefined;
+    try {
+        const upper = name.toUpperCase();
+        const list = await adt.inactiveObjects();
+        return list.some((o) => String(o.name ?? '').toUpperCase() === upper
+            && (o.type === '' || String(o.type ?? '').toUpperCase().startsWith('CLAS')));
+    }
+    catch {
+        return undefined;
+    }
+}