@cspeach/cli 1.1.52 → 1.1.54

package/dist/journey/rebuild.js

@@ -36,6 +36,8 @@ import { shown } from '../register/atc-file.js';
 import { cleanReason, OBJECT_NAME, OBJECT_TYPE, objectShown } from './run.js';
 import { clearJourneyFlow } from './flow.js';
 import { whoAmI } from '../commands/team.js';
+import { FUNCTIONAL_VERB_LINE } from '../commands/team-build.js';
+import { isFunctionalSeat } from '../licence/seat-state.js';
 import { setRebuildRunActive } from '../commands/plan-gate.js';
 /* ── words ──────────────────────────────────────────────────────────────── */
 export const KIND_WORDS = {
@@ -139,6 +141,9 @@ async function seatName() {
 }
 /** One evidence record: the `rebuild` row on each OLD object's key (additive; older readers drop it). */
 export function writeRebuildRows(joined, keys, row, by, now = new Date()) {
+    // Final review F1: a functional seat records nothing into the project (every caller catches this).
+    if (isFunctionalSeat())
+        throw new Error(FUNCTIONAL_VERB_LINE);
     const at = now.toISOString();
     return writeRecord(joined, 'evidence', keys.map((key) => ({ key, rebuild: { ...(typeof row === 'function' ? row(key) : row), by, at } })), { name: by }, { now });
 }
@@ -262,6 +267,9 @@ export function handOffRebuild(h, g, kind) {
     }
     const now = (h.now ?? (() => new Date()))();
     try {
+        // Final review F1: no brief into the shared folder either, on a functional seat.
+        if (isFunctionalSeat())
+            throw new Error(FUNCTIONAL_VERB_LINE);
         if (kind !== 'class') {
             writeRebuildBrief(joined.projectDir, g.app, rebuildBrief({
                 kind, ...(h.sid ? { sid: h.sid } : {}), target: first.target ?? null,

package/dist/journey/run.js

@@ -14,6 +14,8 @@
 import path from 'node:path';
 import { estateSummaryOf, PART_ORDER, PART_WORDS, provenForTargetWords, usageLineWithWindow } from '@cspeach/register-core';
 import { DEFAULT_ATC_VARIANT, FIRST_CHECK_PER_PACKAGE_LINE, FIRST_CHECK_WHOLE_MAX, NO_CHECK_ALL_LINE, ownerMatch, runTeamCommand, severalLine, whoAmI, writeExports, writeReports } from '../commands/team.js';
+import { FUNCTIONAL_VERB_LINE } from '../commands/team-build.js';
+import { isFunctionalSeat } from '../licence/seat-state.js';
 import { EXPORTS_DIR, exportsOff, exportsOn, exportsPresent, setExportsAlways } from '../register/export-files.js';
 import { shown, shownUpTo } from '../register/atc-file.js';
 import { withoutRuleId } from '../register/records.js';
@@ -162,6 +164,11 @@ const IS_PATTERN = /[*?%]/;
  */
 export async function runJourneyStage(stage, ctx) {
     try {
+        // Final review F1: a functional seat reads a team project and never records
+        // into it — no start, no decision, no fix, no check, no report. Said before
+        // any card and before SAP is reached, headless too.
+        if (FUNCTIONAL_STAGES.has(stage) && isFunctionalSeat())
+            return result(stage, [FUNCTIONAL_VERB_LINE], { kind: 'stop' });
         if (ctx.headless)
             return nextStepOnly(stage, ctx);
         // Said before any card: a step that needs SAP, in a session without one.
@@ -189,6 +196,8 @@ export async function runJourneyStage(stage, ctx) {
 }
 const me = (ctx) => whoAmI(ctx.team.deps);
 const facts = (ctx) => readJourneyFacts(ctx.cwd, me(ctx), ctx.skips);
+/** The stages that record work into the project or run SAP's checks: refused on a functional seat. */
+const FUNCTIONAL_STAGES = new Set(['START', 'DECIDE', 'FIX', 'PROVE', 'REPORT']);
 /** Run a team body with its output kept back; `said` holds only this run's lines. */
 async function quiet(ctx, args) {
     const { said } = ctx.team;

package/dist/lane/app-chain.js

@@ -18,7 +18,7 @@ import { readProjectFile } from '../projects/status.js';
 import { looksLikeSpecGap } from '../projects/extract-spec-gap.js';
 import { parsePlanContent } from '../projects/plan-schema.js';
 import { adoptPlanTransportOnResume, buildResumeCommand, planBuildTransport } from '../commands/plan-resume.js';
-import { collectPlannedObjects, plannedObjectFacts, planGrantFactLines } from '../projects/plan-objects.js';
+import { collectPlannedObjects, plannedObjectFacts, planGrantCoversWrites, planGrantFactLines, planTransportFact, } from '../projects/plan-objects.js';
 import { phaseDisplayTitle } from '../projects/plan-run.js';
 import { isDeployPhase } from '../projects/plan-lane.js';
 import { installPlanGrant, planGrantAllowed } from '../approvals/plan-grant.js';
@@ -255,12 +255,15 @@ export function buildStartCardFacts(content, opts = {}) {
     // The plan's recorded transport, else the session's current one: the grant
     // is minted with it bound, so the card names it.
     const transport = planBuildTransport(content.phases);
+    // A local-only plan with no transport: the grant covers no write (it needs
+    // a bound transport), so the card says each write asks.
+    const covers = opts.grant !== false && planGrantCoversWrites(transport, objects);
     const facts = [`Steps: ${content.phases.map((p) => phaseDisplayTitle(p, content.phases)).join(' · ')}`];
     if (objects.length > 0) {
         facts.push(`It will create or change these ${objects.length} SAP object${objects.length === 1 ? '' : 's'}:`);
         facts.push(...plannedObjectFacts(objects).map((r) => `  ${r}`));
-        facts.push(`Transport: ${transport ?? 'a new one for this build'}`);
-        if (opts.grant === false)
+        facts.push(planTransportFact(transport, objects));
+        if (!covers)
             facts.push('CSPeach asks before each write.');
         else
             facts.push(...planGrantFactLines());
@@ -273,7 +276,7 @@ export function buildStartCardFacts(content, opts = {}) {
     }
     // The closing fact follows what was granted: with no object-list approval
     // every SAP write asks, so it never promises "only a write not on the list".
-    facts.push(opts.grant !== false && objects.length > 0
+    facts.push(covers && objects.length > 0
         ? 'It runs every step and stops only for your answers, a write not on the list, a failed check, or the deploy.'
         : 'It runs every step and stops for your answers, each SAP write, a failed check, or the deploy.');
     return { facts, objects, ...(transport ? { transport } : {}) };
@@ -314,8 +317,12 @@ export async function afterSpecGapSave(h, savedPath) {
     h.queueNext(cmd, APP_ORIGIN);
     h.emit(STEP_2);
 }
-/** The result was written but could not be read as a spec-gap: the flow waits at step 1. */
-export const SPEC_GAP_NOT_SAVED_LINE = (specToken) => `The /abap-app run is paused at step 1: the spec-gap result could not be saved. Ask CSPeach to "re-issue the spec gap in the standard structure", or run /abap-app ${shownToken(specToken, 'spec file')} again.`;
+/**
+ * The result was written but could not be read as a spec-gap: the flow waits at step 1.
+ * Task 17 fix round 1: it follows the save step's plain "We couldn't save this…"
+ * line, so it says the same thing in the same voice, with no phrase to type.
+ */
+export const SPEC_GAP_NOT_SAVED_LINE = (specToken) => `The /abap-app run is paused at step 1 until the spec-gap result is saved. When we write it again in the usual layout, the run goes on. To start over, run /abap-app ${shownToken(specToken, 'spec file')}.`;
 /** The user said No to the save: the run ends here. */
 export const SPEC_GAP_DECLINED_LINE = (specToken) => `The /abap-app run stopped at step 1 because the spec-gap result was not saved. To start again, run /abap-app ${shownToken(specToken, 'spec file')}.`;
 /**

package/dist/licence/paths.js

@@ -4,3 +4,8 @@ import { cspeachRoot } from '../config/paths.js';
 export function licenceCachePath() {
     return path.join(cspeachRoot(), 'licence.json');
 }
+/** <CSPeach home>/seat.json — the last verified seat kind (Team build). Holds
+ *  no secret: the MAC is keyed by the API key, which is not in the file. */
+export function seatRecordPath() {
+    return path.join(cspeachRoot(), 'seat.json');
+}

package/dist/licence/seat-kind.js

@@ -0,0 +1,110 @@
+/**
+ * Team build — the seat record and the resolution rule.
+ *
+ * A developer is never wrongly locked read-only, and a functional seat never
+ * turns writable:
+ *   1. a fresh /v1/me answer wins (no field = an older proxy = developer);
+ *   2. else the last verified record in seat.json (HMAC over
+ *      `keyPrefix\nkind\nverifiedAt`, keyed by the full API key);
+ *   3. else a pre-release sign-in (auth.json without `signedInWith`) is a
+ *      developer;
+ *   4. else "not signed in" — never a guess.
+ * A record that is present but fails verification is `invalid`, never a
+ * fall-through to the legacy rule.
+ */
+import crypto from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { formatFailure } from '../renderer/notice-shape.js';
+import { keyPrefixOf } from './licence-check.js';
+import { seatRecordPath } from './paths.js';
+const isSeatKind = (v) => v === 'developer' || v === 'functional';
+export function seatMac(apiKey, keyPrefix, kind, verifiedAt) {
+    return crypto.createHmac('sha256', apiKey).update(`${keyPrefix}\n${kind}\n${verifiedAt}`).digest('hex');
+}
+export function makeSeatRecord(apiKey, kind, now) {
+    const keyPrefix = keyPrefixOf(apiKey);
+    const verifiedAt = now.toISOString();
+    return { keyPrefix, kind, verifiedAt, mac: seatMac(apiKey, keyPrefix, kind, verifiedAt) };
+}
+export function verifySeatRecord(raw, apiKey) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        return null;
+    const r = raw;
+    if (typeof r.keyPrefix !== 'string' || typeof r.verifiedAt !== 'string' || typeof r.mac !== 'string')
+        return null;
+    if (!isSeatKind(r.kind))
+        return null;
+    if (r.keyPrefix !== keyPrefixOf(apiKey))
+        return null;
+    const expected = Buffer.from(seatMac(apiKey, r.keyPrefix, r.kind, r.verifiedAt), 'utf-8');
+    const given = Buffer.from(r.mac, 'utf-8');
+    // Lengths first: timingSafeEqual throws on unequal lengths.
+    if (given.length !== expected.length || !crypto.timingSafeEqual(given, expected))
+        return null;
+    return { keyPrefix: r.keyPrefix, kind: r.kind, verifiedAt: r.verifiedAt, mac: r.mac };
+}
+/** Ruling R7b: the legacy rule's input. No auth.json (a pasted or env key, or
+ *  a pre-login keytar seat) or an auth.json without `signedInWith` is a
+ *  pre-release sign-in; only a sign-in made by this CLI or newer is not. */
+export function isLegacySignIn(authFile) {
+    return !authFile || authFile.signedInWith === undefined;
+}
+export function resolveSeatKind(a) {
+    if (a.fresh?.ok) {
+        const word = a.fresh.profile.seat_kind;
+        const kind = word === undefined ? 'developer' : isSeatKind(word) ? word : null;
+        if (kind === null)
+            return { ok: false, reason: 'invalid' };
+        return { ok: true, kind, source: 'fresh', write: makeSeatRecord(a.apiKey, kind, a.now) };
+    }
+    if (a.stored !== undefined && a.stored !== null) {
+        const rec = verifySeatRecord(a.stored, a.apiKey);
+        return rec ? { ok: true, kind: rec.kind, source: 'stored', write: null } : { ok: false, reason: 'invalid' };
+    }
+    if (a.legacySignIn)
+        return { ok: true, kind: 'developer', source: 'legacy', write: null };
+    return { ok: false, reason: 'missing' };
+}
+/** seat.json as stored: null when there is no file; `{ corrupt: true }` when
+ *  it cannot be read or parsed, so it resolves `invalid`, never `missing`. */
+export async function readSeatRecord() {
+    let text;
+    try {
+        text = await fs.readFile(seatRecordPath(), 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        return { corrupt: true };
+    }
+    try {
+        const parsed = JSON.parse(text);
+        return parsed === null ? { corrupt: true } : parsed;
+    }
+    catch {
+        return { corrupt: true };
+    }
+}
+export async function writeSeatRecord(r) {
+    const p = seatRecordPath();
+    await fs.mkdir(path.dirname(p), { recursive: true });
+    // Only the known fields; temp file + rename, as writeLicenceCache.
+    const body = { keyPrefix: r.keyPrefix, kind: r.kind, verifiedAt: r.verifiedAt, mac: r.mac };
+    const tmp = `${p}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    try {
+        await fs.writeFile(tmp, JSON.stringify(body, null, 2), 'utf-8');
+        await fs.rename(tmp, p);
+    }
+    finally {
+        await fs.rm(tmp, { force: true }).catch(() => { });
+    }
+}
+export function seatSignInMessage() {
+    return formatFailure({
+        what: 'We could not confirm your seat',
+        detail: ['Your SAP work, sessions and snapshots are untouched.'],
+        next: 'cspeach login',
+    }).trimEnd();
+}
+export const READ_ONLY_SEAT_LINE = 'Read-only seat: CSPeach reads your SAP system and never changes it. Specs, notes and Word documents still save to your folder.';

package/dist/licence/seat-state.js

@@ -0,0 +1,4 @@
+let current = 'developer';
+export function getSeatKind() { return current; }
+export function setSeatKind(k) { current = k; }
+export function isFunctionalSeat() { return current === 'functional'; }

package/dist/licence/terminal-seat.js

@@ -0,0 +1,43 @@
+import { isLegacySignIn, resolveSeatKind, verifySeatRecord } from './seat-kind.js';
+export async function resolveTerminalSeat(d) {
+    try {
+        const apiKey = (await d.resolveApiKey().catch(() => ({ key: null }))).key ?? '';
+        const stored = await d.readSeatRecord().catch(() => ({ corrupt: true }));
+        const authFile = await d.readAuthFile().catch(() => null);
+        const verified = stored !== null && stored !== undefined && apiKey !== '' && verifySeatRecord(stored, apiKey) !== null;
+        let fresh = null;
+        if (apiKey && !verified) {
+            try {
+                fresh = await d.fetchMe({ proxyUrl: await d.proxyUrl(), apiKey });
+            }
+            catch {
+                fresh = null;
+            }
+            if (fresh && !fresh.ok && fresh.status === 401)
+                return 'unconfirmed';
+        }
+        const r = resolveSeatKind({ fresh, stored, apiKey, now: d.now?.() ?? new Date(), legacySignIn: isLegacySignIn(authFile) });
+        if (!r.ok)
+            return 'unconfirmed';
+        if (r.write)
+            await d.writeSeatRecord(r.write).catch(() => { });
+        return r.kind;
+    }
+    catch {
+        return 'unconfirmed';
+    }
+}
+/** The real wiring for cli.ts: the stored key, seat.json, auth.json, the configured proxy. */
+export async function resolveTerminalSeatNow() {
+    const [{ resolveApiKey }, { readAuthFile }, { fetchMe }, { loadConfig }, seat] = await Promise.all([
+        import('../auth/key-resolver.js'), import('../auth/auth-file.js'), import('../auth/me.js'), import('../config/loader.js'), import('./seat-kind.js'),
+    ]);
+    return resolveTerminalSeat({
+        resolveApiKey: () => resolveApiKey(),
+        readSeatRecord: seat.readSeatRecord,
+        writeSeatRecord: seat.writeSeatRecord,
+        readAuthFile: () => readAuthFile(),
+        fetchMe: (a) => fetchMe(a),
+        proxyUrl: async () => (await loadConfig()).proxy_url,
+    });
+}

package/dist/licence/turn-gate.js

@@ -61,6 +61,10 @@ export class LicenceTurnGate {
                 this.lastCheckAtMs = -Infinity;
             return { allow: false, message: d.message };
         }
+        try {
+            await this.o.onSeat?.(d);
+        }
+        catch { /* a seat refresh failure never blocks a turn */ }
         return d.verdict === 'unknown' ? { allow: true, line: d.line } : { allow: true };
     }
 }

package/dist/one-shot.js

@@ -28,6 +28,10 @@ import { resolveRenderingMode } from './renderer/rendering-mode.js';
 import { setLook, setBackground } from './renderer/look.js';
 import { setAssistantStyle } from './agent/style-state.js';
 import { setAssistantLevel } from './agent/level-state.js';
+import { readAuthFile } from './auth/auth-file.js';
+import { fetchMe } from './auth/me.js';
+import { resolveSeatKind, readSeatRecord, writeSeatRecord, seatSignInMessage, isLegacySignIn } from './licence/seat-kind.js';
+import { setSeatKind } from './licence/seat-state.js';
 import { alwaysDeclinePreviewHook } from './repl/update-method-preview-hook.js';
 import { createClassicOutputEmitter } from './renderer/notices.js';
 import { AnswerTrim } from './renderer/answer-trim.js';
@@ -82,6 +86,7 @@ import './tools/project/upgrade_merge_progress.js';
 import './tools/project/team_findings.js';
 import './tools/project/team_estate.js';
 import './tools/project/team_lane_move.js';
+import './tools/project/spec_answers_record.js';
 import './tools/subagent/_background-shared.js';
 import './tools/subagent/background_run.js';
 import './tools/subagent/monitor_emit.js';
@@ -169,6 +174,31 @@ export async function runOneShot(prompt, opts) {
         console.error('No API key configured. Run `cspeach` (interactive) first to set one.');
         return 1;
     }
+    // Team build Task 5 — the seat kind, set before the turn. A fresh answer
+    // wins (managed: one /v1/me for the seat, ruling R7a; other modes: the
+    // licence check below), else the verified seat.json, else a pre-release
+    // sign-in — no auth.json, or one without signedInWith (R7b) — is a
+    // developer, else the sign-in message and exit 1 — never a guess.
+    const settleSeat = async (fresh) => {
+        const r = resolveSeatKind({
+            fresh, stored: await readSeatRecord(), apiKey: (await store.get()) ?? '', now: new Date(),
+            legacySignIn: isLegacySignIn(await readAuthFile()),
+        });
+        if (!r.ok) {
+            console.error(seatSignInMessage());
+            return false;
+        }
+        if (r.write)
+            await writeSeatRecord(r.write).catch(() => { });
+        setSeatKind(r.kind);
+        // The developer default follows a functional seat; an explicit level stays.
+        const level = cfg.assistant?.level ?? 'developer';
+        setAssistantLevel(r.kind === 'functional' && level === 'developer' ? 'functional' : level);
+        return true;
+    };
+    if (cfg.llm.mode === 'managed'
+        && !(await settleSeat(await fetchMe({ proxyUrl: cfg.proxy_url, apiKey: (await store.get()) ?? '' }))))
+        return 1;
     // Security batch item 1 — licence check at one-shot start, byok / ai-hub /
     // local only. Managed makes no new call: the proxy checks every request.
     if (cfg.llm.mode !== 'managed') {
@@ -177,6 +207,9 @@ export async function runOneShot(prompt, opts) {
             console.error(licence.message);
             return 1;
         }
+        // The licence check IS the /v1/me call: an ok verdict carries the kind.
+        if (!(await settleSeat(licence.verdict === 'ok' && licence.profile ? { ok: true, profile: licence.profile, serverDate: null } : null)))
+            return 1;
         if (licence.verdict === 'unknown')
             console.error(formatInfo(licence.line).trimEnd());
         // Azure tenant mode — one-shot never asks: a changed endpoint, removed

package/dist/project-context/conventions.js

@@ -25,6 +25,7 @@
  */
 import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
+import { MAX_ENTRIES_VISITED } from './index-files.js';
 /**
  * Default conventions used when no source has anything to say. Picked
  * to match the most common conventions in modern SAP / web projects:
@@ -268,8 +269,11 @@ async function inferStyleFromExistingFiles(cwd) {
  * node_modules, .git, dist, build, .cspeach output dirs. Prefers files
  * likely to reflect human-authored style (ts, js, abap, cds, xml).
  */
-async function findSampleFiles(cwd, limit) {
+export async function findSampleFiles(cwd, limit, maxEntries = MAX_ENTRIES_VISITED) {
     const out = [];
+    // 1.1.53 item 12 — the same entries budget as the index walk: a folder of
+    // ~283,000 empty folders held no sample file and was walked to the end.
+    let entriesLeft = maxEntries;
     const TEXT_EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.abap', '.cds', '.xml', '.yaml', '.yml'];
     const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.cspeach', '.abapforge']);
     async function walk(d) {
@@ -285,6 +289,9 @@ async function findSampleFiles(cwd, limit) {
         for (const ent of entries) {
             if (out.length >= limit)
                 return;
+            if (entriesLeft <= 0)
+                return;
+            entriesLeft--;
             if (ent.isFile()) {
                 if (TEXT_EXTENSIONS.some((ext) => ent.name.endsWith(ext))) {
                     out.push(path.join(d, ent.name));

package/dist/project-context/index-files.js

@@ -35,6 +35,15 @@ import * as path from 'node:path';
 const MAX_FILES_TRAVERSED = 10_000;
 /** Cap on paths shipped in FileIndex. Selected by relevance. */
 const MAX_PATHS_IN_INDEX = 500;
+/**
+ * 1.1.53 item 12 — budget on entries (files AND folders) the walk looks at.
+ * %TEMP% held ~283,000 empty folders: the file cap never fired and the walk
+ * opened every one (~10 s). Spent ⇒ the walk stops and the index is cut.
+ * Measured there: 20,000 took ~2.4 s, 5,000 ~0.95 s (with two root reads).
+ * Controller ruling: 12,000, so a real project (an abapGit export of
+ * thousands of files) keeps its full picture up to the 10,000-file cap.
+ */
+export const MAX_ENTRIES_VISITED = 12_000;
 const ALWAYS_SKIPPED_DIRS = new Set([
     'node_modules',
     '.git',
@@ -71,14 +80,32 @@ const SOURCE_EXTENSIONS = new Set([
  * IO errors during the walk are silently skipped (the offending dir/file
  * just doesn't contribute to the count). Never throws.
  */
-export async function indexFiles(cwd) {
+export async function indexFiles(cwd, options = {}) {
+    const maxEntries = options.maxEntries ?? MAX_ENTRIES_VISITED;
+    let entriesLeft = maxEntries;
+    let walkCut = false;
     const ignoreMatchers = await loadIgnoreMatchers(cwd);
-    /** Files collected with their stat info — used to rank for the path list. */
+    /**
+     * Files collected with their stat info — used to rank for the path list.
+     * `order` is the file's place in a plain depth-first walk (the readdir
+     * index at each level), so the output keeps today's order although the
+     * walk now visits each level's files before its folders.
+     */
     const collected = [];
-    const byExtension = {};
     let totalFiles = 0;
     let truncated = false;
-    async function walk(dir, relPrefix) {
+    let rootEntries = null;
+    /** One entry of the budget; false (and the walk marked cut) once it is spent. */
+    function spend() {
+        if (entriesLeft <= 0) {
+            walkCut = true;
+            truncated = true;
+            return false;
+        }
+        entriesLeft--;
+        return true;
+    }
+    async function walk(dir, relPrefix, order) {
         if (truncated)
             return;
         let entries;
@@ -88,45 +115,68 @@ export async function indexFiles(cwd) {
         catch {
             return;
         }
-        for (const ent of entries) {
+        // The root listing is kept for the top-level list (one read, not two).
+        if (relPrefix === '')
+            rootEntries = entries;
+        // 1.1.53 item 12 (fix round 3) — this level's files first, then its
+        // folders: one big early folder can no longer spend the entries budget
+        // before a spec or plan file at this level is seen.
+        for (let i = 0; i < entries.length; i++) {
+            const ent = entries[i];
+            if (ent.isDirectory())
+                continue;
             if (truncated)
                 return;
+            if (!spend())
+                return;
+            if (!ent.isFile())
+                continue;
             const relPath = relPrefix ? `${relPrefix}/${ent.name}` : ent.name;
-            if (ent.isDirectory()) {
-                if (ALWAYS_SKIPPED_DIRS.has(ent.name))
-                    continue;
-                if (matchesIgnore(ignoreMatchers, relPath, /* isDirectory */ true))
-                    continue;
-                await walk(path.join(dir, ent.name), relPath);
+            if (matchesIgnore(ignoreMatchers, relPath, /* isDirectory */ false))
+                continue;
+            if (totalFiles >= MAX_FILES_TRAVERSED) {
+                truncated = true;
+                return;
             }
-            else if (ent.isFile()) {
-                if (matchesIgnore(ignoreMatchers, relPath, /* isDirectory */ false))
-                    continue;
-                if (totalFiles >= MAX_FILES_TRAVERSED) {
-                    truncated = true;
-                    return;
-                }
-                totalFiles++;
-                const ext = extOf(ent.name);
-                byExtension[ext] = (byExtension[ext] ?? 0) + 1;
-                // Read mtime cheaply; on error use 0 so the file sorts late.
-                let mtime = 0;
-                try {
-                    const s = await fs.stat(path.join(dir, ent.name));
-                    mtime = s.mtimeMs;
-                }
-                catch {
-                    // ignore
-                }
-                collected.push({ path: relPath, ext, mtime });
+            totalFiles++;
+            // Read mtime cheaply; on error use 0 so the file sorts late.
+            let mtime = 0;
+            try {
+                const s = await fs.stat(path.join(dir, ent.name));
+                mtime = s.mtimeMs;
             }
+            catch {
+                // ignore
+            }
+            collected.push({ path: relPath, ext: extOf(ent.name), mtime, order: [...order, i] });
+        }
+        for (let i = 0; i < entries.length; i++) {
+            const ent = entries[i];
+            if (!ent.isDirectory())
+                continue;
+            if (truncated)
+                return;
+            if (!spend())
+                return;
+            if (ALWAYS_SKIPPED_DIRS.has(ent.name))
+                continue;
+            const relPath = relPrefix ? `${relPrefix}/${ent.name}` : ent.name;
+            if (matchesIgnore(ignoreMatchers, relPath, /* isDirectory */ true))
+                continue;
+            await walk(path.join(dir, ent.name), relPath, [...order, i]);
         }
     }
-    await walk(cwd, '');
+    await walk(cwd, '', []);
+    // Back to the plain depth-first order, so the counts and the ranking below
+    // see the files in exactly today's order.
+    collected.sort((a, b) => compareOrder(a.order, b.order));
+    const byExtension = {};
+    for (const f of collected)
+        byExtension[f.ext] = (byExtension[f.ext] ?? 0) + 1;
     // Top-level dirs that survived the walk (i.e. weren't skipped).
     let topLevelDirs = [];
     try {
-        const topLevel = await fs.readdir(cwd, { withFileTypes: true });
+        const topLevel = rootEntries ?? await fs.readdir(cwd, { withFileTypes: true });
         topLevelDirs = topLevel
             .filter((e) => e.isDirectory() && !ALWAYS_SKIPPED_DIRS.has(e.name) && !matchesIgnore(ignoreMatchers, e.name, true))
             .map((e) => e.name)
@@ -144,13 +194,26 @@ export async function indexFiles(cwd) {
         return b.mtime - a.mtime;
     });
     const paths = collected.slice(0, MAX_PATHS_IN_INDEX).map((f) => f.path);
-    return {
+    const index = {
         totalFiles,
         byExtension,
         topLevelDirs,
         paths,
         truncated,
     };
+    // Only a cut walk carries the field, so every other index is the same object as before.
+    if (walkCut)
+        index.walkCut = true;
+    return index;
+}
+/** Lexicographic order of two readdir-index paths (depth-first order). */
+function compareOrder(a, b) {
+    const n = Math.min(a.length, b.length);
+    for (let i = 0; i < n; i++) {
+        if (a[i] !== b[i])
+            return a[i] - b[i];
+    }
+    return a.length - b.length;
 }
 async function loadIgnoreMatchers(cwd) {
     const patterns = [];

package/dist/project-context/index.js

@@ -29,7 +29,7 @@ import { extractCap } from './domain/cap.js';
 import { extractFiori } from './domain/fiori.js';
 import { getGitState } from './git.js';
 import { indexFiles } from './index-files.js';
-export { renderProjectContext } from './render.js';
+export { renderProjectContext, renderProjectContextCapped } from './render.js';
 /**
  * Compute the full project context for a directory. Best-effort: returns
  * null on hard failure (e.g. cwd doesn't exist), otherwise an envelope

package/dist/project-context/render.js

@@ -31,6 +31,12 @@ const CAP_CAP_ENTITIES = 60;
 const CAP_ABAP_OBJECTS = 80;
 const CAP_GIT_COMMITS = 5;
 const CAP_RECENT_OBJECTS = 10;
+/** 1.1.53 item 12 — %TEMP% had ~283,000 top-level folders (a 4.37M-char line). */
+export const CAP_TOP_LEVEL_DIRS = 40;
+export const CAP_NAMING = 20;
+/** Hard ceiling on the whole block, whatever the folder holds. */
+export const PROJECT_CONTEXT_MAX_CHARS = 24_000;
+const CUT_TAIL = '\n  <cut>The folder is very large; this picture was shortened.</cut>\n</project_context>';
 /**
  * Render a ProjectContext as prompt text. The result is a self-contained
  * <project_context> XML-ish block ready to splice into a system prompt.
@@ -38,6 +44,28 @@ const CAP_RECENT_OBJECTS = 10;
  * unconditionally.
  */
 export function renderProjectContext(ctx) {
+    return renderProjectContextCapped(ctx).block;
+}
+/**
+ * The block plus whether it was cut. A block over PROJECT_CONTEXT_MAX_CHARS
+ * is cut at the last line end that keeps it (with the closing note) under
+ * the cap; a block within the cap is returned unchanged.
+ */
+export function renderProjectContextCapped(ctx) {
+    const full = renderFull(ctx);
+    const walkCut = ctx?.index.walkCut === true;
+    if (full.length <= PROJECT_CONTEXT_MAX_CHARS) {
+        if (!walkCut)
+            return { block: full, cut: false };
+        // The walk stopped early: same note, in place of the closing tag.
+        return { block: full.slice(0, full.length - '\n</project_context>'.length) + CUT_TAIL, cut: true };
+    }
+    const room = PROJECT_CONTEXT_MAX_CHARS - CUT_TAIL.length;
+    const lastNl = full.lastIndexOf('\n', room);
+    const head = lastNl > 0 ? full.slice(0, lastNl) : full.slice(0, room);
+    return { block: head + CUT_TAIL, cut: true };
+}
+function renderFull(ctx) {
     if (!ctx)
         return '';
     const parts = [];
@@ -66,13 +94,13 @@ function renderConventions(c) {
     if (c.namingPatterns.classes.length || c.namingPatterns.interfaces.length || c.namingPatterns.cdsViews.length) {
         lines.push('    <naming>');
         if (c.namingPatterns.classes.length) {
-            lines.push(`      <classes>${escapeXml(c.namingPatterns.classes.join(', '))}</classes>`);
+            lines.push(`      <classes>${escapeXml(cappedList(c.namingPatterns.classes, CAP_NAMING))}</classes>`);
         }
         if (c.namingPatterns.interfaces.length) {
-            lines.push(`      <interfaces>${escapeXml(c.namingPatterns.interfaces.join(', '))}</interfaces>`);
+            lines.push(`      <interfaces>${escapeXml(cappedList(c.namingPatterns.interfaces, CAP_NAMING))}</interfaces>`);
         }
         if (c.namingPatterns.cdsViews.length) {
-            lines.push(`      <cds_views>${escapeXml(c.namingPatterns.cdsViews.join(', '))}</cds_views>`);
+            lines.push(`      <cds_views>${escapeXml(cappedList(c.namingPatterns.cdsViews, CAP_NAMING))}</cds_views>`);
         }
         lines.push('    </naming>');
     }
@@ -149,7 +177,7 @@ function renderFileIndex(ctx) {
         `  <file_index total="${idx.totalFiles}"${idx.truncated ? ' truncated="true"' : ''}>`,
     ];
     if (idx.topLevelDirs.length) {
-        lines.push(`    <top_level_dirs>${escapeXml(idx.topLevelDirs.join(', '))}</top_level_dirs>`);
+        lines.push(`    <top_level_dirs>${escapeXml(cappedList(idx.topLevelDirs, CAP_TOP_LEVEL_DIRS))}</top_level_dirs>`);
     }
     const extEntries = Object.entries(idx.byExtension).sort((a, b) => b[1] - a[1]);
     if (extEntries.length) {
@@ -293,6 +321,12 @@ function renderAbapCloud(objects, bdefs) {
     return lines.join('\n');
 }
 /* ── Helpers ───────────────────────────────────────────────────────── */
+/** The first `cap` items joined, then ` (… N more)`; a list within the cap joins as before. */
+function cappedList(items, cap) {
+    if (items.length <= cap)
+        return items.join(', ');
+    return `${items.slice(0, cap).join(', ')} (… ${items.length - cap} more)`;
+}
 function escapeXml(text) {
     return text
         .replace(/&/g, '&amp;')