@cspeach/cli 1.1.53 → 1.1.54

package/dist/repl.js

@@ -39,9 +39,11 @@ import { getStore } from './auth/api-key.js';
 import { readAuthFile } from './auth/auth-file.js';
 import { resolveApiKey } from './auth/key-resolver.js';
 import { fetchMe } from './auth/me.js';
+import { resolveSeatKind, readSeatRecord, writeSeatRecord, seatSignInMessage, isLegacySignIn, READ_ONLY_SEAT_LINE } from './licence/seat-kind.js';
+import { setSeatKind, isFunctionalSeat, getSeatKind } from './licence/seat-state.js';
 import { runLicenceCheck, licenceCheckHeaders } from './licence/licence-check.js';
 import { LicenceTurnGate } from './licence/turn-gate.js';
-import { runStartupAccount } from './repl/startup-account.js';
+import { runStartupAccount, settleSeatAfterStartup } from './repl/startup-account.js';
 import { startSkillsCacheWarmup } from './skills/source-authed.js';
 import { formatLoginBanner, signInFragment } from './ui/login-banner.js';
 import { printStartupBanner, printKeytarFallbackBanner, keychainFallbackNotice } from './renderer/banners.js';
@@ -70,6 +72,7 @@ import { createProviderForMode } from './agent/providers/factory.js';
 import { startUsageFlushAtStartup } from './usage/usage-reporter.js';
 import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
+import { isReadyForDeveloperPhrase } from './repl/ready-phrase.js';
 import { IdleKeepalive } from './agent/cache-keepalive.js';
 import { renderTurnError } from './agent/turn-error-ux.js';
 import { runRerouteTurn } from './repl/reroute-turn.js';
@@ -469,6 +472,8 @@ export async function runRepl(opts) {
         loadConfig, readAuthFile, resolveApiKey: () => resolveApiKey(), fetchMe, runLicenceCheck, licenceCheckHeaders,
         // Final review finding 1 — fill the skills cache for offline use. Fire-and-forget.
         startSkillsWarmup: (c, verdict) => { void startSkillsCacheWarmup(c, verdict); },
+        // Team build Task 5 — the seat kind for this run.
+        readSeatRecord, writeSeatRecord, setSeatKind,
     }, {
         print: (line) => console.log(line),
         notice: (note) => {
@@ -496,6 +501,7 @@ export async function runRepl(opts) {
         else
             printKeytarFallbackBanner();
     }
+    let seat = startupAccount.seat ?? 'developer';
     if (!apiKey) {
         const entered = await promptPassword({
             message: 'Paste your CSPeach API key (from invite email):',
@@ -504,6 +510,17 @@ export async function runRepl(opts) {
         await store.set(entered);
         apiKey = entered;
     }
+    // Team build Task 5, ruling R7a — a key and no seat yet (managed without
+    // auth.json: a stored key, or one pasted just now): settle it here. Only
+    // when start-up resolved nothing, so it never repeats start-up's /v1/me.
+    if (startupAccount.seat === undefined && apiKey) {
+        const settled = await settleSeatAfterStartup({ fetchMe, readAuthFile, readSeatRecord, writeSeatRecord, setSeatKind }, { proxyUrl: (await loadConfig()).proxy_url, apiKey });
+        if (settled === null) {
+            console.log(seatSignInMessage());
+            return 1;
+        }
+        seat = settled;
+    }
     let cfg = await loadConfig();
     setLook(cfg.ui.look);
     // Chat lane (spec 2026-10-17 D1/D2/D5/D9) — the process lane and talking
@@ -515,6 +532,10 @@ export async function runRepl(opts) {
     applyLaneTools(laneSetting, !!process.stdin.isTTY);
     setAssistantStyle(cfg.assistant.style);
     setAssistantLevel(cfg.assistant.level);
+    // Team build Task 5 — the developer default follows a functional seat; an
+    // explicit level stays, and /level still works for the session.
+    if (seat === 'functional' && cfg.assistant.level === 'developer')
+        setAssistantLevel('functional');
     // Apply the rendering mode BEFORE any shouldUseInk() call. This is the
     // interactive entry point, so it is never one-shot whatever argv holds. A
     // stored `classic` is retiring: read as auto, rewritten once, one dim notice
@@ -670,7 +691,18 @@ export async function runRepl(opts) {
         // The config hint only makes sense when config CAUSED advisory.
         next: capped === '' ? 'cspeach config set write_mode approval-gated' : undefined,
     });
-    if (!anyRoleConfigured) {
+    // Team build Task 6 — a functional seat gets the seat line once, instead of
+    // the write-mode banner and its `cspeach config set` hint (config cannot
+    // lift it); both the no-role path here and the role path below skip it.
+    const functionalSeat = isFunctionalSeat();
+    if (functionalSeat) {
+        const seatLine = formatInfo(READ_ONLY_SEAT_LINE);
+        if (getLook() === 'panels')
+            startupNotices.push(seatLine);
+        else
+            console.log(seatLine);
+    }
+    else if (!anyRoleConfigured) {
         if (cfg.write_mode === 'advisory-only') {
             if (getLook() === 'panels')
                 startupNotices.push(advisoryNotice(''));
@@ -747,7 +779,7 @@ export async function runRepl(opts) {
     // byte-identical to pre-role behavior).
     const aliasRole = cfg.sap[selectedAlias]?.role;
     const startupWriteMode = getEffectiveWriteMode(cfg.write_mode, aliasRole);
-    if (anyRoleConfigured) {
+    if (anyRoleConfigured && !functionalSeat) {
         const capped = startupWriteMode !== cfg.write_mode
             ? ` (capped by sap.${selectedAlias}.role = ${aliasRole})`
             : '';
@@ -871,6 +903,24 @@ export async function runRepl(opts) {
         // No start-up check ran (no key yet, e.g. pasted at the prompt below):
         // non-managed checks on the very first turn. Managed never reads it.
         lastCheckAtMs: licenceCheckedAtMs ?? (cfg.llm.mode === 'managed' ? Date.now() : -Infinity),
+        // Team build Task 5 — the seat refreshes with the licence every 4 hours: a
+        // fresh answer wins (a developer→functional flip applies at the next
+        // turn; a fresh developer lifts a stale functional lock), else the stored
+        // record. An unconfirmed seat mid-session changes nothing.
+        onSeat: async (d) => {
+            const key = await store.get();
+            if (!key)
+                return;
+            const r = resolveSeatKind({
+                fresh: d.allow && d.verdict === 'ok' && d.profile ? { ok: true, profile: d.profile, serverDate: null } : null,
+                stored: await readSeatRecord(), apiKey: key, now: new Date(), legacySignIn: isLegacySignIn(await readAuthFile()),
+            });
+            if (!r.ok)
+                return;
+            if (r.write)
+                await writeSeatRecord(r.write).catch(() => { });
+            setSeatKind(r.kind);
+        },
         ...(cfg.llm.mode === 'azure' ? {
             extra: async () => (await import('./connection/azure-gate.js')).azureGateCheck(),
             // Plan D13 — never a prompt between turns (no inquirer inside the Ink
@@ -1326,6 +1376,9 @@ export async function runRepl(opts) {
                     if (result.kind === 'command') {
                         chunkEmitter.emit('chunk', formatInfo(result.command));
                     }
+                    else if (result.kind === 'info') {
+                        chunkEmitter.emit('chunk', result.text + '\n');
+                    }
                     else if (result.kind === 'empty') {
                         // Empty workspace — print the listing so the user sees the
                         // workspace path and the "drop something here" hint. Skipped
@@ -1529,6 +1582,41 @@ export async function runRepl(opts) {
                     effectiveInput = expansion.text;
                 }
             }
+            // Team build Task 10 — "this is ready for the developer" in a team build
+            // folder marks the spec ready for build; no model turn. The phrase is
+            // checked first (no file read); anything else goes on exactly as before.
+            if (isReadyForDeveloperPhrase(trimmed)) {
+                const { readyForDeveloperDoor, inkSpecChooser } = await import('./repl/ready-phrase.js');
+                const { getAuthorIdentity } = await import('./agent/loop.js');
+                if (await readyForDeveloperDoor(trimmed, {
+                    cwd: process.cwd(), identityName: getAuthorIdentity().name,
+                    emit: (line) => chunkEmitter.emit('chunk', line + '\n'), choose: inkSpecChooser(),
+                }))
+                    return;
+            }
+            // Team build Task 11 — a shared spec's open questions travel with it
+            // into the build. Anything not under the shared specs/ goes on unchanged.
+            if (/^\/abap-app\s+--from\b/.test(effectiveInput)) {
+                try {
+                    const { openQuestionsGate, gateChooser, STOPPED_LINE } = await import('./repl/open-questions-gate.js');
+                    const { inkStartupChooser } = await import('./commands/plan-startup.js');
+                    const { getAuthorIdentity, inkAwareChoose, inkAwarePrompt } = await import('./agent/loop.js');
+                    const g = await openQuestionsGate({
+                        cwd: process.cwd(), command: effectiveInput, identity: getAuthorIdentity(),
+                        emit: (line) => chunkEmitter.emit('chunk', line + '\n'),
+                        choose: gateChooser(inkStartupChooser()), answer: inkAwareChoose, prompt: inkAwarePrompt, headless: isHeadless(),
+                    });
+                    if (g && 'stop' in g) {
+                        chunkEmitter.emit('chunk', STOPPED_LINE + '\n');
+                        return;
+                    }
+                    if (g)
+                        effectiveInput = g.command;
+                }
+                catch (e) {
+                    chunkEmitter.emit('chunk', `${(e instanceof Error ? e.message : String(e)).split('\n')[0]}\n`);
+                }
+            }
             // Guided runs — the one front door for Ink, classic and one-shot:
             // the /run verb (rewritten to its alias), then today's trigger. The
             // trigger still decides (spec §4 step 2); the dispatch below is unchanged.
@@ -2783,6 +2871,41 @@ export async function runRepl(opts) {
         // sits in this folder. Best-effort: never blocks the prompt.
         if (!isHeadless()) {
             void (async () => {
+                // Team build Task 8 — the folder sets itself up (spec 2026-10-25 §7.2):
+                // first, so its question never overlaps the offers below. The seat is
+                // settled by now (runStartupAccount / settleSeatAfterStartup above).
+                try {
+                    const { startTeamBuildFolder, fileOfferMemory } = await import('./repl/team-build-start.js');
+                    const { inkAwareConfirm, getAuthorIdentity } = await import('./agent/loop.js');
+                    await startTeamBuildFolder({
+                        cwd: process.cwd(),
+                        seat: getSeatKind(),
+                        identity: { name: getAuthorIdentity().name, ...(signedInAs ? { account: signedInAs } : {}) },
+                        confirm: inkAwareConfirm,
+                        emit: (l) => chunkEmitter.emit('chunk', l + '\n'),
+                        memory: fileOfferMemory(),
+                    });
+                }
+                catch { /* the folder step is best-effort */ }
+                // Team build Task 11 — the start screen: the shared specs of the build
+                // folder CSPeach runs in (R10), and the build offer (developers only).
+                // A submitted build or question is the next turn: the offers below wait.
+                try {
+                    const { runStartScreen } = await import('./repl/team-build-screen.js');
+                    const { inkStartupChooser } = await import('./commands/plan-startup.js');
+                    const { getAuthorIdentity } = await import('./agent/loop.js');
+                    const screen = await runStartScreen({
+                        cwd: process.cwd(),
+                        seat: getSeatKind(),
+                        identityName: getAuthorIdentity().name,
+                        choose: inkStartupChooser(),
+                        submit: (cmd) => { void handleSubmit(cmd); },
+                        emit: (l) => chunkEmitter.emit('chunk', l + '\n'),
+                    });
+                    if (screen.submitted)
+                        return;
+                }
+                catch { /* the start screen is best-effort */ }
                 // 2026-10-08 — one-time offer to retire the old `workspace_folder`
                 // setting, before the plan offer so the two never overlap.
                 try {
@@ -3112,16 +3235,50 @@ export async function runRepl(opts) {
     }, { input: pasteInput });
     // 2026-10-08: one-time offer to retire the old `workspace_folder` setting
     // (files now save in the folder you start in). Best-effort, never blocks.
+    // Team build Task 11 — a build or question the start screen queued is the
+    // next line; the retire and plan offers then stay quiet.
+    let teamBuildSubmitted = false;
     if (!isHeadless()) {
+        // Team build Task 8 — the folder step, first (same as the Ink path).
+        try {
+            const { startTeamBuildFolder, fileOfferMemory } = await import('./repl/team-build-start.js');
+            const { inkAwareConfirm, getAuthorIdentity } = await import('./agent/loop.js');
+            await startTeamBuildFolder({
+                cwd: process.cwd(),
+                seat: getSeatKind(),
+                identity: { name: getAuthorIdentity().name, ...(signedInAs ? { account: signedInAs } : {}) },
+                confirm: inkAwareConfirm,
+                emit: (l) => console.log(l),
+                memory: fileOfferMemory(),
+            });
+        }
+        catch { /* best-effort */ }
+        // Team build Task 11 — the start screen (same as the Ink path).
         try {
-            const { maybeOfferWorkspaceRetire } = await import('./projects/workspace-retire.js');
-            const { inkAwareConfirm } = await import('./agent/loop.js');
-            await maybeOfferWorkspaceRetire({
-                confirm: async (q) => (await inkAwareConfirm(q, { default: 'y' })) === 'y',
-                log: (line) => console.log(chalk.dim(line)),
+            const { runStartScreen } = await import('./repl/team-build-screen.js');
+            const { classicStartupChooser } = await import('./commands/plan-startup.js');
+            const { getAuthorIdentity, inkAwarePrompt } = await import('./agent/loop.js');
+            const screen = await runStartScreen({
+                cwd: process.cwd(),
+                seat: getSeatKind(),
+                identityName: getAuthorIdentity().name,
+                choose: classicStartupChooser(inkAwarePrompt, (...l) => l.forEach((x) => console.log(x))),
+                submit: (cmd) => pendingDispatchAccessor.set(cmd),
+                emit: (l) => console.log(l),
             });
+            teamBuildSubmitted = screen.submitted;
         }
         catch { /* best-effort */ }
+        if (!teamBuildSubmitted)
+            try {
+                const { maybeOfferWorkspaceRetire } = await import('./projects/workspace-retire.js');
+                const { inkAwareConfirm } = await import('./agent/loop.js');
+                await maybeOfferWorkspaceRetire({
+                    confirm: async (q) => (await inkAwareConfirm(q, { default: 'y' })) === 'y',
+                    log: (line) => console.log(chalk.dim(line)),
+                });
+            }
+            catch { /* best-effort */ }
     }
     // 2026-06-15: one-time output-namespace migration. The customer-output
     // root was renamed from the dead-brand `.abapforge/` to `.cspeach/`.
@@ -3146,7 +3303,7 @@ export async function runRepl(opts) {
     }
     // 2026-10-04 (spec §3.5) — "Continue '<plan>'?" (classic: numbered
     // choices, Enter = the first). Continue queues the resume for the loop.
-    if (!isHeadless()) {
+    if (!isHeadless() && !teamBuildSubmitted) {
         try {
             const { offerContinueAtStartup, classicStartupChooser } = await import('./commands/plan-startup.js');
             const { inkAwarePrompt } = await import('./agent/loop.js');
@@ -3460,6 +3617,9 @@ export async function runRepl(opts) {
                     console.log(formatInfo('Picked · press Enter to run, or edit first').trimEnd());
                     pendingPrefill = result.command;
                 }
+                else if (result.kind === 'info') {
+                    console.log(result.text);
+                }
                 else if (result.kind === 'empty') {
                     // Empty workspace — print the listing so the user sees the
                     // workspace path and the "drop something here" hint. Skipped
@@ -3740,6 +3900,9 @@ export async function runRepl(opts) {
         // UX-5 #2 (2026-06-12) — numbered-menu expansion (classic mirror of the
         // Ink block above). Bare `2` after a plain-text numbered menu expands
         // to that item's text with a dim echo; everything else passes through.
+        // Team build Task 10 — the ready door checks what was typed, before a
+        // menu number is expanded (the same text as the Ink door's `trimmed`).
+        const typedText = resolvedTrimmed;
         {
             const expansion = maybeExpandNumberSelection(resolvedTrimmed, lastAssistantText(session.messages));
             if (expansion) {
@@ -3747,6 +3910,39 @@ export async function runRepl(opts) {
                 resolvedTrimmed = expansion.text;
             }
         }
+        // Team build Task 10 — the ready phrase (classic mirror of the Ink door).
+        if (isReadyForDeveloperPhrase(typedText)) {
+            const { readyForDeveloperDoor, classicSpecChooser } = await import('./repl/ready-phrase.js');
+            const { getAuthorIdentity, inkAwarePrompt } = await import('./agent/loop.js');
+            if (await readyForDeveloperDoor(typedText, {
+                cwd: process.cwd(), identityName: getAuthorIdentity().name,
+                emit: (line) => console.log(line), choose: classicSpecChooser(inkAwarePrompt, (line) => console.log(line)),
+            }))
+                continue;
+        }
+        // Team build Task 11 — the open-questions gate (classic mirror of the Ink path).
+        if (/^\/abap-app\s+--from\b/.test(resolvedTrimmed)) {
+            try {
+                const { openQuestionsGate, gateChooser, STOPPED_LINE } = await import('./repl/open-questions-gate.js');
+                const { classicStartupChooser } = await import('./commands/plan-startup.js');
+                const { getAuthorIdentity, inkAwareChoose, inkAwarePrompt } = await import('./agent/loop.js');
+                const g = await openQuestionsGate({
+                    cwd: process.cwd(), command: resolvedTrimmed, identity: getAuthorIdentity(),
+                    emit: (line) => console.log(line),
+                    choose: gateChooser(classicStartupChooser(inkAwarePrompt, (...l) => l.forEach((x) => console.log(x)))),
+                    answer: inkAwareChoose, prompt: inkAwarePrompt, headless: isHeadless(),
+                });
+                if (g && 'stop' in g) {
+                    console.log(STOPPED_LINE);
+                    continue;
+                }
+                if (g)
+                    resolvedTrimmed = g.command;
+            }
+            catch (e) {
+                console.log((e instanceof Error ? e.message : String(e)).split('\n')[0]);
+            }
+        }
         // Guided runs — the same front door as the Ink path: the /run verb
         // (rewritten to its alias), then today's trigger. The trigger still
         // decides (spec §4 step 2); the dispatch below is unchanged.

package/dist/sap-link/policy.js

@@ -112,6 +112,8 @@ export function writesBlockedMessage(alias, role) {
     const now = role === undefined ? 'has no role set' : `has role ${role}`;
     return `Writes to ${alias} need role dev. ${alias} ${now}. Set it with: cspeach config set sap.${alias}.role dev`;
 }
+/** Team build (final review F3): the one line a read-only seat's link says, at start and on every refused write. */
+export const READ_ONLY_LINK_LINE = 'Read-only seat: the SAP link reads and never writes.';
 export function decideRequest(input) {
     const m = effectiveMethod(input.method, input.headers);
     if ('error' in m)
@@ -178,6 +180,8 @@ export function decideRequest(input) {
         };
     }
     const write = verbIsWrite || isBatchPath(url.pathname);
+    if (write && input.seatReadOnly)
+        return { allow: false, status: 403, message: READ_ONLY_LINK_LINE };
     if (write && input.role !== 'dev') {
         return { allow: false, status: 403, message: writesBlockedMessage(input.alias, input.role) };
     }

package/dist/sap-link/registry.js

@@ -26,6 +26,8 @@ import { readLinkTargets } from './project.js';
 import { startSapLink, SapLinkStartError } from './server.js';
 import { UpstreamSession } from './upstream.js';
 import { registerShutdownHook } from '../lib/shutdown-hooks.js';
+import { isFunctionalSeat } from '../licence/seat-state.js';
+import { READ_ONLY_LINK_LINE } from './policy.js';
 /** A registry error. Its message is always a fixed, plain, secret-free sentence. */
 export class SapLinkError extends Error {
 }
@@ -113,6 +115,7 @@ async function ensureUnlocked(projectDir, alias, partial) {
         password: (a, s) => resolveSapPassword(a, s, { headless: () => true }),
         readCa: (p) => readFileSync(p),
         start: startSapLink,
+        readOnlySeat: isFunctionalSeat,
         ...partial,
     };
     // package.json first: its errors are plain LinkConfigErrors and need no SAP settings.
@@ -134,7 +137,9 @@ async function ensureUnlocked(projectDir, alias, partial) {
             await stopUnlocked(projectDir);
         throw new SapLinkError(`No SAP system named ${alias}. Add it with: cspeach config add-sap`);
     }
-    const roleNote = roleNoteFor(alias, sys.role);
+    // A read-only seat: one line of its own; the role note would point at a setting that changes nothing.
+    const seatNote = deps.readOnlySeat() ? READ_ONLY_LINK_LINE : undefined;
+    const roleNote = seatNote ? undefined : roleNoteFor(alias, sys.role);
     const fingerprint = fingerprintFor(sys);
     const existing = links.get(k);
     if (existing && existing.alias === alias && existing.fingerprint === fingerprint &&
@@ -142,7 +147,7 @@ async function ensureUnlocked(projectDir, alias, partial) {
         // A link whose upstream got a 401 refuses every send: start means restart (new session, new password).
         !existing.upstream.isLoginRejected()) {
         // TLS/http notes describe the running link; the role is read fresh (the server does too).
-        return { handle: existing.handle, reused: true, services, ...existing.postureNotes, ...(roleNote ? { roleNote } : {}) };
+        return { handle: existing.handle, reused: true, services, ...existing.postureNotes, ...(roleNote ? { roleNote } : {}), ...(seatNote ? { seatNote } : {}) };
     }
     // Another alias, connection, auth type, TLS posture, port or service list, or a rejected login: the old link goes first.
     if (existing)
@@ -199,6 +204,7 @@ async function ensureUnlocked(projectDir, alias, partial) {
             upstream,
             secret: { password, username: sys.username },
             writeLogFile: writeLogFileFor(projectDir),
+            readOnlySeat: () => deps.readOnlySeat(),
         });
     }
     catch (e) {
@@ -213,7 +219,7 @@ async function ensureUnlocked(projectDir, alias, partial) {
     const postureNotes = postureNotesFor(alias, sys);
     links.set(k, { projectDir: path.resolve(projectDir), alias, prefixes, requestedPort: targets.port, fingerprint, postureNotes, handle, upstream });
     installSapLinkExitHandler();
-    return { handle, reused: false, services, ...postureNotes, ...(roleNote ? { roleNote } : {}) };
+    return { handle, reused: false, services, ...postureNotes, ...(roleNote ? { roleNote } : {}), ...(seatNote ? { seatNote } : {}) };
 }
 export function stopSapLink(projectDir) {
     return serial(() => stopUnlocked(projectDir));

package/dist/sap-link/server.js

@@ -39,7 +39,7 @@
  *     failed pass-through never says "OK".
  */
 import * as http from 'node:http';
-import { decideRequest, writesBlockedMessage } from './policy.js';
+import { decideRequest, READ_ONLY_LINK_LINE, writesBlockedMessage } from './policy.js';
 import { appendWriteRow } from './write-log.js';
 export class SapLinkStartError extends Error {
     code;
@@ -210,6 +210,7 @@ export async function startSapLink(opts) {
             method: req.method ?? 'GET', rawUrl: req.url ?? '/',
             headers: req.headers,
             allowedPrefixes: opts.allowedPrefixes, alias: opts.alias, role,
+            ...(opts.readOnlySeat?.() ? { seatReadOnly: true } : {}),
         });
         if (!d.allow)
             return plain(res, d.status, d.message);
@@ -233,6 +234,8 @@ export async function startSapLink(opts) {
             catch {
                 return plain(res, 503, SETTINGS_UNREADABLE);
             }
+            if (opts.readOnlySeat?.())
+                return plain(res, 403, READ_ONLY_LINK_LINE);
             if (again !== 'dev')
                 return plain(res, 403, writesBlockedMessage(opts.alias, again));
         }

package/dist/tools/_team-work-path.js

@@ -138,7 +138,7 @@ export function pointsIntoSharedCspeach(cwd, realTarget) {
  * Windows opens them, so `LANES.JSON`, `plan\x.json` or `lanes.json.` count.
  */
 const TEAM_OWNED_FILES = ['cspeach-team.json', 'lanes.json'];
-const TEAM_OWNED_DIRS = ['writers', 'rulings', 'plan', 'baseline'];
+const TEAM_OWNED_DIRS = ['writers', 'rulings', 'plan', 'baseline', 'specs'];
 export function isTeamOwnedRel(rel) {
     const segs = rel.split(/[\\/]+/).filter((s) => s !== '' && s !== '.');
     if (!segs.length)

package/dist/tools/cap/sap-link-tool.js

@@ -115,6 +115,8 @@ registerTool({
                 `SAP link ${r.reused ? 'already on' : 'on'}: ${r.handle.url} → ${ctx.sapAlias}`,
                 `Services: ${r.services.join(', ')}`,
             ];
+            if (r.seatNote)
+                lines.push(r.seatNote);
             if (r.roleNote)
                 lines.push(r.roleNote);
             if (r.tlsNote)

package/dist/tools/project/spec_answers_record.js

@@ -17,6 +17,11 @@
  * shared team `.cspeach` (teamReadTarget's fallback there is read-only), and
  * only a spec-gap envelope.
  *
+ * 2026-10-28: a spec shared in a team build (`specs/<slug>/<name>.cspeach.json`)
+ * is answered with the blocker form's record mode: the revision is validated,
+ * each answer becomes its own record in `specs/<slug>/answers/`, and the
+ * author's file is never written.
+ *
  * Every refusal is one line and writes nothing: a sub-agent or reader child,
  * a path outside the project, a missing file, a file that is not a spec-gap
  * envelope in `.cspeach/`, the shared team `.cspeach`, an unknown id, a blank
@@ -34,7 +39,9 @@ import { resolveSafePath, assertRealPathContained, PathOutsideRootError, isReadO
 import { pointsIntoSharedCspeach, SHARED_CSPEACH_REFUSAL, teamReadTarget } from '../_team-work-path.js';
 import { SPEC_ANSWERS_RECORD_TOOL } from '../../projects/blocker-answers-note.js';
 import { readProjectFile } from '../../projects/status.js';
-import { openBlockers, saveBlockerAnswers } from '../../projects/answer-blockers.js';
+import { applyBlockerAnswers, openBlockers, saveBlockerAnswers } from '../../projects/answer-blockers.js';
+import { validateEnvelope } from '../../projects/validate.js';
+import { composeSpec, isSharedSpecPath, readAnswers, sharedSpecTargetFor, specAuthorFor, writeAnswerRecord, SPECS_DIR, } from '../../projects/spec-share.js';
 export const SPEC_ANSWERS_RECORD = SPEC_ANSWERS_RECORD_TOOL;
 /** Fix round 1 (item 4): the longest answer recorded. */
 export const MAX_ANSWER = 2000;
@@ -58,6 +65,14 @@ function realOr(p) {
         return path.resolve(p);
     }
 }
+/** The build project when `real` is a spec right inside `<team>/specs/<slug>/`, else null. */
+function sharedSpecFile(cwd, real) {
+    const target = sharedSpecTargetFor(cwd, 'spec-gap');
+    if (!target || !isSharedSpecPath(target.teamDir, real) || !/\.cspeach\.json$/i.test(real))
+        return null;
+    const rel = path.relative(realOr(path.join(target.teamDir, SPECS_DIR)), real);
+    return rel.split(path.sep).length === 2 ? { projectId: target.projectId } : null;
+}
 export async function specAnswersRecordHandler(args, ctx) {
     // Fix round 1 (item 5): only the main conversation records answers (a child could race the form).
     if (ctx.subagent || ctx.readerMode)
@@ -83,9 +98,13 @@ export async function specAnswersRecordHandler(args, ctx) {
     // fallback to it is for reading only, as for the write tools.
     if (pointsIntoSharedCspeach(ctx.cwd, real))
         return fail(`${SHARED_CSPEACH_REFUSAL} ${NOTHING_SAVED}`);
+    // 2026-10-28 — a spec shared in a team build (specs/<slug>/<name>.cspeach.json)
+    // is answered like the blocker form answers it there: one answer record per
+    // question beside it, the author's file never rewritten.
+    const shared = sharedSpecFile(ctx.cwd, real);
     // Fix round 1 (item 3): only a saved result the CLI writes (.cspeach/<name>.cspeach.json),
     // the same shape file_read's denylist carve-out opens (lane files excluded).
-    if (!isReadOnlyProjectFile(real, t.root) || !/\.cspeach\.json$/i.test(real)) {
+    if (!shared && (!isReadOnlyProjectFile(real, t.root) || !/\.cspeach\.json$/i.test(real))) {
         return fail(`${given} is not a spec-gap file. ${NOTHING_SAVED}`);
     }
     if (!(await fs.stat(real)).isFile())
@@ -93,6 +112,9 @@ export async function specAnswersRecordHandler(args, ctx) {
     let env;
     try {
         env = readProjectFile(real);
+        // R11: only the answers recorded for this envelope.
+        if (shared)
+            env = composeSpec(env, readAnswers(path.dirname(real)).filter((a) => a.file === path.basename(real)));
     }
     catch {
         return fail(`${given} is not a spec-gap file. ${NOTHING_SAVED}`);
@@ -138,15 +160,46 @@ export async function specAnswersRecordHandler(args, ctx) {
     }
     if (problems.length > 0)
         return fail(`${problems.join('; ')}. ${NOTHING_SAVED}`);
-    // The form's own save step: apply with the session identity, validate, write in place.
-    const saved = saveBlockerAnswers(real, env, answers, await sessionIdentity(), new Date().toISOString());
-    if (!saved.ok)
-        return fail(`the revised file did not validate (${saved.error}). ${NOTHING_SAVED}`);
+    const identity = await sessionIdentity();
+    const nowIso = new Date().toISOString();
+    let revised;
+    if (shared) {
+        // The blocker form's record mode: check the revision, write records, never the file.
+        revised = applyBlockerAnswers(env, answers, identity, nowIso);
+        const check = validateEnvelope(JSON.parse(JSON.stringify(revised)));
+        if (!check.ok)
+            return fail(`the revised file did not validate (${check.error.message}). ${NOTHING_SAVED}`);
+        const specDir = path.dirname(real);
+        const by = specAuthorFor(shared.projectId, identity.name);
+        const done = [];
+        try {
+            for (const [gapId, answer] of answers) {
+                writeAnswerRecord(specDir, {
+                    projectId: shared.projectId, slug: path.basename(specDir), file: path.basename(real), gapId, answer, by, at: nowIso,
+                });
+                done.push(gapId);
+            }
+        }
+        catch (err) {
+            // A shared folder can fail part-way (full, read-only, sync lock): say what was recorded.
+            const why = err instanceof Error ? err.message : String(err);
+            return fail(done.length === 0
+                ? `could not write the answer records (${why}). ${NOTHING_SAVED}`
+                : `could not write every answer record (${why}). Recorded: ${done.join(', ')}. The others were not saved.`);
+        }
+    }
+    else {
+        // The form's own save step: apply with the session identity, validate, write in place.
+        const saved = saveBlockerAnswers(real, env, answers, identity, nowIso);
+        if (!saved.ok)
+            return fail(`the revised file did not validate (${saved.error}). ${NOTHING_SAVED}`);
+        revised = saved.revised;
+    }
     const rel = path.relative(realOr(t.root), real).split(path.sep).join('/');
-    const open = openBlockers(saved.revised);
+    const open = openBlockers(revised);
     return {
         content: [
-            `Saved in ${rel}.`,
+            shared ? `Recorded for ${rel} (the spec file itself is unchanged).` : `Saved in ${rel}.`,
             ...order.map((id) => `${id}: recorded.`),
             open.length === 0
                 ? 'No blockers are still open.'
@@ -157,7 +210,7 @@ export async function specAnswersRecordHandler(args, ctx) {
 registerTool({
     name: SPEC_ANSWERS_RECORD,
     description: 'Record answers the developer gives in chat to spec-gap questions, in the saved spec-gap file '
-        + '(.cspeach/<name>.cspeach.json): blockers or any question in the file. The file exists only once the document has been saved, after your turn. Give each question id as in the file '
+        + '(.cspeach/<name>.cspeach.json, or in a team build specs/<slug>/<name>.cspeach.json): blockers or any question in the file. The file exists only once the document has been saved, after your turn. Give each question id as in the file '
         + '(for example gap-004) with its answer, at most 2,000 characters. '
         + 'Answering a question that already has an answer replaces it. Nothing is saved if any id or answer is refused. '
         + 'Never edit .cspeach.json files with shell or file-edit tools. No SAP call.',

package/dist/tools/project/team_findings.js

@@ -30,7 +30,7 @@ import { registerTool } from '../index.js';
 import { findingsByObject, shownUpTo } from '../../register/findings.js';
 import { registerFor } from '../../register/picture.js';
 import { ruleProposalOf } from '../../register/decision-rules.js';
-import { activeProject, readProjectFile } from '../../register/store.js';
+import { activeProject, coreProject, readProjectFile } from '../../register/store.js';
 import { shown } from '../../register/atc-file.js';
 import { journeyPage } from '../../journey/flow.js';
 import { NOT_JOINED_LINE } from './_team-tool-shared.js';
@@ -98,7 +98,7 @@ export async function teamFindingsHandler(args, ctx) {
         const laneId = args.lane?.trim();
         const patterns = (args.packages ?? '').split(',').map((s) => s.trim()).filter(Boolean);
         // The project view, built once: the scope, its parts and every row read it.
-        const view = projectView(register, project);
+        const view = projectView(register, coreProject(project));
         let objects = view.all.objects;
         let scope = { kind: 'project', name: project.name };
         if (laneId) {

package/dist/tools/seat-gate.js

@@ -0,0 +1,41 @@
+import { WRITE_TOOLS } from './write-mode.js';
+export const SEAT_READ_ONLY_REASON = 'This seat reads SAP and never changes it. Describe the change in plain words, or write it up for the developer as cspeach-out/developer-request-<topic>.md. Do not call SAP write, transport, lock, run, test, ATC or approval tools.';
+/**
+ * Refused beyond the generic rule: the two smokes write SAP data over OData
+ * although requiresSap is false; unit tests and ATC runs execute on SAP;
+ * team_lane_move writes the team project's lanes; fiori_deploy uploads an app.
+ * shell_exec and background_run (ruling R8): their safelist runs npm, pnpm,
+ * ui5 and node, a deploy route around the fiori_deploy refusal.
+ */
+export const SEAT_EXTRA_REFUSED = new Set([
+    'fiori_draft_smoke',
+    'cap_link_smoke',
+    'sap_run_unit_test',
+    'team_lane_move',
+    'sap_atc_run',
+    'fiori_deploy',
+    'shell_exec',
+    'background_run',
+]);
+export function isSeatRefusedTool(tool) {
+    return WRITE_TOOLS.has(tool.name) || tool.name === 'request_approval' || SEAT_EXTRA_REFUSED.has(tool.name)
+        || (tool.isMutating === true && tool.requiresSap === true);
+}
+/** The model-facing refusal for this call on this seat, or null when it may run. */
+export function seatRefusal(kind, tool, args) {
+    if (kind !== 'functional')
+        return null;
+    if (isSeatRefusedTool(tool))
+        return SEAT_READ_ONLY_REASON;
+    // No approval minted elsewhere can ever be replayed from a functional seat.
+    if (args && typeof args === 'object'
+        && (Object.prototype.hasOwnProperty.call(args, 'approval_id') || Object.prototype.hasOwnProperty.call(args, 'approval_ids')))
+        return SEAT_READ_ONLY_REASON;
+    return null;
+}
+/** The tools this seat is offered. Developers: the same array, untouched. */
+export function toolsForSeat(tools, kind) {
+    if (kind !== 'functional')
+        return tools;
+    return tools.filter((t) => !isSeatRefusedTool(t));
+}