@cspeach/cli 0.6.0

package/dist/router/classifier.js

@@ -0,0 +1,38 @@
+import { loadConfig } from '../config/loader.js';
+import { getStore } from '../auth/api-key.js';
+export async function classifyPrompt(prompt, context) {
+    const cfg = await loadConfig();
+    const store = await getStore();
+    const key = await store.get();
+    if (!key)
+        throw new Error('no_api_key');
+    const r = await fetch(`${cfg.proxy_url}/v1/classify`, {
+        method: 'POST',
+        headers: {
+            'Authorization': `Bearer ${key}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ prompt, context }),
+    });
+    if (!r.ok)
+        throw new Error(`classifier HTTP ${r.status}`);
+    return (await r.json());
+}
+export function parseShortcut(input) {
+    // `/skill-name rest` → { skill: 'abap-skill-name', prompt: 'rest' }
+    //   abap- prefix auto-prepended if missing (all skills in KV use abap-* namespace).
+    // `@OBJECT_NAME rest` → { object: 'OBJECT_NAME', prompt: 'rest' }
+    // otherwise → { prompt: input }
+    const slashMatch = input.match(/^\/([a-z0-9-]+)\s*(.*)$/i);
+    /** Auto-prepend ONLY inside the slash shortcut branch; plain prose goes through classifyPrompt. */
+    if (slashMatch) {
+        let skill = slashMatch[1];
+        if (!skill.startsWith('abap-'))
+            skill = 'abap-' + skill;
+        return { skill, prompt: slashMatch[2] };
+    }
+    const atMatch = input.match(/^@([A-Z0-9_]+)\s+(.*)$/i);
+    if (atMatch)
+        return { object: atMatch[1], prompt: atMatch[2] };
+    return { prompt: input };
+}

package/dist/router/intent-extractor.js

@@ -0,0 +1,140 @@
+/**
+ * Deterministic intent extractor — pulls structured facts out of the user's
+ * opening prompt BEFORE the LLM sees the turn. The facts become an XML
+ * `<session_context>` block prepended to the user message so the model
+ * reads them as structured data, not prose.
+ *
+ * Why this exists: skills kept ignoring prose rules like "if the user
+ * already said the package, don't ask about it." Prose compliance is
+ * stochastic. Running regex over the user's input is deterministic.
+ * Facts that are deterministically extracted cannot be silently forgotten
+ * by the model.
+ *
+ * This pattern is directly taken from Anthropic's context-engineering
+ * guidance (front-load structured XML sections, don't rely on the model
+ * to parse prose) and from Cursor / Aider's harness-injection pattern.
+ *
+ * Conservative by design: false negatives (miss an intent we could have
+ * extracted) are acceptable — the skill will just ask via ask_question.
+ * False positives (extract something the user didn't mean) are NOT
+ * acceptable — they'd override the user's actual intent. Patterns err
+ * on the strict side.
+ */
+/**
+ * Package name pattern: after a "package"/"pkg"/"in"/"into" keyword, Z or Y
+ * followed by 2+ uppercase-alphanum-or-underscore chars. Requires the
+ * keyword to avoid false-positive matches on random Z* identifiers in the
+ * body (e.g. "ZCL_ORDER" is an object name, not a package).
+ */
+const PACKAGE_RE = /(?:^|\s)(?:package|pkg|in\s+package|into\s+package|dev\s*class)\s+([ZY][A-Z0-9_]{1,29})(?:\b|\s|[.,;])/i;
+/**
+ * Transport pattern: SAP transport IDs follow SID + K + 6 digits (SxxKnnnnnn
+ * e.g. S4HK903342). We match 1-char system letter + 1-2 alphanum + K + 5-7
+ * digits to catch variants.
+ */
+const TRANSPORT_RE = /\b([A-Z][A-Z0-9]{1,2}K[0-9]{5,7})\b/;
+/**
+ * Object name hints — keyword followed by a Z-prefixed or Y-prefixed name.
+ * Triggers: program, report, class, interface, table, structure, function
+ * module, CDS view.
+ */
+const OBJECT_KEYWORD_RE = /(?:^|\s)(?:program|report|class|interface|table|structure|function(?:\s+module)?|cds\s+view|ddic)\s+(?:named|name|called)?\s*([ZY][A-Z0-9_]{2,29})\b/gi;
+/**
+ * Environment hints — presence of these tokens in the opening prompt gives
+ * the skill a head-start without requiring a release probe.
+ */
+const ENV_ONPREM_RE = /\bon[-\s]prem(?:ise)?\b|\bon[-\s]premises\b/i;
+const ENV_CLOUD_RE = /\bBTP\b|\bsteampunk\b|\babap\s+cloud\b/i;
+const ENV_ECC_RE = /\bECC(?:\s*6(?:\.0)?)?\b/i;
+const ENV_S4_RE = /\bS\/?4(?:\s*HANA)?\b/i;
+export function extractIntent(userPrompt) {
+    const result = {};
+    // Package
+    const pkg = PACKAGE_RE.exec(userPrompt);
+    if (pkg)
+        result.package = pkg[1].toUpperCase();
+    // Transport
+    const trp = TRANSPORT_RE.exec(userPrompt);
+    if (trp)
+        result.transport = trp[1].toUpperCase();
+    // Having a transport strongly implies the user wants SAP creation.
+    if (result.transport)
+        result.createIntent = true;
+    // Object names — only when explicitly keyword-prefixed, to avoid
+    // accidental matches on random Z* tokens in prose.
+    const names = [];
+    let m;
+    // Reset lastIndex since the regex uses /g.
+    OBJECT_KEYWORD_RE.lastIndex = 0;
+    while ((m = OBJECT_KEYWORD_RE.exec(userPrompt)) !== null) {
+        names.push(m[1].toUpperCase());
+    }
+    if (names.length > 0) {
+        result.objectNames = [...new Set(names)];
+    }
+    // Environment hints — check most specific first, so "ABAP Cloud on-prem"
+    // (contradictory) resolves to cloud.
+    if (ENV_CLOUD_RE.test(userPrompt))
+        result.environmentHint = 'btp-cloud';
+    else if (ENV_ONPREM_RE.test(userPrompt))
+        result.environmentHint = 's4-onprem';
+    else if (ENV_ECC_RE.test(userPrompt))
+        result.environmentHint = 'ecc';
+    else if (ENV_S4_RE.test(userPrompt))
+        result.environmentHint = 's4-onprem';
+    return result;
+}
+/**
+ * Format the extracted intent as an XML block suitable for prepending to
+ * the user message. Returns empty string when nothing was extracted — we
+ * don't want to clutter clean prompts with empty tags.
+ *
+ * The XML format (as opposed to JSON or prose) follows Anthropic's context-
+ * engineering guidance that XML-tagged sections are read reliably by the
+ * model as structured data.
+ */
+export function formatFactBlock(facts, sapSystemBlock = '') {
+    const lines = [];
+    // SAP system info (release / platform / deployment) is fetched once per
+    // session by getSapSystemInfo and rendered by renderSapSystemBlock. It
+    // sits at the top of the context so skills consult it FIRST when
+    // deciding whether to ask "are we on S/4HANA?" — they shouldn't.
+    if (sapSystemBlock)
+        lines.push('  ' + sapSystemBlock);
+    if (facts.package)
+        lines.push(`  <package>${facts.package}</package>`);
+    if (facts.transport)
+        lines.push(`  <transport>${facts.transport}</transport>`);
+    if (facts.objectNames && facts.objectNames.length > 0) {
+        lines.push(`  <object_names>${facts.objectNames.join(', ')}</object_names>`);
+    }
+    if (facts.environmentHint) {
+        lines.push(`  <environment_hint>${facts.environmentHint}</environment_hint>`);
+    }
+    if (facts.createIntent)
+        lines.push(`  <create_intent>true</create_intent>`);
+    if (lines.length === 0)
+        return '';
+    return ([
+        '<session_context>',
+        '  <!-- Facts already known. DO NOT ask the user about any field present here — they already told you, or the system reported it. -->',
+        ...lines,
+        '</session_context>',
+        '',
+    ].join('\n'));
+}
+/**
+ * Convenience: extract + format in one call. Returns the user message with
+ * the fact block prepended (empty if nothing was extracted AND no SAP
+ * system block was supplied).
+ *
+ * @param userPrompt the raw user prompt
+ * @param sapSystemBlock optional pre-rendered <sap_system .../> XML element
+ *                       (from renderSapSystemBlock); pass '' or omit when
+ *                       no SAP connection is active
+ */
+export function enrichUserMessage(userPrompt, sapSystemBlock = '') {
+    const facts = extractIntent(userPrompt);
+    const block = formatFactBlock(facts, sapSystemBlock);
+    return block.length > 0 ? block + userPrompt : userPrompt;
+}

package/dist/router/routing-decision.js

@@ -0,0 +1,19 @@
+// Hard-coded thresholds — not a config surface. Tunable by editing this file
+// in the future if needed. Keeping them constant avoids the ceremony of a
+// config interface + defaults for two numbers that rarely change.
+//
+// TODO: when cspeach-brain adds per-alternate confidences to ClassifyResult
+// (Layer B spec), extend the silent-arm with a margin check: if
+// top-2.confidence is within 0.15 of top-1, demote to 'coach'. One extra
+// `if` — no API change to this file's exports.
+const HIGH_THRESHOLD = 0.85;
+const COACH_THRESHOLD = 0.60;
+export function decideRouting(result) {
+    if (result.confidence >= HIGH_THRESHOLD) {
+        return { kind: 'silent', skill: result.skill };
+    }
+    if (result.confidence >= COACH_THRESHOLD) {
+        return { kind: 'coach', result };
+    }
+    return { kind: 'picker', result };
+}

package/dist/sap/connection-manager.js

@@ -0,0 +1,52 @@
+import keytar from 'keytar';
+import { SapConnection } from '@cspeach/sap-client';
+import { password as promptPassword } from '@inquirer/prompts';
+const SAP_SERVICE = 'cspeach-sap';
+const cache = new Map();
+export async function getConnection(alias, cfg) {
+    const existing = cache.get(alias);
+    if (existing)
+        return existing;
+    let passwordValue;
+    if (cfg.authType === 'basic') {
+        try {
+            passwordValue = (await keytar.getPassword(SAP_SERVICE, alias)) ?? undefined;
+        }
+        catch { /* keychain unavailable */ }
+        if (!passwordValue) {
+            passwordValue = await promptPassword({
+                message: `SAP password for ${alias}/${cfg.username}:`,
+                mask: '*',
+            });
+        }
+    }
+    if (cfg.authType !== 'basic') {
+        throw new Error('x509 auth not yet supported in v0.1 — set authType=basic in config');
+    }
+    // SapConnection constructor is (config, username, password) — 3 positional args.
+    // SapConfig.authType is typed as 'basic' only (v1); SapSystemConfig carries the
+    // wider union so we cast to satisfy the narrower SapConfig shape.
+    const conn = new SapConnection({
+        host: cfg.host,
+        port: cfg.port,
+        client: cfg.client,
+        useSsl: cfg.useSsl,
+        sslVerify: cfg.sslVerify,
+        credentialRef: alias,
+        authType: 'basic',
+    }, cfg.username, passwordValue ?? '');
+    // Call login() once up front so the CSRF token is fetched and bound to
+    // the same SAP session our subsequent requests will use. Without this,
+    // GETs run "anonymously" (Basic auth, cookies auto-harvested, no token)
+    // and the first state-changing POST (lock) hits SAP with an empty CSRF
+    // header → 403 "CSRF token validation failed". Refreshing CSRF after
+    // that 403 doesn't recover, because fetchCsrfToken issues against a
+    // brand-new session and the token ends up bound to one session while
+    // our existing cookies belong to a different one.
+    await conn.login();
+    cache.set(alias, conn);
+    return conn;
+}
+export function clearConnectionCache() {
+    cache.clear();
+}

package/dist/sap/onboarding.js

@@ -0,0 +1,178 @@
+import { input, select, password, confirm } from '@inquirer/prompts';
+import chalk from 'chalk';
+import keytar from 'keytar';
+import { loadConfig, saveConfig } from '../config/loader.js';
+const SAP_SERVICE = 'cspeach-sap';
+export async function runAddSapWizard() {
+    console.log(chalk.cyan.bold('\nCSPeach — Add SAP system\n'));
+    const alias = await input({
+        message: 'System alias (short name like "S4H-DEV"):',
+        validate: (v) => /^[A-Z0-9_-]{2,32}$/.test(v) || 'Use uppercase letters, digits, _, - (2-32 chars)',
+    });
+    const host = await input({
+        message: 'SAP host or IP (e.g. sap-dev.company.com or 172.16.24.98):',
+        validate: (v) => v.length > 0 || 'Required',
+    });
+    const port = await input({
+        message: 'HTTPS port (default 44300):',
+        default: '44300',
+        validate: (v) => (!Number.isNaN(Number(v)) && Number(v) > 0 && Number(v) < 65536) || 'Invalid port',
+    });
+    const client = await input({
+        message: 'SAP client (e.g. 100):',
+        validate: (v) => /^\d{3}$/.test(v) || 'Must be a 3-digit client number',
+    });
+    const useSsl = await confirm({ message: 'Use HTTPS/TLS?', default: true });
+    const sslVerify = useSsl
+        ? await confirm({ message: 'Verify server certificate? (Say no for self-signed SAP certs)', default: false })
+        : false;
+    const authType = await select({
+        message: 'Authentication type:',
+        choices: [
+            { value: 'basic', name: 'Basic auth (username + password)' },
+            { value: 'x509', name: 'x509 client certificate (v1.1 — not yet supported in proxy)' },
+        ],
+        default: 'basic',
+    });
+    const username = await input({
+        message: 'SAP username (e.g. S.LAEEQ):',
+        validate: (v) => v.length > 0 || 'Required',
+    });
+    let certPath;
+    if (authType === 'x509') {
+        certPath = await input({
+            message: 'Path to PKCS#12 client certificate (.p12 or .pfx):',
+            validate: (v) => v.length > 0 || 'Required',
+        });
+    }
+    else {
+        const pwd = await password({
+            message: 'SAP password (stored in OS keychain):',
+            mask: '*',
+        });
+        try {
+            await keytar.setPassword(SAP_SERVICE, alias, pwd);
+        }
+        catch {
+            console.log(chalk.yellow('Warning: keychain unavailable; password will be prompted per session.'));
+        }
+    }
+    // auto_approve defaults to 'never' — user can change with:
+    //   cspeach config set sap.<alias>.auto_approve low
+    // First low-risk approval will offer a progressive-disclosure prompt.
+    const cfg = await loadConfig();
+    // First-run onboarding: ask write_mode once, the first time the user adds a
+    // SAP system. On subsequent add-sap calls (2nd/3rd system) we skip the prompt
+    // — write_mode is a top-level CLI setting, not a per-SAP setting. User can
+    // always change later with `cspeach config set write_mode <value>`.
+    const isFirstRun = Object.keys(cfg.sap).length === 0;
+    if (isFirstRun) {
+        const write_mode = await select({
+            message: 'How should CSPeach apply SAP changes?',
+            choices: [
+                {
+                    name: 'approval-gated (recommended) — ask before each write',
+                    value: 'approval-gated',
+                    description: 'CSPeach proposes changes; you approve each one; CSPeach executes.',
+                },
+                {
+                    name: 'advisory-only — never execute writes automatically',
+                    value: 'advisory-only',
+                    description: 'CSPeach proposes changes; you apply them yourself in ADT/SE80. Zero write traffic to SAP. Most conservative; compliant with strict policy reviews.',
+                },
+                {
+                    name: 'auto — apply low-risk changes automatically (advanced)',
+                    value: 'auto',
+                    description: 'Advanced. Requires setting auto_approve level per SAP system.',
+                },
+            ],
+            default: 'approval-gated',
+        });
+        cfg.write_mode = write_mode;
+        const llm_mode = await select({
+            message: 'How should CSPeach reach the AI model?',
+            choices: [
+                {
+                    name: 'managed (recommended) — we handle the Anthropic account',
+                    value: 'managed',
+                    description: 'Your prompts route through api.cspeach.dev. We bill, we ratelimit, we sign skills. Simplest setup.',
+                },
+                {
+                    name: 'byok — your own Anthropic account',
+                    value: 'byok',
+                    description: 'Your prompts go direct to Anthropic with your API key. You own the contract. Skills signed + fetched from our public manifest.',
+                },
+                {
+                    name: 'ai-hub — your SAP AI Core tenant (endorsed architecture)',
+                    value: 'ai-hub',
+                    description: 'Your prompts route through your SAP BTP AI Core proxy. Data stays in your SAP landscape. Strongest compliance posture (short of SAP Partner Edge).',
+                },
+                {
+                    name: 'local — your own Ollama / vLLM endpoint (air-gap)',
+                    value: 'local',
+                    description: 'No external AI. Skills bundled with the CLI binary. Tool-calling quality depends on the local model.',
+                },
+            ],
+            default: 'managed',
+        });
+        cfg.llm = { mode: llm_mode };
+        if (llm_mode === 'ai-hub') {
+            cfg.llm.ai_hub_base_url = await input({
+                message: 'AI Core proxy URL (e.g. https://proxy.yourcorp.com/v1):',
+                validate: v => v.startsWith('https://') || v.startsWith('http://') ? true : 'Must be a URL',
+            });
+            cfg.llm.ai_hub_model_alias = await input({
+                message: 'AI Core model alias (default: anthropic--claude-opus-4-6):',
+                default: 'anthropic--claude-opus-4-6',
+            });
+            const aiHubToken = await password({
+                message: 'AI Core API token (input masked):',
+                mask: '*',
+            });
+            try {
+                await keytar.setPassword('cspeach.ai-hub', 'token', aiHubToken);
+            }
+            catch {
+                console.log(chalk.yellow('Warning: keychain unavailable; AI Hub token will be prompted per session.'));
+            }
+        }
+        if (llm_mode === 'local') {
+            cfg.llm.local_base_url = await input({
+                message: 'Local endpoint base URL (default: http://localhost:11434/v1 for Ollama):',
+                default: 'http://localhost:11434/v1',
+            });
+            cfg.llm.local_model = await input({
+                message: 'Model name (e.g. llama3.1:70b):',
+                default: 'llama3.1:70b',
+            });
+        }
+        if (llm_mode === 'byok') {
+            const byokKey = await password({
+                message: 'Anthropic API key sk-ant-... (input masked):',
+                mask: '*',
+            });
+            try {
+                await keytar.setPassword('cspeach.anthropic', 'api-key', byokKey);
+            }
+            catch {
+                console.log(chalk.yellow('Warning: keychain unavailable; Anthropic key will be prompted per session.'));
+            }
+        }
+    }
+    cfg.sap[alias] = {
+        host,
+        port: Number(port),
+        client,
+        useSsl,
+        sslVerify,
+        username,
+        authType,
+        certPath,
+        auto_approve: 'never',
+    };
+    await saveConfig(cfg);
+    console.log(chalk.green(`\nSaved SAP system "${alias}" to ~/.cspeach/config.toml`));
+    console.log(chalk.gray(`  Auto-approve policy: never (change with: cspeach config set sap.${alias}.auto_approve low)\n`));
+    console.log(chalk.gray('Just tell me what you need — no need to pick a skill.'));
+    console.log(chalk.gray('`/skill-name` is a shortcut for power users who know the skill catalog.'));
+}