@cspeach/cli 0.6.0

package/dist/doctor/checks/keychain.js

@@ -0,0 +1,23 @@
+import keytar from 'keytar';
+export async function checkKeychain() {
+    try {
+        const probe = `probe-${Date.now()}`;
+        await keytar.setPassword('cspeach', 'probe', probe);
+        const ok = (await keytar.getPassword('cspeach', 'probe')) === probe;
+        await keytar.deletePassword('cspeach', 'probe');
+        if (ok)
+            return { name: 'keychain', ok: true, message: 'OS keychain working' };
+        return { name: 'keychain', ok: false, message: 'probe write/read mismatch', hint: 'Per-session fallback mode will be used' };
+    }
+    catch (err) {
+        const msg = err.message;
+        let hint = 'Per-session fallback mode will be used; API key + SAP passwords will be prompted each session';
+        if (process.platform === 'win32' && /credential manager/i.test(msg)) {
+            hint = 'Windows Credential Manager may be disabled by GPO ("Network access: Do not allow storage of passwords and credentials"). Ask IT to enable, or use per-session mode.';
+        }
+        if (process.platform === 'linux' && /libsecret|keyring/i.test(msg)) {
+            hint = 'Install libsecret: sudo apt-get install libsecret-1-0 libsecret-1-dev, or use per-session mode';
+        }
+        return { name: 'keychain', ok: false, message: msg, hint };
+    }
+}

package/dist/doctor/checks/llm-mode.js

@@ -0,0 +1,27 @@
+import { createProviderForMode } from '../../agent/providers/factory.js';
+import { getStore } from '../../auth/api-key.js';
+export async function checkLlmMode(cfg) {
+    const getBearer = async () => {
+        const store = await getStore();
+        const key = await store.get();
+        return key ?? '';
+    };
+    try {
+        const provider = createProviderForMode(cfg, getBearer);
+        const h = await provider.healthCheck();
+        return {
+            name: `llm-mode (${cfg.llm.mode})`,
+            ok: h.ok,
+            message: `${provider.name}: ${h.message}`,
+            hint: h.hint,
+        };
+    }
+    catch (e) {
+        return {
+            name: `llm-mode (${cfg.llm.mode})`,
+            ok: false,
+            message: `Failed to construct provider: ${e.message}`,
+            hint: 'Check llm.mode config and per-mode fields',
+        };
+    }
+}

package/dist/doctor/checks/proxy.js

@@ -0,0 +1,13 @@
+import { loadConfig } from '../../config/loader.js';
+export async function checkProxy() {
+    const cfg = await loadConfig();
+    try {
+        const r = await fetch(`${cfg.proxy_url}/health`, { signal: AbortSignal.timeout(5000) });
+        if (!r.ok)
+            return { name: 'proxy', ok: false, message: `HTTP ${r.status}`, hint: `Check ${cfg.proxy_url} reachability` };
+        return { name: 'proxy', ok: true, message: `${cfg.proxy_url} reachable` };
+    }
+    catch (err) {
+        return { name: 'proxy', ok: false, message: `unreachable (${err.message})`, hint: 'Check firewall, DNS, or proxy URL in ~/.cspeach/config.toml' };
+    }
+}

package/dist/doctor/checks/sap.js

@@ -0,0 +1,33 @@
+import { loadConfig } from '../../config/loader.js';
+import { probeGet } from './_http-probe.js';
+export async function checkSap() {
+    const cfg = await loadConfig();
+    const systems = Object.entries(cfg.sap);
+    if (systems.length === 0)
+        return { name: 'sap', ok: false, message: 'no SAP systems configured', hint: 'Run: cspeach config add-sap' };
+    const results = [];
+    let anyFailed = false;
+    for (const [alias, sys] of systems) {
+        const url = `${sys.useSsl ? 'https' : 'http'}://${sys.host}:${sys.port}/sap/bc/adt/discovery`;
+        // Use node's https directly so we can honor sslVerify=false for
+        // self-signed dev systems — Node's built-in fetch() doesn't expose a
+        // per-request TLS-verify toggle. See checks/_http-probe.ts.
+        const r = await probeGet(url, {
+            rejectUnauthorized: sys.sslVerify,
+            timeoutMs: 8000,
+        });
+        if (r.error) {
+            results.push(`${alias}: ${r.error}`);
+            anyFailed = true;
+        }
+        else if (r.status === 200 || r.status === 401) {
+            // 200 = anonymous discovery allowed; 401 = reachable + auth-required (expected, fine)
+            results.push(`${alias}: reachable`);
+        }
+        else {
+            results.push(`${alias}: HTTP ${r.status}`);
+            anyFailed = true;
+        }
+    }
+    return { name: 'sap', ok: !anyFailed, message: results.join('; ') };
+}

package/dist/doctor/checks/skill.js

@@ -0,0 +1,24 @@
+import crypto from 'node:crypto';
+import { loadConfig } from '../../config/loader.js';
+import { getStore } from '../../auth/api-key.js';
+export async function checkSkill() {
+    const cfg = await loadConfig();
+    const store = await getStore();
+    const key = await store.get();
+    if (!key)
+        return { name: 'skill', ok: false, message: 'skipped (no API key)' };
+    try {
+        const r = await fetch(`${cfg.proxy_url}/v1/skills/abap-radar`, { headers: { Authorization: `Bearer ${key}` } });
+        if (!r.ok)
+            return { name: 'skill', ok: false, message: `HTTP ${r.status}` };
+        const body = await r.text();
+        const sha256 = r.headers.get('x-skill-sha256') ?? '';
+        const computed = crypto.createHash('sha256').update(body, 'utf-8').digest('hex');
+        if (sha256 !== computed)
+            return { name: 'skill', ok: false, message: `SHA256 mismatch (header=${sha256}, body=${computed})`, hint: 'Possible tampering or proxy bug — contact support' };
+        return { name: 'skill', ok: true, message: `abap-radar fetched (${body.length} bytes, SHA ${sha256.slice(0, 8)}...)` };
+    }
+    catch (err) {
+        return { name: 'skill', ok: false, message: err.message };
+    }
+}

package/dist/doctor/checks/write-mode.js

@@ -0,0 +1,34 @@
+/**
+ * Doctor check: surfaces the current `write_mode` setting and explains its effect.
+ *
+ * All three modes are valid configurations, so `ok` is always true — this check is
+ * informational. Users run `cspeach doctor` to see how CSPeach will behave before
+ * they make a change; they shouldn't have to read docs or dig into config to find out.
+ *
+ * `auto` additionally emits a `hint` nudging the user to review per-SAP auto_approve
+ * levels, since that's where the actual gating lives when write_mode is auto.
+ */
+export async function checkWriteMode(cfg) {
+    const mode = cfg.write_mode;
+    switch (mode) {
+        case 'advisory-only':
+            return {
+                name: 'write-mode',
+                ok: true,
+                message: 'write_mode = advisory-only — no SAP writes will occur; CSPeach proposes, developer applies',
+            };
+        case 'approval-gated':
+            return {
+                name: 'write-mode',
+                ok: true,
+                message: 'write_mode = approval-gated — CSPeach asks before each write (recommended default)',
+            };
+        case 'auto':
+            return {
+                name: 'write-mode',
+                ok: true,
+                message: 'write_mode = auto — some writes may proceed without prompt based on per-SAP auto_approve level',
+                hint: 'Review auto_approve settings per SAP system via `cspeach config show`',
+            };
+    }
+}

package/dist/doctor/checks/zcspeach.js

@@ -0,0 +1,76 @@
+import keytar from 'keytar';
+import { loadConfig } from '../../config/loader.js';
+import { probeGet } from './_http-probe.js';
+const SAP_SERVICE = 'cspeach-sap';
+export async function checkZcspeach() {
+    const cfg = await loadConfig();
+    const systems = Object.entries(cfg.sap);
+    if (systems.length === 0) {
+        return {
+            name: 'zcspeach',
+            ok: false,
+            message: 'no SAP systems configured',
+            hint: 'Run: cspeach config add-sap',
+        };
+    }
+    const results = [];
+    let anyFailed = false;
+    for (const [alias, sys] of systems) {
+        const protocol = sys.useSsl ? 'https' : 'http';
+        const url = `${protocol}://${sys.host}:${sys.port}/sap/bc/zcspeach/discovery`;
+        let pwd = null;
+        try {
+            pwd = await keytar.getPassword(SAP_SERVICE, alias);
+        }
+        catch {
+            // keychain unavailable — fall through, will be skipped below
+        }
+        if (!pwd) {
+            results.push(`${alias}: skipped (no password in keychain)`);
+            continue;
+        }
+        // Use node's https directly so we can honor sslVerify=false for
+        // self-signed dev systems. See checks/_http-probe.ts.
+        const r = await probeGet(url, {
+            rejectUnauthorized: sys.sslVerify,
+            auth: `${sys.username}:${pwd}`,
+            accept: 'application/json',
+            timeoutMs: 5000,
+        });
+        if (r.error) {
+            results.push(`${alias}: ${r.error}`);
+            anyFailed = true;
+            continue;
+        }
+        if (r.status < 200 || r.status >= 300) {
+            results.push(`${alias}: HTTP ${r.status} from /zcspeach/discovery`);
+            anyFailed = true;
+            continue;
+        }
+        let body;
+        try {
+            body = JSON.parse(r.body);
+        }
+        catch {
+            results.push(`${alias}: invalid JSON from /zcspeach/discovery`);
+            anyFailed = true;
+            continue;
+        }
+        if (body.status !== 'ok') {
+            results.push(`${alias}: discovery returned status=${body.status ?? '<missing>'}`);
+            anyFailed = true;
+            continue;
+        }
+        const ver = body.data?.version ?? '<missing>';
+        const ops = body.data?.operations?.length ?? 0;
+        results.push(`${alias}: v${ver}, ${ops} ops`);
+    }
+    return {
+        name: 'zcspeach',
+        ok: !anyFailed,
+        message: results.join('; '),
+        hint: anyFailed
+            ? 'SICF node /sap/bc/zcspeach must be active; ensure SAP_BASIS supports the framework'
+            : undefined,
+    };
+}

package/dist/doctor/run.js

@@ -0,0 +1,46 @@
+import chalk from 'chalk';
+import { loadConfig } from '../config/loader.js';
+import { checkProxy } from './checks/proxy.js';
+import { checkAuth } from './checks/auth.js';
+import { checkKeychain } from './checks/keychain.js';
+import { checkSap } from './checks/sap.js';
+import { checkZcspeach } from './checks/zcspeach.js';
+import { checkCert } from './checks/cert.js';
+import { checkSkill } from './checks/skill.js';
+import { checkKeychainFallback } from './checks/keychain-fallback.js';
+import { checkWriteMode } from './checks/write-mode.js';
+import { checkLlmMode } from './checks/llm-mode.js';
+import { checkForgeRules } from './checks/forge-rules.js';
+export async function runDoctor() {
+    console.log(chalk.cyan.bold('\nCSPeach — doctor\n'));
+    const cfg = await loadConfig();
+    const checks = [];
+    checks.push(await checkProxy());
+    checks.push(await checkAuth());
+    checks.push(await checkLlmMode(cfg));
+    checks.push(await checkWriteMode(cfg));
+    checks.push(await checkKeychain());
+    checks.push(await checkSap());
+    checks.push(await checkZcspeach());
+    checks.push(await checkCert());
+    checks.push(await checkSkill());
+    checks.push(await checkKeychainFallback());
+    checks.push(await checkForgeRules());
+    let failed = 0;
+    for (const c of checks) {
+        const icon = c.skipped
+            ? chalk.yellow('-  ')
+            : c.ok
+                ? chalk.green('OK ')
+                : chalk.red('X  ');
+        console.log(`  ${icon} ${c.name.padEnd(22)} ${c.message}`);
+        if (c.hint)
+            console.log(chalk.gray(`      -> ${c.hint}`));
+        if (!c.ok && !c.skipped)
+            failed++;
+    }
+    console.log(failed === 0
+        ? chalk.green('\nAll checks passed.\n')
+        : chalk.yellow(`\n${failed} check(s) failed.\n`));
+    return failed === 0 ? 0 : 1;
+}

package/dist/errors/codes.js

@@ -0,0 +1,12 @@
+/**
+ * Error taxonomy — canonical error code constants used across CSPeach CLI tools.
+ */
+export const ERR = {
+    APPROVAL_THRASH: 'APPROVAL_THRASH',
+    APPROVAL_INVALID: 'APPROVAL_INVALID',
+    SNAPSHOT_FAILED: 'SNAPSHOT_FAILED',
+    SYNTAX_ERRORS: 'SYNTAX_ERRORS',
+    SAP_UNREACHABLE: 'SAP_UNREACHABLE',
+    LOCK_HELD_BY_OTHER: 'LOCK_HELD_BY_OTHER',
+    SCHEMA_VERSION_MISMATCH: 'SCHEMA_VERSION_MISMATCH',
+};

package/dist/index.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { main } from './cli.js';
+main(process.argv).then((code) => process.exit(code), (err) => {
+    console.error('cspeach: unhandled error:', err);
+    process.exit(1);
+});

package/dist/lock-contention.js

@@ -0,0 +1,22 @@
+import { select } from '@inquirer/prompts';
+import chalk from 'chalk';
+export async function handleLockConflict(info) {
+    console.log(chalk.yellow(`\n⚠  ${info.object} is locked by ${info.user} since ${info.lockTime}.`));
+    return (await select({
+        message: 'How do you want to proceed?',
+        choices: [
+            { value: 'wait', name: 'Wait (retry every 10s for up to 2 minutes)' },
+            { value: 'skip', name: 'Skip this object (tell the model to work on something else)' },
+            { value: 'cancel', name: 'Cancel turn' },
+        ],
+    }));
+}
+export async function pollLock(checkFn, maxSeconds = 120) {
+    const startedAt = Date.now();
+    while (Date.now() - startedAt < maxSeconds * 1000) {
+        await new Promise((r) => setTimeout(r, 10_000));
+        if (await checkFn())
+            return true;
+    }
+    return false;
+}

package/dist/one-shot.js

@@ -0,0 +1,104 @@
+import chalk from 'chalk';
+import { loadConfig } from './config/loader.js';
+import { getStore } from './auth/api-key.js';
+import { getConnection } from './sap/connection-manager.js';
+import { AdtClient } from '@cspeach/sap-client';
+import { makeSessionId, saveSession } from './session/store.js';
+import { newSession } from './session/schema.js';
+import { createProviderForMode } from './agent/providers/factory.js';
+import { runTurn } from './agent/loop.js';
+import { classifyPrompt, parseShortcut } from './router/classifier.js';
+import { setRenderingOverride } from './renderer/tty.js';
+import { alwaysDeclinePreviewHook } from './repl/update-method-preview-hook.js';
+// Side-effect imports for tool registration.
+import './tools/sap-read.js';
+import './tools/sap-write.js';
+import './tools/transport.js';
+import './tools/approval.js';
+import './tools/snapshot.js';
+import './tools/ask-question.js';
+import './tools/dispatch-skill.js';
+import './tools/filesystem/file-read.js';
+import './tools/filesystem/file-edit.js';
+import './tools/filesystem/file-write.js';
+import './tools/filesystem/glob.js';
+import './tools/filesystem/grep.js';
+import './tools/shell/shell_exec.js';
+import './tools/web/web_fetch.js';
+import './tools/web/web_search.js';
+import './tools/project/project_context_get.js';
+import './tools/project/playbook_get.js';
+import './tools/project/convention_get.js';
+import './tools/subagent/_background-shared.js';
+import './tools/subagent/background_run.js';
+import './tools/subagent/monitor_emit.js';
+import './tools/subagent/schedule_create.js';
+import './tools/subagent/agent_run.js';
+export async function runOneShot(prompt, opts) {
+    const cfg = await loadConfig();
+    setRenderingOverride(cfg.ui.rendering);
+    // Task C.10 — advisory-only is the only mode the one-shot announces, because
+    // non-interactive output should stay minimal. The user needs to know that
+    // writes will NOT be executed before a skill that normally writes runs.
+    if (cfg.write_mode === 'advisory-only') {
+        console.log(chalk.yellow('⚠  Advisory mode: writes will be proposed, not executed.'));
+    }
+    const store = await getStore();
+    if (!(await store.get())) {
+        console.error('No API key configured. Run `cspeach` (interactive) first to set one.');
+        return 1;
+    }
+    const aliases = Object.keys(cfg.sap);
+    if (aliases.length === 0) {
+        console.error('No SAP system configured. Run `cspeach config add-sap` first.');
+        return 1;
+    }
+    // C.1 — --sap-alias flag override
+    const alias = opts?.sapAlias ?? aliases[0];
+    if (opts?.sapAlias) {
+        console.log(chalk.dim(`Using --sap-alias ${opts.sapAlias}`));
+    }
+    const conn = await getConnection(alias, cfg.sap[alias]);
+    const adt = new AdtClient(conn);
+    const session = newSession(makeSessionId(), alias, null, cfg.default_model);
+    await saveSession(session);
+    const parsed = parseShortcut(prompt);
+    const body = parsed.prompt;
+    let skill;
+    if (parsed.skill) {
+        skill = parsed.skill;
+    }
+    else {
+        // One-shot has no interactive picker — always uses top-1 and prints the
+        // confidence band on a dim prelude line. If < 0.6, emit a stderr warning
+        // with top-3 alternates so the user can rerun with an explicit /skill.
+        const c = await classifyPrompt(body, {
+            sap_system: alias,
+            last_skill: session.last_skill ?? null,
+            last_object: parsed.object ?? session.last_object ?? null,
+        });
+        const pct = Math.round(c.confidence * 100);
+        if (c.confidence < 0.6) {
+            const alternates = [c.skill, ...c.alternates].slice(0, 3).map((s) => `/${s}`).join(', ');
+            console.error(chalk.yellow(`[classifier] Low confidence (${pct}%). Using /${c.skill}. ` +
+                `Candidates: ${alternates}. Rerun with an explicit /skill to override.`));
+        }
+        else {
+            console.log(chalk.dim(`┄ Routed to /${c.skill} (${pct}%)`));
+        }
+        skill = c.skill;
+    }
+    const provider = createProviderForMode(cfg, async () => {
+        const key = await store.get();
+        if (!key)
+            throw new Error('No API key configured');
+        return key;
+    });
+    await runTurn({
+        provider,
+        userMessage: body,
+        skill,
+        ctx: { adt, sapAlias: alias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: alwaysDeclinePreviewHook },
+    });
+    return 0;
+}