@cspeach/cli 0.6.2 → 0.6.4

package/dist/commands/__tests__/login.test.js

@@ -0,0 +1,152 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { promises as fs } from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { runLoginCommand } from '../login.js';
+import { __setAuthFilePathForTests, readAuthFile } from '../../auth/auth-file.js';
+const { fetchMock } = vi.hoisted(() => ({ fetchMock: vi.fn() }));
+vi.stubGlobal('fetch', fetchMock);
+const { openMock } = vi.hoisted(() => ({ openMock: vi.fn() }));
+let dir;
+let authPath;
+beforeEach(async () => {
+    fetchMock.mockReset();
+    openMock.mockReset();
+    openMock.mockResolvedValue(undefined);
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), 'cspeach-login-'));
+    authPath = path.join(dir, 'auth.json');
+    __setAuthFilePathForTests(authPath);
+});
+afterEach(async () => {
+    __setAuthFilePathForTests(null);
+    await fs.rm(dir, { recursive: true, force: true });
+});
+describe('cspeach login', () => {
+    it('happy path: start → open browser → poll → save auth file (non-BYOK)', async () => {
+        fetchMock.mockImplementation(async (url) => {
+            if (url.endsWith('/v1/auth/device/start')) {
+                return new Response(JSON.stringify({
+                    device_code: 'dev-1', user_code: 'AAAA-BBBB',
+                    verification_url: 'https://cspeach.dev/device',
+                    verification_url_complete: 'https://cspeach.dev/device?code=AAAA-BBBB',
+                    expires_in: 600, interval: 0,
+                }), { status: 200, headers: { 'content-type': 'application/json' } });
+            }
+            if (url.endsWith('/v1/auth/device/poll')) {
+                return new Response(JSON.stringify({ api_key: 'csp_live_abc' + 'x'.repeat(29), customer_id: 'cust-1' }), { status: 200, headers: { 'content-type': 'application/json' } });
+            }
+            if (url.endsWith('/v1/me')) {
+                return new Response(JSON.stringify({ email: 'c@a.com', plan: 'trial-managed', trial_mode: 'managed-capped' }), { status: 200, headers: { 'content-type': 'application/json' } });
+            }
+            throw new Error(`unexpected URL ${url}`);
+        });
+        const lines = [];
+        const result = await runLoginCommand({
+            proxyUrl: 'https://api.cspeach.dev',
+            open: openMock,
+            print: (s) => lines.push(s),
+            prompt: async () => '',
+            pollIntervalMs: 0,
+            maxAttempts: 3,
+        });
+        expect(result).toBe(0);
+        expect(openMock).toHaveBeenCalledWith('https://cspeach.dev/device?code=AAAA-BBBB');
+        expect(lines.some((l) => /AAAA-BBBB/.test(l))).toBe(true);
+        const saved = await readAuthFile();
+        expect(saved?.apiKey).toBe('csp_live_abc' + 'x'.repeat(29));
+        expect(saved?.customerId).toBe('cust-1');
+        expect(saved?.byokAnthropicKey).toBeNull();
+    });
+    it('BYOK customer: prompts for Anthropic key and saves it', async () => {
+        fetchMock.mockImplementation(async (url) => {
+            if (url.endsWith('/v1/auth/device/start')) {
+                return new Response(JSON.stringify({ device_code: 'dev-2', user_code: 'CCCC-DDDD', verification_url: 'x', verification_url_complete: 'x', expires_in: 600, interval: 0 }), { status: 200 });
+            }
+            if (url.endsWith('/v1/auth/device/poll')) {
+                return new Response(JSON.stringify({ api_key: 'csp_live_byok' + 'y'.repeat(28), customer_id: 'cust-byok' }), { status: 200 });
+            }
+            if (url.endsWith('/v1/me')) {
+                return new Response(JSON.stringify({ email: 'b@a.com', plan: 'trial-byok', trial_mode: 'byok' }), { status: 200 });
+            }
+            throw new Error('unexpected');
+        });
+        let promptCount = 0;
+        const result = await runLoginCommand({
+            proxyUrl: 'https://api.cspeach.dev', open: openMock, print: () => { },
+            prompt: async (q) => { promptCount++; return q.includes('Anthropic') ? ('sk-ant-byok-' + 'x'.repeat(30)) : ''; },
+            pollIntervalMs: 0, maxAttempts: 3,
+        });
+        expect(result).toBe(0);
+        expect(promptCount).toBeGreaterThan(0);
+        const saved = await readAuthFile();
+        expect(saved?.byokAnthropicKey).toBe('sk-ant-byok-' + 'x'.repeat(30));
+    });
+    it('poll returns authorization_pending the first time, success the second', async () => {
+        let pollCount = 0;
+        fetchMock.mockImplementation(async (url) => {
+            if (url.endsWith('/v1/auth/device/start')) {
+                return new Response(JSON.stringify({ device_code: 'dev-3', user_code: 'EEEE-FFFF', verification_url: 'x', verification_url_complete: 'x', expires_in: 600, interval: 0 }), { status: 200 });
+            }
+            if (url.endsWith('/v1/auth/device/poll')) {
+                pollCount++;
+                if (pollCount === 1) {
+                    return new Response(JSON.stringify({ error: 'authorization_pending' }), { status: 400 });
+                }
+                return new Response(JSON.stringify({ api_key: 'csp_live_p' + 'p'.repeat(31), customer_id: 'cust-p' }), { status: 200 });
+            }
+            if (url.endsWith('/v1/me')) {
+                return new Response(JSON.stringify({ email: 'p@a.com', plan: 'solo', trial_mode: null }), { status: 200 });
+            }
+            throw new Error('unexpected');
+        });
+        const result = await runLoginCommand({
+            proxyUrl: 'https://api.cspeach.dev', open: openMock, print: () => { },
+            prompt: async () => '', pollIntervalMs: 0, maxAttempts: 5,
+        });
+        expect(result).toBe(0);
+        expect(pollCount).toBe(2);
+    });
+    it('returns non-zero when poll keeps returning pending past maxAttempts', async () => {
+        fetchMock.mockImplementation(async (url) => {
+            if (url.endsWith('/v1/auth/device/start')) {
+                return new Response(JSON.stringify({ device_code: 'd', user_code: 'X', verification_url: 'x', verification_url_complete: 'x', expires_in: 600, interval: 0 }), { status: 200 });
+            }
+            return new Response(JSON.stringify({ error: 'authorization_pending' }), { status: 400 });
+        });
+        const result = await runLoginCommand({
+            proxyUrl: 'https://api.cspeach.dev', open: openMock, print: () => { },
+            prompt: async () => '', pollIntervalMs: 0, maxAttempts: 2,
+        });
+        expect(result).not.toBe(0);
+    });
+    it('returns non-zero when start endpoint fails', async () => {
+        fetchMock.mockImplementation(async () => new Response('{"error":"server"}', { status: 500 }));
+        const result = await runLoginCommand({
+            proxyUrl: 'https://api.cspeach.dev', open: openMock, print: () => { },
+            prompt: async () => '', pollIntervalMs: 0, maxAttempts: 2,
+        });
+        expect(result).not.toBe(0);
+    });
+    it('does not crash when open() throws (fallback to manual URL print)', async () => {
+        openMock.mockRejectedValue(new Error('xdg-open not installed'));
+        fetchMock.mockImplementation(async (url) => {
+            if (url.endsWith('/v1/auth/device/start')) {
+                return new Response(JSON.stringify({ device_code: 'd', user_code: 'M', verification_url: 'https://cspeach.dev/device', verification_url_complete: 'https://cspeach.dev/device?code=M', expires_in: 600, interval: 0 }), { status: 200 });
+            }
+            if (url.endsWith('/v1/auth/device/poll')) {
+                return new Response(JSON.stringify({ api_key: 'csp_live_' + 'z'.repeat(32), customer_id: 'c' }), { status: 200 });
+            }
+            if (url.endsWith('/v1/me')) {
+                return new Response(JSON.stringify({ email: 'z@a.com', plan: 'solo' }), { status: 200 });
+            }
+            throw new Error('unexpected');
+        });
+        const lines = [];
+        const result = await runLoginCommand({
+            proxyUrl: 'https://api.cspeach.dev', open: openMock, print: (s) => lines.push(s),
+            prompt: async () => '', pollIntervalMs: 0, maxAttempts: 3,
+        });
+        expect(result).toBe(0);
+        expect(lines.some((l) => l.includes('https://cspeach.dev/device'))).toBe(true);
+    });
+});

package/dist/commands/__tests__/logout.test.js

@@ -0,0 +1,39 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { promises as fs } from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { runLogoutCommand } from '../logout.js';
+import { __setAuthFilePathForTests, writeAuthFile } from '../../auth/auth-file.js';
+let dir;
+let authPath;
+beforeEach(async () => {
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), 'cspeach-logout-'));
+    authPath = path.join(dir, 'auth.json');
+    __setAuthFilePathForTests(authPath);
+});
+afterEach(async () => {
+    __setAuthFilePathForTests(null);
+    await fs.rm(dir, { recursive: true, force: true });
+});
+describe('cspeach logout', () => {
+    it('deletes the auth file when present', async () => {
+        await writeAuthFile({ apiKey: 'csp_live_x', customerId: 'c-1', byokAnthropicKey: null });
+        const lines = [];
+        const result = await runLogoutCommand({ print: (s) => lines.push(s) });
+        expect(result).toBe(0);
+        await expect(fs.access(authPath)).rejects.toBeTruthy();
+        expect(lines.some((l) => /Signed out/i.test(l))).toBe(true);
+    });
+    it('prints "Already signed out" when file absent', async () => {
+        const lines = [];
+        const result = await runLogoutCommand({ print: (s) => lines.push(s) });
+        expect(result).toBe(0);
+        expect(lines.some((l) => /Already signed out/i.test(l))).toBe(true);
+    });
+    it('returns 0', async () => {
+        // Both branches above already assert exit code 0; this test pins
+        // the contract that logout never returns non-zero.
+        const result = await runLogoutCommand({ print: () => { } });
+        expect(result).toBe(0);
+    });
+});

package/dist/commands/__tests__/project-context-impact.test.js

@@ -0,0 +1,173 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { promises as fs } from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { analyzeProjectContextImpact, renderImpactReport, } from '../project-context-impact.js';
+let dir;
+beforeEach(async () => {
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), 'cspeach-impact-'));
+});
+afterEach(async () => {
+    await fs.rm(dir, { recursive: true, force: true });
+});
+async function writeSession(t) {
+    const turns = t.turns ?? 1;
+    const messages = [];
+    for (let i = 0; i < turns; i++) {
+        const isFirst = i === 0;
+        const content = isFirst && t.flagOn
+            ? '<project_context type="abapgit">\n  <root>/x</root>\n</project_context>\n\nthe ask'
+            : 'follow-up';
+        messages.push({ role: 'user', content });
+        messages.push({ role: 'assistant', content: 'reply' });
+    }
+    const toolCalls = [];
+    for (let i = 0; i < t.toolCallCount; i++) {
+        toolCalls.push({
+            tool_use_id: `tu${i}`,
+            tool: 'sap_get_source',
+            args: {},
+            result: 'ok',
+            is_error: t.hadErrorTool === true && i === 0,
+            duration_ms: 100,
+            completed_at: '2026-05-10T10:00:00Z',
+            completed: true,
+        });
+    }
+    const session = {
+        schema_version: 1,
+        id: t.id,
+        started_at: t.startedAt ?? '2026-05-10T10:00:00Z',
+        last_turn_at: t.startedAt ?? '2026-05-10T10:00:00Z',
+        sap_system: null,
+        skill: t.skill ?? 'abap-cca',
+        model: 'claude-opus-4-7',
+        messages,
+        toolCalls,
+        usage: { input_tokens: t.inputTokens, output_tokens: t.outputTokens, cache_read_input_tokens: 0 },
+        last_skill: t.skill ?? 'abap-cca',
+        last_object: null,
+        lastUserPrompt: null,
+        awaitingSkillAnswer: false,
+    };
+    await fs.writeFile(path.join(dir, `${t.id}.json`), JSON.stringify(session), 'utf-8');
+}
+describe('analyzeProjectContextImpact — empty state', () => {
+    it('returns zero counts when sessionsDir does not exist', async () => {
+        const report = await analyzeProjectContextImpact({ dir: path.join(dir, 'nope') });
+        expect(report.totalSessions).toBe(0);
+        expect(report.flagOn.count).toBe(0);
+        expect(report.flagOff.count).toBe(0);
+    });
+    it('returns zero counts when dir is empty', async () => {
+        const report = await analyzeProjectContextImpact({ dir });
+        expect(report.totalSessions).toBe(0);
+    });
+});
+describe('analyzeProjectContextImpact — classification', () => {
+    it('classifies a session by whether the first user message contains <project_context', async () => {
+        await writeSession({ id: 'a1', flagOn: false, inputTokens: 1000, outputTokens: 200, toolCallCount: 2 });
+        await writeSession({ id: 'a2', flagOn: true, inputTokens: 1500, outputTokens: 250, toolCallCount: 1 });
+        const report = await analyzeProjectContextImpact({ dir });
+        expect(report.totalSessions).toBe(2);
+        expect(report.flagOn.count).toBe(1);
+        expect(report.flagOff.count).toBe(1);
+    });
+    it('only counts the FIRST user message — a later block doesn\'t flip the flag', async () => {
+        // Edge case: the model echoes <project_context> in turn 3. The
+        // session is still "flag off" because turn 1 had a plain message.
+        const session = {
+            schema_version: 1,
+            id: 'echo',
+            started_at: '2026-05-10T10:00:00Z',
+            last_turn_at: '2026-05-10T10:00:00Z',
+            sap_system: null,
+            skill: null,
+            model: 'm',
+            messages: [
+                { role: 'user', content: 'plain ask, flag was off' },
+                { role: 'assistant', content: 'reply mentioning <project_context type=...>' },
+                { role: 'user', content: 'follow-up' },
+            ],
+            toolCalls: [],
+            usage: { input_tokens: 100, output_tokens: 50, cache_read_input_tokens: 0 },
+            last_skill: null,
+            last_object: null,
+            lastUserPrompt: null,
+            awaitingSkillAnswer: false,
+        };
+        await fs.writeFile(path.join(dir, 'echo.json'), JSON.stringify(session), 'utf-8');
+        const report = await analyzeProjectContextImpact({ dir });
+        expect(report.flagOff.count).toBe(1);
+        expect(report.flagOn.count).toBe(0);
+    });
+});
+describe('analyzeProjectContextImpact — averages + delta', () => {
+    it('computes per-session averages correctly', async () => {
+        // 2 flag-off sessions: 1000+2000 input, 200+400 output, 2+4 tools → averages 1500/300/3
+        await writeSession({ id: 'off1', flagOn: false, inputTokens: 1000, outputTokens: 200, toolCallCount: 2 });
+        await writeSession({ id: 'off2', flagOn: false, inputTokens: 2000, outputTokens: 400, toolCallCount: 4 });
+        // 2 flag-on sessions: 1200+1800 input, 250+350 output, 1+3 tools → averages 1500/300/2
+        await writeSession({ id: 'on1', flagOn: true, inputTokens: 1200, outputTokens: 250, toolCallCount: 1 });
+        await writeSession({ id: 'on2', flagOn: true, inputTokens: 1800, outputTokens: 350, toolCallCount: 3 });
+        const report = await analyzeProjectContextImpact({ dir });
+        expect(report.flagOff.avgInputTokens).toBe(1500);
+        expect(report.flagOff.avgOutputTokens).toBe(300);
+        expect(report.flagOff.avgToolCalls).toBe(3);
+        expect(report.flagOn.avgInputTokens).toBe(1500);
+        expect(report.flagOn.avgOutputTokens).toBe(300);
+        expect(report.flagOn.avgToolCalls).toBe(2);
+    });
+    it('computes error-tool rate as fraction of sessions with at least one error', async () => {
+        await writeSession({ id: 'clean1', flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 2, hadErrorTool: false });
+        await writeSession({ id: 'err1', flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 2, hadErrorTool: true });
+        await writeSession({ id: 'err2', flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 2, hadErrorTool: true });
+        const report = await analyzeProjectContextImpact({ dir });
+        // 2 of 3 sessions had at least one error → 0.667 (rounded to 3 places).
+        expect(report.flagOff.errorToolRate).toBeCloseTo(0.667, 2);
+    });
+    it('returns top 5 skills sorted by frequency', async () => {
+        for (let i = 0; i < 3; i++)
+            await writeSession({ id: `cca${i}`, flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 1, skill: 'abap-cca' });
+        for (let i = 0; i < 2; i++)
+            await writeSession({ id: `rev${i}`, flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 1, skill: 'abap-review' });
+        await writeSession({ id: 'mod', flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 1, skill: 'abap-modernize' });
+        const report = await analyzeProjectContextImpact({ dir });
+        expect(report.flagOff.topSkills[0]).toEqual({ skill: 'abap-cca', n: 3 });
+        expect(report.flagOff.topSkills[1]).toEqual({ skill: 'abap-review', n: 2 });
+        expect(report.flagOff.topSkills[2]).toEqual({ skill: 'abap-modernize', n: 1 });
+    });
+});
+describe('analyzeProjectContextImpact — fault tolerance + filtering', () => {
+    it('skips malformed JSON files and reports them in skippedSessions', async () => {
+        await writeSession({ id: 'good', flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 1 });
+        await fs.writeFile(path.join(dir, 'broken.json'), '{ not json', 'utf-8');
+        const report = await analyzeProjectContextImpact({ dir });
+        expect(report.totalSessions).toBe(1);
+        expect(report.skippedSessions).toBe(1);
+    });
+    it('--since cutoff excludes sessions older than the date', async () => {
+        await writeSession({ id: 'old', flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 1, startedAt: '2024-01-01T00:00:00Z' });
+        await writeSession({ id: 'new', flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 1, startedAt: '2026-04-01T00:00:00Z' });
+        const report = await analyzeProjectContextImpact({ dir, since: '2026-01-01' });
+        expect(report.totalSessions).toBe(1);
+    });
+});
+describe('renderImpactReport', () => {
+    it('renders an empty-bucket message when one side has no sessions', async () => {
+        await writeSession({ id: 'only', flagOn: false, inputTokens: 100, outputTokens: 50, toolCallCount: 1 });
+        const report = await analyzeProjectContextImpact({ dir });
+        const text = renderImpactReport(report);
+        expect(text).toContain('Need at least one session in each bucket');
+    });
+    it('renders a comparison table when both buckets have sessions', async () => {
+        await writeSession({ id: 'off', flagOn: false, inputTokens: 1000, outputTokens: 200, toolCallCount: 3 });
+        await writeSession({ id: 'on', flagOn: true, inputTokens: 1500, outputTokens: 250, toolCallCount: 2 });
+        const report = await analyzeProjectContextImpact({ dir });
+        const text = renderImpactReport(report);
+        expect(text).toContain('Per-session averages');
+        expect(text).toContain('input tokens');
+        expect(text).toContain('tool calls');
+        expect(text).toContain('Top skills');
+    });
+});

package/dist/commands/__tests__/spec-gap-status.test.js

@@ -0,0 +1,31 @@
+import { describe, it, expect, vi } from 'vitest';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runSpecGapStatus } from '../spec-gap-status.js';
+import { buildEnvelope } from '../../projects/build.js';
+describe('runSpecGapStatus', () => {
+    it('reads files and prints summary', async () => {
+        const tmp = mkdtempSync(join(tmpdir(), 'cspeach-cmd-'));
+        try {
+            const env = buildEnvelope({
+                artefactType: 'spec-gap',
+                extract: { title: 'Test', content: { inputType: 'User Story', inferredDomain: 'X', sections: [] }, items: [] },
+                author: { name: 'L', role: 'consultant' },
+                source: { skill: 'abap-spec-gap', skillVersion: '1.0', input: '', tokensUsed: 0, model: 'm' },
+            });
+            const path = join(tmp, 'a.cspeach.json');
+            writeFileSync(path, JSON.stringify(env));
+            const log = vi.fn();
+            await runSpecGapStatus({ files: [path], log });
+            expect(log.mock.calls.flat().join('\n')).toContain('Test — spec-gap');
+        }
+        finally {
+            rmSync(tmp, { recursive: true, force: true });
+        }
+    });
+    it('errors gracefully on missing file', async () => {
+        const log = vi.fn();
+        await expect(runSpecGapStatus({ files: ['/does/not/exist.cspeach.json'], log })).rejects.toThrow();
+    });
+});

package/dist/commands/__tests__/whoami.test.js

@@ -0,0 +1,91 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { promises as fs } from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { runWhoamiCommand } from '../whoami.js';
+import { __setAuthFilePathForTests, writeAuthFile } from '../../auth/auth-file.js';
+const { fetchMock } = vi.hoisted(() => ({ fetchMock: vi.fn() }));
+vi.stubGlobal('fetch', fetchMock);
+let dir;
+let authPath;
+beforeEach(async () => {
+    fetchMock.mockReset();
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), 'cspeach-whoami-'));
+    authPath = path.join(dir, 'auth.json');
+    __setAuthFilePathForTests(authPath);
+});
+afterEach(async () => {
+    __setAuthFilePathForTests(null);
+    await fs.rm(dir, { recursive: true, force: true });
+});
+describe('cspeach whoami', () => {
+    it('returns 0 + prints "Not signed in" message when no auth file', async () => {
+        const lines = [];
+        const result = await runWhoamiCommand({
+            proxyUrl: 'https://api.cspeach.dev',
+            print: (s) => lines.push(s),
+        });
+        expect(result).toBe(0);
+        expect(lines.some((l) => /Not signed in/i.test(l))).toBe(true);
+    });
+    it('returns 0 + prints email/plan/trial when /v1/me succeeds', async () => {
+        await writeAuthFile({ apiKey: 'csp_live_x', customerId: 'c-1', byokAnthropicKey: null });
+        fetchMock.mockResolvedValueOnce(new Response(JSON.stringify({
+            email: 'alice@acme.com', company: 'Acme', plan: 'trial-managed',
+            trial_mode: 'managed-capped', trial_ends_at: '2099-01-01T00:00:00Z',
+            trial_token_cap_input: 200_000, trial_token_cap_output: 50_000,
+            usage_input_tokens: 47_000, usage_output_tokens: 8_000,
+            entitlements: { enabled_skills: [], agent_mode: 'skill', enabled_features: [] },
+        }), { status: 200 }));
+        const lines = [];
+        const result = await runWhoamiCommand({
+            proxyUrl: 'https://api.cspeach.dev',
+            print: (s) => lines.push(s),
+        });
+        expect(result).toBe(0);
+        expect(lines.some((l) => /alice@acme\.com/.test(l))).toBe(true);
+        expect(lines.some((l) => /trial-managed/.test(l))).toBe(true);
+        expect(lines.some((l) => /managed-capped/.test(l))).toBe(true);
+        expect(lines.some((l) => /47000.*200000/.test(l))).toBe(true);
+    });
+    it('returns 1 + prints "/v1/me returned 401" when auth file present but stale', async () => {
+        await writeAuthFile({ apiKey: 'csp_live_stale', customerId: 'c-1', byokAnthropicKey: null });
+        fetchMock.mockResolvedValueOnce(new Response('{"error":"invalid_api_key"}', { status: 401 }));
+        const lines = [];
+        const result = await runWhoamiCommand({
+            proxyUrl: 'https://api.cspeach.dev',
+            print: (s) => lines.push(s),
+        });
+        expect(result).toBe(1);
+        expect(lines.some((l) => /401/.test(l))).toBe(true);
+        expect(lines.some((l) => /cspeach login/.test(l))).toBe(true);
+    });
+    it('includes skills line only when enabled_skills is non-empty', async () => {
+        await writeAuthFile({ apiKey: 'csp_live_x', customerId: 'c-1', byokAnthropicKey: null });
+        // First call: empty skills → no Skills: line.
+        fetchMock.mockResolvedValueOnce(new Response(JSON.stringify({
+            email: 'a@b.com', company: null, plan: 'solo',
+            trial_mode: null, trial_ends_at: null,
+            trial_token_cap_input: null, trial_token_cap_output: null,
+            usage_input_tokens: 0, usage_output_tokens: 0,
+            entitlements: { enabled_skills: [], agent_mode: 'skill', enabled_features: [] },
+        }), { status: 200 }));
+        const linesEmpty = [];
+        await runWhoamiCommand({ proxyUrl: 'https://api.cspeach.dev', print: (s) => linesEmpty.push(s) });
+        expect(linesEmpty.some((l) => /^Skills:/.test(l))).toBe(false);
+        // Second call: non-empty skills → Skills: line present.
+        fetchMock.mockResolvedValueOnce(new Response(JSON.stringify({
+            email: 'a@b.com', company: null, plan: 'solo',
+            trial_mode: null, trial_ends_at: null,
+            trial_token_cap_input: null, trial_token_cap_output: null,
+            usage_input_tokens: 0, usage_output_tokens: 0,
+            entitlements: { enabled_skills: ['abap-cca', 'abap-radar'], agent_mode: 'skill', enabled_features: [] },
+        }), { status: 200 }));
+        const linesFull = [];
+        await runWhoamiCommand({ proxyUrl: 'https://api.cspeach.dev', print: (s) => linesFull.push(s) });
+        const skillsLine = linesFull.find((l) => /^Skills:/.test(l));
+        expect(skillsLine).toBeTruthy();
+        expect(skillsLine).toMatch(/abap-cca/);
+        expect(skillsLine).toMatch(/abap-radar/);
+    });
+});

package/dist/config/__tests__/llm-config.test.js

@@ -0,0 +1,28 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+const pathsHolder = { tmpHome: '' };
+vi.mock('../paths.js', () => ({
+    cspeachRoot: () => pathsHolder.tmpHome,
+    configFile: () => path.join(pathsHolder.tmpHome, 'config.toml'),
+}));
+const { loadConfig } = await import('../loader.js');
+describe('CspeachConfig.llm', () => {
+    beforeEach(async () => {
+        pathsHolder.tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), 'cspeach-test-'));
+    });
+    afterEach(async () => {
+        await fs.rm(pathsHolder.tmpHome, { recursive: true, force: true });
+    });
+    it('defaults to mode=managed', async () => {
+        const cfg = await loadConfig();
+        expect(cfg.llm.mode).toBe('managed');
+    });
+    it('accepts mode values: managed, byok, ai-hub, local', () => {
+        const valid = [
+            'managed', 'byok', 'ai-hub', 'local',
+        ];
+        expect(valid.length).toBe(4);
+    });
+});

package/dist/config/__tests__/shell-exec-config.test.js

@@ -0,0 +1,76 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { promises as fs } from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+let tempHome;
+let origHome;
+let origUserProfile;
+beforeEach(async () => {
+    tempHome = await fs.mkdtemp(path.join(os.tmpdir(), 'cspeach-shell-cfg-'));
+    origHome = process.env.HOME;
+    origUserProfile = process.env.USERPROFILE;
+    process.env.HOME = tempHome;
+    if (process.platform === 'win32')
+        process.env.USERPROFILE = tempHome;
+    vi.resetModules();
+});
+afterEach(async () => {
+    if (origHome === undefined)
+        delete process.env.HOME;
+    else
+        process.env.HOME = origHome;
+    if (process.platform === 'win32') {
+        if (origUserProfile === undefined)
+            delete process.env.USERPROFILE;
+        else
+            process.env.USERPROFILE = origUserProfile;
+    }
+    await fs.rm(tempHome, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
+});
+describe('CspeachConfig — shell_exec block', () => {
+    it('loads an empty shell_exec block as undefined when config file is missing', async () => {
+        const { loadConfig } = await import('../loader.js');
+        const cfg = await loadConfig();
+        expect(cfg.shell_exec).toBeUndefined();
+    });
+    it('parses shell_exec.allow as a string array', async () => {
+        const cspeachDir = path.join(tempHome, '.cspeach');
+        await fs.mkdir(cspeachDir, { recursive: true });
+        await fs.writeFile(path.join(cspeachDir, 'config.toml'), `[shell_exec]\nallow = ["docker", "make"]\n`, 'utf-8');
+        const { loadConfig } = await import('../loader.js');
+        const cfg = await loadConfig();
+        expect(cfg.shell_exec?.allow).toEqual(['docker', 'make']);
+    });
+    it('treats shell_exec block as optional — empty TOML leaves it undefined', async () => {
+        const cspeachDir = path.join(tempHome, '.cspeach');
+        await fs.mkdir(cspeachDir, { recursive: true });
+        await fs.writeFile(path.join(cspeachDir, 'config.toml'), `default_model = "claude-opus-4-7"\n`, 'utf-8');
+        const { loadConfig } = await import('../loader.js');
+        const cfg = await loadConfig();
+        expect(cfg.shell_exec).toBeUndefined();
+    });
+    it('coerces non-array allow values to empty array (defensive)', async () => {
+        const cspeachDir = path.join(tempHome, '.cspeach');
+        await fs.mkdir(cspeachDir, { recursive: true });
+        await fs.writeFile(path.join(cspeachDir, 'config.toml'), `[shell_exec]\nallow = "docker"\n`, 'utf-8');
+        const { loadConfig } = await import('../loader.js');
+        const cfg = await loadConfig();
+        expect(cfg.shell_exec?.allow).toEqual([]);
+    });
+    it('rejects when allow contains a mixed-type TOML array (@iarna/toml throws at parse time)', async () => {
+        // @iarna/toml enforces strict single-type inline arrays — ["docker", 42, "make"] is
+        // a TomlError at parse time, before our sanitiser ever runs. loadConfig re-throws
+        // (only ENOENT is silently absorbed). The runtime filter in loadConfig (Array.isArray
+        // + typeof === 'string' guard) is dead-code as far as TOML inputs go — it only fires
+        // if a non-TOML caller passes a hand-built Partial<CspeachConfig>. We assert the
+        // throw here so a corrupt config.toml surfaces as a startup error rather than
+        // silently producing garbage.
+        const cspeachDir = path.join(tempHome, '.cspeach');
+        await fs.mkdir(cspeachDir, { recursive: true });
+        await fs.writeFile(path.join(cspeachDir, 'config.toml'), `[shell_exec]\nallow = ["docker", 42, "make"]\n`, 'utf-8');
+        const { loadConfig } = await import('../loader.js');
+        // @iarna/toml throws on mixed-type inline arrays; loadConfig should re-throw
+        // (non-ENOENT errors bubble up — user has a corrupt config.toml).
+        await expect(loadConfig()).rejects.toThrow();
+    });
+});

package/dist/config/__tests__/write-mode.test.js

@@ -0,0 +1,36 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+// paths.ts offers no env-var override, so mock it: each test sets `tmpHome`
+// and the mocked configFile() resolves to tmpHome/config.toml. Using a
+// mutable holder keeps the mock stable while letting each test point at a
+// fresh temp directory.
+const pathsHolder = { tmpHome: '' };
+vi.mock('../paths.js', () => ({
+    cspeachRoot: () => pathsHolder.tmpHome,
+    configFile: () => path.join(pathsHolder.tmpHome, 'config.toml'),
+}));
+const { loadConfig } = await import('../loader.js');
+describe('write_mode in CspeachConfig', () => {
+    beforeEach(async () => {
+        pathsHolder.tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), 'cspeach-test-'));
+    });
+    afterEach(async () => {
+        await fs.rm(pathsHolder.tmpHome, { recursive: true, force: true });
+    });
+    it('defaults to approval-gated when no config file exists', async () => {
+        const cfg = await loadConfig();
+        expect(cfg.write_mode).toBe('approval-gated');
+    });
+    it('accepts a valid value from disk', async () => {
+        await fs.writeFile(path.join(pathsHolder.tmpHome, 'config.toml'), 'write_mode = "advisory-only"\n');
+        const cfg = await loadConfig();
+        expect(cfg.write_mode).toBe('advisory-only');
+    });
+    it('falls back to default when disk value is not one of the three literals', async () => {
+        await fs.writeFile(path.join(pathsHolder.tmpHome, 'config.toml'), 'write_mode = "yolo"\n');
+        const cfg = await loadConfig();
+        expect(cfg.write_mode).toBe('approval-gated');
+    });
+});