@cspeach/cli 0.8.0 → 1.0.0

package/dist/agent/steering-queue.js

@@ -0,0 +1,27 @@
+/**
+ * Mid-turn steering queue (2026-06-08).
+ *
+ * While a turn is in flight the user can type a correction and press Enter;
+ * the Footer enqueues it here instead of bouncing it. The agent loop drains
+ * this at each round boundary and injects the text as a user message before
+ * the next createStream, so the model reads the correction and adapts —
+ * CC-style "type any time". Module-level singleton, mirroring the
+ * pendingDispatch accessor pattern; there is exactly one interactive REPL
+ * turn loop at a time.
+ */
+const queue = [];
+/** Add a steer. Trims; ignores empty / whitespace-only input. */
+export function enqueueSteering(text) {
+    const t = text.trim();
+    if (t.length === 0)
+        return;
+    queue.push(t);
+}
+/** Return all queued steers (FIFO) and clear the queue. */
+export function drainSteering() {
+    return queue.splice(0, queue.length);
+}
+/** True when at least one steer is queued. */
+export function hasSteering() {
+    return queue.length > 0;
+}

package/dist/agent/tool-dispatch.js

@@ -23,6 +23,21 @@ export async function dispatchTool(name, args, ctx) {
             batch_count: getWriteOpsThisTurn().length + 1,
         });
         if (!r.confirmed) {
+            // B5 — discriminate WHO declined. A headless fail-fast (nobody ever
+            // saw the card) must not masquerade as a user decision: the model
+            // (and any transcript reader) reacts differently to "the user said
+            // no" vs "no user was available to say yes". Uniform `headless: true`
+            // marker matches the other headless result payloads.
+            if (r.headless) {
+                return {
+                    content: JSON.stringify({
+                        error: 'headless_safety_decline',
+                        headless: true,
+                        reason: r.reason,
+                    }),
+                    is_error: true,
+                };
+            }
             return {
                 content: JSON.stringify({ error: 'cancelled_by_user', reason: r.reason }),
                 is_error: true,

package/dist/approvals/canonical.js

@@ -0,0 +1,91 @@
+/**
+ * Canonical approval-object strings (Task A3 — defects D17/D21/D28).
+ *
+ * The battery exposed an APPROVAL_INVALID:object_mismatch epidemic (~8 wasted
+ * approval round-trips): request_approval minted whatever free-text object
+ * string the model wrote in the change row, while every write tool validated
+ * against a structured argument (args.name / args.className / args.description
+ * / objects[0].name). Any decoration the model added at mint time — and models
+ * reliably add decoration — broke the byte-equality check in
+ * verifyAndSpendApprovalId.
+ *
+ * Observed mismatch classes (exact strings from the battery sessions):
+ *   D17  "ZBP_I_DOWNTIMELOG (CCIMP / lhc_DowntimeLog.validateEndAfterStart)"
+ *        vs "ZBP_I_DOWNTIMELOG"               → trailing parenthetical
+ *   D21  "Transport: Magic fix" vs "Magic fix" → leading transport label
+ *   D28  "ZR_PM_MAINTREQ,ZBP_R_PM_MAINTREQ,…" vs "ZR_PM_MAINTREQ"
+ *        → one batch activate approval, per-object activate calls
+ *
+ * The fix is ONE code path for both sides:
+ *   - mint side (jwt.ts#mintChangeApproval, used by request_approval) stores
+ *     canonicalApprovalObject(change.object) in the JWT;
+ *   - spend side (jwt.ts#verifyAndSpendApprovalId) compares via
+ *     approvalObjectMatches, which canonicalizes BOTH the JWT payload object
+ *     and the tool's expected object before comparing.
+ * The spend side canonicalizes too because (a) the expected side is always the
+ * raw structured tool argument, never pre-canonicalized, and (b) it is
+ * defense-in-depth against any future mint site that bypasses
+ * mintChangeApproval and stores a raw string.
+ */
+/** Leading transport-request labels the model prepends to CTS descriptions. */
+const LEADING_LABEL = /^(?:transport(?:\s+request)?|tr|cts|request)\s*:\s*/i;
+/** A trailing parenthetical decoration, e.g. "(testclasses include)". */
+const TRAILING_PAREN = /\s*\([^()]*\)\s*$/;
+/** What an ABAP repository object name looks like once canonicalized. */
+const OBJECT_NAME = /^[A-Z0-9_/]+$/;
+/**
+ * Normalize an approval object string so mint and spend sides can never
+ * disagree on decoration, case, or whitespace:
+ *
+ *   1. trim
+ *   2. strip a leading "Transport:" / "TR:" / "Request:" label (D21)
+ *   3. strip trailing parenthetical decorations, stacked or single (D17)
+ *   4. collapse internal whitespace
+ *   5. uppercase
+ *
+ * All steps are applied symmetrically to both sides. Note that step 3 strips
+ * trailing parentheticals from free text too: transport descriptions
+ * "Fix dump (urgent)" and "Fix dump (rollback)" both canonicalize to
+ * "FIX DUMP" and therefore cross-match. This collision class is accepted
+ * because descriptions are display labels, not object identities, and every
+ * approval is session-scoped, TTL-bounded, and user-confirmed — the user saw
+ * the specific change row that minted the JWT.
+ */
+export function canonicalApprovalObject(raw) {
+    let s = String(raw ?? '').trim();
+    s = s.replace(LEADING_LABEL, '');
+    for (let prev = ''; prev !== s;) {
+        prev = s;
+        s = s.replace(TRAILING_PAREN, '');
+    }
+    return s.replace(/\s+/g, ' ').trim().toUpperCase();
+}
+/**
+ * Spend-side comparison: does the object string stored in the approval JWT
+ * authorize an operation on `expected` (the structured argument the write
+ * tool validates against)? Returns the match kind, or `false` for no match.
+ *
+ *   - byte equality ('exact'), OR
+ *   - canonical equality ('canonical'), OR
+ *   - the minted string is a comma-joined list of ABAP object names and
+ *     `expected` is one of them ('list_member', D28 — batch activate approval
+ *     spent by per-object sap_activate calls).
+ *
+ * The list rule only applies when EVERY part looks like an object name
+ * (no spaces / free text), so a transport description containing commas can
+ * never partially match.
+ */
+export function approvalObjectMatches(minted, expected) {
+    if (minted === expected)
+        return 'exact';
+    const m = canonicalApprovalObject(minted);
+    const e = canonicalApprovalObject(expected);
+    if (m === e)
+        return 'canonical';
+    const parts = m.split(',').map((p) => p.trim()).filter((p) => p.length > 0);
+    if (parts.length < 2)
+        return false;
+    if (!parts.every((p) => OBJECT_NAME.test(p)))
+        return false;
+    return parts.includes(e) ? 'list_member' : false;
+}

package/dist/approvals/jwt.js

@@ -1,16 +1,68 @@
 import { SignJWT, jwtVerify } from 'jose';
 import crypto from 'node:crypto';
+import { auditLog } from '@cspeach/sap-client';
+import { canonicalApprovalObject, approvalObjectMatches } from './canonical.js';
 // Session-scoped HMAC key — generated per CLI start, never persisted.
 const sessionKey = crypto.randomBytes(32);
 const usedNonces = new Set();
+/**
+ * Op-group coverage. An approval the user granted for one op also authorizes
+ * the natural follow-on ops that *complete* it, on the SAME object:
+ *
+ *   - approving `create` covers create → modify (source write) → activate,
+ *     because creating a DDIC/repo object via ADT is always shell → source →
+ *     activate. One user "yes" to "create ZPM_DT_REASON", not three.
+ *   - approving `modify` covers modify → activate (write then activate).
+ *   - `delete` / `release` stay single-op (and single-use) — one-shot ops the
+ *     user must approve explicitly each time.
+ *
+ * This removes the op_mismatch APPROVAL_INVALID storm (create approval used,
+ * then set_source rejected because it's a different op) without weakening the
+ * invariant that an approval only ever authorizes ITS object, within TTL.
+ */
+const OP_COVERAGE = {
+    create: new Set(['create', 'modify', 'activate']),
+    modify: new Set(['modify', 'activate']),
+    delete: new Set(['delete']),
+    activate: new Set(['activate']),
+    release: new Set(['release']),
+};
+/** create/modify approvals are reusable across their object's lifecycle ops
+ *  until TTL; delete/release are genuinely one-shot. */
+function isOneShotOp(op) {
+    return op === 'delete' || op === 'release';
+}
 export async function mintApprovalId(payload) {
     const nonce = crypto.randomBytes(16).toString('hex');
     return new SignJWT({ ...payload, nonce })
         .setProtectedHeader({ alg: 'HS256' })
         .setIssuedAt()
-        .setExpirationTime('5m')
+        // 30m, was 5m. A single build phase (DDIC batch + RAP stack) runs many
+        // rounds over a slow VPN; the one-write-per-round guard stretches it well
+        // past 5m, which expired approvals mid-phase and forced re-prompts. The
+        // key is session-scoped (regenerated per CLI start) and every approval is
+        // object+op-group bounded, so a longer in-turn window is safe.
+        .setExpirationTime('30m')
         .sign(sessionKey);
 }
+/**
+ * THE minting path for request_approval changes (Task A3 — D17/D21/D28).
+ *
+ * The object string stored in the JWT is canonicalized by the same helper the
+ * spend-side comparison in verifyAndSpendApprovalId uses, so mint and spend
+ * can never disagree on decoration ("Transport: …", "(testclasses include)"),
+ * case, or whitespace. request_approval and any future minting site MUST go
+ * through this function instead of calling mintApprovalId with a free-text
+ * object string.
+ */
+export async function mintChangeApproval(change, sessionId) {
+    return mintApprovalId({
+        object: canonicalApprovalObject(change.object),
+        type: change.type,
+        op: change.op,
+        session_id: sessionId,
+    });
+}
 export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp) {
     // 2026-05-15 (bug 7): the previous catch lumped EVERY thrown failure
     // into `'invalid_signature'`, including expirations (which used to be
@@ -43,12 +95,37 @@ export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp)
         // taxonomy short. Mismatch / spent-nonce paths NEVER reach this catch.
         return { ok: false, reason: 'invalid_signature' };
     }
-    if (usedNonces.has(payload.nonce))
-        return { ok: false, reason: 'nonce_spent' };
-    if (payload.object !== expectedObject)
+    // Canonical comparison (Task A3 — D17/D21/D28): both sides are normalized
+    // by the same helper that mintChangeApproval used at mint time, and a
+    // comma-joined batch approval matches each of its member objects. The spend
+    // side canonicalizes as well because (a) `expectedObject` is always the raw
+    // structured tool argument, never pre-canonicalized, and (b) it is
+    // defense-in-depth against any future mint site that bypasses
+    // mintChangeApproval and stores a raw string. (It is NOT back-compat for
+    // old JWTs: the HMAC key is per-process and never persisted, so no
+    // pre-canonicalization token can ever reach this verifier.)
+    const matchKind = approvalObjectMatches(payload.object, expectedObject);
+    if (!matchKind) {
         return { ok: false, reason: 'object_mismatch' };
-    if (payload.op !== expectedOp)
+    }
+    // Op-group coverage: a create approval also authorizes the modify+activate
+    // that complete the create; a modify approval authorizes its activate.
+    const covered = OP_COVERAGE[payload.op];
+    if (!covered || !covered.has(expectedOp))
         return { ok: false, reason: 'op_mismatch' };
-    usedNonces.add(payload.nonce);
-    return { ok: true, payload };
+    // Single-use only for one-shot destructive ops. create/modify approvals are
+    // reusable for their object's lifecycle ops (create→modify→activate) within
+    // TTL — that IS the change the user approved, so re-spending is not replay.
+    if (isOneShotOp(payload.op)) {
+        if (usedNonces.has(payload.nonce))
+            return { ok: false, reason: 'nonce_spent' };
+        usedNonces.add(payload.nonce);
+    }
+    // Auditability: a lenient (non-byte-equal) match is an authorization
+    // decision worth a trace — record WHICH fold let the spend through, in the
+    // same audit log the write tools use.
+    if (matchKind !== 'exact') {
+        await auditLog('approvalSpend', payload.type, expectedObject, 'success', 0, `matchKind=${matchKind} minted="${payload.object}"`);
+    }
+    return { ok: true, payload, matchKind };
 }

package/dist/approvals/render.js

@@ -2,6 +2,7 @@ import { select, input } from '@inquirer/prompts';
 import chalk from 'chalk';
 import { shouldUseInk } from '../renderer/tty.js';
 import { approvalEmitter } from '../ui/approval-emitter.js';
+import { askQuestionEmitter } from '../ui/ask-question-emitter.js';
 import { withInquirer } from '../repl/inquirer-guard.js';
 import { inquirerTheme } from '../repl/inquirer-theme.js';
 import { PEACH } from '../renderer/banners.js';
@@ -102,6 +103,43 @@ export async function renderPlanGate(summary, changes, transport, effectiveRisk)
     const visibleChanges = collapseImplicitActivates(changes);
     const visibleCount = visibleChanges.length;
     const noun = visibleCount === 1 ? 'change' : 'changes';
+    // Ink path (default): route the gate through the ask_question choice modal so
+    // it renders INSIDE the React frame. The prior inquirer select drew raw to
+    // stdout while Ink owned the terminal — it toggled raw mode out from under
+    // Ink and competed with the Footer for keystrokes (the "turn in progress —
+    // input kept in box" confusion, and dead arrow keys on the modal that
+    // followed). One input system = no handoff, no competition. Mirrors
+    // renderPerChangeApprovalV3, which already went Ink-native via approvalEmitter.
+    if (shouldUseInk()) {
+        const ctx = [
+            summary,
+            [`${visibleCount} ${noun}`, riskTag(effectiveRisk.level), transport ? `transport ${transport}` : '']
+                .filter(Boolean).join(' · '),
+        ];
+        if (effectiveRisk.raisedBy.length > 0) {
+            ctx.push(`(raised from low: ${effectiveRisk.raisedBy.join(', ')})`);
+        }
+        for (const c of visibleChanges)
+            ctx.push(`  ${opIcon(c.op)} ${c.object} (${c.type})`);
+        const result = await askQuestionEmitter.request({
+            id: 'plan-gate',
+            question: 'Apply this plan?',
+            // Strip chalk ANSI from opIcon/riskTag — the Ink modal renders `context`
+            // itself (dimColor), so embedded escape codes would show as raw text.
+            context: ctx.join('\n').replace(/\x1b\[[0-9;]*m/g, ''),
+            kind: 'choice',
+            choices: [
+                { value: 'apply_all', label: `Apply all ${visibleCount} ${noun}` },
+                { value: 'review', label: 'Review each change individually' },
+                { value: 'cancel', label: 'Cancel' },
+            ],
+        });
+        if (result.answer === 'apply_all' || result.answer === 'review' || result.answer === 'cancel') {
+            return result.answer;
+        }
+        return 'cancel'; // Esc / no answer → cancel the plan (safe default)
+    }
+    // Non-Ink (one-shot / non-TTY / classic): the original inquirer flow.
     console.log('');
     console.log(`${peach('Plan')}  ${summary}`);
     const meta = [`${visibleCount} ${noun}`, riskTag(effectiveRisk.level)];

package/dist/auth/org-anthropic-key.js

@@ -0,0 +1,25 @@
+/**
+ * Fetch the organisation's Anthropic API key from the CSPeach proxy.
+ *
+ * Returns the key string on success, or null on any failure.
+ * Non-fatal by design — callers must fall back to the manual prompt when null
+ * is returned. The key is NEVER logged.
+ */
+export async function fetchOrgAnthropicKey(proxyUrl, bearer, deps) {
+    const fetchFn = deps?.fetchImpl ?? fetch;
+    const url = `${proxyUrl.replace(/\/$/, '')}/v1/me/anthropic-key`;
+    try {
+        const r = await fetchFn(url, {
+            headers: { Authorization: `Bearer ${bearer}` },
+        });
+        if (!r.ok)
+            return null;
+        const body = await r.json();
+        if (typeof body.key === 'string' && body.key.length > 0)
+            return body.key;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/classifier/client.js

@@ -8,8 +8,10 @@ const RULES = [
     { skill: 'abap-document', patterns: [/developer\s+documentation|document\s+this\s+(class|program|object)/i] },
     // abap-incident MUST precede dump rules — pipeline framing beats keyword-only matches
     { skill: 'abap-incident', patterns: [/incident|resolve.*dump.*to.*fix|pipeline.*(short\s+dump|st22|dump)|(dump|st22).*to.*transport|formal\s+(incident|dump)\s+report|end.to.end.*dump/i] },
-    { skill: 'abap-dump-triage', patterns: [/dump\s+triage|structured\s+investigation.*dump|dump\s+forensic/i] },
-    { skill: 'abap-dump-analyze', patterns: [/short\s+dump|runtime\s+error|\bst22\b|dump\s+analys/i] },
+    // abap-dump (2026-06-12) — merger of abap-dump-analyze + abap-dump-triage.
+    // Triage-vs-fix is an intent decision INSIDE the skill now, so both
+    // pattern sets route here.
+    { skill: 'abap-dump', patterns: [/short\s+dump|runtime\s+error|\bst22\b|dump\s+(analys|triage|forensic)|structured\s+investigation.*dump/i] },
     { skill: 'abap-eml', patterns: [/\beml\b|entity\s+manipulation|behavior\s+handler/i] },
     { skill: 'abap-enhance', patterns: [/\bbadi\b|enhancement\s+spot|implicit\s+enhancement|customer\s+exit|user\s+exit|(hook\s+into|extend)\s+(sap|standard|me\d+|migo|miro|va\d+|vf\d+|vl\d+|fb\d+)/i] },
     { skill: 'abap-estimate', patterns: [/effort\s+estimat|ticket\s+estimat|size\s+this\s+(work|task|ticket|story)|how\s+(many|long).*(hours|days).*(build|develop|implement)/i] },
@@ -20,11 +22,24 @@ const RULES = [
     // abap-modernize MUST precede abap-rap so "rebuild as RAP" / "convert to RAP" stays
     // on modernize (rebuild intent) instead of falling to abap-rap's bare \brap\b match.
     { skill: 'abap-modernize', patterns: [/modernise|modernize|classic.*to.*modern|convert.*to\s+(rap|fiori|odata)|rebuild.*as\s+(rap|fiori)/i] },
+    // abap-fiori-build (D12, 2026-06-12) MUST follow abap-modernize ("convert
+    // this WRITE report to Fiori" = rebuild intent) and precede abap-rap so
+    // "fiori app for my RAP/OData service" lands on the UI skill, not the
+    // backend scaffolder.
+    { skill: 'abap-fiori-build', patterns: [/\bfiori\b|\b(sap)?ui5\b|freestyle\s+app|\bui\s+app\b|front.?end\s+(for|on)\s/i] },
     // abap-rap MUST precede abap-generate so RAP-stack prompts route to rap, not the
     // generic generator (cluster I, 2026-05-03). Also captures "scaffold a CDS view +
     // BDEF + service binding" type prompts which collide with abap-generate.
     { skill: 'abap-rap', patterns: [/\brap\b|business\s+object(?!s?\s+for)|bdef|service\s+binding|srvb|scaffold.*(cds|odata\s+v4|bdef|behavior)|odata\s+v4\s+service/i] },
-    { skill: 'abap-generate', patterns: [/\bgenerate\b|create\s+(a\s+)?(new\s+)?(class|program|report|include)|build.*from\s+scratch/i] },
+    // Daily-edit phrasings (D12, 2026-06-12): "add a validation to ZCL_X",
+    // "change/fix ZFOO" are abap-generate work — the old rules only matched
+    // explicit "generate"/"create" verbs, so daily edits fell through and the
+    // coaching picker offered enhance/refactor/test instead.
+    { skill: 'abap-generate', patterns: [
+            /\bgenerate\b|create\s+(a\s+)?(new\s+)?(class|program|report|include)|build.*from\s+scratch/i,
+            /\badd\s+(a\s+|an\s+)?[\w\s-]{1,40}\bto\s+z[_a-z0-9]+/i,
+            /\b(change|fix|update|modify|adjust)\s+(the\s+)?z[_a-z0-9]+\b/i,
+        ] },
     { skill: 'abap-impact', patterns: [/impact\s+analysis|where.*used|what.*affected\s+by/i] },
     // abap-upgrade-* must precede abap-migrate
     { skill: 'abap-upgrade-verify', patterns: [/upgrade\s+verify|remediation\s+report|verify\s+upgrade/i] },
@@ -32,6 +47,10 @@ const RULES = [
     { skill: 'abap-upgrade-scan', patterns: [/upgrade\s+scan|scan.*s\/4|readiness\s+variant/i] },
     { skill: 'abap-migrate', patterns: [/ecc.*migration|migrate.*s\/4|api\s+successor/i] },
     { skill: 'abap-performance', patterns: [/performance|\bn\+1\b|select\s+inside\s+loop|slow\s+(query|select)/i] },
+    // abap-plan (B4, 2026-06-06): deliberately NO bare \bplan\b — "I plan to
+    // refactor X" must keep falling through to the refactor/explain rules.
+    // Multi-session / project-plan framing only; refine after real prompts.
+    { skill: 'abap-plan', patterns: [/project\s+plan|implementation\s+plan|plan\s+(this|the|my)\s+(project|build|development)|multi.session\s+(project|plan|build)|resume\s+(the\s+|my\s+)?plan|step.by.step\s+plan/i] },
     { skill: 'abap-preflight', patterns: [/preflight|pre.release|go\/no.go|release\s+readiness/i] },
     { skill: 'abap-radar', patterns: [/radar|quick\s+look|overview\s+of\s+(this\s+)?(class|program|object)/i] },
     { skill: 'abap-refactor', patterns: [/refactor|clean\s+up\s+(code|abap)|procedural.*to\s+oo/i] },
@@ -42,12 +61,12 @@ const RULES = [
     { skill: 'abap-transport-analysis', patterns: [/transport\s+analysis|pre.release\s+transport|transport\s+readiness/i] },
     { skill: 'abap-transport', patterns: [/transport\s+(create|release|list)|\bcts\b|release.*request/i] },
 ];
-if (RULES.length !== 32) {
+if (RULES.length !== 33) {
     // Warn-not-throw — managed-mode users never exercise classify() (the proxy
     // does server-side classification), so a module-load crash would break
     // them for a local-only consistency check. Unit tests assert the exact
     // count.
-    console.warn(`[classifier] RULES drift: expected 32, got ${RULES.length} — reconcile with .claude/skills/`);
+    console.warn(`[classifier] RULES drift: expected 33, got ${RULES.length} — reconcile with .claude/skills/`);
 }
 export function classify(prompt) {
     for (const rule of RULES) {

package/dist/commands/config-set.js

@@ -10,6 +10,8 @@ const MUTABLE_KEYS = new Set([
     'effort',
     'telemetry',
     'classifier.safe_mode',
+    'local_build',
+    'local_files', // deprecated alias for local_build (2026-06-13) — still accepted
     'write_mode',
     'llm.mode',
     'llm.ai_hub_base_url',
@@ -22,6 +24,25 @@ const MUTABLE_KEYS = new Set([
 ]);
 // SAP-scoped key pattern: sap.<alias>.auto_approve
 const SAP_AUTO_APPROVE_RE = /^sap\.([A-Z0-9_-]{2,32})\.auto_approve$/;
+// SAP-scoped TLS keys: sap.<alias>.ca_cert_path | sap.<alias>.insecure_skip_tls_verify
+const SAP_CA_CERT_PATH_RE = /^sap\.([A-Z0-9_-]{2,32})\.ca_cert_path$/;
+const SAP_INSECURE_TLS_RE = /^sap\.([A-Z0-9_-]{2,32})\.insecure_skip_tls_verify$/;
+/**
+ * Coerce a user-typed on/off-style string to a boolean. Accepts the common
+ * spellings a developer expects from a CLI toggle (`on`/`true`/`1` → true,
+ * `off`/`false`/`0` → false). Returns null for anything else so the caller
+ * can reject with a clear error. Case-insensitive.
+ */
+const TRUE_TOKENS = new Set(['on', 'true', '1']);
+const FALSE_TOKENS = new Set(['off', 'false', '0']);
+function coerceBool(value) {
+    const v = value.trim().toLowerCase();
+    if (TRUE_TOKENS.has(v))
+        return true;
+    if (FALSE_TOKENS.has(v))
+        return false;
+    return null;
+}
 const EFFORT_VALUES = ['low', 'medium', 'high', 'xhigh', 'max'];
 const TELEMETRY_VALUES = ['minimal', 'full'];
 const AUTO_APPROVE_VALUES = ['never', 'low', 'medium'];
@@ -73,6 +94,45 @@ export async function runConfigSet(args) {
         console.log(chalk.green(`Set ${key} = ${value}`));
         return;
     }
+    // SAP-scoped TLS: sap.<alias>.ca_cert_path — trust a CA, verification STAYS ON.
+    const caMatch = SAP_CA_CERT_PATH_RE.exec(key);
+    if (caMatch) {
+        const alias = caMatch[1];
+        const cfg = await loadConfig();
+        if (!cfg.sap[alias]) {
+            err(`SAP system "${alias}" not found in config. Add it first with: cspeach config add-sap`);
+        }
+        // Path is stored as-is (no existence check here — the connection fails loudly
+        // and fail-closed if the CA can't be read at connect time). Setting a CA also
+        // clears any insecure flag so the two never conflict.
+        cfg.sap[alias].ca_cert_path = value;
+        delete cfg.sap[alias].insecure_skip_tls_verify;
+        await saveConfig(cfg);
+        console.log(chalk.green(`Set ${key} = ${value}`));
+        console.log(chalk.dim('  → TLS verification stays ON; this CA is added to the trust store.'));
+        return;
+    }
+    // SAP-scoped TLS: sap.<alias>.insecure_skip_tls_verify — dev-only opt-out.
+    const insecMatch = SAP_INSECURE_TLS_RE.exec(key);
+    if (insecMatch) {
+        const alias = insecMatch[1];
+        const b = coerceBool(value);
+        if (b === null) {
+            err(`${key} must be on/off (also accepts true/false, 1/0).`);
+        }
+        const cfg = await loadConfig();
+        if (!cfg.sap[alias]) {
+            err(`SAP system "${alias}" not found in config. Add it first with: cspeach config add-sap`);
+        }
+        cfg.sap[alias].insecure_skip_tls_verify = b;
+        if (b) {
+            console.log(chalk.yellow(`  ⚠ TLS verification will be DISABLED for ${alias} — dev only, NEVER use in production. ` +
+                `Prefer: cspeach config set sap.${alias}.ca_cert_path <path-to-corporate-CA>`));
+        }
+        await saveConfig(cfg);
+        console.log(chalk.green(`Set ${key} = ${b}`));
+        return;
+    }
     // Virtual keys that store secrets in the OS keychain instead of config.toml.
     if (key === 'llm.byok_key' || key === 'llm.ai_hub_token') {
         // Support stdin piping for secrets: `echo "key" | cspeach config set llm.byok_key -`
@@ -142,6 +202,31 @@ export async function runConfigSet(args) {
             }
             cfg.classifier.safe_mode = value === 'true';
             break;
+        case 'local_files':
+            // Deprecated alias (2026-06-13). Still applied — but it WRITES to the new
+            // `local_build` key so the user's config converges on the new name. The
+            // shared `local_build` case below also DELETES any stale legacy
+            // `local_files` key so it doesn't linger after migration. One-line
+            // deprecation note, then fall through.
+            console.log(chalk.yellow('  → "local_files" is deprecated; use "local_build". Applying to local_build.'));
+        // fallthrough
+        case 'local_build': {
+            const b = coerceBool(value);
+            if (b === null) {
+                err(`${key} must be on/off (also accepts true/false, 1/0).`);
+            }
+            cfg.local_build = b;
+            // Migration hygiene (2026-06-13): whether the user typed `local_build` or
+            // the deprecated `local_files` alias, we write the new key AND drop any
+            // stale legacy `local_files` so it doesn't linger in `config show` after
+            // migration. resolveLocalBuild prefers local_build anyway, but a leftover
+            // legacy key is confusing and could surprise a future reader.
+            delete cfg.local_files;
+            // Config is read at startup; a running session isn't retroactively
+            // changed (the tool override is applied once, before the first turn).
+            console.log(chalk.dim('  → takes effect on the next `cspeach` launch.'));
+            break;
+        }
         case 'write_mode':
             if (!isValidWriteMode(value)) {
                 err(`Invalid value for write_mode. Must be one of: auto, approval-gated, advisory-only`);
@@ -201,6 +286,13 @@ export function validateValue(key, value) {
     if (SAP_AUTO_APPROVE_RE.test(key)) {
         return AUTO_APPROVE_VALUES.includes(value);
     }
+    // SAP-scoped TLS keys.
+    if (SAP_CA_CERT_PATH_RE.test(key)) {
+        return value.length > 0; // any non-empty path; existence checked at connect
+    }
+    if (SAP_INSECURE_TLS_RE.test(key)) {
+        return coerceBool(value) !== null;
+    }
     if (!MUTABLE_KEYS.has(key))
         return false;
     switch (key) {
@@ -220,6 +312,9 @@ export function validateValue(key, value) {
             return TELEMETRY_VALUES.includes(value);
         case 'classifier.safe_mode':
             return value === 'true' || value === 'false';
+        case 'local_build':
+        case 'local_files': // deprecated alias — same on/off coercion
+            return coerceBool(value) !== null;
         case 'write_mode':
             return isValidWriteMode(value);
         case 'llm.mode':

package/dist/commands/login.js

@@ -13,7 +13,11 @@
  * Dependencies (open, print, prompt) are injected so the command is
  * unit-testable without stubbing platform globals.
  */
+import keytar from 'keytar';
 import { writeAuthFile } from '../auth/auth-file.js';
+import { fetchOrgAnthropicKey } from '../auth/org-anthropic-key.js';
+const ANTHROPIC_KEYCHAIN_SERVICE = 'cspeach.anthropic';
+const ANTHROPIC_KEYCHAIN_ACCOUNT = 'api-key';
 export async function runLoginCommand(deps) {
     const proxy = deps.proxyUrl.replace(/\/$/, '');
     const pollInterval = deps.pollIntervalMs ?? 5000;
@@ -92,22 +96,35 @@ export async function runLoginCommand(deps) {
             const me = await r.json();
             deps.print(`✓ Signed in as ${me.email} (${me.plan})`);
             if (me.trial_mode === 'byok' || me.plan === 'byo-key') {
-                deps.print('');
-                deps.print('This account is BYOK — you provide your own Anthropic API key.');
-                deps.print('Get one at https://console.anthropic.com/settings/keys');
-                const ak = (await deps.prompt('Paste your Anthropic API key (sk-ant-...): ')).trim();
-                if (ak.startsWith('sk-ant-') && ak.length > 20) {
-                    // The non-BYOK save above just persisted these exact values,
-                    // so reading them back from disk would be redundant.
-                    await writeAuthFile({
-                        apiKey: polled.api_key,
-                        customerId: polled.customer_id,
-                        byokAnthropicKey: ak,
-                    });
-                    deps.print('✓ Anthropic key saved');
+                // Try to fetch the org's Anthropic key first — non-fatal if unavailable.
+                const orgKey = await fetchOrgAnthropicKey(proxy, polled.api_key, {
+                    fetchImpl: deps.fetchImpl,
+                });
+                const setKey = deps.setKeychainKey ??
+                    ((svc, acct, k) => keytar.setPassword(svc, acct, k));
+                if (orgKey !== null) {
+                    await setKey(ANTHROPIC_KEYCHAIN_SERVICE, ANTHROPIC_KEYCHAIN_ACCOUNT, orgKey);
+                    deps.print('Using your organization\'s Anthropic key.');
                 }
                 else {
-                    deps.print('error: Anthropic key looks malformed (must start with sk-ant-). Skipped — run `cspeach login` again later.');
+                    // Fall back to the manual paste prompt — behaviour unchanged.
+                    deps.print('');
+                    deps.print('This account is BYOK — you provide your own Anthropic API key.');
+                    deps.print('Get one at https://console.anthropic.com/settings/keys');
+                    const ak = (await deps.prompt('Paste your Anthropic API key (sk-ant-...): ')).trim();
+                    if (ak.startsWith('sk-ant-') && ak.length > 20) {
+                        // The non-BYOK save above just persisted these exact values,
+                        // so reading them back from disk would be redundant.
+                        await writeAuthFile({
+                            apiKey: polled.api_key,
+                            customerId: polled.customer_id,
+                            byokAnthropicKey: ak,
+                        });
+                        deps.print('✓ Anthropic key saved');
+                    }
+                    else {
+                        deps.print('error: Anthropic key looks malformed (must start with sk-ant-). Skipped — run `cspeach login` again later.');
+                    }
                 }
             }
         }