@cspeach/cli 0.9.0 → 1.1.0

package/dist/approvals/jwt.js

@@ -1,5 +1,7 @@
 import { SignJWT, jwtVerify } from 'jose';
 import crypto from 'node:crypto';
+import { auditLog } from '@cspeach/sap-client';
+import { canonicalApprovalObject, approvalObjectMatches } from './canonical.js';
 // Session-scoped HMAC key — generated per CLI start, never persisted.
 const sessionKey = crypto.randomBytes(32);
 const usedNonces = new Set();
@@ -43,6 +45,24 @@ export async function mintApprovalId(payload) {
         .setExpirationTime('30m')
         .sign(sessionKey);
 }
+/**
+ * THE minting path for request_approval changes (Task A3 — D17/D21/D28).
+ *
+ * The object string stored in the JWT is canonicalized by the same helper the
+ * spend-side comparison in verifyAndSpendApprovalId uses, so mint and spend
+ * can never disagree on decoration ("Transport: …", "(testclasses include)"),
+ * case, or whitespace. request_approval and any future minting site MUST go
+ * through this function instead of calling mintApprovalId with a free-text
+ * object string.
+ */
+export async function mintChangeApproval(change, sessionId) {
+    return mintApprovalId({
+        object: canonicalApprovalObject(change.object),
+        type: change.type,
+        op: change.op,
+        session_id: sessionId,
+    });
+}
 export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp) {
     // 2026-05-15 (bug 7): the previous catch lumped EVERY thrown failure
     // into `'invalid_signature'`, including expirations (which used to be
@@ -75,8 +95,19 @@ export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp)
         // taxonomy short. Mismatch / spent-nonce paths NEVER reach this catch.
         return { ok: false, reason: 'invalid_signature' };
     }
-    if (payload.object !== expectedObject)
+    // Canonical comparison (Task A3 — D17/D21/D28): both sides are normalized
+    // by the same helper that mintChangeApproval used at mint time, and a
+    // comma-joined batch approval matches each of its member objects. The spend
+    // side canonicalizes as well because (a) `expectedObject` is always the raw
+    // structured tool argument, never pre-canonicalized, and (b) it is
+    // defense-in-depth against any future mint site that bypasses
+    // mintChangeApproval and stores a raw string. (It is NOT back-compat for
+    // old JWTs: the HMAC key is per-process and never persisted, so no
+    // pre-canonicalization token can ever reach this verifier.)
+    const matchKind = approvalObjectMatches(payload.object, expectedObject);
+    if (!matchKind) {
         return { ok: false, reason: 'object_mismatch' };
+    }
     // Op-group coverage: a create approval also authorizes the modify+activate
     // that complete the create; a modify approval authorizes its activate.
     const covered = OP_COVERAGE[payload.op];
@@ -90,5 +121,11 @@ export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp)
             return { ok: false, reason: 'nonce_spent' };
         usedNonces.add(payload.nonce);
     }
-    return { ok: true, payload };
+    // Auditability: a lenient (non-byte-equal) match is an authorization
+    // decision worth a trace — record WHICH fold let the spend through, in the
+    // same audit log the write tools use.
+    if (matchKind !== 'exact') {
+        await auditLog('approvalSpend', payload.type, expectedObject, 'success', 0, `matchKind=${matchKind} minted="${payload.object}"`);
+    }
+    return { ok: true, payload, matchKind };
 }

package/dist/approvals/op-labels.js

@@ -0,0 +1,124 @@
+/**
+ * Human-readable operation + object labels for the approval surfaces.
+ *
+ * Replaces the cryptic op-code glyph (`A`/`M`/`D`/`>`/`^`) the live review
+ * found dishonest and information-poor. Every approval box, plan gate, and
+ * classic prompt now speaks a verb ("Create table ZMNT_NOTE") instead of a
+ * one-letter code where a word belongs.
+ */
+const VERBS = {
+    create: 'Create',
+    modify: 'Change',
+    delete: 'Delete',
+    activate: 'Activate',
+    release: 'Release',
+};
+/**
+ * SAP ADT type codes → plain words. The `type` field is free text supplied by
+ * the model, so an unknown/decorated value (e.g. "testclasses include") falls
+ * through unchanged rather than being mangled.
+ */
+const TYPE_WORDS = {
+    TABL: 'table',
+    CLAS: 'class',
+    INTF: 'interface',
+    PROG: 'program',
+    FUGR: 'function group',
+    DDLS: 'CDS view',
+    DDLX: 'metadata extension',
+    DCLS: 'access control',
+    BDEF: 'behavior definition',
+    SRVD: 'service definition',
+    SRVB: 'service binding',
+    DTEL: 'data element',
+    DOMA: 'domain',
+    STRU: 'structure',
+    TTYP: 'table type',
+    MSAG: 'message class',
+    DEVC: 'package',
+    ENHO: 'enhancement',
+    XSLT: 'transformation',
+    SHLP: 'search help',
+};
+export function humanVerb(op) {
+    return VERBS[op] ?? op.charAt(0).toUpperCase() + op.slice(1);
+}
+export function humanType(type) {
+    if (!type)
+        return '';
+    const key = type.trim().toUpperCase();
+    if (TYPE_WORDS[key])
+        return TYPE_WORDS[key];
+    // Already a word (has a lowercase letter or a space)? use it verbatim.
+    if (/[a-z ]/.test(type))
+        return type;
+    return type.toLowerCase();
+}
+/** e.g. "Create table ZMNT_NOTE", "Change class ZCL_X", "Delete table ZOLD". */
+export function verbLine(change) {
+    return [humanVerb(change.op), humanType(change.type), change.object]
+        .filter(Boolean)
+        .join(' ');
+}
+/**
+ * The transport to DISPLAY on the approval surface for one change — mirrors
+ * how the write tools actually resolve it (traced in sap-write.ts, 2026-07-05
+ * review):
+ *   - create-family (sap_create_object / set_class_include / create_domain /
+ *     create_data_element): `args.transport ?? session current` — so the
+ *     session fallback is honest to show.
+ *   - modify/delete (sap_set_source / sap_update_method / sap_delete_object):
+ *     resolveWriteTransport(args only, + owning-TR override) — NO session
+ *     fallback in the actual write, so we only show a transport the request
+ *     explicitly carries.
+ *   - activate/release: the tools take no transport arg at all — never show
+ *     a Transport segment.
+ * When nothing is resolvable, return undefined and the caller OMITS the
+ * segment — no "new (session)" promise (a $TMP write never creates one).
+ */
+export function displayTransport(op, explicit, session) {
+    switch (op) {
+        case 'create':
+            return explicit ?? session ?? undefined;
+        case 'modify':
+        case 'delete':
+            return explicit;
+        default: // activate / release
+            return undefined;
+    }
+}
+/**
+ * A create/delete "diff" is really a source dump (all-adds, or plain source).
+ * Strip unified-diff scaffolding (hunk + file headers) and the leading +/-
+ * marker so View source shows clean source — no +/- colouring that would
+ * imply a before/after that does not exist for a create. Shared by the Ink
+ * modal's [v] view and the classic prompt's View source branch.
+ */
+export function toSourceLines(content) {
+    return content
+        .split('\n')
+        .filter((l) => !l.startsWith('@@') && !l.startsWith('+++') && !l.startsWith('---'))
+        .map((l) => l.replace(/^[+-] ?/, ''));
+}
+/**
+ * The review key that MATCHES the operation — honesty over a blanket "Show
+ * diff":
+ *   - modify  → [d] Show diff (there IS a before/after to diff)
+ *   - create  → [v] View source, only when the new source is carried
+ *   - delete  → [v] View current source, only when the source is carried
+ *   - activate/release → nothing to review (no source in the payload)
+ */
+export function viewAffordance(change) {
+    switch (change.op) {
+        case 'modify':
+            // Existing behaviour: [d] always offered; the renderer warns when the
+            // model supplied a description rather than a real unified diff.
+            return { key: 'd', label: 'Show diff' };
+        case 'create':
+            return change.diff ? { key: 'v', label: 'View source' } : null;
+        case 'delete':
+            return change.diff ? { key: 'v', label: 'View current source' } : null;
+        default:
+            return null;
+    }
+}

package/dist/approvals/render.js

@@ -1,5 +1,6 @@
 import { select, input } from '@inquirer/prompts';
 import chalk from 'chalk';
+import { verbLine, viewAffordance, toSourceLines } from './op-labels.js';
 import { shouldUseInk } from '../renderer/tty.js';
 import { approvalEmitter } from '../ui/approval-emitter.js';
 import { askQuestionEmitter } from '../ui/ask-question-emitter.js';
@@ -7,26 +8,6 @@ import { withInquirer } from '../repl/inquirer-guard.js';
 import { inquirerTheme } from '../repl/inquirer-theme.js';
 import { PEACH } from '../renderer/banners.js';
 const peach = (s) => chalk.hex(PEACH)(s);
-/**
- * Op-row glyph. 2026-05-01: dropped the per-op color spread (yellow M,
- * green A, blue >, magenta ^). Using 5 different hues for routine plan
- * rows trains the user to ignore color as semantic signal — by the time
- * an actual delete shows up, red has already appeared on three other
- * lines and lost its punch. Now: only `D` (delete) gets red, because
- * delete is the only op that's destructive enough to deserve a hot
- * accent. Everything else renders dim — the row layout already tells
- * the user it's a change row.
- */
-function opIcon(op) {
-    switch (op) {
-        case 'create': return chalk.dim('A');
-        case 'modify': return chalk.dim('M');
-        case 'delete': return chalk.red('D');
-        case 'activate': return chalk.dim('>');
-        case 'release': return chalk.dim('^');
-        default: return chalk.dim('?');
-    }
-}
 /**
  * Risk tag. 2026-05-01: yellow used to fire on `medium` too, which
  * meant most plans had a yellow tag — defeating yellow's purpose as
@@ -119,12 +100,14 @@ export async function renderPlanGate(summary, changes, transport, effectiveRisk)
         if (effectiveRisk.raisedBy.length > 0) {
             ctx.push(`(raised from low: ${effectiveRisk.raisedBy.join(', ')})`);
         }
-        for (const c of visibleChanges)
-            ctx.push(`  ${opIcon(c.op)} ${c.object} (${c.type})`);
+        // Numbered, operation-aware verb rows ("1. Create table ZMNT_NOTE") —
+        // no cryptic op-code glyph. The Ink modal renders `context` itself, so
+        // no chalk here.
+        visibleChanges.forEach((c, i) => ctx.push(`  ${i + 1}. ${verbLine(c)}`));
         const result = await askQuestionEmitter.request({
             id: 'plan-gate',
             question: 'Apply this plan?',
-            // Strip chalk ANSI from opIcon/riskTag — the Ink modal renders `context`
+            // Strip chalk ANSI from riskTag — the Ink modal renders `context`
             // itself (dimColor), so embedded escape codes would show as raw text.
             context: ctx.join('\n').replace(/\x1b\[[0-9;]*m/g, ''),
             kind: 'choice',
@@ -149,9 +132,9 @@ export async function renderPlanGate(summary, changes, transport, effectiveRisk)
     if (effectiveRisk.raisedBy.length > 0) {
         console.log(`      ${chalk.dim(`(raised from low: ${effectiveRisk.raisedBy.join(', ')})`)}`);
     }
-    for (const c of visibleChanges) {
-        console.log(`        ${opIcon(c.op)} ${c.object.padEnd(30)} ${chalk.dim(`(${c.type})`)}`);
-    }
+    visibleChanges.forEach((c, i) => {
+        console.log(`        ${chalk.dim(`${i + 1}.`)} ${verbLine(c)}`);
+    });
     console.log('');
     const choice = await withInquirer(() => select({
         message: 'Apply?',
@@ -173,17 +156,20 @@ export async function renderPerChangeApproval(change, effectiveRisk, transport)
     // fires standalone (single-change request_approval) AND risk is non-low.
     void effectiveRisk;
     void transport;
-    const objLabel = `${opIcon(change.op)} ${change.object} (${change.type})`;
+    // Verb-first label ("Create table ZMNT_NOTE — apply?") — no op-code glyph.
+    const objLabel = verbLine(change);
+    // Op-aware review choice: [d] Show diff for modify, [v] View source for
+    // create/delete-with-source, omitted for activate/release.
+    const aff = viewAffordance(change);
+    const choices = [{ value: 'apply', name: 'Apply' }];
+    if (aff)
+        choices.push({ value: 'diff', name: aff.label });
+    choices.push({ value: 'skip', name: 'Skip (tell model why)' }, { value: 'cancel', name: 'Cancel turn' });
     const choice = await withInquirer(() => select({
         message: `${objLabel} — apply?`,
         default: 'apply',
         theme: inquirerTheme,
-        choices: [
-            { value: 'apply', name: 'Apply' },
-            { value: 'diff', name: 'Show diff' },
-            { value: 'skip', name: 'Skip (tell model why)' },
-            { value: 'cancel', name: 'Cancel turn' },
-        ],
+        choices,
     }));
     if (choice === 'apply')
         return { approved: true };
@@ -193,9 +179,29 @@ export async function renderPerChangeApproval(change, effectiveRisk, transport)
         const reason = await withInquirer(() => input({ message: 'Why skip?', theme: inquirerTheme }));
         return { approved: false, reason };
     }
-    // 'diff' — print colorized + lines (green) / - lines (red) / hunk headers
-    // (peach) so the user can scan the change at a glance instead of squinting
-    // at flat-gray text.
+    // Review choice.
+    //
+    // I3 (2026-07-05 review): a 'v' affordance (create/delete View source) is
+    // NOT a diff — the payload is plain/all-adds source. Routing it through the
+    // diff printer fired the "⚠ Model did not provide a unified diff" warning
+    // under a View source label. Print numbered plain source instead — never
+    // the diff path or its warning. (The affordance is only offered when
+    // change.diff is present, so the fallback line is belt-and-braces.)
+    if (aff?.key === 'v') {
+        if (change.diff) {
+            const numbered = toSourceLines(change.diff)
+                .map((line, i) => `${chalk.dim(String(i + 1).padStart(4) + '  ')}${line}`)
+                .join('\n');
+            console.log('\n' + numbered + '\n');
+        }
+        else {
+            console.log(chalk.dim('(No source provided by the model)'));
+        }
+        return renderPerChangeApproval(change, effectiveRisk, transport);
+    }
+    // 'd' (modify) — print colorized + lines (green) / - lines (red) / hunk
+    // headers (peach) so the user can scan the change at a glance instead of
+    // squinting at flat-gray text.
     //
     // 2026-05-01: detect "model sent a description, not a diff" — when the
     // payload has no +/-/@ lines and no `--- /+++ ` headers, colorizeDiff

package/dist/auth/org-anthropic-key.js

@@ -0,0 +1,25 @@
+/**
+ * Fetch the organisation's Anthropic API key from the CSPeach proxy.
+ *
+ * Returns the key string on success, or null on any failure.
+ * Non-fatal by design — callers must fall back to the manual prompt when null
+ * is returned. The key is NEVER logged.
+ */
+export async function fetchOrgAnthropicKey(proxyUrl, bearer, deps) {
+    const fetchFn = deps?.fetchImpl ?? fetch;
+    const url = `${proxyUrl.replace(/\/$/, '')}/v1/me/anthropic-key`;
+    try {
+        const r = await fetchFn(url, {
+            headers: { Authorization: `Bearer ${bearer}` },
+        });
+        if (!r.ok)
+            return null;
+        const body = await r.json();
+        if (typeof body.key === 'string' && body.key.length > 0)
+            return body.key;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/classifier/client.js

@@ -8,8 +8,10 @@ const RULES = [
     { skill: 'abap-document', patterns: [/developer\s+documentation|document\s+this\s+(class|program|object)/i] },
     // abap-incident MUST precede dump rules — pipeline framing beats keyword-only matches
     { skill: 'abap-incident', patterns: [/incident|resolve.*dump.*to.*fix|pipeline.*(short\s+dump|st22|dump)|(dump|st22).*to.*transport|formal\s+(incident|dump)\s+report|end.to.end.*dump/i] },
-    { skill: 'abap-dump-triage', patterns: [/dump\s+triage|structured\s+investigation.*dump|dump\s+forensic/i] },
-    { skill: 'abap-dump-analyze', patterns: [/short\s+dump|runtime\s+error|\bst22\b|dump\s+analys/i] },
+    // abap-dump (2026-06-12) — merger of abap-dump-analyze + abap-dump-triage.
+    // Triage-vs-fix is an intent decision INSIDE the skill now, so both
+    // pattern sets route here.
+    { skill: 'abap-dump', patterns: [/short\s+dump|runtime\s+error|\bst22\b|dump\s+(analys|triage|forensic)|structured\s+investigation.*dump/i] },
     { skill: 'abap-eml', patterns: [/\beml\b|entity\s+manipulation|behavior\s+handler/i] },
     { skill: 'abap-enhance', patterns: [/\bbadi\b|enhancement\s+spot|implicit\s+enhancement|customer\s+exit|user\s+exit|(hook\s+into|extend)\s+(sap|standard|me\d+|migo|miro|va\d+|vf\d+|vl\d+|fb\d+)/i] },
     { skill: 'abap-estimate', patterns: [/effort\s+estimat|ticket\s+estimat|size\s+this\s+(work|task|ticket|story)|how\s+(many|long).*(hours|days).*(build|develop|implement)/i] },
@@ -20,11 +22,24 @@ const RULES = [
     // abap-modernize MUST precede abap-rap so "rebuild as RAP" / "convert to RAP" stays
     // on modernize (rebuild intent) instead of falling to abap-rap's bare \brap\b match.
     { skill: 'abap-modernize', patterns: [/modernise|modernize|classic.*to.*modern|convert.*to\s+(rap|fiori|odata)|rebuild.*as\s+(rap|fiori)/i] },
+    // abap-fiori-build (D12, 2026-06-12) MUST follow abap-modernize ("convert
+    // this WRITE report to Fiori" = rebuild intent) and precede abap-rap so
+    // "fiori app for my RAP/OData service" lands on the UI skill, not the
+    // backend scaffolder.
+    { skill: 'abap-fiori-build', patterns: [/\bfiori\b|\b(sap)?ui5\b|freestyle\s+app|\bui\s+app\b|front.?end\s+(for|on)\s/i] },
     // abap-rap MUST precede abap-generate so RAP-stack prompts route to rap, not the
     // generic generator (cluster I, 2026-05-03). Also captures "scaffold a CDS view +
     // BDEF + service binding" type prompts which collide with abap-generate.
     { skill: 'abap-rap', patterns: [/\brap\b|business\s+object(?!s?\s+for)|bdef|service\s+binding|srvb|scaffold.*(cds|odata\s+v4|bdef|behavior)|odata\s+v4\s+service/i] },
-    { skill: 'abap-generate', patterns: [/\bgenerate\b|create\s+(a\s+)?(new\s+)?(class|program|report|include)|build.*from\s+scratch/i] },
+    // Daily-edit phrasings (D12, 2026-06-12): "add a validation to ZCL_X",
+    // "change/fix ZFOO" are abap-generate work — the old rules only matched
+    // explicit "generate"/"create" verbs, so daily edits fell through and the
+    // coaching picker offered enhance/refactor/test instead.
+    { skill: 'abap-generate', patterns: [
+            /\bgenerate\b|create\s+(a\s+)?(new\s+)?(class|program|report|include)|build.*from\s+scratch/i,
+            /\badd\s+(a\s+|an\s+)?[\w\s-]{1,40}\bto\s+z[_a-z0-9]+/i,
+            /\b(change|fix|update|modify|adjust)\s+(the\s+)?z[_a-z0-9]+\b/i,
+        ] },
     { skill: 'abap-impact', patterns: [/impact\s+analysis|where.*used|what.*affected\s+by/i] },
     // abap-upgrade-* must precede abap-migrate
     { skill: 'abap-upgrade-verify', patterns: [/upgrade\s+verify|remediation\s+report|verify\s+upgrade/i] },

package/dist/cli.js

@@ -62,6 +62,20 @@ export async function main(argv) {
         }
         return 0;
     }
+    if (args[0] === 'config' && args[1] === 'unset') {
+        const { runConfigUnset, ConfigSetError } = await import('./commands/config-set.js');
+        try {
+            await runConfigUnset(args.slice(2));
+        }
+        catch (e) {
+            if (e instanceof ConfigSetError) {
+                console.error(chalk.red(`✗ ${e.message}`));
+                process.exit(e.exitCode);
+            }
+            throw e;
+        }
+        return 0;
+    }
     if (args[0] === 'config' && args[1] === 'show') {
         const { runConfigShow } = await import('./commands/config-show.js');
         await runConfigShow(args.slice(2));
@@ -134,6 +148,7 @@ Usage:
   cspeach config add-sap            Add a SAP system interactively
   cspeach configure                 Alias for \`cspeach config add-sap\`
   cspeach config set <key> <value>  Update a config key
+  cspeach config unset <key>        Remove a config key (revert to default)
   cspeach config show [key]         Show config (full or single key)
   cspeach doctor                    Diagnose install + connectivity
   cspeach login                     Sign in via device-code flow

package/dist/commands/compact.js

@@ -161,6 +161,24 @@ export async function backupBeforeCompact(session) {
     await fs.writeFile(filePath, JSON.stringify(session, null, 2), 'utf-8');
     return filePath;
 }
+/**
+ * UX Wave 2 / Task 4 — render session.todos as a plain-text,
+ * status-prefixed block for the compacted context. Returns '' when there
+ * is no list (undefined or empty) so callers can append unconditionally.
+ *
+ * Format (explicit status words, not glyphs — the reader is the NEXT
+ * turn's model, and `[in_progress]` is unambiguous where `[>]` isn't):
+ *
+ *   Current task list:
+ *   - [completed] Create table ZORDER
+ *   - [in_progress] Write behavior definition
+ *   - [pending] Publish service binding
+ */
+export function renderTodoSection(todos) {
+    if (!todos || todos.length === 0)
+        return '';
+    return ['', 'Current task list:', ...todos.map((t) => `- [${t.status}] ${t.text}`)].join('\n');
+}
 /**
  * The compacted "synthesised earlier history" message that replaces the
  * summarised slice in session.messages. Role=user because (a) Anthropic
@@ -168,9 +186,16 @@ export async function backupBeforeCompact(session) {
  * makes it visually distinct from the model's prior assistant outputs, and
  * (c) the explicit "context compacted by /compact" framing tells the next
  * turn's model exactly what it's looking at.
+ *
+ * UX Wave 2 / Task 4: when `todos` is provided (runCompact passes
+ * session.todos), a `Current task list:` section is appended after the
+ * summary so the model retains its plan across /compact — the summarised
+ * turns are where the list was built, and Haiku isn't trusted to
+ * reproduce it verbatim.
  */
-export function buildSummaryMessage(summary, droppedTurns) {
+export function buildSummaryMessage(summary, droppedTurns, todos) {
     const ts = new Date().toISOString();
+    const todoSection = renderTodoSection(todos);
     return {
         role: 'user',
         content: [
@@ -180,6 +205,7 @@ export function buildSummaryMessage(summary, droppedTurns) {
             `to ~/.cspeach/sessions/${'<session-id>'}.pre-compact-<timestamp>.json]`,
             '',
             summary,
+            ...(todoSection ? [todoSection] : []),
         ].join('\n'),
     };
 }
@@ -228,7 +254,7 @@ export async function runCompact(opts) {
     // which it will be unless the session is very long. (For very long sessions
     // we accept losing the original first prompt because the summary should
     // mention what the goal was.)
-    const summaryMsg = buildSummaryMessage(summary, plan.toSummarise.length);
+    const summaryMsg = buildSummaryMessage(summary, plan.toSummarise.length, session.todos);
     session.messages = [summaryMsg, ...plan.toKeep];
     await saveSession(session);
     return {