@cspeach/cli 0.9.0 → 1.1.0

package/dist/commands/config-set.js

@@ -7,10 +7,16 @@ import { loadConfig, saveConfig, isValidWriteMode } from '../config/loader.js';
 const MUTABLE_KEYS = new Set([
     'proxy_url',
     'default_model',
+    'audit_model',
+    'compact_model',
     'effort',
     'telemetry',
     'classifier.safe_mode',
+    'local_build',
+    'local_files', // deprecated alias for local_build (2026-06-13) — still accepted
     'write_mode',
+    'plan_mode',
+    'plan_audit',
     'llm.mode',
     'llm.ai_hub_base_url',
     'llm.ai_hub_model_alias',
@@ -22,10 +28,34 @@ const MUTABLE_KEYS = new Set([
 ]);
 // SAP-scoped key pattern: sap.<alias>.auto_approve
 const SAP_AUTO_APPROVE_RE = /^sap\.([A-Z0-9_-]{2,32})\.auto_approve$/;
+// SAP-scoped key pattern: sap.<alias>.role (system role → write-mode ceiling)
+const SAP_ROLE_RE = /^sap\.([A-Z0-9_-]{2,32})\.role$/;
+// SAP-scoped TLS keys: sap.<alias>.ca_cert_path | sap.<alias>.insecure_skip_tls_verify
+const SAP_CA_CERT_PATH_RE = /^sap\.([A-Z0-9_-]{2,32})\.ca_cert_path$/;
+const SAP_INSECURE_TLS_RE = /^sap\.([A-Z0-9_-]{2,32})\.insecure_skip_tls_verify$/;
+/**
+ * Coerce a user-typed on/off-style string to a boolean. Accepts the common
+ * spellings a developer expects from a CLI toggle (`on`/`true`/`1` → true,
+ * `off`/`false`/`0` → false). Returns null for anything else so the caller
+ * can reject with a clear error. Case-insensitive.
+ */
+const TRUE_TOKENS = new Set(['on', 'true', '1']);
+const FALSE_TOKENS = new Set(['off', 'false', '0']);
+function coerceBool(value) {
+    const v = value.trim().toLowerCase();
+    if (TRUE_TOKENS.has(v))
+        return true;
+    if (FALSE_TOKENS.has(v))
+        return false;
+    return null;
+}
 const EFFORT_VALUES = ['low', 'medium', 'high', 'xhigh', 'max'];
 const TELEMETRY_VALUES = ['minimal', 'full'];
 const AUTO_APPROVE_VALUES = ['never', 'low', 'medium'];
+const SYSTEM_ROLE_VALUES = ['dev', 'qas', 'prd'];
 const LLM_MODE_VALUES = ['managed', 'byok', 'ai-hub', 'local'];
+const PLAN_MODE_VALUES = ['step', 'guarded'];
+const PLAN_AUDIT_VALUES = ['on', 'off'];
 /**
  * Thrown on validation failure. The outer CLI dispatcher converts to
  * `console.error` + `process.exit(exitCode)`. Throwing instead of calling
@@ -44,6 +74,119 @@ export class ConfigSetError extends Error {
 function err(msg) {
     throw new ConfigSetError(`[config set] ${msg}`);
 }
+function errUnset(msg) {
+    throw new ConfigSetError(`[config unset] ${msg}`);
+}
+/**
+ * Internal, loader-derived flags that are never serialised (stripped by
+ * saveConfig). They must never be targets of `config set`/`config unset`.
+ */
+const INTERNAL_KEYS = new Set(['default_model_set', 'file_keys']);
+/**
+ * Virtual keys whose values live in the OS keychain, not config.toml. `config
+ * unset` cannot remove them — that is a keychain operation — so they are
+ * rejected with a pointer rather than silently no-op'd.
+ */
+const VIRTUAL_KEYCHAIN_KEYS = new Set(['llm.byok_key', 'llm.ai_hub_token']);
+/**
+ * MUTABLE_KEYS that `config unset` can act on (excludes keychain virtuals and
+ * the deprecated `local_files` alias — the canonical name is `local_build`).
+ */
+function unsettableKeyList() {
+    return [...MUTABLE_KEYS]
+        .filter((k) => !VIRTUAL_KEYCHAIN_KEYS.has(k) && k !== 'local_files')
+        .join(', ');
+}
+/**
+ * Mark a top-level config key as explicitly user-set so sparse serialisation
+ * (saveConfig) preserves it even when its value equals the built-in default.
+ * `file_keys` tracks TOP-LEVEL keys, so we push the first dotted segment
+ * (`default_model` → `default_model`, `classifier.safe_mode` → `classifier`).
+ * Dedup-safe. Closes the one edge the value-diff can't see: `config set
+ * default_model claude-opus-4-8` (equal to the built-in default) on a file that
+ * lacked the key would otherwise be dropped on save, permanently opting the
+ * user out of the model-governance server steering (default_model_set semantics).
+ */
+export function markExplicit(cfg, key) {
+    const top = key.split('.')[0];
+    if (!Array.isArray(cfg.file_keys))
+        cfg.file_keys = [];
+    if (!cfg.file_keys.includes(top))
+        cfg.file_keys.push(top);
+}
+/**
+ * Delete a (possibly dotted, max 2-level) key from a loaded config in place.
+ * Returns true if the key was present and removed, false if it was already
+ * absent (the caller renders a friendly no-op). Also drops the top-level key
+ * from `file_keys` — but ONLY when the whole top-level key was removed. If a
+ * nested sibling survives (e.g. unsetting `llm.local_model` while `llm.mode`
+ * remains), keeping the top-level entry in `file_keys` is what stops sparse
+ * save from dropping the now-default-equal parent table.
+ */
+function unsetConfigKey(cfg, key) {
+    const parts = key.split('.');
+    const top = parts[0];
+    const obj = cfg;
+    let removedTop = false;
+    if (parts.length === 1) {
+        if (!Object.prototype.hasOwnProperty.call(obj, top))
+            return false;
+        delete obj[top];
+        removedTop = true;
+    }
+    else {
+        const parent = obj[top];
+        if (!parent || typeof parent !== 'object')
+            return false;
+        const p = parent;
+        const leaf = parts.slice(1).join('.');
+        if (!Object.prototype.hasOwnProperty.call(p, leaf))
+            return false;
+        delete p[leaf];
+        if (Object.keys(p).length === 0) {
+            delete obj[top];
+            removedTop = true;
+        }
+    }
+    if (removedTop && Array.isArray(cfg.file_keys)) {
+        cfg.file_keys = cfg.file_keys.filter((k) => k !== top);
+    }
+    return true;
+}
+/**
+ * Executes `cspeach config unset <key>`.
+ * Removes a MUTABLE top-level key so it reverts to the built-in default (and,
+ * for the model keys, re-enables server model-steering). Rejects internal keys,
+ * keychain virtuals, and non-MUTABLE keys. Unsetting an absent key is a friendly
+ * no-op. Throws ConfigSetError on validation failure (the CLI dispatcher in
+ * cli.ts converts it to console.error + exit).
+ */
+export async function runConfigUnset(args) {
+    const key = args[0];
+    if (!key) {
+        errUnset('Usage: cspeach config unset <key>\n  Valid keys: ' + unsettableKeyList());
+    }
+    if (INTERNAL_KEYS.has(key)) {
+        errUnset(`"${key}" is an internal key (derived on load, never stored) and cannot be unset.`);
+    }
+    if (VIRTUAL_KEYCHAIN_KEYS.has(key)) {
+        errUnset(`"${key}" is stored in the OS keychain, not config.toml — it cannot be removed with config unset.`);
+    }
+    if (key.startsWith('sap.')) {
+        errUnset(`"${key}" is a SAP-scoped key — those are managed per system via \`cspeach config set ${key} <value>\`, not config unset.`);
+    }
+    if (!MUTABLE_KEYS.has(key)) {
+        errUnset(`Unknown key "${key}". Valid keys: ${unsettableKeyList()}`);
+    }
+    const cfg = await loadConfig();
+    const removed = unsetConfigKey(cfg, key);
+    if (!removed) {
+        console.log(chalk.dim(`${key} was not set — nothing to unset.`));
+        return;
+    }
+    await saveConfig(cfg);
+    console.log(chalk.green(`Unset ${key} — it now falls back to the built-in default (and any server steering).`));
+}
 /**
  * Executes `cspeach config set <key> <value>`.
  * Exits process with code 1 on validation error.
@@ -73,6 +216,62 @@ export async function runConfigSet(args) {
         console.log(chalk.green(`Set ${key} = ${value}`));
         return;
     }
+    // SAP-scoped key: sap.<alias>.role — system role, feeds the write-mode ceiling
+    // (prd → advisory-only, qas → approval-gated, dev → no ceiling).
+    const roleMatch = SAP_ROLE_RE.exec(key);
+    if (roleMatch) {
+        const alias = roleMatch[1];
+        if (!SYSTEM_ROLE_VALUES.includes(value)) {
+            err(`Invalid value for ${key}. Allowed: ${SYSTEM_ROLE_VALUES.join(', ')}`);
+        }
+        const cfg = await loadConfig();
+        if (!cfg.sap[alias]) {
+            err(`SAP system "${alias}" not found in config. Add it first with: cspeach config add-sap`);
+        }
+        cfg.sap[alias].role = value;
+        await saveConfig(cfg);
+        console.log(chalk.green(`Set ${key} = ${value}`));
+        return;
+    }
+    // SAP-scoped TLS: sap.<alias>.ca_cert_path — trust a CA, verification STAYS ON.
+    const caMatch = SAP_CA_CERT_PATH_RE.exec(key);
+    if (caMatch) {
+        const alias = caMatch[1];
+        const cfg = await loadConfig();
+        if (!cfg.sap[alias]) {
+            err(`SAP system "${alias}" not found in config. Add it first with: cspeach config add-sap`);
+        }
+        // Path is stored as-is (no existence check here — the connection fails loudly
+        // and fail-closed if the CA can't be read at connect time). Setting a CA also
+        // clears any insecure flag so the two never conflict.
+        cfg.sap[alias].ca_cert_path = value;
+        delete cfg.sap[alias].insecure_skip_tls_verify;
+        await saveConfig(cfg);
+        console.log(chalk.green(`Set ${key} = ${value}`));
+        console.log(chalk.dim('  → TLS verification stays ON; this CA is added to the trust store.'));
+        return;
+    }
+    // SAP-scoped TLS: sap.<alias>.insecure_skip_tls_verify — dev-only opt-out.
+    const insecMatch = SAP_INSECURE_TLS_RE.exec(key);
+    if (insecMatch) {
+        const alias = insecMatch[1];
+        const b = coerceBool(value);
+        if (b === null) {
+            err(`${key} must be on/off (also accepts true/false, 1/0).`);
+        }
+        const cfg = await loadConfig();
+        if (!cfg.sap[alias]) {
+            err(`SAP system "${alias}" not found in config. Add it first with: cspeach config add-sap`);
+        }
+        cfg.sap[alias].insecure_skip_tls_verify = b;
+        if (b) {
+            console.log(chalk.yellow(`  ⚠ TLS verification will be DISABLED for ${alias} — dev only, NEVER use in production. ` +
+                `Prefer: cspeach config set sap.${alias}.ca_cert_path <path-to-corporate-CA>`));
+        }
+        await saveConfig(cfg);
+        console.log(chalk.green(`Set ${key} = ${b}`));
+        return;
+    }
     // Virtual keys that store secrets in the OS keychain instead of config.toml.
     if (key === 'llm.byok_key' || key === 'llm.ai_hub_token') {
         // Support stdin piping for secrets: `echo "key" | cspeach config set llm.byok_key -`
@@ -124,6 +323,24 @@ export async function runConfigSet(args) {
             }
             cfg.default_model = value;
             break;
+        case 'audit_model':
+            // model-governance Step 1 — the per-phase auditor's model. Same claude-
+            // prefix guard as default_model; env CSPEACH_AUDIT_MODEL still overrides
+            // this at runtime (see resolveAuditModel).
+            if (!value.startsWith('claude-')) {
+                err(`model must start with "claude-", got "${value}".`);
+            }
+            cfg.audit_model = value;
+            break;
+        case 'compact_model':
+            // model-governance step 2d — the model `/compact` summarisation runs on.
+            // Same claude- prefix guard as default_model/audit_model; env
+            // CSPEACH_COMPACT_MODEL still overrides this at runtime (resolveModelRole).
+            if (!value.startsWith('claude-')) {
+                err(`model must start with "claude-", got "${value}".`);
+            }
+            cfg.compact_model = value;
+            break;
         case 'effort':
             if (!EFFORT_VALUES.includes(value)) {
                 err(`Invalid effort value "${value}". Allowed: ${EFFORT_VALUES.join(', ')}`);
@@ -142,12 +359,55 @@ export async function runConfigSet(args) {
             }
             cfg.classifier.safe_mode = value === 'true';
             break;
+        case 'local_files':
+            // Deprecated alias (2026-06-13). Still applied — but it WRITES to the new
+            // `local_build` key so the user's config converges on the new name. The
+            // shared `local_build` case below also DELETES any stale legacy
+            // `local_files` key so it doesn't linger after migration. One-line
+            // deprecation note, then fall through.
+            console.log(chalk.yellow('  → "local_files" is deprecated; use "local_build". Applying to local_build.'));
+        // fallthrough
+        case 'local_build': {
+            const b = coerceBool(value);
+            if (b === null) {
+                err(`${key} must be on/off (also accepts true/false, 1/0).`);
+            }
+            cfg.local_build = b;
+            // Migration hygiene (2026-06-13): whether the user typed `local_build` or
+            // the deprecated `local_files` alias, we write the new key AND drop any
+            // stale legacy `local_files` so it doesn't linger in `config show` after
+            // migration. resolveLocalBuild prefers local_build anyway, but a leftover
+            // legacy key is confusing and could surprise a future reader.
+            delete cfg.local_files;
+            // Config is read at startup; a running session isn't retroactively
+            // changed (the tool override is applied once, before the first turn).
+            console.log(chalk.dim('  → takes effect on the next `cspeach` launch.'));
+            break;
+        }
         case 'write_mode':
             if (!isValidWriteMode(value)) {
                 err(`Invalid value for write_mode. Must be one of: auto, approval-gated, advisory-only`);
             }
             cfg.write_mode = value;
             break;
+        case 'plan_mode':
+            // 'step' = prompt before every phase (default when unset);
+            // 'guarded' = auto-chain non-write phases, stop on write phases /
+            // unresolved audits. Per-run --guarded/--step flags override this.
+            if (!PLAN_MODE_VALUES.includes(value)) {
+                err(`Invalid plan_mode "${value}". Allowed: ${PLAN_MODE_VALUES.join(', ')}`);
+            }
+            cfg.plan_mode = value;
+            break;
+        case 'plan_audit':
+            // 'on' = audit every phase (default when unset); 'off' = skip the
+            // independent auditor entirely (owner off-switch, 2026-07-06). Per-run
+            // --audit/--no-audit flags override this default.
+            if (!PLAN_AUDIT_VALUES.includes(value)) {
+                err(`Invalid plan_audit "${value}". Allowed: ${PLAN_AUDIT_VALUES.join(', ')}`);
+            }
+            cfg.plan_audit = value;
+            break;
         case 'llm.mode':
             if (!LLM_MODE_VALUES.includes(value)) {
                 err(`Invalid llm.mode "${value}". Allowed: ${LLM_MODE_VALUES.join(', ')}`);
@@ -185,6 +445,10 @@ export async function runConfigSet(args) {
         default:
             err(`Unhandled key "${key}".`);
     }
+    // Mark this top-level key as explicitly user-set so sparse serialisation
+    // keeps it even when the value equals the built-in default (the edge the
+    // value-diff can't see — e.g. `config set default_model claude-opus-4-8`).
+    markExplicit(cfg, key);
     await saveConfig(cfg);
     console.log(chalk.green(`Set ${key} = ${value}`));
 }
@@ -201,6 +465,17 @@ export function validateValue(key, value) {
     if (SAP_AUTO_APPROVE_RE.test(key)) {
         return AUTO_APPROVE_VALUES.includes(value);
     }
+    // SAP-scoped key: sap.<alias>.role
+    if (SAP_ROLE_RE.test(key)) {
+        return SYSTEM_ROLE_VALUES.includes(value);
+    }
+    // SAP-scoped TLS keys.
+    if (SAP_CA_CERT_PATH_RE.test(key)) {
+        return value.length > 0; // any non-empty path; existence checked at connect
+    }
+    if (SAP_INSECURE_TLS_RE.test(key)) {
+        return coerceBool(value) !== null;
+    }
     if (!MUTABLE_KEYS.has(key))
         return false;
     switch (key) {
@@ -213,6 +488,8 @@ export function validateValue(key, value) {
                 return false;
             }
         case 'default_model':
+        case 'audit_model':
+        case 'compact_model':
             return value.startsWith('claude-');
         case 'effort':
             return EFFORT_VALUES.includes(value);
@@ -220,8 +497,15 @@ export function validateValue(key, value) {
             return TELEMETRY_VALUES.includes(value);
         case 'classifier.safe_mode':
             return value === 'true' || value === 'false';
+        case 'local_build':
+        case 'local_files': // deprecated alias — same on/off coercion
+            return coerceBool(value) !== null;
         case 'write_mode':
             return isValidWriteMode(value);
+        case 'plan_mode':
+            return PLAN_MODE_VALUES.includes(value);
+        case 'plan_audit':
+            return PLAN_AUDIT_VALUES.includes(value);
         case 'llm.mode':
             return LLM_MODE_VALUES.includes(value);
         case 'llm.ai_hub_base_url':

package/dist/commands/config-show.js

@@ -14,6 +14,16 @@ const REDACTED_KEYS = new Set([
     'llm.byok_key', // Anthropic API key — keychain "cspeach.anthropic"
     'llm.ai_hub_token', // SAP AI Hub bearer — keychain "cspeach.ai-hub"
 ]);
+/**
+ * INTERNAL, loader-derived flags that are attached to the config object at load
+ * time but never serialised (stripped by saveConfig). They must not render in
+ * `config show` — `default_model_set` was a pre-existing leak, `file_keys` was
+ * added by sparse-config task 1. Both are top-level only.
+ */
+const INTERNAL_KEYS = new Set([
+    'default_model_set',
+    'file_keys',
+]);
 function formatTomlValue(value) {
     if (typeof value === 'string')
         return `"${value}"`;
@@ -61,6 +71,9 @@ function printConfigAsToml(cfg, prefix = '') {
     const tables = entries.filter(([, v]) => typeof v === 'object' && v !== null && !Array.isArray(v));
     for (const [k, v] of scalars) {
         const fullKey = prefix ? `${prefix}.${k}` : k;
+        // Skip internal, never-serialised keys so they never leak into output.
+        if (INTERNAL_KEYS.has(fullKey))
+            continue;
         if (REDACTED_KEYS.has(fullKey)) {
             console.log(`${k} = [REDACTED]`);
         }
@@ -126,6 +139,13 @@ export async function runConfigShow(args) {
         return;
     }
     const keyPath = args[0];
+    // Reject internal, loader-derived keys in the single-key path too — the full
+    // dump already filters INTERNAL_KEYS, but resolveDottedKey would happily
+    // print e.g. the raw `file_keys` array. Mirror `config unset`'s wording.
+    if (INTERNAL_KEYS.has(keyPath)) {
+        console.error(chalk.red(`[config show] "${keyPath}" is an internal key (derived on load, never stored) and cannot be shown.`));
+        process.exit(1);
+    }
     const resolved = resolveDottedKey(cfg, keyPath);
     if (resolved === undefined) {
         console.error(chalk.red(`[config show] Key "${keyPath}" not found.`));

package/dist/commands/export-audit.js

@@ -0,0 +1,43 @@
+// cspeach-cli/src/commands/export-audit.ts
+//
+// `/export audit [filename]` — write the signable session audit record to a
+// markdown file in the cwd and print the path.
+//
+// Thin I/O wrapper over the pure buildAuditReport builder (session/audit-export
+// .ts): reads the session's cost JSONL, resolves the target filename (explicit
+// arg or a deterministic default), writes the file, and emits a confirmation
+// line through the caller-supplied `emit` (chunkEmitter in Ink mode, console
+// .log in classic mode — same seam as printHelp / runCostCommand).
+//
+// The default filename's date comes from SESSION DATA (last_turn_at), never
+// now() — a re-export of an old session names the file for when the work
+// happened, matching the deterministic report body.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildAuditReport } from '../session/audit-export.js';
+import { readCostLog } from '../cost/cost-log.js';
+/** Parse the text after `/export` into a subcommand + optional filename. */
+export function parseExportArgs(rest) {
+    const parts = rest.trim().split(/\s+/).filter(Boolean);
+    return { sub: (parts[0] ?? '').toLowerCase(), filename: parts[1] };
+}
+/** Deterministic default filename: date from session data, not now(). */
+export function defaultAuditFilename(session) {
+    const date = (session.last_turn_at || session.started_at || '').slice(0, 10) || 'undated';
+    return `cspeach-audit-${session.id}-${date}.md`;
+}
+export async function runExportAuditCommand(opts) {
+    const { session, transport, emit } = opts;
+    const cwd = opts.cwd ?? process.cwd();
+    const costEntries = opts.costEntries ?? (await readCostLog(session.id));
+    const report = buildAuditReport({ session, costEntries, transport });
+    const name = opts.filename && opts.filename.trim().length > 0
+        ? opts.filename.trim()
+        : defaultAuditFilename(session);
+    const outPath = path.resolve(cwd, name);
+    await fs.writeFile(outPath, report, 'utf-8');
+    emit('');
+    emit(`Audit written to ${outPath}`);
+    emit('');
+    return { path: outPath };
+}

package/dist/commands/help.js

@@ -93,7 +93,12 @@ export function printHelp(emit = (s) => console.log(s)) {
     emit(`  ${chalk.bold('/ui [auto|ink|classic]'.padEnd(NAME_COL_PAD))} View or change UI rendering mode`);
     emit(`  ${chalk.bold('/reroute <skill>'.padEnd(NAME_COL_PAD))} Re-run your last prompt with a different skill`);
     emit(`  ${chalk.bold('/new'.padEnd(NAME_COL_PAD))} End the current Q&A chain — next prompt is classified fresh`);
+    emit(`  ${chalk.bold('/mode [advisory|gated|auto]'.padEnd(NAME_COL_PAD))} Cycle or set the session write mode (Shift+Tab / Alt+M also cycle)`);
+    emit(`  ${chalk.bold('/recap'.padEnd(NAME_COL_PAD))} Show the session recap (last session · open tasks · plan progress)`);
+    emit(`  ${chalk.bold('/rewind'.padEnd(NAME_COL_PAD))} Undo a write from this session — restore an object to a pre-write snapshot (Esc Esc)`);
     emit(`  ${chalk.bold('/cost'.padEnd(NAME_COL_PAD))} Show this session's API spend so far ($ + token breakdown)`);
+    emit(`  ${chalk.bold('/context'.padEnd(NAME_COL_PAD))} Show what fills the model context window — a composition grid of bars`);
+    emit(`  ${chalk.bold('/export audit [file]'.padEnd(NAME_COL_PAD))} Write the signable session audit record to a markdown file`);
     emit(`  ${chalk.bold('/compact'.padEnd(NAME_COL_PAD))} Summarise older turns into a compact context block — cuts subsequent turn cost by 80-90%`);
     emit(`  ${chalk.bold('/exit'.padEnd(NAME_COL_PAD))} Quit CSPeach`);
     emit('');

package/dist/commands/login.js

@@ -13,7 +13,11 @@
  * Dependencies (open, print, prompt) are injected so the command is
  * unit-testable without stubbing platform globals.
  */
+import keytar from 'keytar';
 import { writeAuthFile } from '../auth/auth-file.js';
+import { fetchOrgAnthropicKey } from '../auth/org-anthropic-key.js';
+const ANTHROPIC_KEYCHAIN_SERVICE = 'cspeach.anthropic';
+const ANTHROPIC_KEYCHAIN_ACCOUNT = 'api-key';
 export async function runLoginCommand(deps) {
     const proxy = deps.proxyUrl.replace(/\/$/, '');
     const pollInterval = deps.pollIntervalMs ?? 5000;
@@ -92,22 +96,35 @@ export async function runLoginCommand(deps) {
             const me = await r.json();
             deps.print(`✓ Signed in as ${me.email} (${me.plan})`);
             if (me.trial_mode === 'byok' || me.plan === 'byo-key') {
-                deps.print('');
-                deps.print('This account is BYOK — you provide your own Anthropic API key.');
-                deps.print('Get one at https://console.anthropic.com/settings/keys');
-                const ak = (await deps.prompt('Paste your Anthropic API key (sk-ant-...): ')).trim();
-                if (ak.startsWith('sk-ant-') && ak.length > 20) {
-                    // The non-BYOK save above just persisted these exact values,
-                    // so reading them back from disk would be redundant.
-                    await writeAuthFile({
-                        apiKey: polled.api_key,
-                        customerId: polled.customer_id,
-                        byokAnthropicKey: ak,
-                    });
-                    deps.print('✓ Anthropic key saved');
+                // Try to fetch the org's Anthropic key first — non-fatal if unavailable.
+                const orgKey = await fetchOrgAnthropicKey(proxy, polled.api_key, {
+                    fetchImpl: deps.fetchImpl,
+                });
+                const setKey = deps.setKeychainKey ??
+                    ((svc, acct, k) => keytar.setPassword(svc, acct, k));
+                if (orgKey !== null) {
+                    await setKey(ANTHROPIC_KEYCHAIN_SERVICE, ANTHROPIC_KEYCHAIN_ACCOUNT, orgKey);
+                    deps.print('Using your organization\'s Anthropic key.');
                 }
                 else {
-                    deps.print('error: Anthropic key looks malformed (must start with sk-ant-). Skipped — run `cspeach login` again later.');
+                    // Fall back to the manual paste prompt — behaviour unchanged.
+                    deps.print('');
+                    deps.print('This account is BYOK — you provide your own Anthropic API key.');
+                    deps.print('Get one at https://console.anthropic.com/settings/keys');
+                    const ak = (await deps.prompt('Paste your Anthropic API key (sk-ant-...): ')).trim();
+                    if (ak.startsWith('sk-ant-') && ak.length > 20) {
+                        // The non-BYOK save above just persisted these exact values,
+                        // so reading them back from disk would be redundant.
+                        await writeAuthFile({
+                            apiKey: polled.api_key,
+                            customerId: polled.customer_id,
+                            byokAnthropicKey: ak,
+                        });
+                        deps.print('✓ Anthropic key saved');
+                    }
+                    else {
+                        deps.print('error: Anthropic key looks malformed (must start with sk-ant-). Skipped — run `cspeach login` again later.');
+                    }
                 }
             }
         }