@cspeach/cli 1.1.1 → 1.1.2

package/dist/agent/loop.js

@@ -19,6 +19,8 @@ import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
 //  two-line dispatch renderer; re-add if a future in-place spinner returns)
 import { buildRetryCapPausePayload, buildSkippedSiblingResults } from './retry-cap.js';
 import { appendCostLine, buildEntry as buildCostEntry } from '../cost/cost-log.js';
+import { computeSessionCost } from '../cost/session-cost.js';
+import { globalStore } from '../ui/sap-state-store.js';
 import { lastAssistantIsAwaitingAnswer } from '../session/awaiting-answer.js';
 import { enrichUserMessage } from '../router/intent-extractor.js';
 import { resetRule8State, shouldGateRule8 } from '../repl/rule8-detector.js';
@@ -698,6 +700,11 @@ export async function runTurn(params) {
                         session.usage.cache_creation_input_tokens =
                             (session.usage.cache_creation_input_tokens ?? 0)
                                 + (msgUsage.cache_creation_input_tokens ?? 0);
+                        // F-L2-2 — live spend. The store's 200ms trailing rate limiter
+                        // absorbs stream-event volume; no extra throttling here.
+                        if (params.pushSpend) {
+                            globalStore.update({ dollarSpendToday: computeSessionCost(session) });
+                        }
                     }
                     // New message begins — reset the per-message cumulative-output scratch.
                     messageOutputTokensSoFar = 0;
@@ -720,6 +727,10 @@ export async function runTurn(params) {
                         if (inc > 0) {
                             session.usage.output_tokens += inc;
                             messageOutputTokensSoFar = deltaUsage.output_tokens;
+                            // F-L2-2 — live spend (see message_start above).
+                            if (params.pushSpend) {
+                                globalStore.update({ dollarSpendToday: computeSessionCost(session) });
+                            }
                         }
                     }
                 }

package/dist/approvals/jwt.js

@@ -76,9 +76,20 @@ export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp)
     // signature-verification failure code. Mismatch reasons (nonce, object,
     // op) fall out of the post-verify checks below and are returned
     // verbatim — no catch involved.
+    //
+    // F-L2-13: normalize the token at the tool boundary. An approval_id that
+    // arrives wrapped in stray whitespace (a model-emitted argument with a
+    // trailing newline, a copy/paste with leading spaces) is a structurally
+    // valid JWT that jose rejects as malformed — the user then sees
+    // APPROVAL_INVALID / invalid_signature, which reads as "your token is
+    // forged" and offers no way forward. Trimming here covers all 10
+    // tool-boundary callers (sap-write.ts, transport.ts) at one site. Nonce
+    // bookkeeping keys on the decoded `payload.nonce`, never on the raw
+    // string, so trimming cannot desynchronize single-use accounting.
+    const token = String(jwt ?? '').trim();
     let payload;
     try {
-        const verified = await jwtVerify(jwt, sessionKey);
+        const verified = await jwtVerify(token, sessionKey);
         payload = verified.payload;
     }
     catch (err) {

package/dist/cost/session-cost.js

@@ -0,0 +1,28 @@
+/**
+ * Session-scoped cost total — the single source of truth for the statusline
+ * `$` segment and the printed status footer's session line.
+ *
+ * F-L2-2 (2026-08-11): this computation was inlined in
+ * `repl/post-turn-status.ts`, the POST-turn chokepoint. That meant the
+ * statusline spend only ever moved between turns — during a long turn (the
+ * exact moment a user wants to watch the meter) it sat frozen. Extracted
+ * here verbatim so the agent loop can call it mid-stream (after each
+ * `message_start` / `message_delta` usage mutation) and push the running
+ * total to the store.
+ *
+ * Honest-semantics caveat, carried over unchanged from the original site:
+ * the total is priced at `session.model` over LIFETIME `session.usage`. On a
+ * session with model-tiered turns (A4 modelOverride) that is a mixed-model
+ * approximation — the per-turn cost JSONL records the model that actually
+ * ran. Same caveat as the footer's session line.
+ */
+import { computeCost } from './pricing.js';
+/** USD cost of the session's lifetime usage, priced at `session.model`. */
+export function computeSessionCost(session) {
+    return computeCost(session.model, {
+        input: session.usage.input_tokens,
+        output: session.usage.output_tokens,
+        cacheRead: session.usage.cache_read_input_tokens,
+        cacheCreate: session.usage.cache_creation_input_tokens ?? 0,
+    });
+}

package/dist/renderer/abap-inline.js

@@ -7,6 +7,7 @@
  *   ```abap  → existing ABAP regex logic (unchanged)
  *   ```cds   → cli-highlight CDS grammar (via syntax.ts)
  *   ```bdef  → cli-highlight BDEF grammar (via syntax.ts)
+ *   ```ddl   → cli-highlight CDS grammar (ddl is a CDS alias; via syntax.ts)
  *   ```<any other or empty> → pass through (no highlight)
  *
  * The function is renamed `applyCodeHighlight`. A deprecation re-export
@@ -64,7 +65,7 @@ export function applyCodeHighlight(text) {
                 // dependency for the hottest fenced-block type.
                 out.push(highlightAbapBlock(body));
             }
-            else if (lang === 'cds' || lang === 'bdef') {
+            else if (lang === 'cds' || lang === 'bdef' || lang === 'ddl') {
                 // cli-highlight grammars via the Task 5 dispatcher.
                 out.push(highlightCodeBlock(body, lang));
             }

package/dist/renderer/syntax.js

@@ -47,7 +47,13 @@ const hljs = createRequire(require.resolve('cli-highlight'))('highlight.js');
 hljs.registerLanguage('abap', () => abapGrammar);
 hljs.registerLanguage('cds', () => cdsGrammar);
 hljs.registerLanguage('bdef', () => bdefGrammar);
-const SUPPORTED = new Set(['abap', 'cds', 'bdef']);
+// `ddl` is an alias of the CDS grammar: ```ddl fences carry CDS DDL source
+// (the abap-rap templates emit them). Registering it on the same hljs
+// instance also silences marked-terminal's "Could not find the language
+// 'ddl'" warning, since marked-terminal calls cli-highlight directly with
+// the raw fence lang and never goes through highlightCodeBlock().
+hljs.registerLanguage('ddl', () => cdsGrammar);
+const SUPPORTED = new Set(['abap', 'cds', 'bdef', 'ddl']);
 /**
  * Highlight a code block body (without fence markers).
  *

package/dist/repl/current-transport.js

@@ -15,12 +15,23 @@
  * Module-scope singleton per CLI process. Tests must call clearCurrentTransport()
  * in beforeEach to avoid leakage across Vitest test files.
  *
- * Task 9 (ux-wave1) — this setter is ALSO the single statusline wire for the
+ * Task 9 (ux-wave1) — this setter is ALSO a statusline wire for the
  * `tr <TRKORR>` segment: every path that changes the session transport
  * (sap_transport create success, owning-transport adoption in the create
  * guard, /transport slash command) funnels through set/clear here, so the
  * globalStore push lives HERE rather than scattered across tool handlers.
  * Store writes are harmless in classic mode (nothing subscribes there).
+ *
+ * F-L2-1 (2026-08-11) — that wire alone is not enough, so this module now
+ * carries a SECOND, write-side wire: noteWriteTransport(). The session flow
+ * above is the only writer of `store.transport`, but a per-write `corrNr`
+ * coming from a prompt or a plan never travels through it — live evidence: a
+ * whole session's writes stamped S4HK903635 while the statusline read
+ * `tr none`. noteWriteTransport records what a write ACTUALLY stamped into a
+ * SEPARATE store field (`lastWriteTransport`) that the statusline falls back
+ * to. It deliberately does NOT touch the session pointer below: that pointer
+ * feeds the 3-tier write-transport fallback, and moving it would change write
+ * behaviour, not just the display.
  */
 import { globalStore } from '../ui/sap-state-store.js';
 let currentTransport = null;
@@ -35,6 +46,17 @@ export function clearCurrentTransport() {
     currentTransport = null;
     globalStore.update({ transport: null });
 }
+/**
+ * Statusline-only wire (F-L2-1): record the transport actually stamped on the
+ * last successful write. Never touches the session transport pointer — see the
+ * module doc. No-op on a falsy trkorr (local / $TMP objects write without one,
+ * and blanking the display there would lose the last real datapoint).
+ */
+export function noteWriteTransport(trkorr) {
+    if (!trkorr)
+        return;
+    globalStore.update({ lastWriteTransport: trkorr });
+}
 /**
  * Handles the `/transport [<trkorr>|clear]` slash command. Returns user-facing
  * status text. Mirrors the shape of handleSafetyModeCommand in safety-mode-state.ts.

package/dist/repl/post-turn-status.js

@@ -18,6 +18,7 @@
  * primary per-turn status surface.
  */
 import { computeCost } from '../cost/pricing.js';
+import { computeSessionCost } from '../cost/session-cost.js';
 import { globalStore } from '../ui/sap-state-store.js';
 import { printStatusFooter, formatStatusFooter } from '../renderer/status-footer.js';
 import { shouldUseInk } from '../renderer/tty.js';
@@ -43,12 +44,9 @@ export function pushPostTurnStatus(params) {
         cacheCreate: (session.usage.cache_creation_input_tokens ?? 0) - snapshot.cacheCreate,
     };
     const turnCost = computeCost(turnModel ?? session.model, turnCostTokens);
-    const sessionCost = computeCost(session.model, {
-        input: session.usage.input_tokens,
-        output: session.usage.output_tokens,
-        cacheRead: session.usage.cache_read_input_tokens,
-        cacheCreate: session.usage.cache_creation_input_tokens ?? 0,
-    });
+    // F-L2-2: extracted to cost/session-cost.ts so the agent loop can push the
+    // SAME total mid-stream. This call site is unchanged in behaviour.
+    const sessionCost = computeSessionCost(session);
     // Task 9 (ux-wave1) — statusline spend wire. Honest semantics note: the
     // store field is named `dollarSpendToday` (legacy sidebar naming, kept to
     // avoid rename churn) but the value written is SESSION-scoped — the same
@@ -56,6 +54,11 @@ export function pushPostTurnStatus(params) {
     // lifetime session.usage at session.model rates (mixed-model turns are an
     // approximation, same caveat as the footer's session line). There is no
     // day-spanning ledger; the statusline shows session spend.
+    //
+    // F-L2-2 (2026-08-11): the agent loop now pushes the same value mid-stream
+    // so the segment ticks DURING a turn, not only between turns. This push
+    // stays as the authoritative end-of-turn settle (the loop's pushes are
+    // gated to REPL turns; this one runs on every path that reaches here).
     globalStore.update({ dollarSpendToday: sessionCost });
     const statusPayload = {
         sessionId: session.id,

package/dist/repl.js

@@ -822,6 +822,7 @@ export async function runRepl(opts) {
                         skill: rr.skill,
                         ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, chunkEmitter, todoEmitter, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
                         chunkEmitter,
+                        pushSpend: true, // F-L2-2 — top-level REPL turn: live statusline spend
                     });
                 }
                 finally {
@@ -1254,6 +1255,7 @@ export async function runRepl(opts) {
                     skill: skill,
                     ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, chunkEmitter, todoEmitter, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
                     chunkEmitter,
+                    pushSpend: true, // F-L2-2 — top-level REPL turn: live statusline spend
                     signal: currentTurnAbort.signal,
                     suppressSaveHook: planResume !== null || planContinue !== null,
                     // A4 — undefined on every non-plan turn (and when tiering is off).
@@ -2270,6 +2272,7 @@ export async function runRepl(opts) {
                 userMessage: rr.prompt,
                 skill: rr.skill,
                 ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, chunkEmitter: classicOutputEmitter, todoEmitter, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
+                pushSpend: true, // F-L2-2 — top-level REPL turn: live statusline spend
             });
             continue;
         }
@@ -2797,6 +2800,7 @@ export async function runRepl(opts) {
                 userMessage: prompt,
                 skill: skill,
                 ctx: { adt, sapAlias: selectedAlias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: replPreviewHook, chunkEmitter: classicOutputEmitter, todoEmitter, currentTransport: currentTransportAccessor, pendingDispatch: pendingDispatchAccessor },
+                pushSpend: true, // F-L2-2 — top-level REPL turn: live statusline spend
                 signal: turnAbort.signal,
                 suppressSaveHook: planResume !== null || planContinue !== null,
                 // A4 — undefined on every non-plan turn (and when tiering is off).