@cspeach/cli 1.1.1 → 1.1.3

package/dist/agent/loop.js

@@ -1,7 +1,7 @@
 import chalk from 'chalk';
 import { basename } from 'node:path';
 import { dispatchTool } from './tool-dispatch.js';
-import { listTools, getTool, toAnthropicTools } from '../tools/index.js';
+import { listTools, getTool, toAnthropicTools, isStandalone, toolsForContext } from '../tools/index.js';
 import { saveSession } from '../session/store.js';
 import { recordCompletedToolCall } from '../session/pending.js';
 import { loadConfig } from '../config/loader.js';
@@ -19,6 +19,8 @@ import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
 //  two-line dispatch renderer; re-add if a future in-place spinner returns)
 import { buildRetryCapPausePayload, buildSkippedSiblingResults } from './retry-cap.js';
 import { appendCostLine, buildEntry as buildCostEntry } from '../cost/cost-log.js';
+import { computeSessionCost } from '../cost/session-cost.js';
+import { globalStore } from '../ui/sap-state-store.js';
 import { lastAssistantIsAwaitingAnswer } from '../session/awaiting-answer.js';
 import { enrichUserMessage } from '../router/intent-extractor.js';
 import { resetRule8State, shouldGateRule8 } from '../repl/rule8-detector.js';
@@ -28,6 +30,9 @@ import { input } from '@inquirer/prompts';
 import { withInquirer } from '../repl/inquirer-guard.js';
 import { expandTextFileAttachments } from '../projects/workspace.js';
 import { getSapSystemInfo, renderSapSystemBlock } from '../sap/system-info.js';
+import { renderStandaloneContextBlock } from '../sap/standalone-profile.js';
+import { renderStandardsBlock } from '../standards/standards-file.js';
+import { composeSessionContextBlock } from './session-context.js';
 import { objectKeyFromInput } from './retry-key.js';
 import { repairPartialBlocks, healSessionMessagesInPlace, isPartialJsonApiError } from './repair-partial.js';
 import { drainSteering } from './steering-queue.js';
@@ -348,10 +353,23 @@ export async function runTurn(params) {
     // before — no behavioral regression.
     let sapSystemBlock = '';
     let sapSystemInfo = null;
-    if (params.ctx.adt && params.ctx.sapAlias) {
+    const standaloneTurn = isStandalone(params.ctx);
+    if (standaloneTurn) {
+        // Standalone (2026-09-16): nothing to probe. Render the SAME
+        // `<sap_system …/>` element shape from the stored standalone profile —
+        // so skills read one element in both modes — plus the manual-
+        // implementation hand-off note.
+        sapSystemBlock = renderStandaloneContextBlock(cfg.standalone);
+    }
+    else if (params.ctx.adt && params.ctx.sapAlias) {
         sapSystemInfo = await getSapSystemInfo(params.ctx.adt, params.ctx.sapAlias);
         sapSystemBlock = renderSapSystemBlock(sapSystemInfo);
     }
+    // Customer development standards — opt-in, both modes. Renders '' when the
+    // user has no standards file, so the composed block (and therefore the whole
+    // prompt) stays byte-identical to pre-feature output for existing users.
+    const standardsBlock = await renderStandardsBlock(params.ctx.cwd);
+    const sessionContextBlock = composeSessionContextBlock([sapSystemBlock, standardsBlock]);
     // Deterministically extract structured facts from the user's prompt
     // (package, transport, object names, environment hint, create intent)
     // and prepend them as an XML `<session_context>` block. The model reads
@@ -366,7 +384,7 @@ export async function runTurn(params) {
     // when extraction yields nothing (enrichUserMessage returns original).
     const enriched = userMessageForLLM.startsWith('<session_context>')
         ? userMessageForLLM
-        : enrichUserMessage(userMessageForLLM, sapSystemBlock);
+        : enrichUserMessage(userMessageForLLM, sessionContextBlock);
     // Phase 2 of Track B — opt-in project-context enrichment, gated by
     // CSPEACH_PROJECT_CONTEXT=on. Default OFF: production behavior is
     // identical to today. When on, the rendered <project_context> block
@@ -503,7 +521,9 @@ export async function runTurn(params) {
                 // W2.5 — apply optional tool filter (used by agent_run with
                 // read_only: true to send a smaller, read-only tool list to
                 // the subagent). Mirrors CC's Tq2() pattern.
-                const allTools = listTools();
+                // Standalone (2026-09-16): hide every SAP-dependent tool from the
+                // model — calling one could only fail. Identity when connected.
+                const allTools = toolsForContext(listTools(), params.ctx);
                 const filteredTools = params.toolFilter ? allTools.filter(params.toolFilter) : allTools;
                 const tools = toAnthropicTools(filteredTools);
                 // Bug 11a (proactive heal, 2026-06-07) — strip any residual
@@ -698,6 +718,11 @@ export async function runTurn(params) {
                         session.usage.cache_creation_input_tokens =
                             (session.usage.cache_creation_input_tokens ?? 0)
                                 + (msgUsage.cache_creation_input_tokens ?? 0);
+                        // F-L2-2 — live spend. The store's 200ms trailing rate limiter
+                        // absorbs stream-event volume; no extra throttling here.
+                        if (params.pushSpend) {
+                            globalStore.update({ dollarSpendToday: computeSessionCost(session) });
+                        }
                     }
                     // New message begins — reset the per-message cumulative-output scratch.
                     messageOutputTokensSoFar = 0;
@@ -720,6 +745,10 @@ export async function runTurn(params) {
                         if (inc > 0) {
                             session.usage.output_tokens += inc;
                             messageOutputTokensSoFar = deltaUsage.output_tokens;
+                            // F-L2-2 — live spend (see message_start above).
+                            if (params.pushSpend) {
+                                globalStore.update({ dollarSpendToday: computeSessionCost(session) });
+                            }
                         }
                     }
                 }

package/dist/agent/session-context.js

@@ -0,0 +1,24 @@
+/**
+ * Helpers for assembling the `<session_context>` preamble the agent loop
+ * prepends to each user message.
+ *
+ * `formatFactBlock` (router/intent-extractor.ts) takes ONE pre-rendered string
+ * and indents only its first line, so anything we add after the `<sap_system>`
+ * element has to carry its own two-space body indent. This helper is that
+ * single, tested place — the loop just hands it the parts it has.
+ */
+/**
+ * Join the non-empty context parts into one block the fact-formatter can take.
+ *
+ * - No parts (or all empty) → '' — the caller's output is then byte-identical
+ *   to the pre-feature behaviour.
+ * - One part → returned untouched.
+ * - Several → separated by a newline plus the two-space `<session_context>`
+ *   body indent, so each part starts on its own indented line. Inner lines of a
+ *   multi-line part (e.g. the standards document body) are left flush: they are
+ *   element CONTENT, and indenting them would only pad the prompt.
+ */
+export function composeSessionContextBlock(parts) {
+    const nonEmpty = parts.filter((p) => typeof p === 'string' && p.length > 0);
+    return nonEmpty.join('\n  ');
+}

package/dist/agent/tool-dispatch.js

@@ -1,4 +1,5 @@
-import { getTool } from '../tools/index.js';
+import { getTool, isStandalone } from '../tools/index.js';
+import { NOT_CONNECTED_MESSAGE } from '../sap/offline-adt-client.js';
 import { presentSafetyConfirmation } from '../repl/safety-confirm.js';
 import { shouldGateRule8, recordWriteOp, renderPlanSummary, getWriteOpsThisTurn, } from '../repl/rule8-detector.js';
 export async function dispatchTool(name, args, ctx) {
@@ -6,6 +7,21 @@ export async function dispatchTool(name, args, ctx) {
     if (!tool) {
         return { content: JSON.stringify({ error: `unknown_tool: ${name}` }), is_error: true };
     }
+    // Standalone safety net (2026-09-16). SAP-dependent tools are already
+    // filtered out of the list the model sees (agent/loop.ts), but a model can
+    // still call a tool it remembers from an earlier turn or from training. Fail
+    // as a normal tool ERROR RESULT — never a throw — so the model reads the
+    // message and recovers by asking the user to paste the source instead.
+    if (tool.requiresSap && isStandalone(ctx)) {
+        return {
+            content: JSON.stringify({
+                error: 'sap_not_connected',
+                standalone: true,
+                message: NOT_CONNECTED_MESSAGE,
+            }),
+            is_error: true,
+        };
+    }
     // Rule 8 — no batch without plan. 2nd+ mutating call this turn requires
     // explicit confirmation. Fires regardless of /safety-mode toggle (batch
     // detection is unconditional per Plan 3 §6.6).

package/dist/approvals/jwt.js

@@ -76,9 +76,20 @@ export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp)
     // signature-verification failure code. Mismatch reasons (nonce, object,
     // op) fall out of the post-verify checks below and are returned
     // verbatim — no catch involved.
+    //
+    // F-L2-13: normalize the token at the tool boundary. An approval_id that
+    // arrives wrapped in stray whitespace (a model-emitted argument with a
+    // trailing newline, a copy/paste with leading spaces) is a structurally
+    // valid JWT that jose rejects as malformed — the user then sees
+    // APPROVAL_INVALID / invalid_signature, which reads as "your token is
+    // forged" and offers no way forward. Trimming here covers all 10
+    // tool-boundary callers (sap-write.ts, transport.ts) at one site. Nonce
+    // bookkeeping keys on the decoded `payload.nonce`, never on the raw
+    // string, so trimming cannot desynchronize single-use accounting.
+    const token = String(jwt ?? '').trim();
     let payload;
     try {
-        const verified = await jwtVerify(jwt, sessionKey);
+        const verified = await jwtVerify(token, sessionKey);
         payload = verified.payload;
     }
     catch (err) {

package/dist/cli-args.js

@@ -36,3 +36,27 @@ export function extractSapAliasFlag(args, availableAliases) {
     const rest = [...args.slice(0, idx), ...args.slice(idx + 2)];
     return { sapAlias: alias, rest };
 }
+/**
+ * Scan `args` for `--no-sap` (standalone mode — run without a SAP system).
+ *
+ * - Absent: returns `{ noSap: false, rest: args }` — the SAME array reference,
+ *   so every downstream path stays byte-identical to pre-feature behaviour.
+ * - Present: strips EVERY occurrence and returns `{ noSap: true, rest }`.
+ * - Present together with `--sap-alias`: returns `{ error, rest: args }`.
+ *   Asking for a specific system AND for no system at all is a contradiction
+ *   the CLI refuses rather than silently resolving one way.
+ */
+export function extractNoSapFlag(args) {
+    if (!args.includes('--no-sap')) {
+        return { noSap: false, rest: args };
+    }
+    if (args.includes('--sap-alias')) {
+        return {
+            noSap: true,
+            rest: args,
+            error: 'error: --no-sap and --sap-alias cannot be combined. ' +
+                'Use --no-sap to run without a SAP system, or --sap-alias <name> to pick one.',
+        };
+    }
+    return { noSap: true, rest: args.filter((a) => a !== '--no-sap') };
+}

package/dist/cli.js

@@ -3,11 +3,22 @@ import { CLI_VERSION } from './lib/version.js';
 import { runAddSapWizard } from './sap/onboarding.js';
 import { runGcOnStartup } from './session/gc.js';
 import { checkForUpgrade } from './upgrade-check.js';
-import { extractSapAliasFlag } from './cli-args.js';
+import { extractSapAliasFlag, extractNoSapFlag } from './cli-args.js';
 export async function main(argv) {
     runGcOnStartup().catch(() => { });
     checkForUpgrade().catch(() => { });
     let args = argv.slice(2);
+    // Standalone mode (2026-09-16) — `--no-sap` is accepted ANYWHERE in the args
+    // for both the REPL and one-shot, and stripped like `--sap-alias` below.
+    // Absent, `extractNoSapFlag` hands back the same array, so every existing
+    // path stays byte-identical.
+    const noSapParsed = extractNoSapFlag(args);
+    if (noSapParsed.error) {
+        console.error(chalk.red(noSapParsed.error));
+        return 1;
+    }
+    const noSap = noSapParsed.noSap;
+    args = noSapParsed.rest;
     if (args[0] === '--help' || args[0] === '-h') {
         printHelp();
         return 0;
@@ -39,6 +50,15 @@ export async function main(argv) {
         sapAlias = parsed.sapAlias;
         args = parsed.rest;
     }
+    // Standalone profile wizard — re-runnable any time. Checked BEFORE the plain
+    // `configure` branch so `configure --standalone` isn't swallowed by it.
+    // Asks what system the code will land on, then the standards question.
+    if ((args[0] === 'config' && args[1] === 'standalone')
+        || (args[0] === 'configure' && args[1] === '--standalone')) {
+        const { runStandaloneProfileWizard } = await import('./sap/standalone-onboarding.js');
+        await runStandaloneProfileWizard({ cwd: process.cwd() });
+        return 0;
+    }
     if (args[0] === 'configure') {
         console.log(chalk.dim('(alias for `cspeach config add-sap`)'));
         await runAddSapWizard();
@@ -48,6 +68,12 @@ export async function main(argv) {
         await runAddSapWizard();
         return 0;
     }
+    // Capture / import the team's development standards (works connected too).
+    if (args[0] === 'standards' && (args[1] === 'init' || args[1] === undefined)) {
+        const { runStandardsInit } = await import('./standards/standards-init.js');
+        await runStandardsInit(process.cwd());
+        return 0;
+    }
     if (args[0] === 'config' && args[1] === 'set') {
         const { runConfigSet, ConfigSetError } = await import('./commands/config-set.js');
         try {
@@ -124,16 +150,16 @@ export async function main(argv) {
     }
     if (args[0] === '--one-shot') {
         const { runOneShot } = await import('./one-shot.js');
-        return runOneShot(args.slice(1).join(' '), { sapAlias });
+        return runOneShot(args.slice(1).join(' '), { sapAlias, noSap });
     }
     // Default: if first arg exists and is not a flag, treat as one-shot prompt.
     if (args.length > 0 && !args[0].startsWith('-')) {
         const { runOneShot } = await import('./one-shot.js');
-        return runOneShot(args.join(' '), { sapAlias });
+        return runOneShot(args.join(' '), { sapAlias, noSap });
     }
     // No args → REPL.
     const { runRepl } = await import('./repl.js');
-    return runRepl({ sapAlias });
+    return runRepl({ sapAlias, noSap });
 }
 function printHelp() {
     console.log(`
@@ -144,8 +170,11 @@ Usage:
   cspeach "<prompt>"                One-shot — runs one turn and exits
   cspeach --one-shot "<prompt>"     Same as above, explicit flag
   cspeach --sap-alias <name>        Use a specific SAP alias (overrides default)
+  cspeach --no-sap                  Start without a SAP system (paste-mode skills only)
   cspeach --resume [id]             Resume a previous session (list if no id)
   cspeach config add-sap            Add a SAP system interactively
+  cspeach config standalone         Set the standalone SAP profile (no system)
+  cspeach standards init            Capture your team's ABAP development standards
   cspeach configure                 Alias for \`cspeach config add-sap\`
   cspeach config set <key> <value>  Update a config key
   cspeach config unset <key>        Remove a config key (revert to default)

package/dist/commands/config-set.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
 import { loadConfig, saveConfig, isValidWriteMode } from '../config/loader.js';
+import { STANDALONE_PLATFORMS, STANDALONE_DATABASES, STANDALONE_DEPLOYMENTS, STANDALONE_IDES, isStandalonePlatform, deriveDatabase, deriveDeployment, defaultAbapCloudOnly, defaultRelease, } from '../sap/standalone-profile.js';
 /**
  * Mutable keys exposed via `cspeach config set`.
  * Any key not in this set is rejected with an error listing valid keys.
@@ -17,6 +18,7 @@ const MUTABLE_KEYS = new Set([
     'write_mode',
     'plan_mode',
     'plan_audit',
+    'no_sap',
     'llm.mode',
     'llm.ai_hub_base_url',
     'llm.ai_hub_model_alias',
@@ -33,6 +35,17 @@ const SAP_ROLE_RE = /^sap\.([A-Z0-9_-]{2,32})\.role$/;
 // SAP-scoped TLS keys: sap.<alias>.ca_cert_path | sap.<alias>.insecure_skip_tls_verify
 const SAP_CA_CERT_PATH_RE = /^sap\.([A-Z0-9_-]{2,32})\.ca_cert_path$/;
 const SAP_INSECURE_TLS_RE = /^sap\.([A-Z0-9_-]{2,32})\.insecure_skip_tls_verify$/;
+// Standalone-profile keys: standalone.<field> (dotted, like the sap.* family).
+const STANDALONE_KEY_RE = /^standalone\.([a-z_]+)$/;
+const STANDALONE_FIELDS = [
+    'platform',
+    'release',
+    'database',
+    'deployment',
+    'ide',
+    'abap_cloud_only',
+    'notes',
+];
 /**
  * Coerce a user-typed on/off-style string to a boolean. Accepts the common
  * spellings a developer expects from a CLI toggle (`on`/`true`/`1` → true,
@@ -93,9 +106,10 @@ const VIRTUAL_KEYCHAIN_KEYS = new Set(['llm.byok_key', 'llm.ai_hub_token']);
  * the deprecated `local_files` alias — the canonical name is `local_build`).
  */
 function unsettableKeyList() {
-    return [...MUTABLE_KEYS]
-        .filter((k) => !VIRTUAL_KEYCHAIN_KEYS.has(k) && k !== 'local_files')
-        .join(', ');
+    return [
+        ...[...MUTABLE_KEYS].filter((k) => !VIRTUAL_KEYCHAIN_KEYS.has(k) && k !== 'local_files'),
+        ...UNSET_ONLY_KEYS,
+    ].join(', ');
 }
 /**
  * Mark a top-level config key as explicitly user-set so sparse serialisation
@@ -114,6 +128,76 @@ export function markExplicit(cfg, key) {
     if (!cfg.file_keys.includes(top))
         cfg.file_keys.push(top);
 }
+/** Human-readable "allowed values" error for a standalone.<field> set. */
+function standaloneValueError(field, value) {
+    switch (field) {
+        case 'platform':
+            return `Invalid standalone.platform "${value}". Allowed: ${STANDALONE_PLATFORMS.join(', ')}`;
+        case 'database':
+            return `Invalid standalone.database "${value}". Allowed: ${STANDALONE_DATABASES.join(', ')}`;
+        case 'deployment':
+            return `Invalid standalone.deployment "${value}". Allowed: ${STANDALONE_DEPLOYMENTS.join(', ')}`;
+        case 'ide':
+            return `Invalid standalone.ide "${value}". Allowed: ${STANDALONE_IDES.join(', ')}`;
+        case 'abap_cloud_only':
+            return 'standalone.abap_cloud_only must be on/off (also accepts true/false, 1/0).';
+        default:
+            return `standalone.${field} cannot be empty.`;
+    }
+}
+/**
+ * Apply one `standalone.<field>` value to the (possibly absent) profile.
+ *
+ * Setting `platform` on an absent profile seeds the whole table from that
+ * platform's derivations, so `config set standalone.platform S/4HANA` alone
+ * leaves a complete, consistent profile. Changing the platform later keeps the
+ * user's other answers — they said those on purpose.
+ */
+function applyStandaloneField(current, field, value) {
+    if (!current) {
+        // Guarded by the caller: only `platform` reaches here with no profile.
+        const platform = value;
+        return {
+            platform,
+            release: defaultRelease(platform),
+            database: deriveDatabase(platform) ?? 'HANA',
+            deployment: deriveDeployment(platform) ?? 'on-prem',
+            ide: 'ADT',
+            abap_cloud_only: defaultAbapCloudOnly(platform),
+        };
+    }
+    const next = { ...current };
+    switch (field) {
+        case 'platform':
+            next.platform = value;
+            break;
+        case 'release':
+            next.release = value.trim();
+            break;
+        case 'database':
+            next.database = value;
+            break;
+        case 'deployment':
+            next.deployment = value;
+            break;
+        case 'ide':
+            next.ide = value;
+            break;
+        case 'abap_cloud_only':
+            next.abap_cloud_only = coerceBool(value);
+            break;
+        case 'notes':
+            next.notes = value.trim();
+            break;
+    }
+    return next;
+}
+/**
+ * Keys `config unset` accepts that are NOT flat `config set` targets.
+ * `standalone` is a table written field-by-field via `standalone.<field>`, but
+ * users still need one command to clear the whole profile.
+ */
+const UNSET_ONLY_KEYS = new Set(['standalone']);
 /**
  * Delete a (possibly dotted, max 2-level) key from a loaded config in place.
  * Returns true if the key was present and removed, false if it was already
@@ -175,7 +259,7 @@ export async function runConfigUnset(args) {
     if (key.startsWith('sap.')) {
         errUnset(`"${key}" is a SAP-scoped key — those are managed per system via \`cspeach config set ${key} <value>\`, not config unset.`);
     }
-    if (!MUTABLE_KEYS.has(key)) {
+    if (!MUTABLE_KEYS.has(key) && !UNSET_ONLY_KEYS.has(key)) {
         errUnset(`Unknown key "${key}". Valid keys: ${unsettableKeyList()}`);
     }
     const cfg = await loadConfig();
@@ -272,6 +356,30 @@ export async function runConfigSet(args) {
         console.log(chalk.green(`Set ${key} = ${b}`));
         return;
     }
+    // Standalone-profile key: standalone.<field>. Mirrors the sap.<alias>.<key>
+    // shape — a dotted key handled before the flat MUTABLE_KEYS switch.
+    const standaloneMatch = STANDALONE_KEY_RE.exec(key);
+    if (standaloneMatch) {
+        const field = standaloneMatch[1];
+        if (!STANDALONE_FIELDS.includes(field)) {
+            err(`Unknown standalone key "${key}". Valid: ${STANDALONE_FIELDS.map((f) => `standalone.${f}`).join(', ')}`);
+        }
+        if (!validateValue(key, value)) {
+            err(standaloneValueError(field, value));
+        }
+        const cfg = await loadConfig();
+        // The platform is load-bearing: every other field's default derives from
+        // it. Refuse to invent one so a lone `standalone.release` can never sit
+        // under a silently-guessed platform.
+        if (!cfg.standalone && field !== 'platform') {
+            err(`Set the platform first: cspeach config set standalone.platform <${STANDALONE_PLATFORMS.join(' | ')}>`);
+        }
+        cfg.standalone = applyStandaloneField(cfg.standalone, field, value);
+        markExplicit(cfg, key);
+        await saveConfig(cfg);
+        console.log(chalk.green(`Set ${key} = ${value}`));
+        return;
+    }
     // Virtual keys that store secrets in the OS keychain instead of config.toml.
     if (key === 'llm.byok_key' || key === 'llm.ai_hub_token') {
         // Support stdin piping for secrets: `echo "key" | cspeach config set llm.byok_key -`
@@ -384,6 +492,16 @@ export async function runConfigSet(args) {
             console.log(chalk.dim('  → takes effect on the next `cspeach` launch.'));
             break;
         }
+        case 'no_sap': {
+            // Standalone mode — start without a SAP system (paste-mode skills only).
+            const b = coerceBool(value);
+            if (b === null) {
+                err(`${key} must be on/off (also accepts true/false, 1/0).`);
+            }
+            cfg.no_sap = b;
+            console.log(chalk.dim('  → takes effect on the next `cspeach` launch.'));
+            break;
+        }
         case 'write_mode':
             if (!isValidWriteMode(value)) {
                 err(`Invalid value for write_mode. Must be one of: auto, approval-gated, advisory-only`);
@@ -476,6 +594,21 @@ export function validateValue(key, value) {
     if (SAP_INSECURE_TLS_RE.test(key)) {
         return coerceBool(value) !== null;
     }
+    // Standalone-profile keys: standalone.<field>
+    const standaloneMatch = STANDALONE_KEY_RE.exec(key);
+    if (standaloneMatch) {
+        const field = standaloneMatch[1];
+        switch (field) {
+            case 'platform': return isStandalonePlatform(value);
+            case 'database': return STANDALONE_DATABASES.includes(value);
+            case 'deployment': return STANDALONE_DEPLOYMENTS.includes(value);
+            case 'ide': return STANDALONE_IDES.includes(value);
+            case 'abap_cloud_only': return coerceBool(value) !== null;
+            case 'release':
+            case 'notes': return value.trim().length > 0;
+            default: return false;
+        }
+    }
     if (!MUTABLE_KEYS.has(key))
         return false;
     switch (key) {
@@ -506,6 +639,8 @@ export function validateValue(key, value) {
             return PLAN_MODE_VALUES.includes(value);
         case 'plan_audit':
             return PLAN_AUDIT_VALUES.includes(value);
+        case 'no_sap':
+            return coerceBool(value) !== null;
         case 'llm.mode':
             return LLM_MODE_VALUES.includes(value);
         case 'llm.ai_hub_base_url':

package/dist/config/loader.js

@@ -3,6 +3,7 @@ import { isDeepStrictEqual } from 'node:util';
 import toml from '@iarna/toml';
 import { configFile, cspeachRoot } from './paths.js';
 import { DEFAULT_SESSION_MODEL } from './model-defaults.js';
+import { sanitiseStandaloneProfile } from '../sap/standalone-profile.js';
 /**
  * Whitelist guard for WriteMode — rejects typos / stale values from disk so
  * downstream code that trusts the WriteMode type doesn't see garbage.
@@ -141,6 +142,19 @@ export async function loadConfig() {
             // resolveRenderSmoke reads as the default ON (fail-safe: a config typo can
             // never silently disable the smoke).
             render_smoke: typeof parsed.render_smoke === 'boolean' ? parsed.render_smoke : undefined,
+            // no_sap: same absent-preserving coercion as local_build (the key is
+            // dropped below when undefined, so it never serialises as
+            // `no_sap = undefined`). A present-but-invalid value collapses to
+            // `false` — fail-safe: a config typo can never silently disconnect a
+            // user from the SAP system they configured.
+            no_sap: parsed.no_sap === true
+                ? true
+                : parsed.no_sap === undefined
+                    ? undefined
+                    : false,
+            // standalone: whitelist-coerced profile table. An unrecognised platform
+            // drops the whole table (undefined → key deleted below).
+            standalone: sanitiseStandaloneProfile(parsed.standalone),
             write_mode: isValidWriteMode(parsed.write_mode) ? parsed.write_mode : DEFAULT_CONFIG.write_mode,
             // plan_mode: whitelist coercion — anything but the two valid literals
             // (typos, wrong types) collapses to undefined, which callers treat as
@@ -210,6 +224,14 @@ export async function loadConfig() {
         // callers see a genuine "absent" shape (resolveRenderSmoke treats it as ON).
         if (merged.render_smoke === undefined)
             delete merged.render_smoke;
+        // Same for `no_sap` and `standalone`: absent-or-invalid must not serialise
+        // as `undefined` — drop the keys so `config show` stays clean and callers
+        // see a genuine "absent" shape (resolveStandalone treats missing as off,
+        // and an absent profile triggers the standalone wizard).
+        if (merged.no_sap === undefined)
+            delete merged.no_sap;
+        if (merged.standalone === undefined)
+            delete merged.standalone;
         // Same for `plan_mode`: absent-or-invalid must not serialise as
         // `plan_mode = undefined` — drop the key so `config show` stays clean and
         // callers see a genuine "absent" shape (treated as 'step').
@@ -305,6 +327,18 @@ export function resolveLocalBuild(cfg) {
 export function resolveRenderSmoke(cfg) {
     return cfg.render_smoke ?? true;
 }
+/**
+ * Resolve the effective standalone ("no SAP system") mode.
+ *
+ *     effective = --no-sap flag OR config no_sap   (default false)
+ *
+ * The flag can only turn standalone ON for a single run — there is no
+ * "--sap" counterpart — so the resolution is an OR, not a precedence chain.
+ * `no_sap` is already coerced to `true | false | undefined` by loadConfig.
+ */
+export function resolveStandalone(cfg, flagNoSap = false) {
+    return flagNoSap === true || cfg.no_sap === true;
+}
 export async function saveConfig(config) {
     await fs.mkdir(cspeachRoot(), { recursive: true });
     // The set of top-level keys the FILE carried (empty when it was absent).

package/dist/cost/pricing.js

@@ -24,6 +24,10 @@
  */
 import { getServerModelConfig } from '../models/server-config.js';
 const PRICING = {
+    // Claude 5 family (2026-09-15) — Opus 5 keeps the Opus 4.5+ rate ($5/$25);
+    // Sonnet 5 is $2/$10. Cache read = 10% of input, cache write = 1.25x input.
+    'claude-opus-5': { inputPer1M: 5.00, outputPer1M: 25.00, cacheReadPer1M: 0.50, cacheCreatePer1M: 6.25 },
+    'claude-sonnet-5': { inputPer1M: 2.00, outputPer1M: 10.00, cacheReadPer1M: 0.20, cacheCreatePer1M: 2.50 },
     // Claude Opus 4.5+ — input 5, output 25, cache_read 0.50, cache_write 6.25 (1.25x input).
     // 2026-06-07 correction: 4.5/4.6/4.7 were carried at the LEGACY $15/$75; actual
     // since Opus 4.5 is $5/$25. Only claude-opus-4 (4.0/4.1) genuinely was $15/$75.

package/dist/cost/session-cost.js

@@ -0,0 +1,28 @@
+/**
+ * Session-scoped cost total — the single source of truth for the statusline
+ * `$` segment and the printed status footer's session line.
+ *
+ * F-L2-2 (2026-08-11): this computation was inlined in
+ * `repl/post-turn-status.ts`, the POST-turn chokepoint. That meant the
+ * statusline spend only ever moved between turns — during a long turn (the
+ * exact moment a user wants to watch the meter) it sat frozen. Extracted
+ * here verbatim so the agent loop can call it mid-stream (after each
+ * `message_start` / `message_delta` usage mutation) and push the running
+ * total to the store.
+ *
+ * Honest-semantics caveat, carried over unchanged from the original site:
+ * the total is priced at `session.model` over LIFETIME `session.usage`. On a
+ * session with model-tiered turns (A4 modelOverride) that is a mixed-model
+ * approximation — the per-turn cost JSONL records the model that actually
+ * ran. Same caveat as the footer's session line.
+ */
+import { computeCost } from './pricing.js';
+/** USD cost of the session's lifetime usage, priced at `session.model`. */
+export function computeSessionCost(session) {
+    return computeCost(session.model, {
+        input: session.usage.input_tokens,
+        output: session.usage.output_tokens,
+        cacheRead: session.usage.cache_read_input_tokens,
+        cacheCreate: session.usage.cache_creation_input_tokens ?? 0,
+    });
+}

package/dist/doctor/checks/_standalone-skip.js

@@ -0,0 +1,37 @@
+/**
+ * Shared "standalone mode is ON" result for the doctor's SAP checks.
+ *
+ * Standalone mode (2026-09-16) made "deliberately no SAP system" a SUPPORTED
+ * state, so with `no_sap = true` these checks report a neutral yellow `-` line
+ * that does not count toward the failed total.
+ *
+ * NOTHING else changes. With standalone OFF — including the plain "hasn't run
+ * `config add-sap` yet" case — every check keeps its original result, message
+ * and exit-code contribution, byte for byte.
+ */
+export const STANDALONE_SKIP_MESSAGE = 'standalone mode — SAP checks skipped';
+/**
+ * True ONLY when the user has opted into standalone mode via `no_sap = true`.
+ *
+ * Deliberately does NOT treat "no aliases configured" as standalone: for a
+ * user who simply hasn't added a system yet, a missing SAP connection is still
+ * a finding, and the pre-standalone output must be preserved exactly.
+ *
+ * Reads `cfg.no_sap` directly rather than calling `resolveStandalone` so this
+ * helper stays free of a runtime dependency on config/loader — several doctor
+ * tests replace that whole module with a mock. (`doctor` is its own process
+ * invocation, so the per-run `--no-sap` flag never reaches it anyway.)
+ */
+export function sapChecksSkipped(cfg) {
+    return cfg.no_sap === true;
+}
+/** The neutral skip result for a named check. */
+export function standaloneSkip(name) {
+    return {
+        name,
+        ok: false,
+        skipped: true,
+        message: STANDALONE_SKIP_MESSAGE,
+        hint: 'Connect a system any time with: cspeach config add-sap',
+    };
+}

package/dist/doctor/checks/cert.js

@@ -1,7 +1,12 @@
 import tls from 'node:tls';
 import { loadConfig, resolveSapTls } from '../../config/loader.js';
+import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
 export async function checkCert() {
     const cfg = await loadConfig();
+    // Standalone mode ONLY — an opted-in paste-mode user has nothing to probe.
+    // Everything below (including the "n/a" no-TLS line) is unchanged.
+    if (sapChecksSkipped(cfg))
+        return standaloneSkip('cert');
     const systems = Object.entries(cfg.sap).filter(([_, s]) => s.useSsl);
     if (systems.length === 0)
         return { name: 'cert', ok: true, message: 'n/a (no TLS SAP systems configured)' };