@cspeach/cli 1.1.17 → 1.1.19

package/dist/approvals/render.js

@@ -1,13 +1,19 @@
 import { select, input } from '@inquirer/prompts';
 import chalk from 'chalk';
+import { riskReasonText, shownRiskReasons } from './risk-floor.js';
 import { verbLine, viewAffordance, toSourceLines } from './op-labels.js';
 import { shouldUseInk } from '../renderer/tty.js';
 import { approvalEmitter } from '../ui/approval-emitter.js';
-import { askQuestionEmitter } from '../ui/ask-question-emitter.js';
 import { withInquirer } from '../repl/inquirer-guard.js';
 import { inquirerTheme } from '../repl/inquirer-theme.js';
-import { PEACH } from '../renderer/banners.js';
-const peach = (s) => chalk.hex(PEACH)(s);
+import { askConfirm } from '../ui/confirm-request.js';
+import { emitTrace } from '../renderer/trace.js';
+import { getGlyphs } from '../renderer/glyphs.js';
+import { paint } from '../renderer/theme.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { withSpinnerSuspended } from '../renderer/tool-widget.js';
+// Piece 2 §1.1 — the brand accent comes from the theme role, not a legacy hex.
+const peach = (s) => paint('brand', s);
 /**
  * Risk tag. 2026-05-01: yellow used to fire on `medium` too, which
  * meant most plans had a yellow tag — defeating yellow's purpose as
@@ -54,7 +60,7 @@ function colorizeDiff(diff) {
  * per-change prompts that were the main "so much confusion" complaint.
  *
  * Color discipline:
- *   - Peach (PEACH) for the brand-bearing "Plan" header.
+ *   - The brand role for the brand-bearing "Plan" header.
  *   - Default text for the summary, change list. No cyan, no bold-on-bold.
  *   - Yellow tag for medium risk, red for high. Low is dim — no shouting.
  */
@@ -80,57 +86,79 @@ function collapseImplicitActivates(changes) {
         return !writeKeys.has(`${c.type}:${c.object}`);
     });
 }
-export async function renderPlanGate(summary, changes, transport, effectiveRisk) {
+export async function renderPlanGate(summary, changes, transport, effectiveRisk, system) {
     const visibleChanges = collapseImplicitActivates(changes);
     const visibleCount = visibleChanges.length;
     const noun = visibleCount === 1 ? 'change' : 'changes';
-    // Ink path (default): route the gate through the ask_question choice modal so
-    // it renders INSIDE the React frame. The prior inquirer select drew raw to
-    // stdout while Ink owned the terminal — it toggled raw mode out from under
-    // Ink and competed with the Footer for keystrokes (the "turn in progress —
-    // input kept in box" confusion, and dead arrow keys on the modal that
-    // followed). One input system = no handoff, no competition. Mirrors
-    // renderPerChangeApprovalV3, which already went Ink-native via approvalEmitter.
+    // Ink path (piece 2 §5): the plan gate is an APPROVAL confirm card in the
+    // card slot. Same three values, same order, cursor on Apply all; anything
+    // else (Esc, no listener) is 'cancel'. Digits pick on an APPROVAL card
+    // (fix round 3), but typed-ahead keys are dropped (ConfirmCard), so a `1`
+    // or Enter typed before the card opened can't apply a plan. Long plans
+    // print in full to scrollback; the card keeps 4 (controller ruling, C1 fix
+    // round 1: 8 steps broke the spec §2 height cap — rows − 2 — on a 24-row
+    // terminal).
     if (shouldUseInk()) {
-        const ctx = [
+        const MAX_STEPS = 4;
+        const packages = [...new Set(visibleChanges.map((c) => c.package).filter((p) => !!p))];
+        const facts = [
             summary,
-            [`${visibleCount} ${noun}`, riskTag(effectiveRisk.level), transport ? `transport ${transport}` : '']
-                .filter(Boolean).join(' · '),
+            [
+                `${visibleCount} ${noun}`,
+                transport ? `transport ${transport}` : 'no transport',
+                ...(packages.length > 0 ? [`package ${packages.join(', ')}`] : []),
+                `${effectiveRisk.level} risk`,
+            ].join(' · '),
         ];
-        if (effectiveRisk.raisedBy.length > 0) {
-            ctx.push(`(raised from low: ${effectiveRisk.raisedBy.join(', ')})`);
+        const shownReasons = shownRiskReasons(effectiveRisk.raisedBy);
+        if (shownReasons.length > 0) {
+            facts.push(`Risk raised to ${effectiveRisk.level}: ${shownReasons.map(riskReasonText).join('; ')}`);
         }
-        // Numbered, operation-aware verb rows ("1. Create table ZMNT_NOTE") —
-        // no cryptic op-code glyph. The Ink modal renders `context` itself, so
-        // no chalk here.
-        visibleChanges.forEach((c, i) => ctx.push(`  ${i + 1}. ${verbLine(c)}`));
-        const result = await askQuestionEmitter.request({
+        const steps = visibleChanges.map((c, i) => `${i + 1}. ${verbLine(c)}`);
+        if (steps.length > MAX_STEPS) {
+            // Object names are model-supplied: neutralise control characters
+            // before they reach scrollback (the card sanitises its own rows).
+            emitTrace(sanitizeControlChars(['Plan', ...steps.map((s) => `  ${s}`)].join('\n')));
+            facts.push(...steps.slice(0, MAX_STEPS), `${getGlyphs().more} ${steps.length - MAX_STEPS} more steps, listed above`);
+        }
+        else {
+            facts.push(...steps);
+        }
+        const res = await askConfirm({
             id: 'plan-gate',
-            question: 'Apply this plan?',
-            // Strip chalk ANSI from riskTag — the Ink modal renders `context`
-            // itself (dimColor), so embedded escape codes would show as raw text.
-            context: ctx.join('\n').replace(/\x1b\[[0-9;]*m/g, ''),
-            kind: 'choice',
+            tag: 'APPROVAL',
+            title: system ? `Apply this plan on ${system}?` : 'Apply this plan?',
+            facts,
             choices: [
                 { value: 'apply_all', label: `Apply all ${visibleCount} ${noun}` },
-                { value: 'review', label: 'Review each change individually' },
+                { value: 'review', label: 'Review each change one by one' },
                 { value: 'cancel', label: 'Cancel' },
             ],
-        });
-        if (result.answer === 'apply_all' || result.answer === 'review' || result.answer === 'cancel') {
-            return result.answer;
+            initial: 0,
+            footnote: 'Forge Rule 8',
+        }, { traceLabel: 'Plan' });
+        if (res.value === 'apply_all' || res.value === 'review' || res.value === 'cancel') {
+            return res.value;
         }
-        return 'cancel'; // Esc / no answer → cancel the plan (safe default)
+        return 'cancel'; // Esc / no listener / unknown → cancel the plan (safe default)
     }
     // Non-Ink (one-shot / non-TTY / classic): the original inquirer flow.
+    // Review M1: request_approval runs under a live tool spinner — keep it
+    // suspended for the whole preamble + prompt so no stale frame is left.
+    return withSpinnerSuspended(() => classicPlanGate(summary, visibleChanges, transport, effectiveRisk));
+}
+async function classicPlanGate(summary, visibleChanges, transport, effectiveRisk) {
+    const visibleCount = visibleChanges.length;
+    const noun = visibleCount === 1 ? 'change' : 'changes';
     console.log('');
     console.log(`${peach('Plan')}  ${summary}`);
     const meta = [`${visibleCount} ${noun}`, riskTag(effectiveRisk.level)];
     if (transport)
         meta.push(`transport ${transport}`);
     console.log(`      ${chalk.dim(meta.join(' · '))}`);
-    if (effectiveRisk.raisedBy.length > 0) {
-        console.log(`      ${chalk.dim(`(raised from low: ${effectiveRisk.raisedBy.join(', ')})`)}`);
+    const shownReasons = shownRiskReasons(effectiveRisk.raisedBy);
+    if (shownReasons.length > 0) {
+        console.log(`      ${chalk.dim(`(risk raised: ${shownReasons.map(riskReasonText).join('; ')})`)}`);
     }
     visibleChanges.forEach((c, i) => {
         console.log(`        ${chalk.dim(`${i + 1}.`)} ${verbLine(c)}`);
@@ -183,7 +211,7 @@ export async function renderPerChangeApproval(change, effectiveRisk, transport)
     //
     // I3 (2026-07-05 review): a 'v' affordance (create/delete View source) is
     // NOT a diff — the payload is plain/all-adds source. Routing it through the
-    // diff printer fired the "⚠ Model did not provide a unified diff" warning
+    // diff printer fired the "Model did not provide a unified diff" warning
     // under a View source label. Print numbered plain source instead — never
     // the diff path or its warning. (The affordance is only offered when
     // change.diff is present, so the fallback line is belt-and-braces.)
@@ -214,7 +242,7 @@ export async function renderPerChangeApproval(change, effectiveRisk, transport)
             console.log('\n' + colorizeDiff(change.diff) + '\n');
         }
         else {
-            console.log('\n' + chalk.yellow('⚠  Model did not provide a unified diff — only a description:'));
+            console.log('\n' + chalk.yellow(`${getGlyphs().attention}  Model did not provide a unified diff — only a description:`));
             console.log(chalk.dim(change.diff) + '\n');
         }
     }

package/dist/approvals/risk-floor.js

@@ -10,10 +10,33 @@ export function effectiveRisk(declared, changes, ctx) {
     };
     if (ctx.autoApprovePolicy === 'never')
         raise('high', 'non_prod_override');
+    // Round 7 item 8e — never auto-approve anything on an object whose last
+    // syntax check found errors (high is never auto-approved).
+    if (ctx.syntaxErrorObjects && ctx.syntaxErrorObjects.length > 0) {
+        // Keys are `TYPE:NAME` (tools/syntax-state.ts syntaxKey). Re-review 2
+        // item 1: the floor matches on the NAME alone — a type word can be
+        // ambiguous (VIEW, FUNC, TABLE vs STRUCTURE…) or unknown, so any recorded
+        // entry with that name raises. Over-raise, never under-raise: the cost is
+        // a card the user would otherwise not see.
+        const badNames = new Set(ctx.syntaxErrorObjects.map((k) => k.slice(k.lastIndexOf(':') + 1).toUpperCase()));
+        const hit = (c) => badNames.has(c.object.trim().split(/\s+/)[0].toUpperCase());
+        if (changes.some(hit)) {
+            raise('high', 'syntax_errors');
+            // Final review A M-4 — the reason is always shown, even when the floor
+            // was already high (policy never, or declared high).
+            if (!raisedBy.includes('syntax_errors'))
+                raisedBy.push('syntax_errors');
+        }
+    }
     if (changes.some((c) => c.op === 'delete'))
         raise('medium', 'delete_op');
-    if (changes.some((c) => c.op === 'release' || c.op === 'activate'))
-        raise('medium', 'shared_transport');
+    // Round 4 item 8a — these were both labelled 'shared_transport', so a plan
+    // on a transport created seconds earlier read "raised … by shared_transport".
+    // Each reason now says what actually raised it.
+    if (changes.some((c) => c.op === 'release'))
+        raise('medium', 'transport_release');
+    if (changes.some((c) => c.op === 'activate'))
+        raise('medium', 'activation');
     if (ctx.recentAtcFailure && changes.some((c) => ctx.recentAtcFailure.includes(c.object)))
         raise('medium', 'atc_failed_24h');
     if ((ctx.transportRecentDevelopers ?? 0) >= 3)
@@ -24,3 +47,31 @@ export function effectiveRisk(declared, changes, ctx) {
         raise('medium', 'prod_namespace');
     return { level: floor, raisedBy };
 }
+/** Plain words for each risk reason code — the codes stay in audit data only. */
+const RISK_REASON_TEXT = {
+    non_prod_override: 'auto-approve is set to never on this system (a setting, not a risk)',
+    delete_op: 'the plan deletes an object',
+    transport_release: 'the plan releases a transport',
+    activation: 'activation makes the change live on the system',
+    atc_failed_24h: 'ATC failed on this object in the last 24 hours',
+    shared_transport: 'the transport is shared by 3 or more developers',
+    escalated_in_session: 'more than 5 changes in one plan',
+    prod_namespace: 'the object is in a production namespace',
+    syntax_errors: 'the last syntax check of this object found errors',
+};
+/** Round 8 item 4 — every code the floor can raise (each has plain words above). */
+export const RISK_REASON_CODES = Object.keys(RISK_REASON_TEXT);
+/** Round 4 item 8a — never show an internal reason code raw. */
+export function riskReasonText(code) {
+    return RISK_REASON_TEXT[code] ?? code.replace(/_/g, ' ');
+}
+/**
+ * Round 7 item 8b — the reasons a user is SHOWN. `non_prod_override` (the
+ * alias's auto_approve is 'never') raises the floor so nothing auto-approves,
+ * but it is a setting, not a risk: the card read "Risk raised to high:
+ * auto-approve is off for this system". It stays in audit data only.
+ */
+const NOT_A_RISK_REASON = new Set(['non_prod_override']);
+export function shownRiskReasons(raisedBy) {
+    return raisedBy.filter((c) => !NOT_A_RISK_REASON.has(c));
+}

package/dist/auth/api-key.js

@@ -1,17 +1,29 @@
-import keychain from './keychain.js';
+import keychain, { newProbeAccount } from './keychain.js';
 const SERVICE = 'cspeach';
 const ACCOUNT = 'api-key';
 class KeychainStore {
+    /** One probe per store: repeat checks (repl.tsx) reuse the first answer. */
+    available;
     async get() { return keychain.getPassword(SERVICE, ACCOUNT); }
     async set(key) { await keychain.setPassword(SERVICE, ACCOUNT, key); }
     async delete() { await keychain.deletePassword(SERVICE, ACCOUNT); }
-    async isKeychainAvailable() {
+    isKeychainAvailable() {
+        this.available ??= this.probe();
+        return this.available;
+    }
+    async probe() {
         try {
+            // Round 4 item 7 — a per-process account: a fixed 'probe' entry was
+            // deleted by a second cspeach starting at the same time.
+            const account = newProbeAccount();
             const probe = `probe-${Date.now()}`;
-            await keychain.setPassword(SERVICE, 'probe', probe);
-            const ok = (await keychain.getPassword(SERVICE, 'probe')) === probe;
-            await keychain.deletePassword(SERVICE, 'probe');
-            return ok;
+            try {
+                await keychain.setPassword(SERVICE, account, probe);
+                return (await keychain.getPassword(SERVICE, account)) === probe;
+            }
+            finally {
+                await keychain.deletePassword(SERVICE, account).catch(() => false);
+            }
         }
         catch {
             return false;
@@ -25,16 +37,18 @@ class EphemeralStore {
     async delete() { this.cached = null; }
     async isKeychainAvailable() { return false; }
 }
+/**
+ * Round 4 item 4 — memoise the PROMISE, not the result. The startup upgrade
+ * check and runOneShot call getStore() concurrently; with a memoised result
+ * both ran a probe, and a probe that lost the race REPLACED the shared store
+ * with the in-memory EphemeralStore — the next get() found no key
+ * ("No API key configured" / uncaught no_api_key on `cspeach … < /dev/null`).
+ */
 let store;
-export async function getStore() {
-    if (store)
-        return store;
-    const ktr = new KeychainStore();
-    if (await ktr.isKeychainAvailable()) {
-        store = ktr;
-    }
-    else {
-        store = new EphemeralStore();
-    }
+export function getStore() {
+    store ??= (async () => {
+        const ktr = new KeychainStore();
+        return (await ktr.isKeychainAvailable()) ? ktr : new EphemeralStore();
+    })();
     return store;
 }

package/dist/auth/me.js

@@ -2,18 +2,36 @@
  * Fetch /v1/me — customer profile + entitlements + usage.
  * Result envelope so the REPL doesn't need try/catch.
  */
+/** Default /v1/me budget. The panels brand line waits for this call (D5), so a
+ *  hung proxy must not mean a blank screen. */
+export const FETCH_ME_TIMEOUT_MS = 5000;
 export async function fetchMe(opts) {
     const url = `${opts.proxyUrl.replace(/\/$/, '')}/v1/me`;
+    const timeoutMs = opts.timeoutMs ?? FETCH_ME_TIMEOUT_MS;
+    const signal = AbortSignal.timeout(timeoutMs);
+    // Race the signal too, so even a fetch that ignores it cannot hang startup.
+    // A timeout is a status-0 failure (the failed-refresh path), never a 401.
+    const timedOut = new Promise((_, reject) => {
+        signal.addEventListener('abort', () => reject(new Error(`timed out after ${timeoutMs} ms`)), { once: true });
+    });
+    timedOut.catch(() => { });
     try {
-        const r = await fetch(url, { headers: { Authorization: `Bearer ${opts.apiKey}` } });
-        if (!r.ok) {
-            const body = await r.json().catch(() => ({}));
-            return { ok: false, status: r.status, error: body.error ?? 'unknown' };
-        }
-        const profile = await r.json();
-        return { ok: true, profile };
+        return await Promise.race([
+            (async () => {
+                const r = await fetch(url, { headers: { Authorization: `Bearer ${opts.apiKey}` }, signal });
+                if (!r.ok) {
+                    const body = await r.json().catch(() => ({}));
+                    return { ok: false, status: r.status, error: body.error ?? 'unknown' };
+                }
+                const profile = await r.json();
+                return { ok: true, profile };
+            })(),
+            timedOut,
+        ]);
     }
     catch (err) {
+        if (signal.aborted)
+            return { ok: false, status: 0, error: `timed out after ${timeoutMs} ms` };
         return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err) };
     }
 }

package/dist/cli.js

@@ -4,12 +4,16 @@ import { runAddSapWizard } from './sap/onboarding.js';
 import { runGcOnStartup } from './session/gc.js';
 import { checkForUpgrade } from './upgrade-check.js';
 import { extractSapAliasFlag, extractNoSapFlag } from './cli-args.js';
+import { applyColorMode } from './renderer/color-mode.js';
 /**
  * The verbs that make `cspeach project …` a mistyped team command rather than
  * a prompt somebody meant to send. See the check in `main`.
  */
 const TEAM_SUBCOMMANDS = new Set(['init', 'join', 'lane', 'refresh', 'status', 'outbox', 'rule', 'leave']);
 export async function main(argv) {
+    // NO_COLOR (piece 2 §1.2) — before ANY output, for every command (REPL,
+    // one-shot, doctor, login, help, config …).
+    applyColorMode();
     runGcOnStartup().catch(() => { });
     checkForUpgrade().catch(() => { });
     let args = argv.slice(2);
@@ -36,12 +40,9 @@ export async function main(argv) {
         const { runUpgrade } = await import('./upgrade.js');
         return runUpgrade();
     }
-    if (args[0] === '--resume') {
-        const { runResume } = await import('./session/resume.js');
-        return runResume(args[1]);
-    }
-    // C.1 — extract --sap-alias <name> early so it is available for REPL and
-    // one-shot paths. Validation requires loading config to know available aliases.
+    // C.1 — extract --sap-alias <name> early so it is available for REPL,
+    // one-shot and resume paths (round 6 review C1: it used to be parsed after
+    // the --resume branch, so a resume never saw it). Validation requires loading config to know available aliases.
     let sapAlias;
     if (args.includes('--sap-alias')) {
         const { loadConfig } = await import('./config/loader.js');
@@ -55,6 +56,15 @@ export async function main(argv) {
         sapAlias = parsed.sapAlias;
         args = parsed.rest;
     }
+    if (args[0] === '--resume') {
+        // Final batch 5 — `--resume --one-shot "…"`: a flag is never a session id.
+        if (args[1]?.startsWith('-')) {
+            console.error(chalk.red(`error: --resume takes a session id, not '${args[1]}'. Usage: cspeach --resume [<id>]  (no id → pick from a list)`));
+            return 1;
+        }
+        const { runResume } = await import('./session/resume.js');
+        return runResume(args[1], { sapAlias, noSap });
+    }
     // Standalone profile wizard — re-runnable any time. Checked BEFORE the plain
     // `configure` branch so `configure --standalone` isn't swallowed by it.
     // Asks what system the code will land on, then the standards question.
@@ -203,6 +213,15 @@ export async function main(argv) {
         const { runOneShot } = await import('./one-shot.js');
         return runOneShot(args.join(' '), { sapAlias, noSap });
     }
+    // Round 8 item 3 — `echo "prompt" | cspeach`: a piped stdin carrying one
+    // prompt runs as --one-shot (stdout = the answer only). Scripted pipes
+    // (slash lines), empty or live stdin stay with the REPL, nothing consumed.
+    const { readPipedPrompt } = await import('./lib/piped-prompt.js');
+    const piped = await readPipedPrompt(process.stdin);
+    if (piped.kind === 'prompt') {
+        const { runOneShot } = await import('./one-shot.js');
+        return runOneShot(piped.text, { sapAlias, noSap });
+    }
     // No args → REPL.
     const { runRepl } = await import('./repl.js');
     return runRepl({ sapAlias, noSap });

package/dist/commands/compact.js

@@ -26,8 +26,11 @@
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import chalk from 'chalk';
 import { sessionsDir } from '../config/paths.js';
+import { panelHeading, panelRow } from '../renderer/panel-rows.js';
+import { formatInfo } from '../renderer/notice-shape.js';
+import { paint } from '../renderer/theme.js';
+import { getGlyphs } from '../renderer/glyphs.js';
 import { saveSession } from '../session/store.js';
 import { isUserPrompt } from '../session/user-prompt.js';
 /** Keep this many recent user-prompt anchored turns verbatim. */
@@ -277,18 +280,18 @@ export function formatCompactResult(result,
 /** Optional — falls back to the legacy constant for back-compat. */
 keepRecentTurns = KEEP_RECENT_TURNS) {
     if (!result.performed) {
-        return chalk.dim(`/compact: ${result.reason ?? 'nothing to do'}`);
+        return formatInfo(`/compact: ${result.reason ?? 'nothing to do'}`).trimEnd();
     }
     const lines = [
         '',
-        chalk.bold('/compact complete'),
-        chalk.dim(`  dropped:   ${result.droppedTurns} messages`),
-        chalk.dim(`  kept:      ${result.keptTurns} messages (most recent ${keepRecentTurns} user turns intact)`),
-        chalk.dim(`  summary:   ~${result.summaryTokens?.toLocaleString()} tokens`),
-        chalk.dim(`  backup:    ${result.backupPath}`),
+        panelHeading('Compacted', 'older turns summarised'),
+        panelRow('Dropped', `${result.droppedTurns} messages`),
+        panelRow('Kept', `${result.keptTurns} messages (most recent ${keepRecentTurns} user turns intact)`),
+        panelRow('Summary', `~${result.summaryTokens?.toLocaleString()} tokens`),
+        panelRow('Backup', `${result.backupPath}`),
         '',
-        chalk.green('Next turn\'s context is now roughly summary-size instead of full history.'),
-        chalk.dim('Heads-up: the very next turn rebuilds the prompt cache (one-off cost), then turns after that are cheap again.'),
+        `${paint('ok', getGlyphs().done)} The next turn's context is roughly summary-size instead of the full history.`,
+        formatInfo('The very next turn rebuilds the prompt cache once; turns after that are cheap again.').trimEnd(),
         '',
     ];
     return lines.join('\n');

package/dist/commands/config-set.js

@@ -1,4 +1,5 @@
 import chalk from 'chalk';
+import { formatAttention } from '../renderer/notice-shape.js';
 import { loadConfig, saveConfig, isValidWriteMode } from '../config/loader.js';
 import { STANDALONE_PLATFORMS, STANDALONE_DATABASES, STANDALONE_DEPLOYMENTS, STANDALONE_IDES, isStandalonePlatform, deriveDatabase, deriveDeployment, defaultAbapCloudOnly, defaultRelease, } from '../sap/standalone-profile.js';
 /**
@@ -350,8 +351,11 @@ export async function runConfigSet(args) {
         }
         cfg.sap[alias].insecure_skip_tls_verify = b;
         if (b) {
-            console.log(chalk.yellow(`  ⚠ TLS verification will be DISABLED for ${alias} — dev only, NEVER use in production. ` +
-                `Prefer: cspeach config set sap.${alias}.ca_cert_path <path-to-corporate-CA>`));
+            console.log(formatAttention({
+                text: `TLS verification is off for ${alias}`,
+                fact: 'dev only, never in production',
+                next: `cspeach config set sap.${alias}.ca_cert_path <path-to-corporate-CA>`,
+            }).trimEnd());
         }
         await saveConfig(cfg);
         console.log(chalk.green(`Set ${key} = ${b}`));

package/dist/commands/config-show.js

@@ -1,5 +1,7 @@
 import chalk from 'chalk';
 import { loadConfig } from '../config/loader.js';
+import { paint } from '../renderer/theme.js';
+import { formatAttention } from '../renderer/notice-shape.js';
 /**
  * Dotted paths of keys that must never appear in plaintext config output.
  * SAP passwords live in the keychain and should never land in config.toml,
@@ -57,7 +59,7 @@ function printLlmMissingHints(llm) {
     for (const key of required) {
         const value = llm[key];
         if (value === undefined || value === null || value === '') {
-            console.log(`${key} = ${chalk.red('<not set>')}`);
+            console.log(`${key} = ${paint('bad', '<not set>')}`);
         }
     }
 }
@@ -83,14 +85,14 @@ function printConfigAsToml(cfg, prefix = '') {
             // the implication (writes proposed, never executed) without having to
             // read the docs.
             if (fullKey === 'write_mode' && v === 'advisory-only') {
-                console.log(chalk.yellow('  → Advisory mode: writes will be proposed, never executed.'));
+                console.log('  ' + formatAttention({ text: 'Advisory mode', fact: 'writes are proposed, never executed' }).trimEnd());
             }
         }
     }
     for (const [k, v] of tables) {
         const fullKey = prefix ? `${prefix}.${k}` : k;
         console.log('');
-        console.log(chalk.cyan(`[${fullKey}]`));
+        console.log(chalk.bold(`[${fullKey}]`));
         printConfigAsToml(v, fullKey);
         // Mode-aware extras for the `[llm]` section — print required keys that
         // are empty as `<not set>` so a user who ran `cspeach config set llm.mode
@@ -158,7 +160,7 @@ export async function runConfigShow(args) {
     if (typeof resolved === 'object' && resolved !== null) {
         // Sub-object (e.g. sap.S4H-DEV) — print as TOML section
         console.log('');
-        console.log(chalk.cyan(`[${keyPath}]`));
+        console.log(chalk.bold(`[${keyPath}]`));
         for (const [k, v] of Object.entries(resolved)) {
             const subKey = `${keyPath}.${k}`;
             if (REDACTED_KEYS.has(subKey)) {
@@ -173,7 +175,7 @@ export async function runConfigShow(args) {
     else {
         console.log(String(resolved));
         if (keyPath === 'write_mode' && resolved === 'advisory-only') {
-            console.log(chalk.yellow('  → Advisory mode: writes will be proposed, never executed.'));
+            console.log('  ' + formatAttention({ text: 'Advisory mode', fact: 'writes are proposed, never executed' }).trimEnd());
         }
     }
 }