@cspeach/cli 1.1.18 → 1.1.19

package/dist/commands/plan-chain.js

@@ -28,6 +28,10 @@ import { decideNextPhaseGate, getAndResetPlanPhaseSubagentDispatches, getAndRese
 import { runPhaseAudit } from './plan-audit.js';
 import { applyAuditResult, applyPhaseResolution, buildResumeCommand, offerNextPhaseAutoRun, } from './plan-resume.js';
 import { appendCostLine, buildEntry } from '../cost/cost-log.js';
+import { getGlyphs } from '../renderer/glyphs.js';
+import { formatFailure, formatAttention, formatInfo } from '../renderer/notice-shape.js';
+import { paint } from '../renderer/theme.js';
+import { clean } from '../renderer/tool-labels.js';
 import { startThinkingHeartbeat, AUDIT_HEARTBEAT_THRESHOLDS } from '../renderer/thinking-heartbeat.js';
 import { computeCost, formatCost } from '../cost/pricing.js';
 import { creditsActive } from '../cost/credits.js';
@@ -47,7 +51,7 @@ export async function runPostPhaseChain(args) {
         return null;
     let phase = loaded.content.phases.find((p) => p.id === args.executedPhaseId);
     if (!phase) {
-        args.log(chalk.red(`[plan] phase '${args.executedPhaseId}' not found in ${basename(path)} — chain skipped.`));
+        args.log(formatFailure({ what: 'Plan phase not found', object: args.executedPhaseId, detail: [`${basename(path)} · follow-up steps skipped`] }).trimEnd());
         return path;
     }
     // Per-run flags survive the chain: an explicitly flagged run keeps its mode
@@ -89,7 +93,7 @@ export async function runPostPhaseChain(args) {
             clearAudit: true,
             log: args.log,
         });
-        args.log(chalk.red(`✖ plan deviation in phase ${phase.id} — ${deviationDetail}`), stoppedBanner(`plan deviation — phase ${phase.id} blocked (undeclared write denied)`, resumeCmd(path)));
+        args.log(formatFailure({ what: 'Plan deviation', object: `phase ${phase.id}`, detail: [deviationDetail] }).trimEnd(), stoppedBanner(`plan deviation — phase ${phase.id} blocked (undeclared write denied)`, resumeCmd(path)));
         ringBell();
         return path;
     }
@@ -244,7 +248,7 @@ export async function runPostPhaseChain(args) {
             // finding against the phase, whose own exit gate (activation + ATC)
             // already passed. So we do NOT hard-stop verified work: exactly like a
             // warn/pass, render a LOUD, DISTINCT "could not run / NOT verified" note,
-            // keep the infra_failed state recorded (tracker keeps ⚠ audit not run;
+            // keep the infra_failed state recorded (tracker keeps "! audit not run";
             // the final summary lists it as unverified) and CONTINUE to the gate +
             // offer below. isAuditResolved treats infra_failed as resolved, so
             // dependants unlock and the failure menu is never shown.
@@ -253,7 +257,7 @@ export async function runPostPhaseChain(args) {
         else if (verdict.state === 'failed') {
             renderFindings(args.log, phase.id, verdict.findings);
             if (forceBlock) {
-                args.log(chalk.red(`✖ phase ${phase.id} failed its audit ${countedFailures} times in a row — marked blocked.`), stoppedBanner('two consecutive failed audits — phase blocked', resumeCmd(path)));
+                args.log(formatFailure({ what: `Phase ${phase.id} failed its audit ${countedFailures} times in a row`, detail: ['marked blocked'] }).trimEnd(), stoppedBanner('two consecutive failed audits — phase blocked', resumeCmd(path)));
                 ringBell();
                 return path;
             }
@@ -291,7 +295,7 @@ export async function runPostPhaseChain(args) {
                     summary: `audit ${phase.id}: failed — user chose re-run (status → todo)`,
                     log: args.log,
                 });
-                args.log(`↩ re-running phase ${phase.id} — it will be re-audited after execution.`);
+                args.log(formatInfo(`Re-running phase ${phase.id} · it will be re-audited after execution.`).trimEnd());
                 args.queueDispatch(resumeCmd(path));
                 return path;
             }
@@ -308,7 +312,7 @@ export async function runPostPhaseChain(args) {
             if (!loaded)
                 return path;
             phase = loaded.content.phases.find((p) => p.id === args.executedPhaseId);
-            args.log(chalk.yellow(`✎ audit waived (${category}) for ${phase.id} — reason recorded in the envelope.`));
+            args.log(paint('dim', `${getGlyphs().info} audit waived (${category}) for ${phase.id} — reason recorded in the envelope.`));
         }
         else if (verdict.state === 'warn') {
             // Non-blocking tier: ALWAYS shown, concise (Open-Q decision — warns are
@@ -317,7 +321,7 @@ export async function runPostPhaseChain(args) {
             renderWarnings(args.log, phase.id, verdict.findings);
         }
         else {
-            args.log(chalk.green(`✔ audit passed — ${phase.id} verified against the evidence.`));
+            args.log(paint('ok', `${getGlyphs().done} audit passed · ${phase.id} verified against the evidence.`));
         }
     }
     /* ── 2. gate + offer ──────────────────────────────────────────────────── */
@@ -383,6 +387,7 @@ export async function runPostPhaseChain(args) {
             nextDelegateTo: next.delegateTo,
         },
         prompt: args.prompt,
+        confirm: args.confirm,
         queueDispatch: args.queueDispatch,
         log: args.log,
         gate: decision,
@@ -439,8 +444,11 @@ export async function runReauditPass(args) {
         if (queued) {
             const remaining = phaseIds.slice(i + 1);
             if (remaining.length > 0) {
-                args.log(chalk.yellow(`⚠ ${remaining.length} hand-edited phase(s) not re-audited yet: ${remaining.join(', ')} — `
-                    + 'they are not auto-detected after this write; verify them (or re-run their phases) once the queued dispatch completes.'));
+                args.log(formatAttention({
+                    text: `${remaining.length} hand-edited phase(s) not re-audited yet`,
+                    fact: remaining.join(', '),
+                    next: 'they are not auto-detected after this write; verify them (or re-run their phases) once the queued dispatch completes',
+                }).trimEnd());
             }
             break;
         }
@@ -452,18 +460,18 @@ function loadPlan(path, log) {
     try {
         const envelope = readProjectFile(path);
         if (envelope.artefactType !== 'plan') {
-            log(chalk.red(`[plan] ${basename(path)} is not a plan envelope — chain skipped.`));
+            log(formatFailure({ what: 'Not a plan file', object: basename(path), detail: ['follow-up steps skipped'] }).trimEnd());
             return null;
         }
         const pc = parsePlanContent(envelope.content);
         if (!pc.ok) {
-            log(chalk.red(`[plan] ${basename(path)} failed content validation — chain skipped: ${pc.errors[0] ?? ''}`));
+            log(formatFailure({ what: 'Plan file failed validation', object: basename(path), detail: [pc.errors[0] ?? '', 'follow-up steps skipped'] }).trimEnd());
             return null;
         }
         return { envelope, content: pc.content };
     }
     catch (e) {
-        log(chalk.red(`[plan] could not load ${basename(path)} — ${e instanceof Error ? e.message : String(e)}`));
+        log(formatFailure({ what: 'Could not load the plan file', object: basename(path), detail: [e instanceof Error ? e.message : String(e)] }).trimEnd());
         return null;
     }
 }
@@ -491,7 +499,7 @@ function clampInfra(msg) {
     return flat.length > INFRA_RENDER_CHARS ? flat.slice(0, INFRA_RENDER_CHARS - 1).trimEnd() + '…' : flat;
 }
 function renderFindings(log, phaseId, findings) {
-    log('', chalk.red(`✖ audit FAILED for phase ${phaseId}:`));
+    log('', paint('bad', `${getGlyphs().failed} audit FAILED for phase ${phaseId}:`));
     const shown = findings.length > 0 ? findings : ['(auditor returned no findings text)'];
     shown.forEach((f, i) => log(`  ${i + 1}. ${f}`));
 }
@@ -503,7 +511,7 @@ function renderFindings(log, phaseId, findings) {
  */
 function renderWarnings(log, phaseId, findings) {
     const n = findings.length;
-    log('', chalk.yellow(`⚠ audit passed with ${n} note${n === 1 ? '' : 's'} for phase ${phaseId}:`));
+    log('', paint('warn', `${getGlyphs().attention} audit passed with ${n} note${n === 1 ? '' : 's'} for phase ${phaseId}:`));
     const shown = n > 0 ? findings : ['(auditor returned a warn verdict with no note detail)'];
     shown.forEach((f, i) => log(`  ${i + 1}. ${f}`));
 }
@@ -517,51 +525,36 @@ function renderWarnings(log, phaseId, findings) {
  * nothing else surfaces this).
  */
 function renderAuditNotRun(log, phaseId, reason, resumeCommand) {
-    log('', chalk.yellow(`⚠ audit could not run for phase ${phaseId} (audit infrastructure failed after 3 attempts — the model call returned no output).`), chalk.yellow('  This phase is NOT audit-verified; its own exit gate (activation + ATC) passed. Proceeding.'), chalk.dim(`  reason: ${reason}`), chalk.dim(`  If the auditor keeps failing, run with --no-audit (or set audit off in config) to stop retrying; resume as usual: ${resumeCommand}`));
+    log('', paint('warn', `${getGlyphs().attention} audit could not run for phase ${phaseId} (audit infrastructure failed after 3 attempts — the model call returned no output).`), paint('warn', '  This phase is NOT audit-verified; its own exit gate (activation + ATC) passed. Proceeding.'), paint('dim', `  reason: ${reason}`), paint('dim', `  If the auditor keeps failing, run with --no-audit (or set audit off in config) to stop retrying; resume as usual: ${resumeCommand}`));
 }
 /**
  * Shared menu surface for the audit-resolution selects. Mirrors
  * safety-confirm.ts: headless → no decision (fail-closed, nothing written);
- * Ink → askQuestionEmitter choice modal; classic → inquirer select.
+ * Ink → confirm card via askConfirm (piece 2 §5); classic → inquirer select.
  */
 async function selectAuditAction(args) {
     const { isHeadless, shouldUseInk } = await import('../renderer/tty.js');
     if (isHeadless())
         return 'none';
     if (shouldUseInk()) {
-        // D-C — this modal opens in the POST-PHASE chain, after the phase turn
-        // ended. Its sibling gate presentSafetyConfirmation (repl/safety-confirm.ts)
-        // documents the exact failure this caused live: opening the askQuestion
-        // modal while another render source (the in-place tool spinner, a ticking
-        // turn-status row) still repaints the Ink frame lets the first keystroke
-        // LEAK past the modal and auto-select its FIRST choice. Here the first
-        // choice is "Re-run phase", so the menu never visibly rendered and the
-        // phase silently re-ran — the reported symptom. Claim exclusive input
-        // focus the same way safety-confirm does: stop the spinner, freeze the
-        // status row, restore both in the finally.
-        const { clearActiveSpinner } = await import('../renderer/tool-widget.js');
-        const { turnStatusEmitter } = await import('../ui/turn-status-emitter.js');
-        const { askQuestionEmitter } = await import('../ui/ask-question-emitter.js');
-        clearActiveSpinner();
-        const statusWasActive = turnStatusEmitter.snapshot().active;
-        if (statusWasActive)
-            turnStatusEmitter.pause();
-        try {
-            const res = await askQuestionEmitter.request({
-                id: args.id,
-                question: args.question,
-                context: args.context,
-                kind: 'choice',
-                choices: args.choices,
-            });
-            if (res.cancelled || res.answer == null)
-                return 'none';
-            return coerceAction(res.answer, args.choices);
-        }
-        finally {
-            if (statusWasActive)
-                turnStatusEmitter.resume();
-        }
+        // D-C — this card opens in the POST-PHASE chain. A leaked keystroke used
+        // to auto-select choice 1 ("Re-run phase") and silently re-run the
+        // phase. The card slot claims input focus (spinner stopped, status row
+        // paused, restored after), digits only move the cursor, and typed-ahead
+        // keys are dropped — so no stray key can pick a choice.
+        const { askConfirm } = await import('../ui/confirm-request.js');
+        const res = await askConfirm({
+            id: args.id,
+            tag: 'SAFETY CHECK',
+            title: args.question,
+            facts: args.facts,
+            choices: args.choices,
+            initial: 0,
+            footnote: 'Plan audit',
+        });
+        if (res.cancelled || res.value == null)
+            return 'none';
+        return coerceAction(res.value, args.choices);
     }
     const { select } = await import('@inquirer/prompts');
     const { withInquirer } = await import('../repl/inquirer-guard.js');
@@ -583,12 +576,23 @@ async function selectAuditAction(args) {
 function coerceAction(answer, choices) {
     return choices.some((c) => c.value === answer) ? answer : 'none';
 }
-/** Production failed-verdict menu (see selectAuditAction for the surface). */
-async function defaultSelectFailureAction(a) {
+/** Production failed-verdict menu (see selectAuditAction for the surface).
+ *  The findings are already printed above by renderFindings; the card
+ *  repeats only the count and the first three. */
+export async function defaultSelectFailureAction(a) {
+    const n = a.findings.length;
+    const facts = [
+        `${n} ${n === 1 ? 'finding' : 'findings'}, listed above`,
+        // Findings are model text: display-clean them at the source (ANSI and
+        // control characters out, one line each), like the safety-card rows.
+        ...a.findings.slice(0, 3).map((f, i) => `${i + 1}. ${clean(f)}`),
+    ];
+    if (n > 3)
+        facts.push(`${getGlyphs().more} ${n - 3} more`);
     return selectAuditAction({
         id: 'plan-audit-failed',
         question: `Audit failed for phase ${a.phaseId} — what now?`,
-        context: a.findings.map((f, i) => `${i + 1}. ${f}`).join('\n'),
+        facts,
         choices: [
             { value: 'rerun', label: 'Re-run phase (re-audited after execution)' },
             { value: 'waive', label: 'Waive audit (record a one-line reason)' },
@@ -604,7 +608,8 @@ async function defaultSelectFailureAction(a) {
  * a waive no human explicitly labelled a false-positive is recorded as
  * accepted-risk, so the measured FP rate never over-counts). Never hangs.
  */
-async function defaultSelectWaiveCategory(a) {
+/** Exported for the piece-2 behaviour pins (plan-chain-focus-pin.test.ts). */
+export async function defaultSelectWaiveCategory(a) {
     const { isHeadless, shouldUseInk } = await import('../renderer/tty.js');
     if (isHeadless())
         return 'accepted-risk';
@@ -615,30 +620,19 @@ async function defaultSelectWaiveCategory(a) {
     ];
     const coerce = (answer) => choices.some((c) => c.value === answer) ? answer : 'accepted-risk';
     if (shouldUseInk()) {
-        // Same input-focus discipline as selectAuditAction — this modal opens in
-        // the post-phase chain, so a leaked keystroke must not auto-select choice 1.
-        const { clearActiveSpinner } = await import('../renderer/tool-widget.js');
-        const { turnStatusEmitter } = await import('../ui/turn-status-emitter.js');
-        const { askQuestionEmitter } = await import('../ui/ask-question-emitter.js');
-        clearActiveSpinner();
-        const statusWasActive = turnStatusEmitter.snapshot().active;
-        if (statusWasActive)
-            turnStatusEmitter.pause();
-        try {
-            const res = await askQuestionEmitter.request({
-                id: 'plan-waive-category',
-                question,
-                kind: 'choice',
-                choices,
-            });
-            if (res.cancelled || res.answer == null)
-                return 'accepted-risk';
-            return coerce(res.answer);
-        }
-        finally {
-            if (statusWasActive)
-                turnStatusEmitter.resume();
-        }
+        // Same input-focus discipline as selectAuditAction (askConfirm).
+        const { askConfirm } = await import('../ui/confirm-request.js');
+        const res = await askConfirm({
+            id: 'plan-waive-category',
+            tag: 'QUESTION',
+            title: question,
+            choices,
+            initial: 0,
+            footnote: 'Plan audit',
+        });
+        if (res.cancelled || res.value == null)
+            return 'accepted-risk';
+        return coerce(res.value);
     }
     const { select } = await import('@inquirer/prompts');
     const { withInquirer } = await import('../repl/inquirer-guard.js');

package/dist/commands/plan-continue.js

@@ -173,6 +173,7 @@ export async function runContinuationChain(args) {
         attemptStartedAt: args.marker.attemptStartedAt,
         subagentDispatches: args.subagentDispatches,
         prompt: args.prompt,
+        confirm: args.confirm,
         queueDispatch: args.queueDispatch,
         log: args.log,
     });

package/dist/commands/plan-resume.js

@@ -52,6 +52,8 @@ import { collectTurnAssistantText } from '../agent/turn-assistant-text.js';
 import { getAuthorIdentity } from '../agent/loop.js';
 import { FLOORPLAN_TO_TEMPLATE } from '../tools/fiori/floorplan-map.js';
 import { getCurrentTransport, setCurrentTransport } from '../repl/current-transport.js';
+import { askYesNo, isYes } from '../projects/yes-no.js';
+import { formatAttention, formatInfo } from '../renderer/notice-shape.js';
 /**
  * Parse and STRIP the per-run chaining-mode (`--guarded` / `--step`) and
  * audit off-switch (`--audit` / `--no-audit`) flags from a plan-resume body.
@@ -182,7 +184,7 @@ export async function preparePlanResume(args) {
         // the auto-fire dispatch) should never have to name a version number.
         const newestOfFamily = pickNewestPlanVersion(resolved.matches.map((m) => m.path));
         if (newestOfFamily) {
-            args.log(`↪ resolved @${tokens[0]} to the latest version ${basename(newestOfFamily)}`);
+            args.log(formatInfo(`Resolved @${tokens[0]} to the latest version ${basename(newestOfFamily)}`).trimEnd());
             path = newestOfFamily;
         }
         else {
@@ -206,7 +208,7 @@ export async function preparePlanResume(args) {
     // next to the picked file, silently redirect to it with a note.
     const newest = findNewestVersion(path, envelope);
     if (newest) {
-        args.log(`↪ newer version found — resuming ${basename(newest.path)} (you picked ${basename(path)})`);
+        args.log(formatInfo(`Newer version found · resuming ${basename(newest.path)} (you picked ${basename(path)})`).trimEnd());
         path = newest.path;
         envelope = newest.envelope;
     }
@@ -252,11 +254,13 @@ export async function preparePlanResume(args) {
         const lease = acquireRunLease(path, args.sessionId, { log: (line) => args.log(line) });
         if (!lease.acquired && lease.holder) {
             const holder = lease.holder;
-            args.log(`⚠ another session is already resuming this plan — session ${holder.sessionId} (pid ${holder.pid}${holder.at ? `, since ${holder.at}` : ''}).`);
-            const answer = args.prompt
-                ? (await args.prompt('Take over its run lease and resume here anyway? [y/N]: ')).trim().toLowerCase()
-                : '';
-            if (answer !== 'y' && answer !== 'yes') {
+            args.log(formatAttention({ text: 'Another session is already resuming this plan', fact: `session ${holder.sessionId} (pid ${holder.pid}${holder.at ? `, since ${holder.at}` : ''})` }).trimEnd());
+            const answer = await askYesNo({
+                question: 'Take over its run lease and resume here anyway?',
+                confirm: args.confirm,
+                prompt: args.prompt,
+            });
+            if (!isYes(answer)) {
                 args.log('Resume refused — the other session keeps the lease. Re-run when it finishes (a dead session\'s lease is taken over automatically).');
                 return null;
             }
@@ -300,7 +304,7 @@ export async function preparePlanResume(args) {
             const names = unresolved.map((p) => p.audit?.state === 'failed'
                 ? `${p.id} (FAILED audit — ${p.audit.findings?.length ?? 0} finding${(p.audit.findings?.length ?? 0) === 1 ? '' : 's'} waived)`
                 : `${p.id} (${p.audit?.state ?? 'unresolved'})`);
-            args.log(`↪ audits off (--no-audit): waived ${unresolved.length} unresolved audit${unresolved.length === 1 ? '' : 's'} from an earlier run — ${names.join(', ')} (reason: audits turned off).`);
+            args.log(formatInfo(`audits off (--no-audit): waived ${unresolved.length} unresolved audit${unresolved.length === 1 ? '' : 's'} from an earlier run — ${names.join(', ')} (reason: audits turned off).`).trimEnd());
         }
     }
     // Task 6 — hand-edit detection: the newest history entry was NOT authored
@@ -322,7 +326,7 @@ export async function preparePlanResume(args) {
                 ? { ...p, audit: { ...(p.audit ?? {}), state: 'not_audited_hand_edited' } }
                 : p),
         };
-        args.log(`⚠ envelope was last edited outside this harness (by ${lastHistory?.by?.name ?? 'unknown'}) — satisfied phases without a harness audit are shown as hand-edited (file not rewritten).`);
+        args.log(formatAttention({ text: `Plan was last edited outside CSPeach (by ${lastHistory?.by?.name ?? 'unknown'})`, fact: 'satisfied phases without an audit show as hand-edited · file not rewritten' }).trimEnd());
     }
     // Task 6 — re-audit-on-resume: an unresolved persisted audit (a crash
     // between phase save and verdict save leaves 'pending'; an auditor outage
@@ -636,12 +640,16 @@ export async function offerNextPhaseAutoRun(args) {
         return false;
     const delegate = args.outcome.nextDelegateTo ? ` (${args.outcome.nextDelegateTo})` : '';
     if (args.gate?.action === 'auto') {
-        args.log(`▶ auto-running next phase ${args.outcome.nextPhaseId}${delegate} — guarded mode: declared non-write phase, prior audit clean.`);
+        args.log(formatInfo(`Auto-running next phase ${args.outcome.nextPhaseId}${delegate} · guarded mode: declared non-write phase, prior audit clean.`).trimEnd());
         args.queueDispatch(args.outcome.resumeCommand);
         return true;
     }
-    const answer = (await args.prompt(`Run next phase ${args.outcome.nextPhaseId}${delegate} now in a fresh context? [y/N]: `)).trim().toLowerCase();
-    if (answer !== 'y' && answer !== 'yes') {
+    const answer = await askYesNo({
+        question: `Run next phase ${args.outcome.nextPhaseId}${delegate} now in a fresh context?`,
+        confirm: args.confirm,
+        prompt: args.prompt,
+    });
+    if (!isYes(answer)) {
         args.log(`Exiting — resume later with: ${args.outcome.resumeCommand}`);
         return false;
     }

package/dist/commands/whoami.js

@@ -6,30 +6,44 @@
  */
 import { readAuthFile } from '../auth/auth-file.js';
 import { fetchMe } from '../auth/me.js';
+import { formatFailure, formatInfo } from '../renderer/notice-shape.js';
+import { panelHeading, panelRow } from '../renderer/panel-rows.js';
+import { paint } from '../renderer/theme.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
+/** Server-supplied text (email, plan, trial fields) is one line with no control characters. */
+const serverText = (v) => sanitizeControlChars(String(v ?? '')).replace(/\s*\r?\n\s*/g, ' ').trim();
 export async function runWhoamiCommand(deps) {
     const auth = await readAuthFile();
     if (!auth) {
-        deps.print('Not signed in via cspeach login (no ~/.cspeach/auth.json).');
-        deps.print('Your REPL may still authenticate via the keychain-stored key — run `cspeach` to check.');
+        deps.print(formatInfo('Not signed in with cspeach login (no ~/.cspeach/auth.json)').trimEnd());
+        deps.print(`  ${paint('dim', 'Next:')} cspeach login   (the REPL may still use a keychain key — run cspeach to check)`);
         return 0;
     }
     const me = await fetchMe({ proxyUrl: deps.proxyUrl, apiKey: auth.apiKey });
     if (!me.ok) {
-        deps.print(`Auth file present but /v1/me returned ${me.status} (${me.error}).`);
-        deps.print('Run `cspeach login` to refresh.');
+        // Status 0 = the request never got an answer (network error or the /v1/me
+        // timeout): signing in again would not help. Any HTTP answer keeps the
+        // log-in hint, as before.
+        const unreachable = me.status === 0;
+        deps.print(formatFailure({
+            what: 'Could not read your account',
+            detail: [unreachable ? `could not reach the server (${me.error})` : `the server answered ${me.status} (${me.error})`],
+            next: unreachable ? 'check your network or VPN, then run cspeach whoami again' : 'cspeach login',
+        }).trimEnd());
         return 1;
     }
     const p = me.profile;
-    deps.print(`Email:    ${p.email}`);
-    deps.print(`Plan:     ${p.plan}`);
+    deps.print(panelHeading('Account'));
+    deps.print(panelRow('Email', serverText(p.email), 8));
+    deps.print(panelRow('Plan', serverText(p.plan), 8));
     if (p.trial_mode) {
-        deps.print(`Trial:    ${p.trial_mode}, ends ${p.trial_ends_at}`);
+        deps.print(panelRow('Trial', serverText(`${p.trial_mode}, ends ${p.trial_ends_at}`), 8));
         if (p.trial_token_cap_input) {
-            deps.print(`Tokens:   ${p.usage_input_tokens}/${p.trial_token_cap_input} in, ${p.usage_output_tokens}/${p.trial_token_cap_output ?? '∞'} out`);
+            deps.print(panelRow('Tokens', serverText(`${p.usage_input_tokens}/${p.trial_token_cap_input} in, ${p.usage_output_tokens}/${p.trial_token_cap_output ?? '∞'} out`), 8));
         }
     }
     if (p.entitlements.enabled_skills.length > 0) {
-        deps.print(`Skills:   ${p.entitlements.enabled_skills.join(', ')}`);
+        deps.print(panelRow('Skills', serverText(p.entitlements.enabled_skills.join(', ')), 8));
     }
     return 0;
 }

package/dist/config/loader.js

@@ -22,9 +22,15 @@ export const DEFAULT_CONFIG = {
     // Default `auto` — Ink inline+Static is the production path as of 0.8.0.
     // Smoke-verified 2026-06-06 (A1, post-Hajj plan): smooth streaming on a
     // big skill turn, no stutter/jumping/picker re-mount, phantom cursor #25
-    // root-caused and fixed (485604b). Users can pin `ui.rendering = 'classic'`
-    // to keep the chalk REPL; piped/CI invocations fall back automatically.
-    ui: { rendering: 'auto' },
+    // root-caused and fixed (485604b). Piped/CI/one-shot invocations fall back
+    // to plain output automatically. A stored 'classic' is retiring (2026-09-27):
+    // it is read as 'auto' — see renderer/rendering-mode.ts (CSPEACH_UI=classic
+    // is the one-launch escape hatch).
+    // 2026-09-26 — `look` = the conversation look (spec
+    // docs/superpowers/specs/2026-09-26-cli-look-piece1-design.md). 'panels' is
+    // the default; 'legacy' reproduces the pre-overhaul output exactly.
+    // `background` is left unset: getBackground() then reads COLORFGBG, else dark.
+    ui: { rendering: 'auto', look: 'panels' },
     // Default `approval-gated` — preserves current UX (user approves each write).
     write_mode: 'approval-gated',
     // Default `managed` — lowest-friction entry point; uses the cspeach.dev proxy.
@@ -218,6 +224,12 @@ export async function loadConfig() {
         // `config show` and saveConfig output clean — no `local_files = undefined`.
         if (merged.local_files === undefined)
             delete merged.local_files;
+        // 2026-09-26 — unknown values fall back instead of reaching the renderer.
+        if (merged.ui.look !== 'panels' && merged.ui.look !== 'legacy')
+            merged.ui.look = DEFAULT_CONFIG.ui.look;
+        if (merged.ui.background !== undefined && merged.ui.background !== 'dark' && merged.ui.background !== 'light') {
+            delete merged.ui.background;
+        }
         // Same for `local_build`: when the key is absent from disk we coerce it to
         // `undefined` (so resolveLocalBuild's legacy fallback can fire). Delete the
         // key so it doesn't serialise as `local_build = undefined` and so callers

package/dist/cost/pricing.js

@@ -22,10 +22,12 @@
  * Unknown models → returns null + records the model name to a process-level
  * Set so we surface them as an obvious warning rather than silently zeroing.
  */
+import { recordFullNotice } from '../renderer/notice-log.js';
 import { getServerModelConfig } from '../models/server-config.js';
 const PRICING = {
     // Claude 5 family (2026-09-15) — Opus 5 keeps the Opus 4.5+ rate ($5/$25);
     // Sonnet 5 is $2/$10. Cache read = 10% of input, cache write = 1.25x input.
+    'claude-opus-5-5': { inputPer1M: 4.00, outputPer1M: 20.00, cacheReadPer1M: 0.20, cacheCreatePer1M: 5.00 },
     'claude-opus-5': { inputPer1M: 5.00, outputPer1M: 25.00, cacheReadPer1M: 0.50, cacheCreatePer1M: 6.25 },
     'claude-sonnet-5': { inputPer1M: 2.00, outputPer1M: 10.00, cacheReadPer1M: 0.20, cacheCreatePer1M: 2.50 },
     // Claude Opus 4.5+ — input 5, output 25, cache_read 0.50, cache_write 6.25 (1.25x input).
@@ -90,11 +92,10 @@ export function getRate(model) {
         return PRICING[stripDate];
     if (!seenUnknownModels.has(normalized)) {
         seenUnknownModels.add(normalized);
-        // Best-effort warn; don't crash if the console is unavailable.
-        try {
-            console.warn(JSON.stringify({ msg: 'pricing_unknown_model', model: normalized }));
-        }
-        catch { /* noop */ }
+        // Diagnostics never reach the user's screen (fix round 3, item 1): a raw
+        // console.warn bypassed the Ink/classic writers and printed JSON into the
+        // chat, spinner, goodbye and one-shot stderr. Log file only.
+        recordFullNotice('debug', JSON.stringify({ msg: 'pricing_unknown_model', model: normalized }));
     }
     return null;
 }

package/dist/doctor/checks/forge-rules.js

@@ -19,6 +19,7 @@ import { loadConfig } from '../../config/loader.js';
 import { getConnection } from '../../sap/connection-manager.js';
 import { AdtClient, snapshots } from '@cspeach/sap-client';
 import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
+import { verifySyntax } from '../../tools/verify.js';
 const PROBE_NAME = 'Z_CSPEACH_DOCTOR_PROBE';
 const PROBE_PACKAGE = '$TMP';
 const PROBE_SOURCE = `REPORT ${PROBE_NAME}.\nWRITE / 'cspeach doctor probe — safe to delete'.`;
@@ -84,12 +85,21 @@ export async function checkForgeRules() {
             };
         }
         // Step 4: Verify Rule 10 fired — syntax was checked. Re-run syntaxCheck and confirm clean.
-        const syntax = await adt.syntaxCheck('PROG', PROBE_NAME);
-        if (syntax.hasErrors) {
+        // Re-review item 2 — through verifySyntax (fail closed): a check that did
+        // not run is ok:false with its reason, never a throw out of collectChecks.
+        const syntax = await verifySyntax(adt, PROBE_NAME, 'PROG');
+        if (syntax.didNotRun !== undefined) {
             return {
                 name: 'forge-rules',
                 ok: false,
-                message: `Rule 10: syntax check returned errors on probe: ${syntax.messages[0]?.text ?? 'unknown'}`,
+                message: `Rule 10: syntax check did not run: ${syntax.didNotRun.replace(/^Syntax check did not run:?\s*/i, '')}`,
+            };
+        }
+        if (!syntax.ok) {
+            return {
+                name: 'forge-rules',
+                ok: false,
+                message: `Rule 10: syntax check returned errors on probe: ${syntax.errors[0] ?? 'unknown'}`,
             };
         }
         return {

package/dist/doctor/checks/keychain.js

@@ -1,10 +1,12 @@
-import keychain from '../../auth/keychain.js';
+import keychain, { newProbeAccount } from '../../auth/keychain.js';
 export async function checkKeychain() {
     try {
+        // Round 4 item 7 — per-process probe account (see newProbeAccount).
+        const account = newProbeAccount();
         const probe = `probe-${Date.now()}`;
-        await keychain.setPassword('cspeach', 'probe', probe);
-        const ok = (await keychain.getPassword('cspeach', 'probe')) === probe;
-        await keychain.deletePassword('cspeach', 'probe');
+        await keychain.setPassword('cspeach', account, probe);
+        const ok = (await keychain.getPassword('cspeach', account)) === probe;
+        await keychain.deletePassword('cspeach', account);
         if (ok)
             return { name: 'keychain', ok: true, message: 'OS keychain working' };
         return { name: 'keychain', ok: false, message: 'probe write/read mismatch', hint: 'Per-session fallback mode will be used' };