@cspeach/cli 1.1.18 → 1.1.20

package/dist/approvals/approval-prompt.js

@@ -1,10 +1,19 @@
 import chalk from 'chalk';
+import stringWidth from 'string-width';
 import { loadConfig, saveConfig } from '../config/loader.js';
-const BOX_WIDTH = 62;
-const TOP = '┌' + '─'.repeat(BOX_WIDTH) + '┐';
-const BOTTOM = '└' + '─'.repeat(BOX_WIDTH) + '┘';
-const pad = (s) => '│  ' + s.padEnd(BOX_WIDTH - 2) + '│';
-const blank = '│' + ' '.repeat(BOX_WIDTH) + '│';
+import { shouldUseInk } from '../renderer/tty.js';
+import { uiWidth } from '../renderer/ui-width.js';
+import { paint } from '../renderer/theme.js';
+import { emitTrace } from '../renderer/trace.js';
+import { askConfirm } from '../ui/confirm-request.js';
+// Classic box: width from the §1.4 rule (was a fixed 62); padding counts
+// VISIBLE cells (string-width ignores ANSI) so coloured rows line up with
+// plain ones. (strip-ansi is a devDependency only — not usable here.)
+const boxWidth = () => uiWidth() - 2;
+const top = () => '┌' + '─'.repeat(boxWidth()) + '┐';
+const bottom = () => '└' + '─'.repeat(boxWidth()) + '┘';
+const pad = (s) => '│  ' + s + ' '.repeat(Math.max(0, boxWidth() - 2 - stringWidth(s))) + '│';
+const blank = () => '│' + ' '.repeat(boxWidth()) + '│';
 /**
  * Capture a single keypress for the y/n/d answer. Raw-mode readline so the
  * hand-drawn box stays the only visible affordance.
@@ -43,6 +52,31 @@ async function promptNagChoice() {
         process.stdin.on('data', onData);
     });
 }
+/**
+ * Piece 2 §6.1 — under Ink the nag is a confirm card in the card slot.
+ * Raw stdin reads while Ink is mounted steal or double keystrokes.
+ * y / n / d stay as keys; Esc (or no listener) is 'n', like Ctrl+C today.
+ * Cursor starts on "No": the one choice that writes nothing.
+ */
+async function promptNagChoiceInk(sapAlias) {
+    const res = await askConfirm({
+        id: 'auto-approve-nag',
+        tag: 'QUESTION',
+        title: `Auto-approve low-risk changes on ${sapAlias}?`,
+        facts: [
+            'This change was classified as low risk.',
+            `Today every change on ${sapAlias} asks you first.`,
+        ],
+        choices: [
+            { value: 'y', label: 'Yes, auto-approve low-risk changes', hint: 'DEV systems only' },
+            { value: 'n', label: 'No, keep asking every time' },
+            { value: 'd', label: `Don't ask me this again on ${sapAlias}` },
+        ],
+        initial: 1,
+        aliases: { y: 'y', n: 'n', d: 'd' },
+    });
+    return res.value === 'y' || res.value === 'd' ? res.value : 'n';
+}
 /**
  * Called just before `renderPerChangeApproval` when the current change
  * is low-risk on a `never` system and the nag has not been dismissed.
@@ -61,29 +95,42 @@ export async function maybeShowAutoApproveNag(ctx) {
         return;
     if (sapCfg.nag_dismissed ?? false)
         return;
-    // Draw the box. This is the ONLY visible UI — keypress answers it directly.
-    console.log('');
-    console.log(TOP);
-    console.log(blank);
-    console.log(pad(chalk.yellow('This change was classified as LOW risk.')));
-    console.log(blank);
-    console.log(pad(`Your current policy on ${ctx.sapAlias} prompts on everything.`));
-    console.log(pad('Want to auto-approve low-risk changes on this system?'));
-    console.log(blank);
-    console.log(pad(chalk.green('[y] yes') + '  (safer for DEV systems only)'));
-    console.log(pad(chalk.dim('[n] no ') + '  (keep prompting every time)'));
-    console.log(pad(chalk.dim('[d] don\'t ask me this again (on ' + ctx.sapAlias + ')')));
-    console.log(blank);
-    console.log(BOTTOM);
-    process.stdout.write(chalk.dim('Press y / n / d: '));
-    const choice = await promptNagChoice();
+    const ink = shouldUseInk();
+    let choice;
+    if (ink) {
+        choice = await promptNagChoiceInk(ctx.sapAlias);
+    }
+    else {
+        // Classic: the box is the UI — keypress answers it directly.
+        console.log('');
+        console.log(top());
+        console.log(blank());
+        console.log(pad(chalk.yellow('This change was classified as LOW risk.')));
+        console.log(blank());
+        console.log(pad(`Your current policy on ${ctx.sapAlias} prompts on everything.`));
+        console.log(pad('Want to auto-approve low-risk changes on this system?'));
+        console.log(blank());
+        console.log(pad(chalk.green('[y] yes') + '  (safer for DEV systems only)'));
+        console.log(pad(chalk.dim('[n] no ') + '  (keep prompting every time)'));
+        console.log(pad(chalk.dim('[d] don\'t ask me this again (on ' + ctx.sapAlias + ')')));
+        console.log(blank());
+        console.log(bottom());
+        process.stdout.write(chalk.dim('Press y / n / d: '));
+        choice = await promptNagChoice();
+    }
     if (choice === 'y') {
         const fresh = await loadConfig(); // re-read to avoid stale write
         if (fresh.sap[ctx.sapAlias]) {
             fresh.sap[ctx.sapAlias].auto_approve = 'low';
             await saveConfig(fresh);
-            console.log(chalk.green(`Auto-approve set to "low" for ${ctx.sapAlias}.`));
-            console.log(chalk.gray('Change with: cspeach config set sap.' + ctx.sapAlias + '.auto_approve never\n'));
+            if (ink) {
+                emitTrace(paint('ok', `Auto-approve set to "low" for ${ctx.sapAlias}.`));
+                emitTrace(paint('dim', `Change with: cspeach config set sap.${ctx.sapAlias}.auto_approve never`));
+            }
+            else {
+                console.log(chalk.green(`Auto-approve set to "low" for ${ctx.sapAlias}.`));
+                console.log(chalk.gray('Change with: cspeach config set sap.' + ctx.sapAlias + '.auto_approve never\n'));
+            }
         }
     }
     else if (choice === 'd') {
@@ -93,7 +140,10 @@ export async function maybeShowAutoApproveNag(ctx) {
         if (fresh.sap[ctx.sapAlias]) {
             fresh.sap[ctx.sapAlias].nag_dismissed = true;
             await saveConfig(fresh);
-            console.log(chalk.gray(`Noted. This prompt will not appear again on ${ctx.sapAlias}.\n`));
+            if (ink)
+                emitTrace(paint('dim', `Noted. This prompt will not appear again on ${ctx.sapAlias}.`));
+            else
+                console.log(chalk.gray(`Noted. This prompt will not appear again on ${ctx.sapAlias}.\n`));
         }
     }
     // 'n' → no config change, fall through to per-change approval normally.

package/dist/approvals/jwt.js

@@ -55,12 +55,13 @@ export async function mintApprovalId(payload) {
  * through this function instead of calling mintApprovalId with a free-text
  * object string.
  */
-export async function mintChangeApproval(change, sessionId) {
+export async function mintChangeApproval(change, sessionId, opts = {}) {
     return mintApprovalId({
         object: canonicalApprovalObject(change.object),
         type: change.type,
         op: change.op,
         session_id: sessionId,
+        ...(opts.auto ? { auto: true } : {}),
     });
 }
 export async function verifyAndSpendApprovalId(jwt, expectedObject, expectedOp) {

package/dist/approvals/render.js

@@ -1,13 +1,19 @@
 import { select, input } from '@inquirer/prompts';
 import chalk from 'chalk';
+import { riskReasonText, shownRiskReasons } from './risk-floor.js';
 import { verbLine, viewAffordance, toSourceLines } from './op-labels.js';
 import { shouldUseInk } from '../renderer/tty.js';
 import { approvalEmitter } from '../ui/approval-emitter.js';
-import { askQuestionEmitter } from '../ui/ask-question-emitter.js';
 import { withInquirer } from '../repl/inquirer-guard.js';
 import { inquirerTheme } from '../repl/inquirer-theme.js';
-import { PEACH } from '../renderer/banners.js';
-const peach = (s) => chalk.hex(PEACH)(s);
+import { askConfirm } from '../ui/confirm-request.js';
+import { emitTrace } from '../renderer/trace.js';
+import { getGlyphs } from '../renderer/glyphs.js';
+import { paint } from '../renderer/theme.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { withSpinnerSuspended } from '../renderer/tool-widget.js';
+// Piece 2 §1.1 — the brand accent comes from the theme role, not a legacy hex.
+const peach = (s) => paint('brand', s);
 /**
  * Risk tag. 2026-05-01: yellow used to fire on `medium` too, which
  * meant most plans had a yellow tag — defeating yellow's purpose as
@@ -54,7 +60,7 @@ function colorizeDiff(diff) {
  * per-change prompts that were the main "so much confusion" complaint.
  *
  * Color discipline:
- *   - Peach (PEACH) for the brand-bearing "Plan" header.
+ *   - The brand role for the brand-bearing "Plan" header.
  *   - Default text for the summary, change list. No cyan, no bold-on-bold.
  *   - Yellow tag for medium risk, red for high. Low is dim — no shouting.
  */
@@ -80,57 +86,79 @@ function collapseImplicitActivates(changes) {
         return !writeKeys.has(`${c.type}:${c.object}`);
     });
 }
-export async function renderPlanGate(summary, changes, transport, effectiveRisk) {
+export async function renderPlanGate(summary, changes, transport, effectiveRisk, system) {
     const visibleChanges = collapseImplicitActivates(changes);
     const visibleCount = visibleChanges.length;
     const noun = visibleCount === 1 ? 'change' : 'changes';
-    // Ink path (default): route the gate through the ask_question choice modal so
-    // it renders INSIDE the React frame. The prior inquirer select drew raw to
-    // stdout while Ink owned the terminal — it toggled raw mode out from under
-    // Ink and competed with the Footer for keystrokes (the "turn in progress —
-    // input kept in box" confusion, and dead arrow keys on the modal that
-    // followed). One input system = no handoff, no competition. Mirrors
-    // renderPerChangeApprovalV3, which already went Ink-native via approvalEmitter.
+    // Ink path (piece 2 §5): the plan gate is an APPROVAL confirm card in the
+    // card slot. Same three values, same order, cursor on Apply all; anything
+    // else (Esc, no listener) is 'cancel'. Digits pick on an APPROVAL card
+    // (fix round 3), but typed-ahead keys are dropped (ConfirmCard), so a `1`
+    // or Enter typed before the card opened can't apply a plan. Long plans
+    // print in full to scrollback; the card keeps 4 (controller ruling, C1 fix
+    // round 1: 8 steps broke the spec §2 height cap — rows − 2 — on a 24-row
+    // terminal).
     if (shouldUseInk()) {
-        const ctx = [
+        const MAX_STEPS = 4;
+        const packages = [...new Set(visibleChanges.map((c) => c.package).filter((p) => !!p))];
+        const facts = [
             summary,
-            [`${visibleCount} ${noun}`, riskTag(effectiveRisk.level), transport ? `transport ${transport}` : '']
-                .filter(Boolean).join(' · '),
+            [
+                `${visibleCount} ${noun}`,
+                transport ? `transport ${transport}` : 'no transport',
+                ...(packages.length > 0 ? [`package ${packages.join(', ')}`] : []),
+                `${effectiveRisk.level} risk`,
+            ].join(' · '),
         ];
-        if (effectiveRisk.raisedBy.length > 0) {
-            ctx.push(`(raised from low: ${effectiveRisk.raisedBy.join(', ')})`);
+        const shownReasons = shownRiskReasons(effectiveRisk.raisedBy);
+        if (shownReasons.length > 0) {
+            facts.push(`Risk raised to ${effectiveRisk.level}: ${shownReasons.map(riskReasonText).join('; ')}`);
         }
-        // Numbered, operation-aware verb rows ("1. Create table ZMNT_NOTE") —
-        // no cryptic op-code glyph. The Ink modal renders `context` itself, so
-        // no chalk here.
-        visibleChanges.forEach((c, i) => ctx.push(`  ${i + 1}. ${verbLine(c)}`));
-        const result = await askQuestionEmitter.request({
+        const steps = visibleChanges.map((c, i) => `${i + 1}. ${verbLine(c)}`);
+        if (steps.length > MAX_STEPS) {
+            // Object names are model-supplied: neutralise control characters
+            // before they reach scrollback (the card sanitises its own rows).
+            emitTrace(sanitizeControlChars(['Plan', ...steps.map((s) => `  ${s}`)].join('\n')));
+            facts.push(...steps.slice(0, MAX_STEPS), `${getGlyphs().more} ${steps.length - MAX_STEPS} more steps, listed above`);
+        }
+        else {
+            facts.push(...steps);
+        }
+        const res = await askConfirm({
             id: 'plan-gate',
-            question: 'Apply this plan?',
-            // Strip chalk ANSI from riskTag — the Ink modal renders `context`
-            // itself (dimColor), so embedded escape codes would show as raw text.
-            context: ctx.join('\n').replace(/\x1b\[[0-9;]*m/g, ''),
-            kind: 'choice',
+            tag: 'APPROVAL',
+            title: system ? `Apply this plan on ${system}?` : 'Apply this plan?',
+            facts,
             choices: [
                 { value: 'apply_all', label: `Apply all ${visibleCount} ${noun}` },
-                { value: 'review', label: 'Review each change individually' },
+                { value: 'review', label: 'Review each change one by one' },
                 { value: 'cancel', label: 'Cancel' },
             ],
-        });
-        if (result.answer === 'apply_all' || result.answer === 'review' || result.answer === 'cancel') {
-            return result.answer;
+            initial: 0,
+            footnote: 'Forge Rule 8',
+        }, { traceLabel: 'Plan' });
+        if (res.value === 'apply_all' || res.value === 'review' || res.value === 'cancel') {
+            return res.value;
         }
-        return 'cancel'; // Esc / no answer → cancel the plan (safe default)
+        return 'cancel'; // Esc / no listener / unknown → cancel the plan (safe default)
     }
     // Non-Ink (one-shot / non-TTY / classic): the original inquirer flow.
+    // Review M1: request_approval runs under a live tool spinner — keep it
+    // suspended for the whole preamble + prompt so no stale frame is left.
+    return withSpinnerSuspended(() => classicPlanGate(summary, visibleChanges, transport, effectiveRisk));
+}
+async function classicPlanGate(summary, visibleChanges, transport, effectiveRisk) {
+    const visibleCount = visibleChanges.length;
+    const noun = visibleCount === 1 ? 'change' : 'changes';
     console.log('');
     console.log(`${peach('Plan')}  ${summary}`);
     const meta = [`${visibleCount} ${noun}`, riskTag(effectiveRisk.level)];
     if (transport)
         meta.push(`transport ${transport}`);
     console.log(`      ${chalk.dim(meta.join(' · '))}`);
-    if (effectiveRisk.raisedBy.length > 0) {
-        console.log(`      ${chalk.dim(`(raised from low: ${effectiveRisk.raisedBy.join(', ')})`)}`);
+    const shownReasons = shownRiskReasons(effectiveRisk.raisedBy);
+    if (shownReasons.length > 0) {
+        console.log(`      ${chalk.dim(`(risk raised: ${shownReasons.map(riskReasonText).join('; ')})`)}`);
     }
     visibleChanges.forEach((c, i) => {
         console.log(`        ${chalk.dim(`${i + 1}.`)} ${verbLine(c)}`);
@@ -183,7 +211,7 @@ export async function renderPerChangeApproval(change, effectiveRisk, transport)
     //
     // I3 (2026-07-05 review): a 'v' affordance (create/delete View source) is
     // NOT a diff — the payload is plain/all-adds source. Routing it through the
-    // diff printer fired the "⚠ Model did not provide a unified diff" warning
+    // diff printer fired the "Model did not provide a unified diff" warning
     // under a View source label. Print numbered plain source instead — never
     // the diff path or its warning. (The affordance is only offered when
     // change.diff is present, so the fallback line is belt-and-braces.)
@@ -214,7 +242,7 @@ export async function renderPerChangeApproval(change, effectiveRisk, transport)
             console.log('\n' + colorizeDiff(change.diff) + '\n');
         }
         else {
-            console.log('\n' + chalk.yellow('⚠  Model did not provide a unified diff — only a description:'));
+            console.log('\n' + chalk.yellow(`${getGlyphs().attention}  Model did not provide a unified diff — only a description:`));
             console.log(chalk.dim(change.diff) + '\n');
         }
     }

package/dist/approvals/risk-floor.js

@@ -10,10 +10,33 @@ export function effectiveRisk(declared, changes, ctx) {
     };
     if (ctx.autoApprovePolicy === 'never')
         raise('high', 'non_prod_override');
+    // Round 7 item 8e — never auto-approve anything on an object whose last
+    // syntax check found errors (high is never auto-approved).
+    if (ctx.syntaxErrorObjects && ctx.syntaxErrorObjects.length > 0) {
+        // Keys are `TYPE:NAME` (tools/syntax-state.ts syntaxKey). Re-review 2
+        // item 1: the floor matches on the NAME alone — a type word can be
+        // ambiguous (VIEW, FUNC, TABLE vs STRUCTURE…) or unknown, so any recorded
+        // entry with that name raises. Over-raise, never under-raise: the cost is
+        // a card the user would otherwise not see.
+        const badNames = new Set(ctx.syntaxErrorObjects.map((k) => k.slice(k.lastIndexOf(':') + 1).toUpperCase()));
+        const hit = (c) => badNames.has(c.object.trim().split(/\s+/)[0].toUpperCase());
+        if (changes.some(hit)) {
+            raise('high', 'syntax_errors');
+            // Final review A M-4 — the reason is always shown, even when the floor
+            // was already high (policy never, or declared high).
+            if (!raisedBy.includes('syntax_errors'))
+                raisedBy.push('syntax_errors');
+        }
+    }
     if (changes.some((c) => c.op === 'delete'))
         raise('medium', 'delete_op');
-    if (changes.some((c) => c.op === 'release' || c.op === 'activate'))
-        raise('medium', 'shared_transport');
+    // Round 4 item 8a — these were both labelled 'shared_transport', so a plan
+    // on a transport created seconds earlier read "raised … by shared_transport".
+    // Each reason now says what actually raised it.
+    if (changes.some((c) => c.op === 'release'))
+        raise('medium', 'transport_release');
+    if (changes.some((c) => c.op === 'activate'))
+        raise('medium', 'activation');
     if (ctx.recentAtcFailure && changes.some((c) => ctx.recentAtcFailure.includes(c.object)))
         raise('medium', 'atc_failed_24h');
     if ((ctx.transportRecentDevelopers ?? 0) >= 3)
@@ -24,3 +47,31 @@ export function effectiveRisk(declared, changes, ctx) {
         raise('medium', 'prod_namespace');
     return { level: floor, raisedBy };
 }
+/** Plain words for each risk reason code — the codes stay in audit data only. */
+const RISK_REASON_TEXT = {
+    non_prod_override: 'auto-approve is set to never on this system (a setting, not a risk)',
+    delete_op: 'the plan deletes an object',
+    transport_release: 'the plan releases a transport',
+    activation: 'activation makes the change live on the system',
+    atc_failed_24h: 'ATC failed on this object in the last 24 hours',
+    shared_transport: 'the transport is shared by 3 or more developers',
+    escalated_in_session: 'more than 5 changes in one plan',
+    prod_namespace: 'the object is in a production namespace',
+    syntax_errors: 'the last syntax check of this object found errors',
+};
+/** Round 8 item 4 — every code the floor can raise (each has plain words above). */
+export const RISK_REASON_CODES = Object.keys(RISK_REASON_TEXT);
+/** Round 4 item 8a — never show an internal reason code raw. */
+export function riskReasonText(code) {
+    return RISK_REASON_TEXT[code] ?? code.replace(/_/g, ' ');
+}
+/**
+ * Round 7 item 8b — the reasons a user is SHOWN. `non_prod_override` (the
+ * alias's auto_approve is 'never') raises the floor so nothing auto-approves,
+ * but it is a setting, not a risk: the card read "Risk raised to high:
+ * auto-approve is off for this system". It stays in audit data only.
+ */
+const NOT_A_RISK_REASON = new Set(['non_prod_override']);
+export function shownRiskReasons(raisedBy) {
+    return raisedBy.filter((c) => !NOT_A_RISK_REASON.has(c));
+}

package/dist/auth/api-key.js

@@ -1,17 +1,29 @@
-import keychain from './keychain.js';
+import keychain, { newProbeAccount } from './keychain.js';
 const SERVICE = 'cspeach';
 const ACCOUNT = 'api-key';
 class KeychainStore {
+    /** One probe per store: repeat checks (repl.tsx) reuse the first answer. */
+    available;
     async get() { return keychain.getPassword(SERVICE, ACCOUNT); }
     async set(key) { await keychain.setPassword(SERVICE, ACCOUNT, key); }
     async delete() { await keychain.deletePassword(SERVICE, ACCOUNT); }
-    async isKeychainAvailable() {
+    isKeychainAvailable() {
+        this.available ??= this.probe();
+        return this.available;
+    }
+    async probe() {
         try {
+            // Round 4 item 7 — a per-process account: a fixed 'probe' entry was
+            // deleted by a second cspeach starting at the same time.
+            const account = newProbeAccount();
             const probe = `probe-${Date.now()}`;
-            await keychain.setPassword(SERVICE, 'probe', probe);
-            const ok = (await keychain.getPassword(SERVICE, 'probe')) === probe;
-            await keychain.deletePassword(SERVICE, 'probe');
-            return ok;
+            try {
+                await keychain.setPassword(SERVICE, account, probe);
+                return (await keychain.getPassword(SERVICE, account)) === probe;
+            }
+            finally {
+                await keychain.deletePassword(SERVICE, account).catch(() => false);
+            }
         }
         catch {
             return false;
@@ -25,16 +37,18 @@ class EphemeralStore {
     async delete() { this.cached = null; }
     async isKeychainAvailable() { return false; }
 }
+/**
+ * Round 4 item 4 — memoise the PROMISE, not the result. The startup upgrade
+ * check and runOneShot call getStore() concurrently; with a memoised result
+ * both ran a probe, and a probe that lost the race REPLACED the shared store
+ * with the in-memory EphemeralStore — the next get() found no key
+ * ("No API key configured" / uncaught no_api_key on `cspeach … < /dev/null`).
+ */
 let store;
-export async function getStore() {
-    if (store)
-        return store;
-    const ktr = new KeychainStore();
-    if (await ktr.isKeychainAvailable()) {
-        store = ktr;
-    }
-    else {
-        store = new EphemeralStore();
-    }
+export function getStore() {
+    store ??= (async () => {
+        const ktr = new KeychainStore();
+        return (await ktr.isKeychainAvailable()) ? ktr : new EphemeralStore();
+    })();
     return store;
 }

package/dist/auth/me.js

@@ -2,18 +2,36 @@
  * Fetch /v1/me — customer profile + entitlements + usage.
  * Result envelope so the REPL doesn't need try/catch.
  */
+/** Default /v1/me budget. The panels brand line waits for this call (D5), so a
+ *  hung proxy must not mean a blank screen. */
+export const FETCH_ME_TIMEOUT_MS = 5000;
 export async function fetchMe(opts) {
     const url = `${opts.proxyUrl.replace(/\/$/, '')}/v1/me`;
+    const timeoutMs = opts.timeoutMs ?? FETCH_ME_TIMEOUT_MS;
+    const signal = AbortSignal.timeout(timeoutMs);
+    // Race the signal too, so even a fetch that ignores it cannot hang startup.
+    // A timeout is a status-0 failure (the failed-refresh path), never a 401.
+    const timedOut = new Promise((_, reject) => {
+        signal.addEventListener('abort', () => reject(new Error(`timed out after ${timeoutMs} ms`)), { once: true });
+    });
+    timedOut.catch(() => { });
     try {
-        const r = await fetch(url, { headers: { Authorization: `Bearer ${opts.apiKey}` } });
-        if (!r.ok) {
-            const body = await r.json().catch(() => ({}));
-            return { ok: false, status: r.status, error: body.error ?? 'unknown' };
-        }
-        const profile = await r.json();
-        return { ok: true, profile };
+        return await Promise.race([
+            (async () => {
+                const r = await fetch(url, { headers: { Authorization: `Bearer ${opts.apiKey}` }, signal });
+                if (!r.ok) {
+                    const body = await r.json().catch(() => ({}));
+                    return { ok: false, status: r.status, error: body.error ?? 'unknown' };
+                }
+                const profile = await r.json();
+                return { ok: true, profile };
+            })(),
+            timedOut,
+        ]);
     }
     catch (err) {
+        if (signal.aborted)
+            return { ok: false, status: 0, error: `timed out after ${timeoutMs} ms` };
         return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err) };
     }
 }

package/dist/cli.js

@@ -4,12 +4,16 @@ import { runAddSapWizard } from './sap/onboarding.js';
 import { runGcOnStartup } from './session/gc.js';
 import { checkForUpgrade } from './upgrade-check.js';
 import { extractSapAliasFlag, extractNoSapFlag } from './cli-args.js';
+import { applyColorMode } from './renderer/color-mode.js';
 /**
  * The verbs that make `cspeach project …` a mistyped team command rather than
  * a prompt somebody meant to send. See the check in `main`.
  */
 const TEAM_SUBCOMMANDS = new Set(['init', 'join', 'lane', 'refresh', 'status', 'outbox', 'rule', 'leave']);
 export async function main(argv) {
+    // NO_COLOR (piece 2 §1.2) — before ANY output, for every command (REPL,
+    // one-shot, doctor, login, help, config …).
+    applyColorMode();
     runGcOnStartup().catch(() => { });
     checkForUpgrade().catch(() => { });
     let args = argv.slice(2);
@@ -36,12 +40,9 @@ export async function main(argv) {
         const { runUpgrade } = await import('./upgrade.js');
         return runUpgrade();
     }
-    if (args[0] === '--resume') {
-        const { runResume } = await import('./session/resume.js');
-        return runResume(args[1]);
-    }
-    // C.1 — extract --sap-alias <name> early so it is available for REPL and
-    // one-shot paths. Validation requires loading config to know available aliases.
+    // C.1 — extract --sap-alias <name> early so it is available for REPL,
+    // one-shot and resume paths (round 6 review C1: it used to be parsed after
+    // the --resume branch, so a resume never saw it). Validation requires loading config to know available aliases.
     let sapAlias;
     if (args.includes('--sap-alias')) {
         const { loadConfig } = await import('./config/loader.js');
@@ -55,6 +56,15 @@ export async function main(argv) {
         sapAlias = parsed.sapAlias;
         args = parsed.rest;
     }
+    if (args[0] === '--resume') {
+        // Final batch 5 — `--resume --one-shot "…"`: a flag is never a session id.
+        if (args[1]?.startsWith('-')) {
+            console.error(chalk.red(`error: --resume takes a session id, not '${args[1]}'. Usage: cspeach --resume [<id>]  (no id → pick from a list)`));
+            return 1;
+        }
+        const { runResume } = await import('./session/resume.js');
+        return runResume(args[1], { sapAlias, noSap });
+    }
     // Standalone profile wizard — re-runnable any time. Checked BEFORE the plain
     // `configure` branch so `configure --standalone` isn't swallowed by it.
     // Asks what system the code will land on, then the standards question.
@@ -109,6 +119,17 @@ export async function main(argv) {
     }
     if (args[0] === 'config' && args[1] === 'show') {
         const { runConfigShow } = await import('./commands/config-show.js');
+        if (args.length === 2) {
+            // Task 12 — the full dump ends with "# model set by your account admin"
+            // when /v1/me/model-config says the admin's model is enforced. Capped at
+            // 1.5 s and fail-open: offline / signed out ⇒ the output is unchanged.
+            const [{ loadConfig }, { getStore }, { loadCustomerModelConfig }] = await Promise.all([
+                import('./config/loader.js'),
+                import('./auth/api-key.js'),
+                import('./models/server-config.js'),
+            ]);
+            await loadCustomerModelConfig(await loadConfig(), async () => (await (await getStore()).get()) ?? '', { timeoutMs: 1500 }).catch(() => { });
+        }
         await runConfigShow(args.slice(2));
         return 0;
     }
@@ -203,6 +224,15 @@ export async function main(argv) {
         const { runOneShot } = await import('./one-shot.js');
         return runOneShot(args.join(' '), { sapAlias, noSap });
     }
+    // Round 8 item 3 — `echo "prompt" | cspeach`: a piped stdin carrying one
+    // prompt runs as --one-shot (stdout = the answer only). Scripted pipes
+    // (slash lines), empty or live stdin stay with the REPL, nothing consumed.
+    const { readPipedPrompt } = await import('./lib/piped-prompt.js');
+    const piped = await readPipedPrompt(process.stdin);
+    if (piped.kind === 'prompt') {
+        const { runOneShot } = await import('./one-shot.js');
+        return runOneShot(piped.text, { sapAlias, noSap });
+    }
     // No args → REPL.
     const { runRepl } = await import('./repl.js');
     return runRepl({ sapAlias, noSap });