@cspeach/cli 1.1.2 → 1.1.4

package/dist/agent/loop.js

@@ -1,7 +1,7 @@
 import chalk from 'chalk';
 import { basename } from 'node:path';
 import { dispatchTool } from './tool-dispatch.js';
-import { listTools, getTool, toAnthropicTools } from '../tools/index.js';
+import { listTools, getTool, toAnthropicTools, isStandalone, toolsForContext } from '../tools/index.js';
 import { saveSession } from '../session/store.js';
 import { recordCompletedToolCall } from '../session/pending.js';
 import { loadConfig } from '../config/loader.js';
@@ -20,6 +20,7 @@ import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
 import { buildRetryCapPausePayload, buildSkippedSiblingResults } from './retry-cap.js';
 import { appendCostLine, buildEntry as buildCostEntry } from '../cost/cost-log.js';
 import { computeSessionCost } from '../cost/session-cost.js';
+import { refreshCreditsAfterTurn, creditsForCostLog } from '../cost/credits-wire.js';
 import { globalStore } from '../ui/sap-state-store.js';
 import { lastAssistantIsAwaitingAnswer } from '../session/awaiting-answer.js';
 import { enrichUserMessage } from '../router/intent-extractor.js';
@@ -30,6 +31,9 @@ import { input } from '@inquirer/prompts';
 import { withInquirer } from '../repl/inquirer-guard.js';
 import { expandTextFileAttachments } from '../projects/workspace.js';
 import { getSapSystemInfo, renderSapSystemBlock } from '../sap/system-info.js';
+import { renderStandaloneContextBlock } from '../sap/standalone-profile.js';
+import { renderStandardsBlock } from '../standards/standards-file.js';
+import { composeSessionContextBlock } from './session-context.js';
 import { objectKeyFromInput } from './retry-key.js';
 import { repairPartialBlocks, healSessionMessagesInPlace, isPartialJsonApiError } from './repair-partial.js';
 import { drainSteering } from './steering-queue.js';
@@ -350,10 +354,23 @@ export async function runTurn(params) {
     // before — no behavioral regression.
     let sapSystemBlock = '';
     let sapSystemInfo = null;
-    if (params.ctx.adt && params.ctx.sapAlias) {
+    const standaloneTurn = isStandalone(params.ctx);
+    if (standaloneTurn) {
+        // Standalone (2026-09-16): nothing to probe. Render the SAME
+        // `<sap_system …/>` element shape from the stored standalone profile —
+        // so skills read one element in both modes — plus the manual-
+        // implementation hand-off note.
+        sapSystemBlock = renderStandaloneContextBlock(cfg.standalone);
+    }
+    else if (params.ctx.adt && params.ctx.sapAlias) {
         sapSystemInfo = await getSapSystemInfo(params.ctx.adt, params.ctx.sapAlias);
         sapSystemBlock = renderSapSystemBlock(sapSystemInfo);
     }
+    // Customer development standards — opt-in, both modes. Renders '' when the
+    // user has no standards file, so the composed block (and therefore the whole
+    // prompt) stays byte-identical to pre-feature output for existing users.
+    const standardsBlock = await renderStandardsBlock(params.ctx.cwd);
+    const sessionContextBlock = composeSessionContextBlock([sapSystemBlock, standardsBlock]);
     // Deterministically extract structured facts from the user's prompt
     // (package, transport, object names, environment hint, create intent)
     // and prepend them as an XML `<session_context>` block. The model reads
@@ -368,7 +385,7 @@ export async function runTurn(params) {
     // when extraction yields nothing (enrichUserMessage returns original).
     const enriched = userMessageForLLM.startsWith('<session_context>')
         ? userMessageForLLM
-        : enrichUserMessage(userMessageForLLM, sapSystemBlock);
+        : enrichUserMessage(userMessageForLLM, sessionContextBlock);
     // Phase 2 of Track B — opt-in project-context enrichment, gated by
     // CSPEACH_PROJECT_CONTEXT=on. Default OFF: production behavior is
     // identical to today. When on, the rendered <project_context> block
@@ -505,7 +522,9 @@ export async function runTurn(params) {
                 // W2.5 — apply optional tool filter (used by agent_run with
                 // read_only: true to send a smaller, read-only tool list to
                 // the subagent). Mirrors CC's Tq2() pattern.
-                const allTools = listTools();
+                // Standalone (2026-09-16): hide every SAP-dependent tool from the
+                // model — calling one could only fail. Identity when connected.
+                const allTools = toolsForContext(listTools(), params.ctx);
                 const filteredTools = params.toolFilter ? allTools.filter(params.toolFilter) : allTools;
                 const tools = toAnthropicTools(filteredTools);
                 // Bug 11a (proactive heal, 2026-06-07) — strip any residual
@@ -805,6 +824,11 @@ export async function runTurn(params) {
         // never crash a turn. Runs for both happy and interrupted paths so
         // the user's spend is recorded even when a turn dies mid-stream.
         {
+            // Credits (2026-09-16): sample the customer's balance BEFORE building
+            // the cost line so the JSONL records what the LEDGER charged alongside
+            // our COGS, and so the status footer the REPL prints next reads a fresh
+            // figure. No-op + no request outside credits mode; capped at 2.5 s.
+            await refreshCreditsAfterTurn();
             const turnTokens = {
                 input: (session.usage?.input_tokens ?? 0) - turnStartTokens.input,
                 output: (session.usage?.output_tokens ?? 0) - turnStartTokens.output,
@@ -820,6 +844,9 @@ export async function runTurn(params) {
                 model: params.modelOverride ?? session.model,
                 tokens: turnTokens,
                 duration_ms: turnDurationMs,
+                // Additive: present only in credits mode (undefined in USD mode, so
+                // the emitted line is byte-identical to a pre-credits one).
+                credits: creditsForCostLog(),
             });
             void appendCostLine(session.id, entry);
         }

package/dist/agent/session-context.js

@@ -0,0 +1,24 @@
+/**
+ * Helpers for assembling the `<session_context>` preamble the agent loop
+ * prepends to each user message.
+ *
+ * `formatFactBlock` (router/intent-extractor.ts) takes ONE pre-rendered string
+ * and indents only its first line, so anything we add after the `<sap_system>`
+ * element has to carry its own two-space body indent. This helper is that
+ * single, tested place — the loop just hands it the parts it has.
+ */
+/**
+ * Join the non-empty context parts into one block the fact-formatter can take.
+ *
+ * - No parts (or all empty) → '' — the caller's output is then byte-identical
+ *   to the pre-feature behaviour.
+ * - One part → returned untouched.
+ * - Several → separated by a newline plus the two-space `<session_context>`
+ *   body indent, so each part starts on its own indented line. Inner lines of a
+ *   multi-line part (e.g. the standards document body) are left flush: they are
+ *   element CONTENT, and indenting them would only pad the prompt.
+ */
+export function composeSessionContextBlock(parts) {
+    const nonEmpty = parts.filter((p) => typeof p === 'string' && p.length > 0);
+    return nonEmpty.join('\n  ');
+}

package/dist/agent/tool-dispatch.js

@@ -1,4 +1,5 @@
-import { getTool } from '../tools/index.js';
+import { getTool, isStandalone } from '../tools/index.js';
+import { NOT_CONNECTED_MESSAGE } from '../sap/offline-adt-client.js';
 import { presentSafetyConfirmation } from '../repl/safety-confirm.js';
 import { shouldGateRule8, recordWriteOp, renderPlanSummary, getWriteOpsThisTurn, } from '../repl/rule8-detector.js';
 export async function dispatchTool(name, args, ctx) {
@@ -6,6 +7,21 @@ export async function dispatchTool(name, args, ctx) {
     if (!tool) {
         return { content: JSON.stringify({ error: `unknown_tool: ${name}` }), is_error: true };
     }
+    // Standalone safety net (2026-09-16). SAP-dependent tools are already
+    // filtered out of the list the model sees (agent/loop.ts), but a model can
+    // still call a tool it remembers from an earlier turn or from training. Fail
+    // as a normal tool ERROR RESULT — never a throw — so the model reads the
+    // message and recovers by asking the user to paste the source instead.
+    if (tool.requiresSap && isStandalone(ctx)) {
+        return {
+            content: JSON.stringify({
+                error: 'sap_not_connected',
+                standalone: true,
+                message: NOT_CONNECTED_MESSAGE,
+            }),
+            is_error: true,
+        };
+    }
     // Rule 8 — no batch without plan. 2nd+ mutating call this turn requires
     // explicit confirmation. Fires regardless of /safety-mode toggle (batch
     // detection is unconditional per Plan 3 §6.6).

package/dist/cli-args.js

@@ -36,3 +36,27 @@ export function extractSapAliasFlag(args, availableAliases) {
     const rest = [...args.slice(0, idx), ...args.slice(idx + 2)];
     return { sapAlias: alias, rest };
 }
+/**
+ * Scan `args` for `--no-sap` (standalone mode — run without a SAP system).
+ *
+ * - Absent: returns `{ noSap: false, rest: args }` — the SAME array reference,
+ *   so every downstream path stays byte-identical to pre-feature behaviour.
+ * - Present: strips EVERY occurrence and returns `{ noSap: true, rest }`.
+ * - Present together with `--sap-alias`: returns `{ error, rest: args }`.
+ *   Asking for a specific system AND for no system at all is a contradiction
+ *   the CLI refuses rather than silently resolving one way.
+ */
+export function extractNoSapFlag(args) {
+    if (!args.includes('--no-sap')) {
+        return { noSap: false, rest: args };
+    }
+    if (args.includes('--sap-alias')) {
+        return {
+            noSap: true,
+            rest: args,
+            error: 'error: --no-sap and --sap-alias cannot be combined. ' +
+                'Use --no-sap to run without a SAP system, or --sap-alias <name> to pick one.',
+        };
+    }
+    return { noSap: true, rest: args.filter((a) => a !== '--no-sap') };
+}

package/dist/cli.js

@@ -3,11 +3,22 @@ import { CLI_VERSION } from './lib/version.js';
 import { runAddSapWizard } from './sap/onboarding.js';
 import { runGcOnStartup } from './session/gc.js';
 import { checkForUpgrade } from './upgrade-check.js';
-import { extractSapAliasFlag } from './cli-args.js';
+import { extractSapAliasFlag, extractNoSapFlag } from './cli-args.js';
 export async function main(argv) {
     runGcOnStartup().catch(() => { });
     checkForUpgrade().catch(() => { });
     let args = argv.slice(2);
+    // Standalone mode (2026-09-16) — `--no-sap` is accepted ANYWHERE in the args
+    // for both the REPL and one-shot, and stripped like `--sap-alias` below.
+    // Absent, `extractNoSapFlag` hands back the same array, so every existing
+    // path stays byte-identical.
+    const noSapParsed = extractNoSapFlag(args);
+    if (noSapParsed.error) {
+        console.error(chalk.red(noSapParsed.error));
+        return 1;
+    }
+    const noSap = noSapParsed.noSap;
+    args = noSapParsed.rest;
     if (args[0] === '--help' || args[0] === '-h') {
         printHelp();
         return 0;
@@ -39,6 +50,15 @@ export async function main(argv) {
         sapAlias = parsed.sapAlias;
         args = parsed.rest;
     }
+    // Standalone profile wizard — re-runnable any time. Checked BEFORE the plain
+    // `configure` branch so `configure --standalone` isn't swallowed by it.
+    // Asks what system the code will land on, then the standards question.
+    if ((args[0] === 'config' && args[1] === 'standalone')
+        || (args[0] === 'configure' && args[1] === '--standalone')) {
+        const { runStandaloneProfileWizard } = await import('./sap/standalone-onboarding.js');
+        await runStandaloneProfileWizard({ cwd: process.cwd() });
+        return 0;
+    }
     if (args[0] === 'configure') {
         console.log(chalk.dim('(alias for `cspeach config add-sap`)'));
         await runAddSapWizard();
@@ -48,6 +68,12 @@ export async function main(argv) {
         await runAddSapWizard();
         return 0;
     }
+    // Capture / import the team's development standards (works connected too).
+    if (args[0] === 'standards' && (args[1] === 'init' || args[1] === undefined)) {
+        const { runStandardsInit } = await import('./standards/standards-init.js');
+        await runStandardsInit(process.cwd());
+        return 0;
+    }
     if (args[0] === 'config' && args[1] === 'set') {
         const { runConfigSet, ConfigSetError } = await import('./commands/config-set.js');
         try {
@@ -124,16 +150,16 @@ export async function main(argv) {
     }
     if (args[0] === '--one-shot') {
         const { runOneShot } = await import('./one-shot.js');
-        return runOneShot(args.slice(1).join(' '), { sapAlias });
+        return runOneShot(args.slice(1).join(' '), { sapAlias, noSap });
     }
     // Default: if first arg exists and is not a flag, treat as one-shot prompt.
     if (args.length > 0 && !args[0].startsWith('-')) {
         const { runOneShot } = await import('./one-shot.js');
-        return runOneShot(args.join(' '), { sapAlias });
+        return runOneShot(args.join(' '), { sapAlias, noSap });
     }
     // No args → REPL.
     const { runRepl } = await import('./repl.js');
-    return runRepl({ sapAlias });
+    return runRepl({ sapAlias, noSap });
 }
 function printHelp() {
     console.log(`
@@ -144,8 +170,11 @@ Usage:
   cspeach "<prompt>"                One-shot — runs one turn and exits
   cspeach --one-shot "<prompt>"     Same as above, explicit flag
   cspeach --sap-alias <name>        Use a specific SAP alias (overrides default)
+  cspeach --no-sap                  Start without a SAP system (paste-mode skills only)
   cspeach --resume [id]             Resume a previous session (list if no id)
   cspeach config add-sap            Add a SAP system interactively
+  cspeach config standalone         Set the standalone SAP profile (no system)
+  cspeach standards init            Capture your team's ABAP development standards
   cspeach configure                 Alias for \`cspeach config add-sap\`
   cspeach config set <key> <value>  Update a config key
   cspeach config unset <key>        Remove a config key (revert to default)

package/dist/commands/config-set.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
 import { loadConfig, saveConfig, isValidWriteMode } from '../config/loader.js';
+import { STANDALONE_PLATFORMS, STANDALONE_DATABASES, STANDALONE_DEPLOYMENTS, STANDALONE_IDES, isStandalonePlatform, deriveDatabase, deriveDeployment, defaultAbapCloudOnly, defaultRelease, } from '../sap/standalone-profile.js';
 /**
  * Mutable keys exposed via `cspeach config set`.
  * Any key not in this set is rejected with an error listing valid keys.
@@ -14,9 +15,11 @@ const MUTABLE_KEYS = new Set([
     'classifier.safe_mode',
     'local_build',
     'local_files', // deprecated alias for local_build (2026-06-13) — still accepted
+    'show_cogs',
     'write_mode',
     'plan_mode',
     'plan_audit',
+    'no_sap',
     'llm.mode',
     'llm.ai_hub_base_url',
     'llm.ai_hub_model_alias',
@@ -33,6 +36,17 @@ const SAP_ROLE_RE = /^sap\.([A-Z0-9_-]{2,32})\.role$/;
 // SAP-scoped TLS keys: sap.<alias>.ca_cert_path | sap.<alias>.insecure_skip_tls_verify
 const SAP_CA_CERT_PATH_RE = /^sap\.([A-Z0-9_-]{2,32})\.ca_cert_path$/;
 const SAP_INSECURE_TLS_RE = /^sap\.([A-Z0-9_-]{2,32})\.insecure_skip_tls_verify$/;
+// Standalone-profile keys: standalone.<field> (dotted, like the sap.* family).
+const STANDALONE_KEY_RE = /^standalone\.([a-z_]+)$/;
+const STANDALONE_FIELDS = [
+    'platform',
+    'release',
+    'database',
+    'deployment',
+    'ide',
+    'abap_cloud_only',
+    'notes',
+];
 /**
  * Coerce a user-typed on/off-style string to a boolean. Accepts the common
  * spellings a developer expects from a CLI toggle (`on`/`true`/`1` → true,
@@ -93,9 +107,10 @@ const VIRTUAL_KEYCHAIN_KEYS = new Set(['llm.byok_key', 'llm.ai_hub_token']);
  * the deprecated `local_files` alias — the canonical name is `local_build`).
  */
 function unsettableKeyList() {
-    return [...MUTABLE_KEYS]
-        .filter((k) => !VIRTUAL_KEYCHAIN_KEYS.has(k) && k !== 'local_files')
-        .join(', ');
+    return [
+        ...[...MUTABLE_KEYS].filter((k) => !VIRTUAL_KEYCHAIN_KEYS.has(k) && k !== 'local_files'),
+        ...UNSET_ONLY_KEYS,
+    ].join(', ');
 }
 /**
  * Mark a top-level config key as explicitly user-set so sparse serialisation
@@ -114,6 +129,76 @@ export function markExplicit(cfg, key) {
     if (!cfg.file_keys.includes(top))
         cfg.file_keys.push(top);
 }
+/** Human-readable "allowed values" error for a standalone.<field> set. */
+function standaloneValueError(field, value) {
+    switch (field) {
+        case 'platform':
+            return `Invalid standalone.platform "${value}". Allowed: ${STANDALONE_PLATFORMS.join(', ')}`;
+        case 'database':
+            return `Invalid standalone.database "${value}". Allowed: ${STANDALONE_DATABASES.join(', ')}`;
+        case 'deployment':
+            return `Invalid standalone.deployment "${value}". Allowed: ${STANDALONE_DEPLOYMENTS.join(', ')}`;
+        case 'ide':
+            return `Invalid standalone.ide "${value}". Allowed: ${STANDALONE_IDES.join(', ')}`;
+        case 'abap_cloud_only':
+            return 'standalone.abap_cloud_only must be on/off (also accepts true/false, 1/0).';
+        default:
+            return `standalone.${field} cannot be empty.`;
+    }
+}
+/**
+ * Apply one `standalone.<field>` value to the (possibly absent) profile.
+ *
+ * Setting `platform` on an absent profile seeds the whole table from that
+ * platform's derivations, so `config set standalone.platform S/4HANA` alone
+ * leaves a complete, consistent profile. Changing the platform later keeps the
+ * user's other answers — they said those on purpose.
+ */
+function applyStandaloneField(current, field, value) {
+    if (!current) {
+        // Guarded by the caller: only `platform` reaches here with no profile.
+        const platform = value;
+        return {
+            platform,
+            release: defaultRelease(platform),
+            database: deriveDatabase(platform) ?? 'HANA',
+            deployment: deriveDeployment(platform) ?? 'on-prem',
+            ide: 'ADT',
+            abap_cloud_only: defaultAbapCloudOnly(platform),
+        };
+    }
+    const next = { ...current };
+    switch (field) {
+        case 'platform':
+            next.platform = value;
+            break;
+        case 'release':
+            next.release = value.trim();
+            break;
+        case 'database':
+            next.database = value;
+            break;
+        case 'deployment':
+            next.deployment = value;
+            break;
+        case 'ide':
+            next.ide = value;
+            break;
+        case 'abap_cloud_only':
+            next.abap_cloud_only = coerceBool(value);
+            break;
+        case 'notes':
+            next.notes = value.trim();
+            break;
+    }
+    return next;
+}
+/**
+ * Keys `config unset` accepts that are NOT flat `config set` targets.
+ * `standalone` is a table written field-by-field via `standalone.<field>`, but
+ * users still need one command to clear the whole profile.
+ */
+const UNSET_ONLY_KEYS = new Set(['standalone']);
 /**
  * Delete a (possibly dotted, max 2-level) key from a loaded config in place.
  * Returns true if the key was present and removed, false if it was already
@@ -175,7 +260,7 @@ export async function runConfigUnset(args) {
     if (key.startsWith('sap.')) {
         errUnset(`"${key}" is a SAP-scoped key — those are managed per system via \`cspeach config set ${key} <value>\`, not config unset.`);
     }
-    if (!MUTABLE_KEYS.has(key)) {
+    if (!MUTABLE_KEYS.has(key) && !UNSET_ONLY_KEYS.has(key)) {
         errUnset(`Unknown key "${key}". Valid keys: ${unsettableKeyList()}`);
     }
     const cfg = await loadConfig();
@@ -272,6 +357,30 @@ export async function runConfigSet(args) {
         console.log(chalk.green(`Set ${key} = ${b}`));
         return;
     }
+    // Standalone-profile key: standalone.<field>. Mirrors the sap.<alias>.<key>
+    // shape — a dotted key handled before the flat MUTABLE_KEYS switch.
+    const standaloneMatch = STANDALONE_KEY_RE.exec(key);
+    if (standaloneMatch) {
+        const field = standaloneMatch[1];
+        if (!STANDALONE_FIELDS.includes(field)) {
+            err(`Unknown standalone key "${key}". Valid: ${STANDALONE_FIELDS.map((f) => `standalone.${f}`).join(', ')}`);
+        }
+        if (!validateValue(key, value)) {
+            err(standaloneValueError(field, value));
+        }
+        const cfg = await loadConfig();
+        // The platform is load-bearing: every other field's default derives from
+        // it. Refuse to invent one so a lone `standalone.release` can never sit
+        // under a silently-guessed platform.
+        if (!cfg.standalone && field !== 'platform') {
+            err(`Set the platform first: cspeach config set standalone.platform <${STANDALONE_PLATFORMS.join(' | ')}>`);
+        }
+        cfg.standalone = applyStandaloneField(cfg.standalone, field, value);
+        markExplicit(cfg, key);
+        await saveConfig(cfg);
+        console.log(chalk.green(`Set ${key} = ${value}`));
+        return;
+    }
     // Virtual keys that store secrets in the OS keychain instead of config.toml.
     if (key === 'llm.byok_key' || key === 'llm.ai_hub_token') {
         // Support stdin piping for secrets: `echo "key" | cspeach config set llm.byok_key -`
@@ -384,6 +493,30 @@ export async function runConfigSet(args) {
             console.log(chalk.dim('  → takes effect on the next `cspeach` launch.'));
             break;
         }
+        case 'no_sap': {
+            // Standalone mode — start without a SAP system (paste-mode skills only).
+            const b = coerceBool(value);
+            if (b === null) {
+                err(`${key} must be on/off (also accepts true/false, 1/0).`);
+            }
+            cfg.no_sap = b;
+            console.log(chalk.dim('  → takes effect on the next `cspeach` launch.'));
+            break;
+        }
+        case 'show_cogs': {
+            // Operator escape hatch — render OUR Anthropic COGS in USD even on a
+            // managed, metered account (where the customer-facing unit is credits).
+            // Off/absent is the product default; see cost/display-mode.ts.
+            const b = coerceBool(value);
+            if (b === null) {
+                err(`${key} must be on/off (also accepts true/false, 1/0).`);
+            }
+            cfg.show_cogs = b;
+            console.log(chalk.dim(b
+                ? '  → cost figures will show USD (our Anthropic cost), not credits.'
+                : '  → cost figures will show credits on a managed, metered account.'));
+            break;
+        }
         case 'write_mode':
             if (!isValidWriteMode(value)) {
                 err(`Invalid value for write_mode. Must be one of: auto, approval-gated, advisory-only`);
@@ -476,6 +609,21 @@ export function validateValue(key, value) {
     if (SAP_INSECURE_TLS_RE.test(key)) {
         return coerceBool(value) !== null;
     }
+    // Standalone-profile keys: standalone.<field>
+    const standaloneMatch = STANDALONE_KEY_RE.exec(key);
+    if (standaloneMatch) {
+        const field = standaloneMatch[1];
+        switch (field) {
+            case 'platform': return isStandalonePlatform(value);
+            case 'database': return STANDALONE_DATABASES.includes(value);
+            case 'deployment': return STANDALONE_DEPLOYMENTS.includes(value);
+            case 'ide': return STANDALONE_IDES.includes(value);
+            case 'abap_cloud_only': return coerceBool(value) !== null;
+            case 'release':
+            case 'notes': return value.trim().length > 0;
+            default: return false;
+        }
+    }
     if (!MUTABLE_KEYS.has(key))
         return false;
     switch (key) {
@@ -499,6 +647,7 @@ export function validateValue(key, value) {
             return value === 'true' || value === 'false';
         case 'local_build':
         case 'local_files': // deprecated alias — same on/off coercion
+        case 'show_cogs':
             return coerceBool(value) !== null;
         case 'write_mode':
             return isValidWriteMode(value);
@@ -506,6 +655,8 @@ export function validateValue(key, value) {
             return PLAN_MODE_VALUES.includes(value);
         case 'plan_audit':
             return PLAN_AUDIT_VALUES.includes(value);
+        case 'no_sap':
+            return coerceBool(value) !== null;
         case 'llm.mode':
             return LLM_MODE_VALUES.includes(value);
         case 'llm.ai_hub_base_url':

package/dist/commands/cost.js

@@ -11,7 +11,24 @@
 import chalk from 'chalk';
 import { readCostLog, summarise } from '../cost/cost-log.js';
 import { formatCost } from '../cost/pricing.js';
-export async function runCostCommand(sessionId) {
+import { creditsActive, formatCredits, globalCredits, CREDITS_PENDING, } from '../cost/credits.js';
+/**
+ * Sum the credits the proxy charged across the logged turns. Entries written
+ * before credits existed (or on turns whose balance fetch failed) carry no
+ * number — they are skipped, not counted as zero, and the caller says so.
+ */
+function summariseCredits(entries) {
+    let total = 0;
+    let unknown = 0;
+    for (const e of entries) {
+        if (typeof e.credits_charged === 'number')
+            total += e.credits_charged;
+        else
+            unknown++;
+    }
+    return { total, unknown };
+}
+export async function runCostCommand(sessionId, credits = globalCredits.snapshot()) {
     const entries = await readCostLog(sessionId);
     if (entries.length === 0) {
         console.log('');
@@ -20,9 +37,27 @@ export async function runCostCommand(sessionId) {
         return;
     }
     const s = summarise(entries);
+    // Credits mode: the customer is billed in credits at a multiplier we do not
+    // disclose, so NOTHING derived from cost/pricing.ts may be printed here —
+    // not the total, not the per-model split, not the per-turn figures. Tokens
+    // stay: they are a usage fact, not a COGS leak.
+    const inCredits = creditsActive();
+    const perTurn = summariseCredits(entries);
     // Header
     console.log('');
-    console.log(chalk.bold(`Session cost so far: ${formatCost(s.totalCost)}`) + chalk.dim(`   (${s.turns} turn${s.turns === 1 ? '' : 's'})`));
+    if (inCredits) {
+        const unit = credits?.unitLabel ?? 'credits';
+        // Prefer the live session tracker (balance deltas observed this run);
+        // fall back to the logged per-turn charges when it has nothing yet.
+        const total = credits && credits.sessionTotal > 0 ? credits.sessionTotal : perTurn.total;
+        console.log(chalk.bold(`Session usage so far: ${formatCredits(total, unit)}`) + chalk.dim(`   (${s.turns} turn${s.turns === 1 ? '' : 's'})`));
+        if (credits?.balance != null) {
+            console.log(chalk.dim(`Remaining balance: ${formatCredits(credits.balance, unit)}`));
+        }
+    }
+    else {
+        console.log(chalk.bold(`Session cost so far: ${formatCost(s.totalCost)}`) + chalk.dim(`   (${s.turns} turn${s.turns === 1 ? '' : 's'})`));
+    }
     // Token breakdown
     console.log('');
     console.log(chalk.dim('Tokens:'));
@@ -35,7 +70,10 @@ export async function runCostCommand(sessionId) {
         console.log('');
         console.log(chalk.dim('By model:'));
         for (const m of s.byModel) {
-            console.log(`  ${m.model.padEnd(24)} ${m.turns} turn${m.turns === 1 ? '' : 's'}   ${formatCost(m.cost)}`);
+            // Credits mode: turn counts only. A per-model dollar split is a direct
+            // read on our per-model COGS.
+            const tail = inCredits ? '' : `   ${formatCost(m.cost)}`;
+            console.log(`  ${m.model.padEnd(24)} ${m.turns} turn${m.turns === 1 ? '' : 's'}${tail}`);
         }
     }
     else if (s.byModel[0]) {
@@ -48,7 +86,21 @@ export async function runCostCommand(sessionId) {
     console.log(chalk.dim(`Recent turns (last ${recent.length}):`));
     for (const e of recent) {
         const tok = (e.tokens.input + e.tokens.output).toLocaleString();
-        console.log(`  turn ${String(e.turn).padStart(3)}   ${tok.padStart(10)} tok   ${formatCost(e.cost)}`);
+        // Credits mode: the per-turn figure is what the LEDGER charged (a balance
+        // delta recorded at turn end), never our computed USD. A turn whose
+        // balance sample failed shows the pending marker rather than a number we
+        // would have to invent.
+        const tail = inCredits
+            ? (typeof e.credits_charged === 'number'
+                ? formatCredits(e.credits_charged, credits?.unitLabel ?? 'credits')
+                : CREDITS_PENDING)
+            : formatCost(e.cost);
+        console.log(`  turn ${String(e.turn).padStart(3)}   ${tok.padStart(10)} tok   ${tail}`);
+    }
+    if (inCredits && perTurn.unknown > 0) {
+        console.log('');
+        console.log(chalk.dim(`${perTurn.unknown} turn${perTurn.unknown === 1 ? '' : 's'} had no balance reading — `
+            + `their usage is included in a later turn's figure.`));
     }
     console.log('');
     console.log(chalk.dim(`Detailed JSONL: ~/.cspeach/sessions/${sessionId}-cost.jsonl`));

package/dist/commands/export-audit.js

@@ -15,6 +15,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { buildAuditReport } from '../session/audit-export.js';
+import { globalCredits } from '../cost/credits.js';
 import { readCostLog } from '../cost/cost-log.js';
 /** Parse the text after `/export` into a subcommand + optional filename. */
 export function parseExportArgs(rest) {
@@ -30,7 +31,9 @@ export async function runExportAuditCommand(opts) {
     const { session, transport, emit } = opts;
     const cwd = opts.cwd ?? process.cwd();
     const costEntries = opts.costEntries ?? (await readCostLog(session.id));
-    const report = buildAuditReport({ session, costEntries, transport });
+    // The exported .md is a file the customer opens and forwards, so it carries
+    // their credits (not our COGS) whenever credits mode is active.
+    const report = buildAuditReport({ session, costEntries, transport, credits: globalCredits.snapshot() });
     const name = opts.filename && opts.filename.trim().length > 0
         ? opts.filename.trim()
         : defaultAuditFilename(session);

package/dist/commands/plan-chain.js

@@ -30,6 +30,7 @@ import { applyAuditResult, applyPhaseResolution, buildResumeCommand, offerNextPh
 import { appendCostLine, buildEntry } from '../cost/cost-log.js';
 import { startThinkingHeartbeat, AUDIT_HEARTBEAT_THRESHOLDS } from '../renderer/thinking-heartbeat.js';
 import { computeCost, formatCost } from '../cost/pricing.js';
+import { creditsActive } from '../cost/credits.js';
 /** Two consecutive failed verdicts on the same phase force status 'blocked'. */
 export const MAX_CONSECUTIVE_AUDIT_FAILURES = 2;
 /** Infra error strings are model/HTTP noise — clamp when rendering (Task 5 review). */
@@ -659,7 +660,13 @@ function renderAuditCost(args, cost) {
     try {
         const tok = cost.tokens.input + cost.tokens.output;
         const usd = computeCost(cost.model, cost.tokens);
-        args.log(chalk.dim(`[audit] ${tok.toLocaleString()} tok · ${formatCost(usd)} (${cost.model})`));
+        // Credits mode: the audit turn's USD is our COGS. There is no per-audit
+        // credit figure to substitute (the ledger charges the turn, not this
+        // sub-step), so the dim line drops the cost fragment and keeps tokens —
+        // never a dollar on a managed customer's screen.
+        args.log(chalk.dim(creditsActive()
+            ? `[audit] ${tok.toLocaleString()} tok (${cost.model})`
+            : `[audit] ${tok.toLocaleString()} tok · ${formatCost(usd)} (${cost.model})`));
         void appendCostLine(args.sessionId, {
             ...buildEntry({ turn: 0, model: cost.model, tokens: cost.tokens, duration_ms: cost.durationMs }),
             label: 'audit',