@cspeach/cli 1.1.2 → 1.1.4

package/dist/config/loader.js

@@ -3,6 +3,7 @@ import { isDeepStrictEqual } from 'node:util';
 import toml from '@iarna/toml';
 import { configFile, cspeachRoot } from './paths.js';
 import { DEFAULT_SESSION_MODEL } from './model-defaults.js';
+import { sanitiseStandaloneProfile } from '../sap/standalone-profile.js';
 /**
  * Whitelist guard for WriteMode — rejects typos / stale values from disk so
  * downstream code that trusts the WriteMode type doesn't see garbage.
@@ -141,6 +142,24 @@ export async function loadConfig() {
             // resolveRenderSmoke reads as the default ON (fail-safe: a config typo can
             // never silently disable the smoke).
             render_smoke: typeof parsed.render_smoke === 'boolean' ? parsed.render_smoke : undefined,
+            // no_sap: same absent-preserving coercion as local_build (the key is
+            // dropped below when undefined, so it never serialises as
+            // `no_sap = undefined`). A present-but-invalid value collapses to
+            // `false` — fail-safe: a config typo can never silently disconnect a
+            // user from the SAP system they configured.
+            no_sap: parsed.no_sap === true
+                ? true
+                : parsed.no_sap === undefined
+                    ? undefined
+                    : false,
+            // standalone: whitelist-coerced profile table. An unrecognised platform
+            // drops the whole table (undefined → key deleted below).
+            standalone: sanitiseStandaloneProfile(parsed.standalone),
+            // show_cogs: plain boolean, DEFAULT off (absent). Preserve only a genuine
+            // boolean; a typo/wrong-type collapses to undefined, which reads as OFF —
+            // fail-safe in the customer's favour: a config typo can never leak our
+            // USD COGS onto a managed customer's screen.
+            show_cogs: typeof parsed.show_cogs === 'boolean' ? parsed.show_cogs : undefined,
             write_mode: isValidWriteMode(parsed.write_mode) ? parsed.write_mode : DEFAULT_CONFIG.write_mode,
             // plan_mode: whitelist coercion — anything but the two valid literals
             // (typos, wrong types) collapses to undefined, which callers treat as
@@ -210,6 +229,19 @@ export async function loadConfig() {
         // callers see a genuine "absent" shape (resolveRenderSmoke treats it as ON).
         if (merged.render_smoke === undefined)
             delete merged.render_smoke;
+        // Same for `no_sap` and `standalone`: absent-or-invalid must not serialise
+        // as `undefined` — drop the keys so `config show` stays clean and callers
+        // see a genuine "absent" shape (resolveStandalone treats missing as off,
+        // and an absent profile triggers the standalone wizard).
+        if (merged.no_sap === undefined)
+            delete merged.no_sap;
+        if (merged.standalone === undefined)
+            delete merged.standalone;
+        // Same for `show_cogs`: absent-or-invalid must not serialise as
+        // `show_cogs = undefined` — drop the key so `config show` stays clean and
+        // callers see a genuine "absent" shape (treated as OFF → credits).
+        if (merged.show_cogs === undefined)
+            delete merged.show_cogs;
         // Same for `plan_mode`: absent-or-invalid must not serialise as
         // `plan_mode = undefined` — drop the key so `config show` stays clean and
         // callers see a genuine "absent" shape (treated as 'step').
@@ -305,6 +337,18 @@ export function resolveLocalBuild(cfg) {
 export function resolveRenderSmoke(cfg) {
     return cfg.render_smoke ?? true;
 }
+/**
+ * Resolve the effective standalone ("no SAP system") mode.
+ *
+ *     effective = --no-sap flag OR config no_sap   (default false)
+ *
+ * The flag can only turn standalone ON for a single run — there is no
+ * "--sap" counterpart — so the resolution is an OR, not a precedence chain.
+ * `no_sap` is already coerced to `true | false | undefined` by loadConfig.
+ */
+export function resolveStandalone(cfg, flagNoSap = false) {
+    return flagNoSap === true || cfg.no_sap === true;
+}
 export async function saveConfig(config) {
     await fs.mkdir(cspeachRoot(), { recursive: true });
     // The set of top-level keys the FILE carried (empty when it was absent).

package/dist/cost/cost-log.js

@@ -27,7 +27,7 @@ export function costLogPath(sessionId) {
  * `appendCostLine` or accumulate in memory for the `/cost` command.
  */
 export function buildEntry(opts) {
-    return {
+    const entry = {
         ts: new Date().toISOString(),
         turn: opts.turn,
         model: opts.model,
@@ -35,6 +35,11 @@ export function buildEntry(opts) {
         cost: computeCost(opts.model, opts.tokens),
         duration_ms: opts.duration_ms,
     };
+    if (opts.credits) {
+        entry.credits_charged = opts.credits.charged;
+        entry.balance_credits = opts.credits.balance;
+    }
+    return entry;
 }
 /**
  * Append a single line to the session's cost log. Best-effort:

package/dist/cost/credits-wire.js

@@ -0,0 +1,101 @@
+/**
+ * The one place the credits meter is driven (2026-09-16).
+ *
+ * Two touch points, both best-effort and both no-ops outside credits mode:
+ *
+ *   initCredits()              — REPL / one-shot startup. ONE balance call,
+ *                                capped at BALANCE_TIMEOUT_MS. Resolves the
+ *                                display mode and seeds the tracker + store.
+ *   refreshCreditsAfterTurn()  — post-turn. One more capped call; the proxy
+ *                                commits a turn's charge BEFORE the SSE stream
+ *                                closes, so this sample already includes the
+ *                                turn that just ended.
+ *
+ * The post-turn refresh is awaited inside the agent loop's post-turn block
+ * rather than fired and forgotten, because two consumers need the fresh
+ * number synchronously: the JSONL cost line written moments later, and the
+ * post-turn status footer the REPL prints once runTurn returns. Awaiting a
+ * 2.5 s-capped call at the end of a multi-second turn is cheap; showing the
+ * previous turn's figure would be wrong.
+ *
+ * The cfg + bearer getter are captured at init so every later call site stays
+ * a one-liner and no module has to re-derive the display mode for itself.
+ */
+import { fetchBalance, globalCredits, setCostDisplayMode, creditsActive, } from './credits.js';
+import { costDisplayMode } from './display-mode.js';
+import { globalStore } from '../ui/sap-state-store.js';
+let wiredCfg = null;
+let wiredBearer = null;
+/** Mirror the tracker's state onto the Ink store so the chrome re-renders. */
+function publish() {
+    const s = globalCredits.snapshot();
+    globalStore.update({
+        creditsMode: creditsActive(),
+        creditsSessionTotal: s.sessionTotal,
+        creditsBalance: s.balance,
+        creditsUnitLabel: s.unitLabel,
+        creditsPending: s.pending,
+    });
+}
+/**
+ * Startup: resolve the display mode and seed the opening balance.
+ * Never throws; on any failure the process stays in USD mode, which is the
+ * pre-credits behaviour.
+ */
+export async function initCredits(cfg, getBearer) {
+    try {
+        // Non-managed modes can't be metered by us — skip the round-trip entirely.
+        if (cfg.llm?.mode !== 'managed') {
+            setCostDisplayMode('usd');
+            return;
+        }
+        const info = await fetchBalance(cfg, getBearer);
+        const mode = costDisplayMode(cfg, info);
+        setCostDisplayMode(mode);
+        if (mode !== 'credits')
+            return;
+        wiredCfg = cfg;
+        wiredBearer = getBearer;
+        globalCredits.start(info);
+        publish();
+    }
+    catch {
+        // Startup must never be blocked by the meter.
+        setCostDisplayMode('usd');
+    }
+}
+/**
+ * Post-turn: sample the balance again and fold the delta into the session
+ * total. Returns null (and makes no request) outside credits mode.
+ */
+export async function refreshCreditsAfterTurn() {
+    if (!creditsActive() || !wiredCfg || !wiredBearer)
+        return null;
+    try {
+        const info = await fetchBalance(wiredCfg, wiredBearer);
+        const r = globalCredits.afterTurn(info);
+        publish();
+        return r;
+    }
+    catch {
+        // Treat an unexpected throw exactly like a failed fetch: unknown, not zero.
+        const r = globalCredits.afterTurn(null);
+        publish();
+        return r;
+    }
+}
+/**
+ * The credits payload for a cost-log line, or undefined in USD mode so the
+ * emitted JSONL keeps its pre-credits shape byte for byte.
+ */
+export function creditsForCostLog() {
+    if (!creditsActive())
+        return undefined;
+    const s = globalCredits.snapshot();
+    return { charged: s.chargedThisTurn, balance: s.balance };
+}
+/** Test seam — drop the captured cfg/bearer between cases. */
+export function resetCreditsWire() {
+    wiredCfg = null;
+    wiredBearer = null;
+}

package/dist/cost/credits.js

@@ -0,0 +1,199 @@
+/**
+ * Customer-facing spend — credits, not dollars (2026-09-16).
+ *
+ * Every figure in `cost/pricing.ts` is OUR Anthropic COGS. A managed
+ * customer is billed in CREDITS at a multiplier we do not disclose, so
+ * showing them a `$` number is both wrong (it is not what they pay) and a
+ * business leak (it reveals our margin). This module is the customer-facing
+ * half of the split:
+ *
+ *   cost/pricing.ts   → USD, our cost, telemetry + BYOK/local/ai-hub display
+ *   cost/credits.ts   → credits, what the customer is actually charged
+ *
+ * The proxy is the only source of truth for credits. It commits a turn's
+ * charge BEFORE the SSE stream closes, so a balance fetched after the turn
+ * ends already reflects that turn — which is why the per-turn charge here is
+ * a BALANCE DELTA, not a locally computed number. We never price a turn in
+ * credits ourselves; we only observe what the ledger did.
+ *
+ * Everything in here is best-effort. A balance fetch that fails, times out,
+ * or returns garbage must never crash or block a turn — it degrades to
+ * "unknown", which the UI renders as `credits: updating…` (never a dollar
+ * fallback; see display-mode.ts).
+ */
+/** Hard cap on the balance round-trip — never block a turn on it. */
+export const BALANCE_TIMEOUT_MS = 2_500;
+const DEFAULT_UNIT_LABEL = 'credits';
+function num(v) {
+    return typeof v === 'number' && Number.isFinite(v) ? v : null;
+}
+/**
+ * Fetch the customer's credit balance from the proxy.
+ *
+ * Uses the same bearer key the CLI already sends on every other proxy call.
+ * NEVER throws and NEVER hangs past BALANCE_TIMEOUT_MS — returns null on any
+ * failure (transport error, non-2xx, timeout, unparseable body, no key).
+ */
+export async function fetchBalance(cfg, getBearer) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), BALANCE_TIMEOUT_MS);
+    try {
+        const key = await getBearer();
+        if (!key)
+            return null;
+        const url = `${cfg.proxy_url.replace(/\/$/, '')}/v1/me/balance`;
+        const r = await fetch(url, {
+            headers: { Authorization: `Bearer ${key}` },
+            signal: controller.signal,
+        });
+        if (!r.ok)
+            return null;
+        const body = await r.json();
+        if (typeof body !== 'object' || body === null)
+            return null;
+        const b = body;
+        const info = {
+            metered: b.metered === true,
+            unit_label: typeof b.unit_label === 'string' && b.unit_label ? b.unit_label : DEFAULT_UNIT_LABEL,
+            balance_credits: num(b.balance_credits),
+            subscription_credits: num(b.subscription_credits),
+            purchased_credits: num(b.purchased_credits),
+        };
+        if (b.unprovisioned === true)
+            info.unprovisioned = true;
+        return info;
+    }
+    catch {
+        // Timeout, offline, DNS, malformed JSON — all the same to the caller.
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * In-memory, session-scoped credit meter.
+ *
+ * Honest-arithmetic contract:
+ * - A turn's charge is `previousBalance − currentBalance`, clamped at ≥ 0
+ *   (a mid-session top-up must never subtract from the session total).
+ * - When a fetch fails we do NOT invent a charge and we do NOT move the
+ *   baseline. The turn is reported as `null` (unknown) and the spend it
+ *   incurred is folded into the next SUCCESSFUL fetch's delta — so the
+ *   session total stays correct even across missed samples.
+ * - With no baseline at all (session opened offline) the first successful
+ *   fetch only establishes the baseline; it cannot be a delta.
+ */
+export class CreditsTracker {
+    baseline = null;
+    state = {
+        chargedThisTurn: null,
+        sessionTotal: 0,
+        balance: null,
+        unitLabel: DEFAULT_UNIT_LABEL,
+        pending: false,
+    };
+    /** Seed the session's opening balance. */
+    start(balance) {
+        if (balance)
+            this.state.unitLabel = balance.unit_label;
+        const opening = balance ? balance.balance_credits : null;
+        this.baseline = opening;
+        this.state = {
+            ...this.state,
+            chargedThisTurn: null,
+            sessionTotal: 0,
+            balance: opening,
+            pending: false,
+        };
+    }
+    /** Record a post-turn balance sample and return this turn's charge. */
+    afterTurn(balance) {
+        if (balance)
+            this.state.unitLabel = balance.unit_label;
+        const current = balance ? balance.balance_credits : null;
+        if (current === null) {
+            // Unknown — keep the baseline so the next good sample covers both turns.
+            this.state = { ...this.state, chargedThisTurn: null, pending: true };
+            return { chargedThisTurn: null, sessionTotal: this.state.sessionTotal, balance: this.state.balance };
+        }
+        if (this.baseline === null) {
+            // First balance we have ever seen — establish the baseline only.
+            this.baseline = current;
+            this.state = { ...this.state, chargedThisTurn: null, balance: current, pending: false };
+            return { chargedThisTurn: null, sessionTotal: this.state.sessionTotal, balance: current };
+        }
+        const charged = Math.max(0, this.baseline - current);
+        this.baseline = current;
+        const sessionTotal = this.state.sessionTotal + charged;
+        this.state = { ...this.state, chargedThisTurn: charged, sessionTotal, balance: current, pending: false };
+        return { chargedThisTurn: charged, sessionTotal, balance: current };
+    }
+    snapshot() {
+        return { ...this.state };
+    }
+}
+/**
+ * Format a credit count for display: thousands-separated, unit-labelled.
+ * Credits are whole units to the customer, so fractions round.
+ */
+export function formatCredits(n, unitLabel = DEFAULT_UNIT_LABEL) {
+    return `${Math.round(n).toLocaleString('en-US')} ${unitLabel}`;
+}
+/**
+ * Shown instead of a number when the post-turn balance fetch failed.
+ * Deliberately NOT a dollar fallback: a managed customer must never see our
+ * COGS, and "updating" is the truth — the charge is committed server-side and
+ * will surface on the next successful sample.
+ */
+export const CREDITS_PENDING = 'credits: updating…';
+/**
+ * The customer-facing spend line, e.g.
+ *   `▲ 52 credits this turn · 519 this session · balance 9,481`
+ * Degrades gracefully: an unknown turn charge renders CREDITS_PENDING, and a
+ * missing balance simply drops that segment.
+ */
+export function formatCreditsLine(s) {
+    if (s.chargedThisTurn === null)
+        return CREDITS_PENDING;
+    const parts = [
+        `▲ ${formatCredits(s.chargedThisTurn, s.unitLabel)} this turn`,
+        `${Math.round(s.sessionTotal).toLocaleString('en-US')} this session`,
+    ];
+    if (s.balance !== null) {
+        parts.push(`balance ${Math.round(s.balance).toLocaleString('en-US')}`);
+    }
+    return parts.join(' · ');
+}
+/**
+ * Session-scoped singletons.
+ *
+ * The cost-render sites are scattered across chalk printers, Ink components,
+ * slash commands and the markdown audit exporter — threading config + balance
+ * through every one of them would be a far larger diff than the behaviour
+ * warrants, and would leave each site free to re-derive the mode differently
+ * (exactly how a leak happens). Instead the mode is decided ONCE at startup
+ * (see costDisplayMode) and published here; every render site asks.
+ *
+ * Tests inject explicitly via each site's optional parameter, so the singleton
+ * is a default, never a hard dependency.
+ */
+export const globalCredits = new CreditsTracker();
+let activeMode = 'usd';
+/** Publish the resolved display mode for the whole process. */
+export function setCostDisplayMode(mode) {
+    activeMode = mode;
+}
+/** The resolved display mode. Defaults to 'usd' until startup resolves it —
+ *  fail-safe for BYOK/local/one-shot paths that never call the setter. */
+export function activeCostDisplayMode() {
+    return activeMode;
+}
+/** Convenience predicate for render sites. */
+export function creditsActive() {
+    return activeMode === 'credits';
+}
+/** Test seam — reset the process-wide mode between cases. */
+export function resetCostDisplayMode() {
+    activeMode = 'usd';
+}

package/dist/cost/display-mode.js

@@ -0,0 +1,29 @@
+/**
+ * The one rule that decides whether a cost figure renders as credits or as
+ * dollars (2026-09-16).
+ *
+ * `'credits'` — a MANAGED customer on a METERED account. They pay us in
+ *   credits; the USD number we compute locally is our Anthropic COGS and
+ *   must never reach their screen.
+ *
+ * `'usd'` — everything else:
+ *   - byok / ai-hub / local: the customer holds the provider relationship,
+ *     so the dollar figure IS their bill. Showing it is the whole point.
+ *   - managed but unmetered (or the balance fetch failed): we have no
+ *     credit truth to show. Fall back to the existing dollar rendering so
+ *     the meter is never blank.
+ *   - `show_cogs = on`: our own operator escape hatch for reading real COGS
+ *     on a managed account (margin analysis, pricing work). Never a default.
+ *
+ * Callers must treat this as the single source of truth — no site may
+ * re-derive the mode from `cfg.llm.mode` alone.
+ */
+export function costDisplayMode(cfg, balanceInfo) {
+    if (cfg.llm?.mode !== 'managed')
+        return 'usd';
+    if (balanceInfo?.metered !== true)
+        return 'usd';
+    if (cfg.show_cogs === true)
+        return 'usd';
+    return 'credits';
+}

package/dist/cost/pricing.js

@@ -24,6 +24,10 @@
  */
 import { getServerModelConfig } from '../models/server-config.js';
 const PRICING = {
+    // Claude 5 family (2026-09-15) — Opus 5 keeps the Opus 4.5+ rate ($5/$25);
+    // Sonnet 5 is $2/$10. Cache read = 10% of input, cache write = 1.25x input.
+    'claude-opus-5': { inputPer1M: 5.00, outputPer1M: 25.00, cacheReadPer1M: 0.50, cacheCreatePer1M: 6.25 },
+    'claude-sonnet-5': { inputPer1M: 2.00, outputPer1M: 10.00, cacheReadPer1M: 0.20, cacheCreatePer1M: 2.50 },
     // Claude Opus 4.5+ — input 5, output 25, cache_read 0.50, cache_write 6.25 (1.25x input).
     // 2026-06-07 correction: 4.5/4.6/4.7 were carried at the LEGACY $15/$75; actual
     // since Opus 4.5 is $5/$25. Only claude-opus-4 (4.0/4.1) genuinely was $15/$75.

package/dist/doctor/checks/_standalone-skip.js

@@ -0,0 +1,37 @@
+/**
+ * Shared "standalone mode is ON" result for the doctor's SAP checks.
+ *
+ * Standalone mode (2026-09-16) made "deliberately no SAP system" a SUPPORTED
+ * state, so with `no_sap = true` these checks report a neutral yellow `-` line
+ * that does not count toward the failed total.
+ *
+ * NOTHING else changes. With standalone OFF — including the plain "hasn't run
+ * `config add-sap` yet" case — every check keeps its original result, message
+ * and exit-code contribution, byte for byte.
+ */
+export const STANDALONE_SKIP_MESSAGE = 'standalone mode — SAP checks skipped';
+/**
+ * True ONLY when the user has opted into standalone mode via `no_sap = true`.
+ *
+ * Deliberately does NOT treat "no aliases configured" as standalone: for a
+ * user who simply hasn't added a system yet, a missing SAP connection is still
+ * a finding, and the pre-standalone output must be preserved exactly.
+ *
+ * Reads `cfg.no_sap` directly rather than calling `resolveStandalone` so this
+ * helper stays free of a runtime dependency on config/loader — several doctor
+ * tests replace that whole module with a mock. (`doctor` is its own process
+ * invocation, so the per-run `--no-sap` flag never reaches it anyway.)
+ */
+export function sapChecksSkipped(cfg) {
+    return cfg.no_sap === true;
+}
+/** The neutral skip result for a named check. */
+export function standaloneSkip(name) {
+    return {
+        name,
+        ok: false,
+        skipped: true,
+        message: STANDALONE_SKIP_MESSAGE,
+        hint: 'Connect a system any time with: cspeach config add-sap',
+    };
+}

package/dist/doctor/checks/cert.js

@@ -1,7 +1,12 @@
 import tls from 'node:tls';
 import { loadConfig, resolveSapTls } from '../../config/loader.js';
+import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
 export async function checkCert() {
     const cfg = await loadConfig();
+    // Standalone mode ONLY — an opted-in paste-mode user has nothing to probe.
+    // Everything below (including the "n/a" no-TLS line) is unchanged.
+    if (sapChecksSkipped(cfg))
+        return standaloneSkip('cert');
     const systems = Object.entries(cfg.sap).filter(([_, s]) => s.useSsl);
     if (systems.length === 0)
         return { name: 'cert', ok: true, message: 'n/a (no TLS SAP systems configured)' };

package/dist/doctor/checks/credits.js

@@ -0,0 +1,48 @@
+/**
+ * `cspeach doctor` — credits line (2026-09-16).
+ *
+ * Purely informational: whether this account is billed in credits and, if so,
+ * what is left. It NEVER fails the run — a customer with no balance reading
+ * still has a perfectly working CLI, and an unreachable balance endpoint is a
+ * proxy problem the proxy check already reports.
+ *
+ * Deliberately dollar-free: doctor output is the first thing a customer pastes
+ * into a support thread.
+ */
+import { fetchBalance, formatCredits } from '../../cost/credits.js';
+import { getStore } from '../../auth/api-key.js';
+function defaultProbe(cfg) {
+    return () => fetchBalance(cfg, async () => {
+        const store = await getStore();
+        return (await store.get()) ?? '';
+    });
+}
+export async function checkCredits(cfg, probe = defaultProbe(cfg)) {
+    // BYOK / ai-hub / local never touch our ledger — no reason to call the proxy.
+    if (cfg.llm?.mode !== 'managed') {
+        return { name: 'credits', ok: true, message: 'not metered (BYOK)' };
+    }
+    const info = await probe().catch(() => null);
+    if (!info) {
+        return {
+            name: 'credits', ok: true, skipped: true, message: 'unavailable',
+            hint: 'Could not read your balance — check the proxy check above, then retry.',
+        };
+    }
+    if (!info.metered) {
+        return { name: 'credits', ok: true, message: 'not metered (BYOK)' };
+    }
+    if (info.balance_credits === null) {
+        return {
+            name: 'credits', ok: true, skipped: true, message: 'unavailable',
+            hint: info.unprovisioned
+                ? 'Your account is metered but has no credit ledger yet — visit cspeach.dev/portal.'
+                : 'The server reported no balance figure.',
+        };
+    }
+    return {
+        name: 'credits',
+        ok: true,
+        message: `balance ${formatCredits(info.balance_credits, info.unit_label)}`,
+    };
+}

package/dist/doctor/checks/forge-rules.js

@@ -18,11 +18,17 @@
 import { loadConfig } from '../../config/loader.js';
 import { getConnection } from '../../sap/connection-manager.js';
 import { AdtClient, snapshots } from '@cspeach/sap-client';
+import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
 const PROBE_NAME = 'Z_CSPEACH_DOCTOR_PROBE';
 const PROBE_PACKAGE = '$TMP';
 const PROBE_SOURCE = `REPORT ${PROBE_NAME}.\nWRITE / 'cspeach doctor probe — safe to delete'.`;
 export async function checkForgeRules() {
     const cfg = await loadConfig();
+    // Standalone mode ONLY — the Rule 7/10 probe needs a live system, and an
+    // opted-in paste-mode user has none. Everything below (including the
+    // no-alias skip) is unchanged.
+    if (sapChecksSkipped(cfg))
+        return standaloneSkip('forge-rules');
     const aliases = Object.keys(cfg.sap);
     if (aliases.length === 0) {
         return {

package/dist/doctor/checks/sap.js

@@ -1,8 +1,13 @@
 import { readFile } from 'node:fs/promises';
 import { loadConfig, resolveSapTls } from '../../config/loader.js';
 import { probeGet } from './_http-probe.js';
+import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
 export async function checkSap() {
     const cfg = await loadConfig();
+    // Standalone mode ONLY — an opted-in paste-mode user has nothing to probe.
+    // Everything below (including the no-alias failure) is unchanged.
+    if (sapChecksSkipped(cfg))
+        return standaloneSkip('sap');
     const systems = Object.entries(cfg.sap);
     if (systems.length === 0)
         return { name: 'sap', ok: false, message: 'no SAP systems configured', hint: 'Run: cspeach config add-sap' };

package/dist/doctor/checks/standards.js

@@ -0,0 +1,27 @@
+/**
+ * Doctor check: standards (2026-09-16).
+ *
+ * Purely informational — surfaces WHICH development-standards document the
+ * session context is carrying, so a team that thinks their rules are being
+ * followed can confirm it at a glance. Having none is a normal state (CSPeach's
+ * built-in conventions apply), so it renders as a neutral `-` line, never a
+ * failure.
+ */
+import { resolveStandardsFile, displayStandardsPath } from '../../standards/standards-file.js';
+export async function checkStandards() {
+    const cwd = process.cwd();
+    const file = await resolveStandardsFile(cwd);
+    if (!file) {
+        return {
+            name: 'standards',
+            ok: false,
+            skipped: true,
+            message: 'none (run: cspeach standards init)',
+        };
+    }
+    return {
+        name: 'standards',
+        ok: true,
+        message: displayStandardsPath(file.path, cwd),
+    };
+}

package/dist/doctor/checks/system-roles.js

@@ -1,3 +1,4 @@
+import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
 /**
  * Doctor check: system-roles (UX Wave 1, Task 1).
  *
@@ -11,6 +12,10 @@
  * never counts toward the doctor's failed total. Pure — no I/O beyond cfg.
  */
 export async function checkSystemRoles(cfg) {
+    // Standalone mode ONLY — nothing to put a write-mode ceiling on. Everything
+    // below (including the no-alias skip) is unchanged.
+    if (sapChecksSkipped(cfg))
+        return standaloneSkip('system-roles');
     const entries = Object.entries(cfg.sap ?? {});
     if (entries.length === 0) {
         return {

package/dist/doctor/checks/zcspeach.js

@@ -2,9 +2,14 @@ import keytar from 'keytar';
 import { readFile } from 'node:fs/promises';
 import { loadConfig, resolveSapTls } from '../../config/loader.js';
 import { probeGet } from './_http-probe.js';
+import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
 const SAP_SERVICE = 'cspeach-sap';
 export async function checkZcspeach() {
     const cfg = await loadConfig();
+    // Standalone mode ONLY — an opted-in paste-mode user has nothing to probe.
+    // Everything below (including the no-alias failure) is unchanged.
+    if (sapChecksSkipped(cfg))
+        return standaloneSkip('zcspeach');
     const systems = Object.entries(cfg.sap);
     if (systems.length === 0) {
         return {

package/dist/doctor/run.js

@@ -10,8 +10,10 @@ import { checkSkill } from './checks/skill.js';
 import { checkKeychainFallback } from './checks/keychain-fallback.js';
 import { checkWriteMode } from './checks/write-mode.js';
 import { checkLlmMode } from './checks/llm-mode.js';
+import { checkCredits } from './checks/credits.js';
 import { checkForgeRules } from './checks/forge-rules.js';
 import { checkSystemRoles } from './checks/system-roles.js';
+import { checkStandards } from './checks/standards.js';
 export async function runDoctor() {
     console.log(chalk.cyan.bold('\nCSPeach — doctor\n'));
     const cfg = await loadConfig();
@@ -19,6 +21,7 @@ export async function runDoctor() {
     checks.push(await checkProxy());
     checks.push(await checkAuth());
     checks.push(await checkLlmMode(cfg));
+    checks.push(await checkCredits(cfg));
     checks.push(await checkWriteMode(cfg));
     checks.push(await checkSystemRoles(cfg));
     checks.push(await checkKeychain());
@@ -28,6 +31,7 @@ export async function runDoctor() {
     checks.push(await checkSkill());
     checks.push(await checkKeychainFallback());
     checks.push(await checkForgeRules());
+    checks.push(await checkStandards());
     let failed = 0;
     for (const c of checks) {
         const icon = c.skipped