@cspeach/cli 1.1.22 → 1.1.23

package/dist/agent/tool-dispatch.js

@@ -38,6 +38,8 @@ export async function dispatchTool(name, args, ctx) {
     // silent). Headless runs are declined, never auto-approved.
     // The hook may be async (it reads the app's files). A hook that throws is
     // doubt — never let the call through unprompted: fail the call instead.
+    // `scope` (optional) keys the approval per tool too — sap_link sets it so a
+    // fiori_preview approval for the same alias does not cover it (Task 8 M-2).
     let handover = null;
     try {
         handover = (await tool.credentialHandover?.(args, ctx)) ?? null;
@@ -49,7 +51,7 @@ export async function dispatchTool(name, args, ctx) {
         };
     }
     const sessionId = ctx.session?.id;
-    if (handover && !isCredentialHandoverApproved(sessionId, handover.alias)) {
+    if (handover && !isCredentialHandoverApproved(sessionId, handover.alias, handover.scope)) {
         const r = await presentSafetyConfirmation({
             rule: 'CREDENTIAL_HANDOVER',
             op: tool.name,
@@ -61,7 +63,7 @@ export async function dispatchTool(name, args, ctx) {
         });
         if (!r.confirmed)
             return declined(r);
-        markCredentialHandoverApproved(sessionId, handover.alias);
+        markCredentialHandoverApproved(sessionId, handover.alias, handover.scope);
     }
     // Rule 8 — no batch without plan. 2nd+ mutating call this turn requires
     // explicit confirmation. Fires regardless of /safety-mode toggle (batch

package/dist/cli.js

@@ -203,6 +203,18 @@ export async function main(argv) {
             },
         });
     }
+    // CAP phase 2 — run the SAP link in the foreground for a local CAP app.
+    if (args[0] === 'sap' && args[1] === 'link') {
+        const { runSapLinkCommand } = await import('./commands/sap-link.js');
+        return runSapLinkCommand(args.slice(2), {
+            print: (s) => console.log(s),
+            defaultAlias: sapAlias,
+            standalone: async () => {
+                const { loadConfig, resolveStandalone } = await import('./config/loader.js');
+                return resolveStandalone(await loadConfig(), noSap);
+            },
+        });
+    }
     // Typed from yesterday's notes. Without this the words fall through to the
     // one-shot path at the bottom of this function and are sent to the model as
     // a PAID prompt on a machine that is configured and logged in. A hint, not
@@ -255,6 +267,7 @@ Usage:
   cspeach config set <key> <value>  Update a config key
   cspeach config unset <key>        Remove a config key (revert to default)
   cspeach config show [key]         Show config (full or single key)
+  cspeach sap link [alias] [--project dir]  Let a local CAP app reach its S/4 services (Ctrl+C stops)
   cspeach doctor                    Diagnose install + connectivity
   cspeach login                     Sign in via device-code flow
   cspeach logout                    Sign out (keep keychain key, if any)

package/dist/commands/plan-audit-evidence.js

@@ -69,6 +69,52 @@ const PROTECTED_TOOL_RE = /^sap_(set_source|update_method|create_object|delete_o
 const EXISTENCE_READ_RE = /^sap_(object_structure|get_source|transport_for_object)/;
 /** Any row the auditor may see is the union of the two tiers. */
 const EVIDENCE_TOOL_RE = new RegExp(`${PROTECTED_TOOL_RE.source}|${EXISTENCE_READ_RE.source}`);
+/**
+ * CAP phase 2 (2026-09-30): a CAP phase writes LOCAL files and proves itself
+ * with `cds build` + the Fiori/CAP smokes — none of which are sap_* rows. Without
+ * these the auditor sees the "(no ...)" sentinel and B4-blocks a finished phase.
+ * PROTECTED tier: they are the proof, never evicted by reads.
+ *
+ * R26: the CAP-only tools (and `cds build` rows) exist only in CAP work, so they
+ * are admitted always. The fiori_* smokes also run in RAP/Fiori sessions; they
+ * are admitted ONLY when the audited phase is a cap.* phase, so RAP/Fiori audits
+ * stay byte-identical to main.
+ */
+export const CAP_PROOF_TOOL_RE = /^(cap_metadata_import|cap_link_smoke)$/;
+/** Fiori smokes: CAP proof only in a cap.* phase audit (R26). */
+export const CAP_PHASE_SMOKE_TOOL_RE = /^(fiori_render_smoke|fiori_draft_smoke|fiori_metadata_audit)$/;
+/** True for a CAP proof row (tool name + args), given whether the audited phase is cap.*. */
+function isCapProof(toolName, args, capPhase) {
+    if (CAP_PROOF_TOOL_RE.test(toolName))
+        return true;
+    if (capPhase && CAP_PHASE_SMOKE_TOOL_RE.test(toolName))
+        return true;
+    return toolName === 'shell_exec' && isCapBuildShellRow(args);
+}
+/**
+ * A shell_exec row is CAP proof only for `cds build|compile|import`, with `cds`
+ * matched BY POSITION (controller ruling R6): argv[0] (`cds build`), argv[1]
+ * after `npx`, or argv[2] after `npm exec` / `pnpm exec`. Not `pnpm dlx cds`: it
+ * fetches the registry package `cds`, not @sap/cds-dk, so it proves nothing. Matching
+ * `cds` anywhere would let a safelisted row such as
+ * `git commit -m cds build` or `node x.js cds build` pass as PROTECTED build proof.
+ */
+export function isCapBuildShellRow(args) {
+    if (!args || typeof args !== 'object')
+        return false;
+    const a = args;
+    const argv = [a.command, ...(Array.isArray(a.args) ? a.args : [])].map(String);
+    let i = -1;
+    if (argv[0] === 'cds')
+        i = 0;
+    else if (argv[0] === 'npx' && argv[1] === 'cds')
+        i = 1;
+    else if ((argv[0] === 'npm' || argv[0] === 'pnpm') && argv[1] === 'exec') {
+        if (argv[2] === 'cds')
+            i = 2;
+    }
+    return i >= 0 && ['build', 'compile', 'import'].includes(argv[i + 1] ?? '');
+}
 const NO_LOG_SENTINEL = '(no tool-call log found for this session)';
 const NO_EVIDENCE_ROWS = '(tool-call log present, but no write/verify calls recorded for this session)';
 const DEFAULT_MAX_ROWS = 60;
@@ -101,7 +147,7 @@ function resultCapFor(toolName) {
         return ATC_RESULT_CAP;
     return RESULT_EXCERPT_CHARS;
 }
-function normalizeRow(raw) {
+function normalizeRow(raw, capPhase) {
     if (raw === null || typeof raw !== 'object')
         return null;
     const r = raw;
@@ -119,9 +165,19 @@ function normalizeRow(raw) {
     // PROTECTED is checked first: it is a strict-enough family that no
     // existence-read name can collide with it, but ordering makes the tiering
     // explicit for the reader.
-    const kind = PROTECTED_TOOL_RE.test(toolName) ? 'protected' : 'existence';
+    const kind = PROTECTED_TOOL_RE.test(toolName) || isCapProof(toolName, r.args, capPhase)
+        ? 'protected' : 'existence';
     return { toolName, args: r.args, result: r.result, isError, at, kind };
 }
+/**
+ * Admission filter: the sap_* write/verify + existence-read tiers, plus CAP
+ * proof (cap_link_smoke / cap_metadata_import, the fiori_* smokes in a cap.*
+ * phase only, and shell_exec ONLY for `cds build|compile|import` — never
+ * arbitrary shell rows).
+ */
+function isEvidenceRow(row, capPhase) {
+    return EVIDENCE_TOOL_RE.test(row.toolName) || isCapProof(row.toolName, row.args, capPhase);
+}
 /** Render the args as `name/type` when available, else a compact fallback. */
 function renderArgs(args) {
     if (args === null || args === undefined || typeof args !== 'object')
@@ -201,6 +257,7 @@ function renderRow(row) {
  */
 export async function extractAuditEvidence(sessionId, opts) {
     const maxRows = opts?.maxRows ?? DEFAULT_MAX_ROWS;
+    const capPhase = opts?.capPhase === true;
     const sinceIso = opts?.sinceIso;
     const filePath = path.join(checkpointsRoot(), sessionId, 'tool-calls.jsonl');
     let content;
@@ -222,8 +279,8 @@ export async function extractAuditEvidence(sessionId, opts) {
         catch {
             continue; // malformed line — skip silently
         }
-        const row = normalizeRow(parsed);
-        if (!row || !EVIDENCE_TOOL_RE.test(row.toolName))
+        const row = normalizeRow(parsed, capPhase);
+        if (!row || !isEvidenceRow(row, capPhase))
             continue;
         // D-B attempt-window: drop rows recorded before this attempt started.
         // ISO-8601 UTC strings compare correctly lexicographically. A row with no

package/dist/commands/plan-audit.js

@@ -189,6 +189,13 @@ export const PLAN_AUDIT_PROMPT_CONTRACT = [
     '- Transport (infra, not a deliverable): recorded in work.transport (and/or an sap_transport',
     '  row). A transport is NEVER required in work.generated and is NEVER activated — do not flag',
     '  a transport for having no write and no activation.',
+    '- Local CAP work (phase layer cap.link / cap.model / cap.service / cap.ui): NO SAP object is',
+    '  written and NO sap_activate is expected — its absence is NEVER a finding for these layers.',
+    '  Proof is: an ok shell_exec `cds build` (or `cds compile`) row for the build, and for',
+    '  cap.link an ok cap_link_smoke live read leg (a result saying "mock only" does not count);',
+    '  for cap.model and cap.service an ok `cds build` plus an ok cap_link_smoke mock; for cap.ui',
+    '  ok fiori_render_smoke, ok fiori_draft_smoke when the app has draft, and ok cap_link_smoke.',
+    '  A cap_link_smoke result that says "mock only" proves the offline gate, not the live one.',
     'If you cannot map a type code to one of these classes, that is a W3 warn, not a block.',
     '',
     'ESCALATION EXCEPTION (§6, governs B3) — recognized from GROUND TRUTH, not the manifest\'s',
@@ -427,7 +434,12 @@ async function buildAuditPrompt(args) {
         manifest: phase.manifest,
         work: phase.work ?? null,
     }, null, 2);
-    const evidence = await extractAuditEvidence(sessionId, sinceIso ? { sinceIso } : undefined);
+    // R26: fiori_* smoke rows are evidence only when the audited phase is a CAP phase.
+    const capPhase = typeof phase.layer === 'string' && phase.layer.startsWith('cap.');
+    const evidence = await extractAuditEvidence(sessionId, {
+        ...(sinceIso ? { sinceIso } : {}),
+        ...(capPhase ? { capPhase } : {}),
+    });
     const windowAttr = sinceIso ? ` window="this attempt only, since ${sinceIso}"` : '';
     return [
         `Independent audit of plan phase "${phaseId}" — plan "${envelope.title}" (envelope v${envelope.version}).`,

package/dist/commands/sap-link.js

@@ -0,0 +1,52 @@
+// cspeach-cli/src/commands/sap-link.ts
+//
+// CAP phase 2, Task 8 — `cspeach sap link [alias] [--project dir]`: run the SAP
+// link in the foreground for a local CAP app. Ctrl+C stops it and exits 0.
+// Never prompts for a password; refuses in standalone (no-SAP) mode; prints
+// only plain registry messages, never raw exception text.
+import { ensureSapLink, stopSapLink, SapLinkError } from '../sap-link/registry.js';
+import { LinkConfigError } from '../sap-link/project.js';
+function waitForSignal() {
+    return new Promise((resolve) => {
+        const done = () => {
+            process.off('SIGINT', done);
+            process.off('SIGTERM', done);
+            resolve();
+        };
+        process.once('SIGINT', done);
+        process.once('SIGTERM', done);
+    });
+}
+export async function runSapLinkCommand(argv, deps) {
+    if (deps.standalone && (await deps.standalone())) {
+        deps.print('The SAP link needs a SAP system. CSPeach is running without one (standalone).');
+        return 1;
+    }
+    const pi = argv.indexOf('--project');
+    const projectDir = pi >= 0 ? argv[pi + 1] ?? '.' : '.';
+    const alias = argv.find((a, i) => !a.startsWith('--') && argv[i - 1] !== '--project') ?? deps.defaultAlias;
+    if (!alias) {
+        deps.print('Name the SAP system: cspeach sap link <alias>');
+        return 1;
+    }
+    try {
+        const r = await ensureSapLink(projectDir, alias, deps.linkDeps);
+        deps.print(`SAP link on: ${r.handle.url} → ${alias}`);
+        deps.print(`Services: ${r.services.join(', ')}`);
+        if (r.roleNote)
+            deps.print(r.roleNote);
+        if (r.tlsNote)
+            deps.print(r.tlsNote);
+        if (r.httpNote)
+            deps.print(r.httpNote);
+        deps.print('Start your app with: cds watch --profile s4   (Ctrl+C here stops the link)');
+    }
+    catch (e) {
+        deps.print(e instanceof SapLinkError || e instanceof LinkConfigError ? e.message : 'The SAP link could not start.');
+        return 1;
+    }
+    await (deps.waitForStop ?? waitForSignal)();
+    await stopSapLink(projectDir);
+    deps.print('SAP link stopped.');
+    return 0;
+}

package/dist/lib/shutdown-hooks.js

@@ -0,0 +1,87 @@
+// cspeach-cli/src/lib/shutdown-hooks.ts
+/**
+ * One shared "managed-resource shutdown" for the whole CLI process.
+ *
+ * Why shared (Task 8 fix round 1, I-1): the Fiori preview registry and the SAP
+ * link registry each used to prepend their OWN signal listener and re-raise only
+ * when `listenerCount(sig) === 1`. With both installed each saw a count of 2,
+ * neither re-raised, and Ctrl+C / SIGTERM no longer ended the CLI.
+ *
+ * Now each registry registers a synchronous cleanup here. This module installs
+ * ONE `exit` listener and ONE prepended listener per terminating signal, runs
+ * every cleanup (a throwing cleanup never stops the others), then re-raises the
+ * signal when every remaining listener is its own — so a command that waits on
+ * the signal itself (e.g. `cspeach sap link`) still gets it, and otherwise
+ * Node's default "exit on signal" behaviour is kept.
+ *
+ * PREPEND: ui/alt-screen.ts re-raises with process.kill(process.pid, sig), which
+ * on Windows is an immediate TerminateProcess — a listener appended after it
+ * would never run.
+ *
+ * The re-raise can throw (SIGHUP is ENOSYS on Windows): it is wrapped and falls
+ * back to process.exit(128 + signal number).
+ */
+import * as os from 'node:os';
+const SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+const hooks = new Set();
+let installed = false;
+const listeners = new Map();
+function runHooks() {
+    for (const h of [...hooks]) {
+        try {
+            h();
+        }
+        catch { /* best effort: one failing cleanup never blocks the rest */ }
+    }
+}
+function reRaise(sig) {
+    const own = listeners.get(sig);
+    if (own)
+        process.removeListener(sig, own);
+    try {
+        process.kill(process.pid, sig);
+    }
+    catch {
+        const n = os.constants.signals[sig] ?? 15;
+        process.exit(128 + n);
+    }
+}
+function install() {
+    if (installed)
+        return;
+    installed = true;
+    const onExit = () => runHooks();
+    listeners.set('exit', onExit);
+    process.on('exit', onExit);
+    for (const sig of SIGNALS) {
+        const onSignal = () => {
+            runHooks();
+            const rest = process.listeners(sig);
+            if (rest.every((l) => l === onSignal))
+                reRaise(sig);
+        };
+        listeners.set(sig, onSignal);
+        process.prependListener(sig, onSignal);
+    }
+}
+/**
+ * Register a SYNCHRONOUS cleanup to run on process exit or a terminating
+ * signal. Installs the shared listeners on first use. Returns an unregister.
+ */
+export function registerShutdownHook(hook) {
+    install();
+    hooks.add(hook);
+    return () => { hooks.delete(hook); };
+}
+/** Test-only — the listener installed for a signal (or 'exit'). */
+export function __shutdownListenerFor(name) {
+    return listeners.get(name);
+}
+/** Test-only — remove the shared listeners and forget every hook. */
+export function __resetShutdownHooksForTests() {
+    for (const [name, l] of listeners)
+        process.removeListener(name, l);
+    listeners.clear();
+    hooks.clear();
+    installed = false;
+}

package/dist/one-shot.js

@@ -52,6 +52,10 @@ import './tools/filesystem/glob.js';
 import './tools/filesystem/grep.js';
 import './tools/shell/shell_exec.js';
 import './tools/fiori/tools.js';
+import './tools/cap/service-catalog.js';
+import './tools/cap/metadata-import.js';
+import './tools/cap/sap-link-tool.js';
+import './tools/cap/link-smoke.js';
 import './tools/extend-model/tool.js';
 import './tools/capability/tool.js';
 import './tools/web/web_fetch.js';

package/dist/projects/plan-run.js

@@ -112,6 +112,10 @@ const LAYER_LABELS = {
     'orchestration': 'Jobs & reports',
     'integration': 'Integration',
     'ui': 'UI',
+    'cap.link': 'S/4 link',
+    'cap.model': 'CAP data model',
+    'cap.service': 'CAP service',
+    'cap.ui': 'CAP app',
 };
 const DELEGATE_LABELS = {
     'abap-design': 'Design',
@@ -353,7 +357,7 @@ g = getGlyphs()) {
             continue;
         lines.push(`${g.attention} ${p.id} was NOT audit-verified (audit infrastructure failed — its own exit gate, activation + ATC, passed).`);
     }
-    const hasUi = phases.some((p) => p.layer === 'ui' || p.delegateTo === 'abap-fiori-build');
+    const hasUi = phases.some((p) => p.layer === 'ui' || p.layer === 'cap.ui' || p.delegateTo === 'abap-fiori-build');
     const hasService = phases.some((p) => p.layer === 'service');
     if (!hasUi && hasService) {
         const binding = findServiceBinding(phases);

package/dist/projects/plan-schema.js

@@ -16,6 +16,7 @@ import { z } from 'zod';
 export const PLAN_LAYERS = [
     'types', 'persistence', 'data-model', 'behavior', 'service',
     'orchestration', 'integration', 'ui',
+    'cap.link', 'cap.model', 'cap.service', 'cap.ui',
 ];
 /**
  * Existing skills a phase may delegate to. Keep in sync with
@@ -29,7 +30,7 @@ export const PLAN_LAYERS = [
 export const PLAN_DELEGATE_SKILLS = [
     'abap-design', 'abap-data-model', 'abap-rap', 'abap-eml',
     'abap-generate', 'abap-segw', 'abap-test', 'abap-fiori-build',
-    'abap-extend-model',
+    'abap-extend-model', 'abap-cap',
 ];
 /**
  * Keep in sync with ItemStatusByType['plan'] in types.ts.

package/dist/renderer/tool-labels.js

@@ -153,6 +153,10 @@ const RULES = {
     sap_preview_change: sapObject('Previewed change'),
     sap_run_unit_test: sapObject('Ran unit tests'),
     sap_odata_test: (a) => ({ verb: 'OData test', object: shortRight([str(a['servicePath']), str(a['entity'])].filter(Boolean).join(' ')) }),
+    sap_service_catalog: (a) => ({ verb: 'Service catalog', object: shortRight(str(a['search']) ?? '') }),
+    cap_metadata_import: (a) => ({ verb: 'Import metadata', object: str(a['apiName']) ?? '' }),
+    sap_link: (a) => ({ verb: 'SAP link', object: str(a['action']) ?? '' }),
+    cap_link_smoke: (a) => ({ verb: 'S/4 link check', object: str(a['s4']?.['entitySet']) ?? '' }),
     sap_badi_list: (a) => ({ verb: 'Searched BAdIs', object: shortRight(`"${str(a['query']) ?? ''}"`) }),
     sap_snapshot_list: (a) => ({ verb: 'Listed snapshots', object: shortRight(str(a['name']) ?? '') }),
     sap_snapshot_read: sapObject('Read snapshot'),
@@ -241,7 +245,7 @@ const PRESENT = {
     Structure: 'Reading structure of', 'Change log': 'Reading change log of', 'Read dumps': 'Reading dumps',
     'API state': 'Checking API state of', 'ABAP docs': 'Reading ABAP docs for', 'Read includes': 'Reading includes of',
     Compared: 'Comparing', 'Previewed change': 'Previewing change to', 'Ran unit tests': 'Running unit tests on',
-    'OData test': 'Testing OData', 'Searched BAdIs': 'Searching BAdIs', 'Listed snapshots': 'Listing snapshots',
+    'OData test': 'Testing OData', 'Service catalog': 'Reading service catalog', 'Import metadata': 'Importing metadata', 'SAP link': 'SAP link', 'S/4 link check': 'Checking S/4 link', 'Searched BAdIs': 'Searching BAdIs', 'Listed snapshots': 'Listing snapshots',
     'Read snapshot': 'Reading snapshot of', 'Cleaned snapshots': 'Cleaning snapshots',
     'Created transport': 'Creating transport', 'Transport for': 'Finding transport for',
     'Listed transports': 'Listing transports', Released: 'Releasing', 'Created domain': 'Creating domain',

package/dist/repl/credential-handover-gate.js

@@ -14,14 +14,20 @@
  * session id inside one, asks again. Tests call the reset in beforeEach.
  */
 const approved = new Set();
-function key(sessionId, alias) {
-    return `${sessionId ?? '(no session)'}\u0000${alias}`;
+/**
+ * `scope` (optional, Task 8 fix M-2) is a key discriminator: sap_link passes
+ * 'sap_link' so an earlier fiori_preview approval for the same alias does not
+ * cover it. No scope → the key is byte-identical to before (fiori_preview).
+ */
+function key(sessionId, alias, scope) {
+    const base = `${sessionId ?? '(no session)'}\u0000${alias}`;
+    return scope ? `${base}\u0000${scope}` : base;
 }
-export function isCredentialHandoverApproved(sessionId, alias) {
-    return approved.has(key(sessionId, alias));
+export function isCredentialHandoverApproved(sessionId, alias, scope) {
+    return approved.has(key(sessionId, alias, scope));
 }
-export function markCredentialHandoverApproved(sessionId, alias) {
-    approved.add(key(sessionId, alias));
+export function markCredentialHandoverApproved(sessionId, alias, scope) {
+    approved.add(key(sessionId, alias, scope));
 }
 export function __resetCredentialHandoverGateForTests() {
     approved.clear();

package/dist/repl.js

@@ -148,6 +148,10 @@ import './tools/filesystem/glob.js';
 import './tools/filesystem/grep.js';
 import './tools/shell/shell_exec.js';
 import './tools/fiori/tools.js';
+import './tools/cap/service-catalog.js';
+import './tools/cap/metadata-import.js';
+import './tools/cap/sap-link-tool.js';
+import './tools/cap/link-smoke.js';
 import './tools/extend-model/tool.js';
 import './tools/capability/tool.js';
 import './tools/web/web_fetch.js';

package/dist/sap/connection-manager.js

@@ -5,34 +5,40 @@ import { password as promptPassword } from '@inquirer/prompts';
 import { isHeadless } from '../renderer/tty.js';
 const SAP_SERVICE = 'cspeach-sap';
 const cache = new Map();
+/**
+ * The single place that reads an SAP alias password: keychain first, then a
+ * masked prompt when interactive. Headless callers (and the SAP link, which
+ * passes `headless: () => true`) never prompt. The password is never logged
+ * and never placed in an error message.
+ */
+export async function resolveSapPassword(alias, cfg, deps = {}) {
+    if (cfg.authType !== 'basic') {
+        throw new Error('x509 auth not yet supported in v0.1 — set authType=basic in config');
+    }
+    const getPassword = deps.getPassword ?? ((s, a) => keychain.getPassword(s, a));
+    let value;
+    try {
+        value = (await getPassword(SAP_SERVICE, alias)) ?? undefined;
+    }
+    catch { /* keychain unavailable */ }
+    if (value)
+        return value;
+    // B5 (2026-06-11) — headless guard: the keytar-miss fallback is a
+    // stdin password prompt, which would hang a headless run forever
+    // (same defect family as D1). Fail fast with an actionable error
+    // instead of prompting.
+    if ((deps.headless ?? isHeadless)()) {
+        throw new Error(`no stored password for SAP alias '${alias}' — store credentials first ` +
+            '(run interactively once or use cspeach config) — headless runs cannot prompt');
+    }
+    const prompt = deps.prompt ?? ((message) => promptPassword({ message, mask: '*' }));
+    return prompt(`SAP password for ${alias}/${cfg.username}:`);
+}
 export async function getConnection(alias, cfg) {
     const existing = cache.get(alias);
     if (existing)
         return existing;
-    let passwordValue;
-    if (cfg.authType === 'basic') {
-        try {
-            passwordValue = (await keychain.getPassword(SAP_SERVICE, alias)) ?? undefined;
-        }
-        catch { /* keychain unavailable */ }
-        if (!passwordValue) {
-            // B5 (2026-06-11) — headless guard: the keytar-miss fallback is a
-            // stdin password prompt, which would hang a headless run forever
-            // (same defect family as D1). Fail fast with an actionable error
-            // instead of prompting.
-            if (isHeadless()) {
-                throw new Error(`no stored password for SAP alias '${alias}' — store credentials first ` +
-                    '(run interactively once or use cspeach config) — headless runs cannot prompt');
-            }
-            passwordValue = await promptPassword({
-                message: `SAP password for ${alias}/${cfg.username}:`,
-                mask: '*',
-            });
-        }
-    }
-    if (cfg.authType !== 'basic') {
-        throw new Error('x509 auth not yet supported in v0.1 — set authType=basic in config');
-    }
+    const passwordValue = await resolveSapPassword(alias, cfg);
     // SapConnection constructor is (config, username, password) — 3 positional args.
     // SapConfig.authType is typed as 'basic' only (v1); SapSystemConfig carries the
     // wider union so we cast to satisfy the narrower SapConfig shape.