@cspeach/cli 1.1.24 → 1.1.26

package/dist/tools/fiori/tools.js

@@ -47,12 +47,14 @@
 import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
 import { registerTool } from '../index.js';
-import { resolveSafePath, PathOutsideRootError } from '../_filesystem-shared.js';
+import { resolveSafePath, realPathForWrite, isDenylistedPath, PathOutsideRootError, DENYLIST_DESCRIPTION, } from '../_filesystem-shared.js';
 import { scaffoldFreestyle } from './scaffold.js';
 import { decodeHtmlEscapes } from './html-escapes.js';
 import { applyEntry } from './apply.js';
 import { listCatalog } from './catalog/index.js';
 import { writeDeployConfig } from './deploy-config.js';
+import { runFioriDeploy } from './deploy/run.js';
+import { FIORI_DEPLOY_HANDOVER_SCOPE } from './deploy/scope.js';
 import { scaffoldFioriElements } from './fe-scaffold.js';
 import { deriveExpectedColumns } from './smoke/audit-columns.js';
 import { PINNED_UI5_VERSION } from './ui5-version.js';
@@ -62,7 +64,7 @@ import { runDraftSmoke, draftSmokePreconditions } from './smoke/draft-smoke.js';
 import { customerService, isLoopbackAppUrl, capService, isCapDevIndex } from './smoke/draft-safety.js';
 import { verifyAndSpendApprovalId } from '../../approvals/jwt.js';
 import { deriveFreestyleSmokeSpec, FreestyleSmokeDerivationError } from './smoke/freestyle-spec.js';
-import { loadConfig, resolveRenderSmoke } from '../../config/loader.js';
+import { loadConfig, resolveRenderSmoke, resolveSapTls } from '../../config/loader.js';
 import { startPreview } from './preview/start.js';
 import { loginNeed, readStartScript } from './preview/app-guard.js';
 import { isCredentialHandoverApproved } from '../../repl/credential-handover-gate.js';
@@ -80,16 +82,53 @@ const SAMPLE_INDEX = sampleIndexJson;
 // model can cite the source (licensing constraint A-M1). Derived from the
 // corpus NOTICE: OpenUI5 sources, adapted, under Apache-2.0.
 const SAMPLE_ATTRIBUTION = 'Adapted from OpenUI5 (github.com/SAP/openui5) sample sources, licensed under Apache-2.0.';
-/** Resolve a user-supplied dir inside the project root, mapping the escape error. */
-function safeDir(ctx, userPath) {
+/** Shared denylist refusal text for a protected app / base folder. */
+function protectedDirError(p, ctx) {
+    const verdict = isDenylistedPath(p, ctx.cwd);
+    return verdict.blocked
+        ? `"${verdict.relFromRoot}" is a protected folder (denylist: ${DENYLIST_DESCRIPTION})`
+        : null;
+}
+/**
+ * Sync form of safeDir for pure read helpers: containment + the shared
+ * denylist on the spelled path (which already covers NTFS stream suffixes,
+ * trailing dots/spaces and 8.3 short names). No link resolution.
+ */
+function safeDirSync(ctx, userPath) {
+    let abs;
     try {
-        return { abs: resolveSafePath(ctx.cwd, userPath) };
+        abs = resolveSafePath(ctx.cwd, userPath);
     }
     catch (err) {
         if (err instanceof PathOutsideRootError)
             return { error: err.message };
         return { error: err instanceof Error ? err.message : String(err) };
     }
+    const refused = protectedDirError(abs, ctx);
+    return refused ? { error: refused } : { abs };
+}
+/**
+ * Resolve a user-supplied dir inside the project root, mapping the escape error.
+ * The dir must also not be a protected folder (`.git`, `.cspeach`, …) or an
+ * alias of one — checked on the spelled path AND on its real path (links,
+ * Windows 8.3 short names), through the shared denylist. The returned `abs` is
+ * still the spelled path so result strings and registry keys stay unchanged.
+ */
+async function safeDir(ctx, userPath) {
+    const spelled = safeDirSync(ctx, userPath);
+    if ('error' in spelled)
+        return spelled;
+    let real;
+    try {
+        real = await realPathForWrite(spelled.abs, ctx.cwd);
+    }
+    catch (err) {
+        if (err instanceof PathOutsideRootError)
+            return { error: err.message };
+        return { error: err instanceof Error ? err.message : String(err) };
+    }
+    const refused = protectedDirError(real, ctx);
+    return refused ? { error: refused } : spelled;
 }
 /** Relative-to-cwd, forward-slash path for stable, readable result strings. */
 function rel(ctx, abs) {
@@ -127,11 +166,12 @@ export async function fioriScaffoldHandler(args, ctx) {
         return { content: 'error: basePath is required', is_error: true };
     if (!args.appId)
         return { content: 'error: appId is required', is_error: true };
-    const resolved = safeDir(ctx, args.basePath);
+    const resolved = await safeDir(ctx, args.basePath);
     if ('error' in resolved)
         return { content: `error: ${resolved.error}`, is_error: true };
     try {
         await scaffoldFreestyle({
+            denyRoot: ctx.cwd,
             basePath: resolved.abs,
             appId: args.appId,
             appTitle: decodeTitle(args.appTitle ?? args.appId),
@@ -160,7 +200,7 @@ export async function fioriApplyHandler(args, ctx) {
         return { content: 'error: appDir is required', is_error: true };
     if (!args.entry)
         return { content: 'error: entry is required', is_error: true };
-    const resolved = safeDir(ctx, args.appDir);
+    const resolved = await safeDir(ctx, args.appDir);
     if ('error' in resolved)
         return { content: `error: ${resolved.error}`, is_error: true };
     // Params may arrive as a parsed object (preferred) or a JSON string (mirrors
@@ -181,7 +221,7 @@ export async function fioriApplyHandler(args, ctx) {
         // applyEntry preserves the engine's loud-on-conflict manifest merge — a
         // conflicting manifest patch throws here and surfaces as is_error, never a
         // silent last-wins overwrite.
-        applyEntry({ appDir: resolved.abs, entryName: args.entry, params });
+        applyEntry({ appDir: resolved.abs, entryName: args.entry, params, denyRoot: ctx.cwd });
     }
     catch (err) {
         return { content: `error: apply failed — ${err instanceof Error ? err.message : String(err)}`, is_error: true };
@@ -199,7 +239,7 @@ export async function fioriListHandler(_args, _ctx) {
     return { content: JSON.stringify(entries, null, 2) };
 }
 // ──────────────────────────── fiori_deploy_config ─────────────────────────
-export async function fioriDeployConfigHandler(args, ctx) {
+export async function fioriDeployConfigHandler(args, ctx, deps) {
     if (!args.appDir)
         return { content: 'error: appDir is required', is_error: true };
     if (!args.url)
@@ -210,9 +250,26 @@ export async function fioriDeployConfigHandler(args, ctx) {
         return { content: 'error: name (BSP app name) is required', is_error: true };
     if (!args.package)
         return { content: 'error: package is required', is_error: true };
-    const resolved = safeDir(ctx, args.appDir);
+    const resolved = await safeDir(ctx, args.appDir);
     if ('error' in resolved)
         return { content: `error: ${resolved.error}`, is_error: true };
+    // Review 2026-10-03 — TLS follows the alias: when the alias verifies
+    // certificates (a CA is configured, or the system trust store), the yaml
+    // never says ignoreCertErrors: true (fiori_deploy would override it anyway).
+    let ignoreCertErrors = args.ignoreCertErrors === true;
+    let tlsNote = '';
+    if (ignoreCertErrors) {
+        try {
+            const cfg = await (deps?.loadConfig ?? loadConfig)();
+            const sys = cfg.sap?.[ctx.sapAlias];
+            if (sys && resolveSapTls(sys).mode !== 'insecure') {
+                ignoreCertErrors = false;
+                tlsNote = `
+ignoreCertErrors was written as false: alias ${ctx.sapAlias} verifies certificates${sys.ca_cert_path ? ` (CA ${sys.ca_cert_path})` : ''}.`;
+            }
+        }
+        catch { /* no config — keep what was asked */ }
+    }
     try {
         writeDeployConfig(resolved.abs, {
             url: args.url,
@@ -221,7 +278,7 @@ export async function fioriDeployConfigHandler(args, ctx) {
             description: args.description,
             package: args.package,
             transport: args.transport ?? '',
-            ignoreCertErrors: args.ignoreCertErrors === true,
+            ignoreCertErrors,
         });
     }
     catch (err) {
@@ -233,9 +290,58 @@ export async function fioriDeployConfigHandler(args, ctx) {
     return {
         content: `Deploy config written: ${appDir}/ui5-deploy.yaml (BSP app ${args.name} → package ${args.package}` +
             `${args.transport ? `, transport ${args.transport}` : ''}).\n` +
-            `package.json gained "deploy" and "deploy-test" scripts. Run "npm run deploy-test" to validate without deploying.`,
+            `package.json gained "deploy" and "deploy-test" scripts. Next: fiori_deploy with mode "test" (the backend validates, ` +
+            'nothing is deployed), then mode "deploy" — it uses the SAP logon CSPeach already stores; no password or variable is needed.' +
+            tlsNote,
     };
 }
+/** The credential-handover scope: a fiori_preview approval for the alias does not cover a deploy. */
+export { FIORI_DEPLOY_HANDOVER_SCOPE };
+/**
+ * fiori_deploy — build + `fiori deploy` the app as a BSP with the SAP logon
+ * CSPeach already holds (deploy/run.ts has the full contract). The handler
+ * only sandboxes appDir, re-checks the credential-handover approval
+ * (TOCTOU, same as fiori_preview) and renders the result.
+ */
+export async function fioriDeployHandler(args, ctx, deps) {
+    if (!args || typeof args.appDir !== 'string' || args.appDir.trim() === '') {
+        return { content: 'error: appDir is required (the scaffolded app root, relative to the project root)', is_error: true };
+    }
+    const mode = args.mode ?? 'test';
+    if (mode !== 'test' && mode !== 'deploy') {
+        return { content: 'error: mode must be "test" (the backend validates, nothing is deployed) or "deploy"', is_error: true };
+    }
+    const resolved = await safeDir(ctx, args.appDir);
+    if ('error' in resolved)
+        return { content: `error: ${resolved.error}`, is_error: true };
+    const alias = args.alias ?? ctx.sapAlias;
+    const approved = (deps?.isLoginApproved ?? ((a) => isCredentialHandoverApproved(ctx.session?.id, a, FIORI_DEPLOY_HANDOVER_SCOPE)))(alias);
+    if (!approved) {
+        return {
+            content: `error: fiori_deploy refused (nothing was sent): handing the SAP logon for alias ${alias} to fiori deploy was not ` +
+                'approved in this session. Call fiori_deploy again so the approval prompt can be shown.',
+            is_error: true,
+        };
+    }
+    const { isLoginApproved: _gate, ...runDeps } = deps ?? {};
+    const r = await runFioriDeploy({
+        appDir: resolved.abs,
+        projectRoot: ctx.cwd,
+        mode,
+        alias,
+        ...(typeof args.approval_id === 'string' ? { approvalId: args.approval_id } : {}),
+    }, { log: (line) => ctx.chunkEmitter?.emit('info', line), ...runDeps });
+    if (!r.ok) {
+        const head = r.stage === 'refused' ? 'fiori_deploy refused (nothing was sent)' : `fiori_deploy failed at the ${r.stage} step`;
+        return { content: `error: ${head}: ${r.error}`, is_error: true };
+    }
+    const lines = [r.summary, ...r.notes.map((n) => `note: ${n}`)];
+    if (r.url)
+        lines.push(`deployedUrl: ${r.url}`);
+    else
+        lines.push('Next: run fiori_deploy with mode "deploy" (needs an approval_id for the BSP).');
+    return { content: lines.join('\n') };
+}
 // ──────────────────────────── fiori_scaffold_fe ───────────────────────────
 export async function fioriScaffoldFeHandler(args, ctx) {
     if (!args.basePath)
@@ -248,11 +354,12 @@ export async function fioriScaffoldFeHandler(args, ctx) {
         return { content: 'error: localAnnotations requires both technicalName and xml', is_error: true };
     }
     // metadata is OPTIONAL (the FE writer does not need it — spike §4); no $metadata fetch.
-    const resolved = safeDir(ctx, args.basePath);
+    const resolved = await safeDir(ctx, args.basePath);
     if ('error' in resolved)
         return { content: `error: ${resolved.error}`, is_error: true };
     try {
         await scaffoldFioriElements({
+            denyRoot: ctx.cwd,
             basePath: resolved.abs,
             appId: args.appId,
             appTitle: decodeTitle(args.appTitle ?? args.appId),
@@ -284,12 +391,12 @@ export async function feExtendHandler(args, ctx) {
     if (!FE_EXTEND_OPS.includes(args.op)) {
         return { content: `error: unknown op "${args.op}" — expected one of ${FE_EXTEND_OPS.join(', ')}`, is_error: true };
     }
-    const resolved = safeDir(ctx, args.basePath);
+    const resolved = await safeDir(ctx, args.basePath);
     if ('error' in resolved)
         return { content: `error: ${resolved.error}`, is_error: true };
     const before = new Set(await listFilesUnder(ctx, resolved.abs));
     try {
-        await feExtend({ basePath: resolved.abs, op: args.op, params: args.params ?? {} });
+        await feExtend({ basePath: resolved.abs, op: args.op, params: args.params ?? {}, denyRoot: ctx.cwd });
     }
     catch (err) {
         // V4-only scope limit: fe-fpm-writer refuses non-V4-FE apps (no
@@ -369,7 +476,7 @@ export async function fioriPreviewHandler(args, ctx, deps) {
     }
     if (!args.appDir)
         return { content: 'error: appDir is required for action "start"', is_error: true };
-    const resolved = safeDir(ctx, args.appDir);
+    const resolved = await safeDir(ctx, args.appDir);
     if ('error' in resolved)
         return { content: `error: ${resolved.error}`, is_error: true };
     const result = await startPreview({
@@ -442,7 +549,7 @@ export function resolvePreviewAppUrl(args) {
  * without launching a browser; the handler only orchestrates.
  */
 export function resolveFreestyleSmokeSpec(args, ctx) {
-    const resolved = safeDir(ctx, args.appDir);
+    const resolved = safeDirSync(ctx, args.appDir);
     if ('error' in resolved)
         return { error: resolved.error };
     let derived;
@@ -909,7 +1016,7 @@ registerTool({
     description: 'Write the ABAP-repository (BSP) deploy configuration for a scaffolded app: ui5-deploy.yaml ' +
         'plus "deploy" / "deploy-test" package.json scripts. Validates BSP app name (≤15 chars, ' +
         'uppercase), package namespace, and transport format. Credentials are NEVER written — ' +
-        'fiori deploy takes env-var NAMES at deploy time. appDir is sandboxed to the project root.',
+        'deploy with fiori_deploy, which uses the stored SAP logon. appDir is sandboxed to the project root.',
     isMutating: true,
     category: 'fiori',
     flagGated: true,
@@ -929,6 +1036,50 @@ registerTool({
     },
     handler: fioriDeployConfigHandler,
 });
+registerTool({
+    name: 'fiori_deploy',
+    description: 'Deploy a scaffolded UI5 app to the ABAP repository as a BSP application with the SAP "fiori deploy" tool, using ' +
+        'the SAP logon CSPeach already keeps for the alias in the OS credential store — the developer types no password ' +
+        'and sets no environment variable. Reads ui5-deploy.yaml in the app (write it first with fiori_deploy_config) and ' +
+        'REFUSES when it is not valid (BSP name, package, transport rules) or when its target url/port/client are not the ' +
+        'system of the SAP alias (a yaml that names the box by IP passes only when the alias host resolves to that IP); ' +
+        'the deploy then goes to the alias url. Runs the "build" script of the app first (without the logon). The logon ' +
+        'reaches only the fiori deploy process, by environment, and is scrubbed from all output. mode "test" (default): ' +
+        'the backend validates the upload and deploys nothing — no write approval needed. mode "deploy": a SAP WRITE — ' +
+        'call request_approval with a change {op:"create", object:"<BSP NAME>", type:"WAPA"} first and pass the id as ' +
+        'approval_id (one approval, one deploy; an auto-approval does not count); refused in advisory-only mode and on production-tagged aliases. On ' +
+        'success the tool GETs /sap/bc/ui5_ui5/sap/<bsp>/index.html over the alias connection and returns deployedUrl ' +
+        'only when it answered 200. Asks once per session per alias before handing the logon over. Flag-gated (enabled ' +
+        'with local_build).',
+    isMutating: true,
+    requiresSap: true,
+    category: 'fiori',
+    flagGated: true,
+    input_schema: {
+        type: 'object',
+        properties: {
+            appDir: { type: 'string', description: 'The scaffolded app root (relative to the project root, sandboxed). In a plan: phases[ui.build].work.app.dir.' },
+            mode: { type: 'string', enum: ['test', 'deploy'], description: '"test" (default): backend validation only, nothing deployed. "deploy": the real deploy.' },
+            alias: { type: 'string', description: 'SAP alias whose system and stored logon are used. Defaults to the session alias.' },
+            approval_id: { type: 'string', description: 'mode "deploy" only: from request_approval, change {op:"create", object:"<BSP NAME>", type:"WAPA"}.' },
+        },
+        required: ['appDir'],
+    },
+    // The logon is handed to a child process in BOTH modes — dispatchTool asks a
+    // human once per session per alias (scope fiori_deploy, so an earlier
+    // fiori_preview approval does not cover it). The /abap-plan deploy card
+    // records this approval when the developer confirms it.
+    credentialHandover: (args, ctx) => {
+        const alias = args?.alias ?? ctx.sapAlias;
+        return {
+            alias,
+            scope: FIORI_DEPLOY_HANDOVER_SCOPE,
+            summary: `CSPeach's stored SAP logon for alias ${alias} is passed to "fiori deploy" (${args?.appDir ?? '(no appDir given)'}) ` +
+                'through its environment only — never on the command line, never in a file. Asked once per session for each alias.',
+        };
+    },
+    handler: fioriDeployHandler,
+});
 registerTool({
     name: 'fiori_scaffold_fe',
     description: 'Scaffold a trivial Fiori Elements app shell (List Report Object Page, Worklist, Overview Page, or Analytical List Page) ' +
@@ -1233,7 +1384,7 @@ registerTool({
         try {
             if (!args.appDir)
                 return handover;
-            const resolved = safeDir(ctx, args.appDir);
+            const resolved = await safeDir(ctx, args.appDir);
             if ('error' in resolved)
                 return handover;
             const startScript = await readStartScript(resolved.abs);

package/dist/tools/local-build.js

@@ -11,6 +11,7 @@
  *   filesystem: file_read, file_write, file_edit, glob, grep
  *   shell:      shell_exec
  *   fiori:      fiori_scaffold, fiori_apply, fiori_list, fiori_deploy_config,
+ *               fiori_deploy (BSP deploy with the stored SAP logon — approval-gated write),
  *               fiori_scaffold_fe, fiori_fe_extend, fiori_render_smoke,
  *               fiori_preview (L1-6 — the preview server every browser check
  *               depends on), fiori_metadata_audit, fiori_draft_smoke
@@ -66,6 +67,8 @@ export const LOCAL_BUILD_TOOLS = [
     'fiori_apply',
     'fiori_list',
     'fiori_deploy_config',
+    // Deploy with the stored SAP logon (2026-10-02) — a SAP write in mode 'deploy', approval-gated.
+    'fiori_deploy',
     'fiori_scaffold_fe',
     'fiori_fe_extend',
     'fiori_render_smoke',

package/dist/tools/project/_merge-shared.js

@@ -11,7 +11,10 @@
  * (no ensureWorkspace side effects from a tool call); only bare tokens
  * trigger the workspace lookup.
  */
-import { basename, isAbsolute, join } from 'node:path';
+import { basename, isAbsolute, join, resolve } from 'node:path';
+import { promises as fsp } from 'node:fs';
+import { isDenylistedPath, isInsideRoot } from '../_filesystem-shared.js';
+import { workspaceFolderFor } from '../../lane/roots.js';
 import { readProjectFile } from '../../projects/status.js';
 import { resolveAtTokenAsync, formatProjectFileList } from '../../projects/workspace.js';
 export function labelFor(path) {
@@ -42,8 +45,40 @@ export async function resolveEnvelopeToken(rawToken, cwd) {
  * Resolve + read + type-check one envelope input. readProjectFile
  * already validates the envelope schema and throws readable errors.
  */
+/**
+ * SEC (review round 1): the merge tools must not be a file-existence / JSON
+ * oracle for arbitrary paths (`~/.cspeach/auth.json`, `../../other/x`). An
+ * input is read only when its REAL path is
+ *   - inside the project folder (cwd) and not a protected path, or
+ *   - inside the resolved workspace folder (which may sit outside cwd, e.g. a
+ *     git-root `.cspeach/` or a configured `workspace_folder`) AND named
+ *     `*.cspeach.json` — a saved envelope, never a secret.
+ * The spelled path is checked BEFORE the disk is touched, so an outside path
+ * gets the same answer whether it exists or not.
+ */
+async function assertEnvelopeInputAllowed(rawToken, filePath, cwd) {
+    const refused = new Error(`'${rawToken}' is outside the project and its workspace folder, or a protected path — `
+        + 'merge inputs must be saved .cspeach.json envelopes inside this project or its workspace folder.');
+    const abs = resolve(cwd, filePath);
+    const workspace = await workspaceFolderFor(cwd);
+    const isEnvelope = /\.cspeach\.json$/i.test(basename(abs));
+    const allowedAt = (p) => (isInsideRoot(p, cwd) && !isDenylistedPath(p, cwd).blocked)
+        || (isEnvelope && /\.cspeach\.json$/i.test(basename(p)) && isInsideRoot(p, workspace));
+    if (!allowedAt(abs))
+        throw refused;
+    let real;
+    try {
+        real = await fsp.realpath(abs);
+    }
+    catch {
+        throw new Error(`cannot read '${rawToken}': file not found`);
+    }
+    if (!allowedAt(real))
+        throw refused;
+}
 export async function loadEnvelope(rawToken, cwd, expectedType) {
     const path = await resolveEnvelopeToken(rawToken, cwd);
+    await assertEnvelopeInputAllowed(rawToken, path, cwd);
     let envelope;
     try {
         envelope = readProjectFile(path);

package/dist/tools/project/cca_merge.js

@@ -29,6 +29,7 @@ import { dirname, isAbsolute, join } from 'node:path';
 import { registerTool } from '../index.js';
 import { mergeCcaAssessments, renderCcaMergeManifest, } from '../../projects/merge-cca.js';
 import { loadEnvelope, MANIFEST_PASTE_INSTRUCTIONS } from './_merge-shared.js';
+import { assertWritable } from '../_filesystem-shared.js';
 export async function ccaMergeHandler(args, ctx) {
     if (!Array.isArray(args.inputs) || args.inputs.some((i) => typeof i !== 'string')) {
         return { content: 'error: inputs must be an array of envelope paths / @-tokens.', is_error: true };
@@ -99,6 +100,9 @@ export async function ccaMergeHandler(args, ctx) {
     let detailWritten = true;
     const detailAbs = isAbsolute(merged.detailPath) ? merged.detailPath : join(ctx.cwd, merged.detailPath);
     try {
+        // SEC (review round 2): the real landing path must stay in the project and
+        // not be protected (a junctioned .cspeach/<domain> -> .git is refused).
+        await assertWritable(detailAbs, ctx.cwd);
         mkdirSync(dirname(detailAbs), { recursive: true });
         writeFileSync(detailAbs, JSON.stringify({
             generatedAt: new Date().toISOString(),

package/dist/tools/project/upgrade_merge_progress.js

@@ -31,6 +31,8 @@ import { dirname, isAbsolute, join } from 'node:path';
 import { registerTool } from '../index.js';
 import { mergeUpgradeProgress, renderUpgradeMergeManifest, } from '../../projects/merge-upgrade.js';
 import { loadEnvelope, MANIFEST_PASTE_INSTRUCTIONS } from './_merge-shared.js';
+import { assertWritable } from '../_filesystem-shared.js';
+import { resolveDetailFile } from '../../projects/detail-path.js';
 function sha256OfFile(path) {
     return createHash('sha256').update(readFileSync(path)).digest('hex');
 }
@@ -88,19 +90,25 @@ export async function upgradeMergeProgressHandler(args, ctx) {
         const scanContent = scan.envelope.content;
         // baseline_sha256 is the sha256 of the baseline DETAIL JSON body (the
         // upgrade-fix manifest contract), not of the envelope.
-        const detailAbs = isAbsolute(scanContent.detailPath)
-            ? scanContent.detailPath
-            : join(ctx.cwd, scanContent.detailPath);
+        // SEC (review round 2): detailPath comes from INSIDE the scan envelope
+        // (model-writable). It is resolved only to a real file in a
+        // `.cspeach/upgrades/` working folder of this project or its workspace,
+        // never a protected path. Refused and missing get ONE message that never
+        // echoes the path — no existence oracle, no hash of an arbitrary file.
+        const unavailable = {
+            content: "error: the scan's baseline detail file is not available. The merge needs the scan's detail JSON "
+                + 'on this machine, saved under .cspeach/upgrades/ in this project or its workspace folder.',
+            is_error: true,
+        };
+        const detailReal = await resolveDetailFile(scanContent.detailPath, 'upgrades', ctx.cwd);
+        if (!detailReal)
+            return unavailable;
         let sha256;
         try {
-            sha256 = sha256OfFile(detailAbs);
+            sha256 = sha256OfFile(detailReal);
         }
-        catch (e) {
-            return {
-                content: `error: cannot hash baseline detail file '${scanContent.detailPath}' (resolved: ${detailAbs}): `
-                    + `${e instanceof Error ? e.message : String(e)}. The merge needs the scan's detail JSON on this machine.`,
-                is_error: true,
-            };
+        catch {
+            return unavailable;
         }
         baseline = {
             sha256,
@@ -143,6 +151,9 @@ export async function upgradeMergeProgressHandler(args, ctx) {
     let detailWritten = true;
     const mergedDetailAbs = isAbsolute(merged.detailPath) ? merged.detailPath : join(ctx.cwd, merged.detailPath);
     try {
+        // SEC (review round 2): the real landing path must stay in the project and
+        // not be protected (a junctioned .cspeach/<domain> -> .git is refused).
+        await assertWritable(mergedDetailAbs, ctx.cwd);
         mkdirSync(dirname(mergedDetailAbs), { recursive: true });
         writeFileSync(mergedDetailAbs, JSON.stringify({
             generatedAt: new Date().toISOString(),

package/dist/tools/subagent/read_agent.js

@@ -22,7 +22,7 @@ import { listTools, registerTool, toolsForContext } from '../index.js';
 import { runTurn } from '../../agent/loop.js';
 import { collectTurnAssistantText } from '../../agent/turn-assistant-text.js';
 import { newSession } from '../../session/schema.js';
-import { computeSessionCost } from '../../cost/session-cost.js';
+import { computeSessionModelCost } from '../../cost/session-cost.js';
 import { sessionIdOf, spillIfLarge } from '../result-spill.js';
 import { INTERRUPTED_LINE, READER_SKILL, READER_SYSTEM_PROMPT, READER_TOOLS, hasReaderReadTools } from './reader-prompt.js';
 export { INTERRUPTED_LINE, READER_SKILL, READER_SYSTEM_PROMPT, READER_TOOLS, hasReaderReadTools };
@@ -118,7 +118,9 @@ export async function readAgentHandler(args, ctx) {
     finally {
         // Spend counts whether or not the reader finished.
         if (ctx.readerSpend) {
-            ctx.readerSpend.cost += computeSessionCost(childSession);
+            // The child's own model cost only — the BYOK router spend is already in
+            // the session total once (review S1, 2026-10-02).
+            ctx.readerSpend.cost += computeSessionModelCost(childSession);
             ctx.readerSpend.calls += 1;
         }
     }

package/dist/tools/tool-loading.js

@@ -35,7 +35,7 @@ export const CORE_TOOLS = Object.freeze([
     'sap_create_object',
 ]);
 const FIORI_FAMILY = [
-    'fiori_apply', 'fiori_deploy_config', 'fiori_draft_smoke', 'fiori_fe_extend',
+    'fiori_apply', 'fiori_deploy', 'fiori_deploy_config', 'fiori_draft_smoke', 'fiori_fe_extend',
     'fiori_list', 'fiori_metadata_audit', 'fiori_preview', 'fiori_render_smoke',
     'fiori_sample_get', 'fiori_sample_search', 'fiori_scaffold', 'fiori_scaffold_fe',
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cspeach/cli",
-  "version": "1.1.24",
+  "version": "1.1.26",
   "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
   "keywords": [
     "abap",