@cspeach/cli 1.1.24 → 1.1.26

package/dist/commands/deploy-card.js

@@ -0,0 +1,135 @@
+// cspeach-cli/src/commands/deploy-card.ts
+/**
+ * The deploy card (owner, 2026-10-02) — the CLI-owned stop between ui.build
+ * and ui.deploy. Deploy is a chained step of a UI plan, so the chain does not
+ * just ask "run the next phase?": it shows WHERE the app will go (system,
+ * client, BSP name, package, transport) and that CSPeach's stored SAP logon
+ * will be used, and only then dispatches ui.deploy.
+ *
+ * ONE CLEAR APPROVAL
+ * ------------------
+ *  - This card = consent to run the deploy phase AND to hand the stored logon
+ *    to `fiori deploy` this session. Confirming it records the fiori_deploy
+ *    credential handover (scope fiori_deploy), so the tool does not ask that
+ *    question a second time.
+ *  - The real deploy is a SAP write: inside the phase it still needs ONE
+ *    request_approval for the BSP — the same approval box every SAP write
+ *    gets, which is where write_mode, the qas/prd role ceilings and the
+ *    guarded-run "no auto-approve" rule are enforced. The test-mode deploy
+ *    that runs first needs no approval (it writes nothing).
+ *  - A deploy that can never run (production alias, advisory-only, no SAP
+ *    system) is explained on the card and never asked or queued.
+ *
+ * Pure-ish: config + file reads are injectable; nothing here talks to SAP.
+ */
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { readDeployYaml } from '../tools/fiori/deploy/yaml-read.js';
+import { cardLine } from '../lane/card.js';
+/** The last value of a work field across phases (last written wins, as in planCompletionLines). */
+function lastWork(phases, pick) {
+    for (const p of [...phases].reverse()) {
+        const v = pick(p);
+        if (v !== undefined && v !== null && v !== '')
+            return v;
+    }
+    return undefined;
+}
+export async function gatherDeployCardFacts(a) {
+    const f = {};
+    f.appDir = lastWork(a.phases, (p) => (p.layer === 'ui' ? p.work?.app?.dir : undefined));
+    f.transport = lastWork(a.phases, (p) => p.work?.transport);
+    // The app's deploy config, when ui.build (or an earlier run) already wrote it.
+    if (f.appDir) {
+        try {
+            const abs = path.resolve(a.cwd, f.appDir);
+            const read = readDeployYaml(await fs.readFile(path.join(abs, 'ui5-deploy.yaml'), 'utf8'));
+            if (read.ok) {
+                f.bsp = read.config.name;
+                f.package = read.config.package.toUpperCase();
+                f.transport = read.config.transport || (f.package === '$TMP' ? undefined : f.transport);
+            }
+        }
+        catch { /* no deploy config yet — the phase writes it */ }
+    }
+    if (!a.sapAlias || a.sapAlias === 'none') {
+        f.blocked = 'no SAP system is connected in this session — start CSPeach with the SAP alias to deploy to';
+        return f;
+    }
+    f.alias = a.sapAlias;
+    let cfg;
+    try {
+        cfg = await (a.loadConfig ?? (async () => (await import('../config/loader.js')).loadConfig()))();
+    }
+    catch {
+        f.blocked = 'the CSPeach config could not be read';
+        return f;
+    }
+    const sys = cfg.sap?.[a.sapAlias];
+    if (!sys) {
+        f.blocked = `SAP alias ${a.sapAlias} is not configured`;
+        return f;
+    }
+    const host = sys.host.trim().replace(/^[a-z][a-z0-9+.-]*:\/\//i, '').replace(/[/?#].*$/, '').replace(/:\d+$/, '').toLowerCase();
+    f.systemUrl = `${sys.useSsl === false ? 'http' : 'https'}://${host}:${sys.port}`;
+    f.client = String(sys.client);
+    if (sys.role === 'prd') {
+        f.blocked = `${a.sapAlias} is tagged as a production system — CSPeach deploys in development; move the app with the transport`;
+        return f;
+    }
+    const effective = (a.effectiveWriteMode ?? (await import('../repl/mode-cycle.js')).getEffectiveWriteMode)(cfg.write_mode ?? 'approval-gated', sys.role);
+    if (effective === 'advisory-only') {
+        f.blocked = `write mode is advisory-only for ${a.sapAlias} — the deploy is a SAP write`;
+    }
+    return f;
+}
+export function renderDeployCard(f, nextPhaseId) {
+    const v = (s, fallback) => (s ? cardLine(s) : fallback);
+    const lines = [
+        '',
+        `Deploy the app to SAP (next phase: ${cardLine(nextPhaseId)})`,
+        `  System     ${v(f.alias, '(none)')}${f.systemUrl ? ` — ${cardLine(f.systemUrl)}` : ''}${f.client ? ` · client ${cardLine(f.client)}` : ''}`,
+        `  App        ${v(f.appDir, '(recorded by ui.build)')}`,
+        `  BSP name   ${v(f.bsp, 'set in this phase (max 15 characters, Z/Y, uppercase)')}`,
+        `  Package    ${v(f.package, 'set in this phase (the backend package)')}`,
+        `  Transport  ${f.package === '$TMP' ? '(none — $TMP, local only)' : v(f.transport, 'the session transport')}`,
+        `  Logon      CSPeach's stored SAP logon${f.alias ? ` for ${cardLine(f.alias)}` : ''} — no password is typed, nothing is written to a file`,
+    ];
+    if (f.blocked) {
+        lines.push(`  Blocked    ${cardLine(f.blocked)}`);
+    }
+    else {
+        lines.push('  The phase runs a test deploy first (nothing is written), then the real deploy asks for one write approval for the BSP, confirmed on screen — never an auto-approval.');
+    }
+    return lines;
+}
+/**
+ * Show the card and ask — the ONE implementation used by the post-phase chain
+ * (plan-chain.ts) and by a direct `/abap-plan --resume` into the deploy phase
+ * (plan-resume.ts). A "yes" records the fiori_deploy logon handover for the
+ * alias, which is also how a later resume knows the card was already shown.
+ */
+export async function askDeployCard(a) {
+    const facts = await gatherDeployCardFacts({
+        phases: a.phases,
+        cwd: a.cwd,
+        ...(a.sapAlias ? { sapAlias: a.sapAlias } : {}),
+        ...(a.deps?.loadConfig ? { loadConfig: a.deps.loadConfig } : {}),
+        ...(a.deps?.effectiveWriteMode ? { effectiveWriteMode: a.deps.effectiveWriteMode } : {}),
+    });
+    a.log(...renderDeployCard(facts, a.nextPhaseId));
+    if (facts.blocked)
+        return { outcome: 'blocked', reason: facts.blocked };
+    const { askYesNo, isYes } = await import('../projects/yes-no.js');
+    const answer = await askYesNo({
+        question: `Deploy now — run ${a.nextPhaseId} with the stored SAP logon for ${facts.alias}?`,
+        confirm: a.confirm,
+        prompt: a.prompt,
+    });
+    if (!isYes(answer))
+        return { outcome: 'no' };
+    const { markCredentialHandoverApproved } = await import('../repl/credential-handover-gate.js');
+    const { FIORI_DEPLOY_HANDOVER_SCOPE } = await import('../tools/fiori/deploy/scope.js');
+    markCredentialHandoverApproved(a.sessionId, facts.alias, FIORI_DEPLOY_HANDOVER_SCOPE);
+    return { outcome: 'yes' };
+}

package/dist/commands/login.js

@@ -7,8 +7,10 @@
  *   3) Print user_code prominently so customer can read it
  *   4) Poll /v1/auth/device/poll every interval until verified or maxAttempts
  *   5) Save api_key + customer_id to ~/.cspeach/auth.json
- *   6) Call GET /v1/me — if trial_mode === 'byok', prompt for the user's own API key
- *   7) Re-save auth file with byokAnthropicKey if provided
+ *   6) Call GET /v1/me — if trial_mode === 'byok', pull the org's Anthropic key,
+ *      or prompt for the user's own
+ *   7) Store that key in the OS keychain (cspeach.anthropic/api-key) — never
+ *      in auth.json (2026-10-02)
  *
  * Dependencies (open, print, prompt) are injected so the command is
  * unit-testable without stubbing platform globals.
@@ -94,7 +96,6 @@ export async function runLoginCommand(deps) {
     await writeAuthFile({
         apiKey: polled.api_key,
         customerId: polled.customer_id,
-        byokAnthropicKey: null,
     });
     deps.print(done('Saved your CSPeach key to ~/.cspeach/auth.json'));
     // 6) /v1/me — figure out if BYOK is required.
@@ -111,8 +112,8 @@ export async function runLoginCommand(deps) {
                 const setKey = deps.setKeychainKey ??
                     ((svc, acct, k) => keychain.setPassword(svc, acct, k));
                 if (orgKey !== null) {
-                    await setKey(ANTHROPIC_KEYCHAIN_SERVICE, ANTHROPIC_KEYCHAIN_ACCOUNT, orgKey);
-                    deps.print(done("Using your organization's API key"));
+                    if (await storeKey(setKey, orgKey, deps.print))
+                        deps.print(done("Using your organization's API key"));
                 }
                 else {
                     // Fall back to the manual paste prompt — behaviour unchanged.
@@ -121,14 +122,11 @@ export async function runLoginCommand(deps) {
                     // The key-entry row — the one place the vendor and its key page are named.
                     const ak = (await deps.prompt('Paste your Anthropic API key (sk-ant-..., from https://console.anthropic.com/settings/keys): ')).trim();
                     if (ak.startsWith('sk-ant-') && ak.length > 20) {
-                        // The non-BYOK save above just persisted these exact values,
-                        // so reading them back from disk would be redundant.
-                        await writeAuthFile({
-                            apiKey: polled.api_key,
-                            customerId: polled.customer_id,
-                            byokAnthropicKey: ak,
-                        });
-                        deps.print(done('API key saved'));
+                        // 2026-10-02: the OS keychain, the same entry as the org key above
+                        // and the one BYOK reads (byok-provider.ts). This used to go to
+                        // auth.json in PLAINTEXT, where nothing read it.
+                        if (await storeKey(setKey, ak, deps.print))
+                            deps.print(done('API key saved to your OS keychain'));
                     }
                     else {
                         deps.print(formatFailure({ what: 'That does not look like your own API key', detail: ['it must start with sk-ant-', 'skipped'], next: 'run cspeach login again later' }).trimEnd());
@@ -143,6 +141,26 @@ export async function runLoginCommand(deps) {
     deps.print(`  ${paint('dim', 'Next:')} run cspeach to start`);
     return 0;
 }
+/**
+ * 2026-10-02 (review nit): store the BYOK key in the OS keychain. A keychain
+ * failure (e.g. Linux without a Secret Service) gets its own plain notice —
+ * it used to surface as "Could not read your account details". The key is
+ * never written anywhere else.
+ */
+async function storeKey(setKey, key, print) {
+    try {
+        await setKey(ANTHROPIC_KEYCHAIN_SERVICE, ANTHROPIC_KEYCHAIN_ACCOUNT, key);
+        return true;
+    }
+    catch (err) {
+        print(formatFailure({
+            what: "Couldn't save your API key to the OS keychain",
+            detail: [err instanceof Error ? err.message : String(err), 'sign-in itself worked; the key was not stored anywhere'],
+            next: 'make the OS keychain available (on Linux: a Secret Service such as gnome-keyring), then run cspeach login again',
+        }).trimEnd());
+        return false;
+    }
+}
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }

package/dist/commands/plan-chain.js

@@ -24,6 +24,8 @@ import chalk from 'chalk';
 import { readProjectFile } from '../projects/status.js';
 import { parsePlanContent } from '../projects/plan-schema.js';
 import { statusesFromItems, computeNextPhase, isPhaseSatisfied, isAuditResolved, planCompletionLines, renderPlanTracker, } from '../projects/plan-run.js';
+import { isDeployPhase } from '../projects/plan-lane.js';
+import { askDeployCard } from './deploy-card.js';
 import { decideNextPhaseGate, getAndResetPlanPhaseSubagentDispatches, getAndResetPlanDeviation, } from './plan-gate.js';
 import { runPhaseAudit } from './plan-audit.js';
 import { applyAuditResult, applyPhaseResolution, buildResumeCommand, offerNextPhaseAutoRun, } from './plan-resume.js';
@@ -379,6 +381,35 @@ export async function runPostPhaseChain(args) {
         args.log(substitutePlanToken(decision.banner ?? '', path));
         ringBell();
     }
+    // 2026-10-02 — deploy is a chained step of a UI plan. Before ui.deploy the
+    // chain stops on the CLI-owned deploy card (deploy-card.ts), in step AND
+    // guarded mode, instead of the plain "run the next phase?" question.
+    if (isDeployPhase(next)) {
+        const card = await askDeployCard({
+            phases: loaded.content.phases,
+            cwd: args.cwd,
+            ...(args.sapAlias ? { sapAlias: args.sapAlias } : {}),
+            sessionId: args.sessionId,
+            nextPhaseId: next.id,
+            prompt: args.prompt,
+            ...(args.confirm ? { confirm: args.confirm } : {}),
+            log: args.log,
+            deps: {
+                ...(args.deps?.loadDeployCardConfig ? { loadConfig: args.deps.loadDeployCardConfig } : {}),
+                ...(args.deps?.effectiveWriteMode ? { effectiveWriteMode: args.deps.effectiveWriteMode } : {}),
+            },
+        });
+        if (card.outcome === 'blocked') {
+            args.log(`${next.id} cannot run here: ${card.reason}. Resume later with: ${resumeCmd(path)}`);
+            return path;
+        }
+        if (card.outcome === 'no') {
+            args.log(`Not deployed — resume later with: ${resumeCmd(path)}`);
+            return path;
+        }
+        args.queueDispatch(resumeCmd(path));
+        return path;
+    }
     await offerNextPhaseAutoRun({
         outcome: {
             savedPath: path,

package/dist/commands/plan-continue.js

@@ -176,6 +176,7 @@ export async function runContinuationChain(args) {
         executedPhaseId: args.marker.phaseId,
         sessionId: args.sessionId,
         cwd: args.cwd,
+        ...(args.sapAlias ? { sapAlias: args.sapAlias } : {}),
         mode: args.prepared.effectiveMode ?? 'step',
         modeFlag: args.prepared.mode,
         auditMode: args.prepared.auditMode,

package/dist/commands/plan-resume.js

@@ -54,7 +54,10 @@ import { FLOORPLAN_TO_TEMPLATE } from '../tools/fiori/floorplan-map.js';
 import { getCurrentTransport, setCurrentTransport } from '../repl/current-transport.js';
 import { askYesNo, isYes } from '../projects/yes-no.js';
 import { formatAttention, formatInfo } from '../renderer/notice-shape.js';
-import { checkLaneConsistency, loadPlanLaneForRun, renderLaneBlock } from '../projects/plan-lane.js';
+import { checkLaneConsistency, checkRequiredDeploy, isDeployPhase, loadPlanLaneForRun, renderLaneBlock } from '../projects/plan-lane.js';
+import { askDeployCard } from './deploy-card.js';
+import { isCredentialHandoverApproved } from '../repl/credential-handover-gate.js';
+import { FIORI_DEPLOY_HANDOVER_SCOPE } from '../tools/fiori/deploy/scope.js';
 /**
  * Parse and STRIP the per-run chaining-mode (`--guarded` / `--step`) and
  * audit off-switch (`--audit` / `--no-audit`) flags from a plan-resume body.
@@ -137,6 +140,18 @@ export function buildUiPhaseContext(phases, next) {
         lines.push(`- App directory (recorded by ui.build): ${appDir}`);
     if (service)
         lines.push(`- Service URL: ${service.url ?? ''}${service.path ?? ''} (OData ${service.version ?? '?'})`);
+    // 2026-10-02 — deploy is a chained, required step: inside a deploy phase it
+    // is EXPECTED (the developer already confirmed the CLI deploy card).
+    if (isDeployPhase(next)) {
+        const transport = [...phases].reverse().map((p) => p.work?.transport).find(Boolean);
+        lines.push(transport
+            ? `- Session transport: ${transport}`
+            : '- Session transport: NOT RECORDED in any phase work.transport — use the session transport (sap_transport list) or ask once.');
+        lines.push('- Deploy is expected in this phase (the developer confirmed the deploy card): if the app has no ui5-deploy.yaml, ' +
+            'write it with fiori_deploy_config (BSP name max 15 chars uppercase Z/Y, package = the backend package, transport = ' +
+            'the session transport); then fiori_deploy mode "test"; then request_approval {op:"create", object:"<BSP NAME>", ' +
+            'type:"WAPA"} and fiori_deploy mode "deploy" with that approval_id. Record the URL it returns in work.deployedUrl.');
+    }
     return lines;
 }
 /** Compact-example work keys for ui phases — the write-back contract
@@ -450,6 +465,32 @@ export async function preparePlanResume(args) {
             releaseRunLease(path);
         return null;
     }
+    // 2026-10-02 — a direct `/abap-plan --resume` into the deploy phase shows the
+    // same deploy card the post-phase chain shows. A "yes" there (or here)
+    // records the fiori_deploy logon handover for the alias, so a resume the
+    // chain itself queued after its card is not asked twice.
+    if (isDeployPhase(next) && args.sapAlias && args.prompt
+        && !isCredentialHandoverApproved(args.sessionId, args.sapAlias, FIORI_DEPLOY_HANDOVER_SCOPE)) {
+        const card = await askDeployCard({
+            phases: content.phases,
+            cwd: args.cwd,
+            sapAlias: args.sapAlias,
+            ...(args.sessionId ? { sessionId: args.sessionId } : {}),
+            nextPhaseId: next.id,
+            prompt: args.prompt,
+            ...(args.confirm ? { confirm: args.confirm } : {}),
+            log: args.log,
+            ...(args.deployCardDeps ? { deps: args.deployCardDeps } : {}),
+        });
+        if (card.outcome !== 'yes') {
+            args.log(card.outcome === 'blocked'
+                ? `${next.id} cannot run here: ${card.reason}. Resume later with: ${buildResumeCommand(path)}`
+                : `Not deployed — resume later with: ${buildResumeCommand(path)}`);
+            if (args.sessionId)
+                releaseRunLease(path);
+            return null;
+        }
+    }
     // Inline the phase's declared rule files (coarse v1: whole files).
     // Paths resolve against cwd — dogfood runs sit inside a repo carrying
     // .claude/rules/. A missing file is noted, not fatal: the skill falls
@@ -757,7 +798,13 @@ export async function finishPlanResume(args) {
     // App lane routing (Task 6, Review Focus 4) — the write-back may restructure
     // the plan (full shape) or overlay a phase; it must still fit the lane.
     if (args.prepared.laneRecord) {
-        const conflict = checkLaneConsistency(extract.content, args.prepared.laneRecord);
+        // 2026-10-02 — a write-back may not drop the required deploy phase. Only a
+        // plan that already met the rule is held to it, so a lane plan saved before
+        // the rule existed keeps running unchanged (no-regression).
+        const priorParsed = parsePlanContent(args.prepared.envelope.content);
+        const priorMetDeploy = priorParsed.ok && checkRequiredDeploy(priorParsed.content, args.prepared.laneRecord) === null;
+        const conflict = checkLaneConsistency(extract.content, args.prepared.laneRecord)
+            ?? (priorMetDeploy ? checkRequiredDeploy(extract.content, args.prepared.laneRecord) : null);
         if (conflict) {
             args.log('');
             args.log(`[plan] PHASE RESULT NOT PERSISTED — ${conflict}`);

package/dist/cost/cost-log.js

@@ -68,6 +68,8 @@ export function buildEntry(opts) {
         entry.call_index = opts.call_index;
     if (opts.kind !== undefined)
         entry.kind = opts.kind;
+    if (opts.scope !== undefined)
+        entry.scope = opts.scope;
     if (opts.refusal_category !== undefined)
         entry.refusal_category = opts.refusal_category;
     if (opts.input_transformations !== undefined)
@@ -123,12 +125,76 @@ export async function readCostLog(sessionId) {
         return [];
     }
 }
+/**
+ * 2026-10-03 — one model call's own token counts: the session counters now
+ * minus the counters when the previous cost line was written (or turn start).
+ * Never negative (a counter reset — e.g. a compaction rewrite — reads as 0).
+ */
+export function perCallTokens(now, last) {
+    const d = (a, b) => Math.max(0, a - b);
+    return {
+        input: d(now.input, last.input),
+        output: d(now.output, last.output),
+        cacheRead: d(now.cacheRead, last.cacheRead),
+        cacheCreate: d(now.cacheCreate, last.cacheCreate),
+    };
+}
+/**
+ * 2026-10-03 — the lines that add up. Task-3-era lines (call_index, no
+ * scope: 1.1.19–1.1.25) each carry the running total since turn start, so a
+ * turn contributes only its LAST such line. Per-call lines (scope 'call'),
+ * pre-Task-3 lines and turn-0 labelled lines (audit) are each counted as-is.
+ * File order is preserved.
+ */
+export function countableEntries(entries) {
+    const lastLegacy = new Map(); // turn -> index of its last running-total line
+    entries.forEach((e, i) => {
+        if (isLegacyRunningTotal(e))
+            lastLegacy.set(e.turn, i);
+    });
+    return entries.filter((e, i) => !isLegacyRunningTotal(e) || lastLegacy.get(e.turn) === i);
+}
+function isLegacyRunningTotal(e) {
+    return e.call_index !== undefined && e.scope !== 'call' && e.turn > 0 && e.kind !== 'reader_rollup';
+}
+/**
+ * Per-turn rows in file order. Tokens/cost come from the countable lines
+ * (legacy running totals → the turn's last line); credits are per-call balance
+ * deltas in BOTH line generations, so every line's charge is summed.
+ * Reader rollup lines are not turns; turn-0 labelled lines are rows of their own.
+ */
+export function turnRows(entries) {
+    const countable = new Set(countableEntries(entries));
+    const rows = [];
+    const byKey = new Map();
+    entries.forEach((e, i) => {
+        if (e.kind === 'reader_rollup')
+            return;
+        const key = e.turn > 0 ? `t${e.turn}` : `z${i}`;
+        let row = byKey.get(key);
+        if (!row) {
+            row = { turn: e.turn, tokens: 0, cost: 0, credits: null };
+            byKey.set(key, row);
+            rows.push(row);
+        }
+        if (countable.has(e)) {
+            row.tokens += e.tokens.input + e.tokens.output;
+            row.cost += e.cost;
+        }
+        if (typeof e.credits_charged === 'number')
+            row.credits = (row.credits ?? 0) + e.credits_charged;
+    });
+    return rows;
+}
 export function summarise(entries) {
     const totals = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
     let total = 0;
     const perModel = new Map();
     const readerByTurn = new Map();
-    let lines = 0;
+    // Turns: distinct turn numbers (> 0) plus each turn-0 labelled line.
+    const turnKeys = new Set();
+    const modelTurnKeys = new Map();
+    const countable = new Set(countableEntries(entries));
     for (const e of entries) {
         if (typeof e.reader_calls === 'number' && e.reader_calls > 0) {
             const prev = readerByTurn.get(e.turn);
@@ -142,7 +208,10 @@ export function summarise(entries) {
         // Fix M3 — a zero-token reader rollup line (interrupted turn) is not a model call.
         if (e.kind === 'reader_rollup')
             continue;
-        lines += 1;
+        if (!countable.has(e))
+            continue;
+        const turnKey = e.turn > 0 ? `t${e.turn}` : `z${turnKeys.size}`;
+        turnKeys.add(turnKey);
         total += e.cost;
         totals.input += e.tokens.input;
         totals.output += e.tokens.output;
@@ -153,7 +222,10 @@ export function summarise(entries) {
             cost: 0,
             tokens: { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 },
         };
-        slot.turns += 1;
+        const mk = modelTurnKeys.get(e.model) ?? new Set();
+        mk.add(turnKey);
+        modelTurnKeys.set(e.model, mk);
+        slot.turns = mk.size;
         slot.cost += e.cost;
         slot.tokens.input += e.tokens.input;
         slot.tokens.output += e.tokens.output;
@@ -170,7 +242,7 @@ export function summarise(entries) {
     return {
         totalCost: Math.round((total + readerCost) * 10000) / 10000,
         totalTokens: totals,
-        turns: lines,
+        turns: turnKeys.size,
         byModel: [...perModel.entries()].map(([model, v]) => ({ model, ...v })),
         readerCost: Math.round(readerCost * 10000) / 10000,
         readerCalls,

package/dist/cost/credits-wire.js

@@ -64,6 +64,15 @@ export async function initCredits(cfg, getBearer) {
         setCostDisplayMode('usd');
     }
 }
+/**
+ * A user request is starting (2026-10-02): the receipt then shows every
+ * model round of it, not only the last. No-op outside credits mode.
+ */
+export function beginCreditsRequest() {
+    if (!creditsActive())
+        return;
+    globalCredits.beginRequest();
+}
 /**
  * Post-turn: sample the balance again and fold the delta into the session
  * total. Returns null (and makes no request) outside credits mode.

package/dist/cost/credits.js

@@ -86,8 +86,11 @@ export async function fetchBalance(cfg, getBearer) {
  */
 export class CreditsTracker {
     baseline = null;
+    /** sessionTotal when the current user request began. */
+    requestStartTotal = 0;
     state = {
         chargedThisTurn: null,
+        chargedThisRequest: null,
         sessionTotal: 0,
         balance: null,
         unitLabel: DEFAULT_UNIT_LABEL,
@@ -99,34 +102,48 @@ export class CreditsTracker {
             this.state.unitLabel = balance.unit_label;
         const opening = balance ? balance.balance_credits : null;
         this.baseline = opening;
+        this.requestStartTotal = 0;
         this.state = {
             ...this.state,
             chargedThisTurn: null,
+            chargedThisRequest: null,
             sessionTotal: 0,
             balance: opening,
             pending: false,
         };
     }
-    /** Record a post-turn balance sample and return this turn's charge. */
+    /** Mark the start of a user request (one or more model rounds). */
+    beginRequest() {
+        this.requestStartTotal = this.state.sessionTotal;
+        this.state = { ...this.state, chargedThisRequest: null };
+    }
+    /** Record a post-round balance sample and return this round's charge. */
     afterTurn(balance) {
         if (balance)
             this.state.unitLabel = balance.unit_label;
         const current = balance ? balance.balance_credits : null;
         if (current === null) {
             // Unknown — keep the baseline so the next good sample covers both turns.
-            this.state = { ...this.state, chargedThisTurn: null, pending: true };
+            this.state = { ...this.state, chargedThisTurn: null, chargedThisRequest: null, pending: true };
             return { chargedThisTurn: null, sessionTotal: this.state.sessionTotal, balance: this.state.balance };
         }
         if (this.baseline === null) {
             // First balance we have ever seen — establish the baseline only.
             this.baseline = current;
-            this.state = { ...this.state, chargedThisTurn: null, balance: current, pending: false };
+            this.state = { ...this.state, chargedThisTurn: null, chargedThisRequest: null, balance: current, pending: false };
             return { chargedThisTurn: null, sessionTotal: this.state.sessionTotal, balance: current };
         }
         const charged = Math.max(0, this.baseline - current);
         this.baseline = current;
         const sessionTotal = this.state.sessionTotal + charged;
-        this.state = { ...this.state, chargedThisTurn: charged, sessionTotal, balance: current, pending: false };
+        this.state = {
+            ...this.state,
+            chargedThisTurn: charged,
+            chargedThisRequest: sessionTotal - this.requestStartTotal,
+            sessionTotal,
+            balance: current,
+            pending: false,
+        };
         return { chargedThisTurn: charged, sessionTotal, balance: current };
     }
     snapshot() {
@@ -154,10 +171,11 @@ export const CREDITS_PENDING = 'credits: updating…';
  * missing balance simply drops that segment.
  */
 export function formatCreditsLine(s) {
-    if (s.chargedThisTurn === null)
+    // 2026-10-02: "this turn" = the whole user request, not its last round.
+    if (s.chargedThisRequest === null)
         return CREDITS_PENDING;
     const parts = [
-        `▲ ${formatCredits(s.chargedThisTurn, s.unitLabel)} this turn`,
+        `▲ ${formatCredits(s.chargedThisRequest, s.unitLabel)} this turn`,
         `${Math.round(s.sessionTotal).toLocaleString('en-US')} this session`,
     ];
     if (s.balance !== null) {

package/dist/cost/router-spend.js

@@ -0,0 +1,24 @@
+/**
+ * BYOK skill-router spend (2026-10-02, review nit).
+ *
+ * In BYOK the skill router runs on the laptop, on the customer's own key, so
+ * each free-text prompt costs them one small router call. That is their bill,
+ * so the USD meter must count it. The router call's model differs from the
+ * session model, so it is priced here at its own rate and added to the
+ * session total (computeSessionCost) — not mixed into `session.usage`, which
+ * is priced at the session model. Process-scoped. Managed never records here
+ * (the proxy's router cost is ours, never shown).
+ */
+import { computeCost } from './pricing.js';
+let usd = 0;
+export function addRouterSpend(model, usage) {
+    usd += computeCost(model, usage);
+}
+/** USD spent on BYOK router calls in this process. */
+export function routerSpendUsd() {
+    return usd;
+}
+/** Test-only reset. */
+export function __resetRouterSpendForTests() {
+    usd = 0;
+}

package/dist/cost/session-cost.js

@@ -17,8 +17,14 @@
  * ran. Same caveat as the footer's session line.
  */
 import { computeCost } from './pricing.js';
-/** USD cost of the session's lifetime usage, priced at `session.model`. */
-export function computeSessionCost(session) {
+import { routerSpendUsd } from './router-spend.js';
+/**
+ * USD cost of ONE session's lifetime usage, priced at `session.model` — no
+ * BYOK router spend. Use this for a single session's own spend (e.g. a
+ * reader child: read_agent adds it per call, so the process-wide router
+ * spend must not ride along — review S1, 2026-10-02).
+ */
+export function computeSessionModelCost(session) {
     return computeCost(session.model, {
         input: session.usage.input_tokens,
         output: session.usage.output_tokens,
@@ -26,3 +32,11 @@ export function computeSessionCost(session) {
         cacheCreate: session.usage.cache_creation_input_tokens ?? 0,
     });
 }
+/**
+ * The session total the meter shows: the model cost plus (2026-10-02) the
+ * BYOK router calls made on the laptop, priced at the router model
+ * (cost/router-spend.ts; always 0 outside BYOK), counted once.
+ */
+export function computeSessionCost(session) {
+    return computeSessionModelCost(session) + routerSpendUsd();
+}

package/dist/models/server-config.js

@@ -276,9 +276,27 @@ export function servedToolLoading() {
 export function managedProxyServesNewShapes() {
     return snapshot?.tool_loading !== undefined;
 }
-/** BYOK only: fetch `/v1/model-config` and keep its `tool_loading`. */
+// 2026-10-02 (BYOK local routing) — BYOK now classifies prompts on the laptop
+// (direct to the model, the customer's key) instead of POSTing them to our
+// /v1/classify. It uses the router model CSPeach serves, `roles.router`, kept
+// from the SAME public /v1/model-config fetch as `tool_loading` above (no
+// extra request; the fetch carries no prompt data). Only the router role is
+// kept — the session roles still never steer a BYOK session.
+/** The proxy's built-in router model (cspeach-proxy/src/models/config.ts). */
+export const DEFAULT_BYOK_ROUTER_MODEL = 'claude-haiku-4-5';
+let byokRouter;
+/** Test-only setter for the BYOK router model. */
+export function __setByokRouterModelForTests(v) {
+    byokRouter = v;
+}
+/** The router model for BYOK classification: the served `roles.router`, else the default. Pure sync read. */
+export function byokRouterModel() {
+    return byokRouter ?? DEFAULT_BYOK_ROUTER_MODEL;
+}
+/** BYOK only: fetch `/v1/model-config` and keep its `tool_loading` (and, since 2026-10-02, `roles.router`). */
 export async function fetchToolLoadingMode(cfg, getBearer, opts) {
     byokToolLoading = undefined;
+    byokRouter = undefined;
     if (cfg.llm?.mode !== 'byok')
         return undefined;
     const controller = new AbortController();
@@ -298,10 +316,12 @@ export async function fetchToolLoadingMode(cfg, getBearer, opts) {
             return undefined;
         const body = (await r.json());
         byokToolLoading = coerceToolLoading(body && typeof body === 'object' ? body.tool_loading : undefined);
+        byokRouter = coerceRoles(body && typeof body === 'object' ? body.roles : undefined).router;
         return byokToolLoading;
     }
     catch {
         byokToolLoading = undefined;
+        byokRouter = undefined;
         return undefined;
     }
     finally {