@cspeach/cli 1.1.25 → 1.1.26

package/dist/agent/loop.js

@@ -27,10 +27,10 @@ import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
 // (progress-chatter import removed 2026-05-01 — superseded by CC-style
 //  two-line dispatch renderer; re-add if a future in-place spinner returns)
 import { buildRetryCapPausePayload, buildSkippedSiblingResults } from './retry-cap.js';
-import { appendCostLine, buildEntry as buildCostEntry, summariseInputTransformations } from '../cost/cost-log.js';
+import { appendCostLine, buildEntry as buildCostEntry, perCallTokens, summariseInputTransformations } from '../cost/cost-log.js';
 import { modelAcceptsBinding, sessionMaxTokens, clampMaxTokens } from './provider-shape.js';
 import { computeSessionCost } from '../cost/session-cost.js';
-import { refreshCreditsAfterTurn, creditsForCostLog } from '../cost/credits-wire.js';
+import { refreshCreditsAfterTurn, creditsForCostLog, beginCreditsRequest } from '../cost/credits-wire.js';
 import { globalStore } from '../ui/sap-state-store.js';
 import { lastAssistantIsAwaitingAnswer } from '../session/awaiting-answer.js';
 import { enrichUserMessage } from '../router/intent-extractor.js';
@@ -835,6 +835,15 @@ ${imageExpansion.error}`));
         cacheRead: session.usage?.cache_read_input_tokens ?? 0,
         cacheCreate: session.usage?.cache_creation_input_tokens ?? 0,
     };
+    // 2026-10-02 — the per-turn receipt shows what this whole user request cost
+    // (every model round below), not just its last round. A reader child never
+    // marks a request: its spend belongs to the parent's.
+    if (!readerChild)
+        beginCreditsRequest();
+    // 2026-10-03 — each cost line records ONLY its own model call: tokens since
+    // the previous line, not since turn start (Task 3 wrote running totals, so
+    // /cost, the audit export and the context meter over-counted).
+    let lastLoggedTokens = { ...turnStartTokens };
     // Turn number for the cost log — count of prior user messages + this one.
     const turnNumber = session.messages.filter((m) => m.role === 'user').length + 1;
     // Final review I4 — the monotonic per-session turn counter the auto-compact
@@ -1438,12 +1447,14 @@ ${imageExpansion.error}`));
             // race on the shared sample.
             if (!readerChild)
                 await refreshCreditsAfterTurn();
-            const turnTokens = {
-                input: (session.usage?.input_tokens ?? 0) - turnStartTokens.input,
-                output: (session.usage?.output_tokens ?? 0) - turnStartTokens.output,
-                cacheRead: (session.usage?.cache_read_input_tokens ?? 0) - turnStartTokens.cacheRead,
-                cacheCreate: (session.usage?.cache_creation_input_tokens ?? 0) - turnStartTokens.cacheCreate,
+            const nowTokens = {
+                input: session.usage?.input_tokens ?? 0,
+                output: session.usage?.output_tokens ?? 0,
+                cacheRead: session.usage?.cache_read_input_tokens ?? 0,
+                cacheCreate: session.usage?.cache_creation_input_tokens ?? 0,
             };
+            const callTokens = perCallTokens(nowTokens, lastLoggedTokens);
+            lastLoggedTokens = nowTokens;
             const turnDurationMs = Date.now() - turnStartedAt;
             const entry = buildCostEntry({
                 turn: turnNumber,
@@ -1451,7 +1462,8 @@ ${imageExpansion.error}`));
                 // (plan model tiering), the cost line must record the ACTUAL model
                 // or the Sonnet-priced turn would be billed at session-model rates.
                 model: params.modelOverride ?? session.model,
-                tokens: turnTokens,
+                tokens: callTokens,
+                scope: 'call',
                 duration_ms: turnDurationMs,
                 // Additive: present only in credits mode (undefined in USD mode, so
                 // the emitted line is byte-identical to a pre-credits one).

package/dist/agent/tool-dispatch.js

@@ -146,6 +146,12 @@ function declined(r) {
 export function isLocalProjectWork(tool, args) {
     if (tool.category === 'filesystem')
         return true;
+    // 2026-10-02 — fiori_deploy mode "test" (the default) writes nothing to SAP:
+    // the backend validates the upload and keeps nothing. Not a batch write, so
+    // a deploy phase shows ONE approval (the real deploy's request_approval),
+    // not a batch card before it. Mode "deploy" is gated exactly as before.
+    if (tool.name === 'fiori_deploy')
+        return (args?.mode ?? 'test') === 'test';
     if (tool.category !== 'shell')
         return false;
     const argv = [args?.command, ...(Array.isArray(args?.args) ? args.args : [])].map((a) => String(a ?? ''));

package/dist/auth/auth-file.js

@@ -1,6 +1,11 @@
 /**
- * Read/write ~/.cspeach/auth.json — the customer's CSPeach API key
- * + optional Anthropic key for BYOK trials.
+ * Read/write ~/.cspeach/auth.json — the customer's CSPeach API key.
+ *
+ * 2026-10-02: auth.json no longer holds an Anthropic key. `cspeach login` used
+ * to write a hand-pasted BYOK key here in PLAINTEXT (`byokAnthropicKey`), and
+ * nothing read it — BYOK reads the OS keychain (cspeach.anthropic/api-key).
+ * A pasted key now goes to the keychain, and migrateLegacyByokKey (run at
+ * startup) moves an old plaintext copy there and deletes it from this file.
  *
  * Permissions: 0600 on POSIX. Windows uses NTFS ACLs which Node's
  * fs mode flag doesn't translate; we rely on the user-dir default
@@ -29,11 +34,7 @@ export async function readAuthFile() {
         const parsed = JSON.parse(raw);
         if (typeof parsed.apiKey !== 'string' || typeof parsed.customerId !== 'string')
             return null;
-        return {
-            apiKey: parsed.apiKey,
-            customerId: parsed.customerId,
-            byokAnthropicKey: typeof parsed.byokAnthropicKey === 'string' ? parsed.byokAnthropicKey : null,
-        };
+        return { apiKey: parsed.apiKey, customerId: parsed.customerId };
     }
     catch {
         return null;
@@ -42,18 +43,178 @@ export async function readAuthFile() {
 export async function writeAuthFile(auth) {
     const p = authFilePath();
     await fs.mkdir(path.dirname(p), { recursive: true });
-    await fs.writeFile(p, JSON.stringify(auth, null, 2), { encoding: 'utf-8', mode: 0o600 });
-    // Defensive: re-chmod in case the create-time mode was ignored (e.g., umask 022).
-    if (process.platform !== 'win32') {
+    // Only the two known fields — never a secret a caller passes along by mistake.
+    const body = { apiKey: auth.apiKey, customerId: auth.customerId };
+    await writeAtomic0600(p, JSON.stringify(body, null, 2));
+}
+/** Rename errors that mean "the target is open elsewhere" (Windows), worth retrying. */
+const LOCK_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+/** Backoff between rename attempts (5 tries in all). */
+const RENAME_BACKOFF_MS = [50, 100, 150, 200];
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * 2026-10-02 (review nits): write via a temp file + rename, so a crash
+ * mid-write never leaves a truncated auth.json (losing the sign-in). 0600 on
+ * POSIX.
+ *
+ * Review S3: on Windows a rename over an auth.json another process holds open
+ * (antivirus, a second cspeach, an editor) fails with EPERM / EACCES / EBUSY.
+ * Retry 5 times with a short backoff, then fall back to an in-place write.
+ * The temp file holds the API key, so it is always removed.
+ */
+async function writeAtomic0600(p, text) {
+    const tmp = `${p}.${process.pid}.tmp`;
+    try {
+        await fs.writeFile(tmp, text, { encoding: 'utf-8', mode: 0o600 });
+        // Defensive: re-chmod in case the create-time mode was ignored (e.g., umask 022).
+        if (process.platform !== 'win32') {
+            try {
+                await fs.chmod(tmp, 0o600);
+            }
+            catch { /* ignore */ }
+        }
+        for (let attempt = 0;; attempt++) {
+            try {
+                await fs.rename(tmp, p);
+                return;
+            }
+            catch (err) {
+                const code = err.code ?? '';
+                if (!LOCK_CODES.has(code))
+                    throw err;
+                if (attempt >= RENAME_BACKOFF_MS.length)
+                    break;
+                await sleep(RENAME_BACKOFF_MS[attempt]);
+            }
+        }
+        // Still locked: write in place (not atomic, but the sign-in is saved).
+        await fs.writeFile(p, text, { encoding: 'utf-8', mode: 0o600 });
+        if (process.platform !== 'win32') {
+            try {
+                await fs.chmod(p, 0o600);
+            }
+            catch { /* ignore */ }
+        }
+    }
+    finally {
         try {
-            await fs.chmod(p, 0o600);
+            await fs.unlink(tmp);
         }
-        catch { /* ignore */ }
+        catch { /* already renamed or never written */ }
     }
 }
+/**
+ * Review S3: remove auth.json.*.tmp files a crashed write left behind — they
+ * hold the API key in plain text. Run at startup. Only files older than a
+ * minute, so another cspeach's in-progress write is never touched. Never throws.
+ */
+const STALE_TEMP_MS = 60_000;
+export async function cleanStaleAuthTemps() {
+    try {
+        const p = authFilePath();
+        const dir = path.dirname(p);
+        const base = path.basename(p);
+        for (const name of await fs.readdir(dir)) {
+            if (!(name.startsWith(`${base}.`) && name.endsWith('.tmp')))
+                continue;
+            const f = path.join(dir, name);
+            try {
+                // Older than a minute: not another cspeach's write in progress.
+                if (Date.now() - (await fs.stat(f)).mtimeMs < STALE_TEMP_MS)
+                    continue;
+                await fs.unlink(f);
+            }
+            catch { /* ignore */ }
+        }
+    }
+    catch { /* no ~/.cspeach yet */ }
+}
 export async function deleteAuthFile() {
     try {
         await fs.unlink(authFilePath());
     }
     catch { /* ignore */ }
 }
+/** The BYOK key's keychain entry — the same one byok-provider.ts reads and login writes. */
+const BYOK_KEYCHAIN_SERVICE = 'cspeach.anthropic';
+const BYOK_KEYCHAIN_ACCOUNT = 'api-key';
+/**
+ * 2026-10-02 — move a plaintext `byokAnthropicKey` left in auth.json by an
+ * older `cspeach login` into the OS keychain, then delete it from the file.
+ *
+ *   'none'     nothing to do (no file, or no string key in it) — the keychain
+ *              is not touched;
+ *   'migrated' the keychain had no key: the file's key was stored there and
+ *              deleted from the file;
+ *   'removed'  the keychain already held the SAME key: only the plaintext
+ *              copy is deleted;
+ *   'conflict' the keychain holds a DIFFERENT key (the one BYOK uses). The
+ *              pasted key may be the only copy, so nothing is deleted — the
+ *              caller shows one notice (review nit);
+ *   'keychain-unavailable'  the keychain could not be read or written (e.g.
+ *              Linux without a Secret Service): the file is left as-is so the
+ *              key is not lost — the caller shows one notice;
+ *   'failed'   the file could not be rewritten (retried on the next start).
+ * Never throws.
+ */
+export async function migrateLegacyByokKey(deps) {
+    let raw;
+    try {
+        const parsed = JSON.parse(await fs.readFile(authFilePath(), 'utf-8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return 'none';
+        raw = parsed;
+    }
+    catch {
+        return 'none';
+    }
+    const legacy = raw.byokAnthropicKey;
+    if (typeof legacy !== 'string' || legacy.trim() === '')
+        return 'none';
+    const pasted = legacy.trim();
+    let outcome;
+    try {
+        const d = deps ?? (await defaultKeychainDeps());
+        const existing = await d.getKey(BYOK_KEYCHAIN_SERVICE, BYOK_KEYCHAIN_ACCOUNT);
+        if (existing) {
+            if (existing.trim() !== pasted)
+                return 'conflict';
+            outcome = 'removed';
+        }
+        else {
+            await d.setKey(BYOK_KEYCHAIN_SERVICE, BYOK_KEYCHAIN_ACCOUNT, pasted);
+            outcome = 'migrated';
+        }
+    }
+    catch {
+        return 'keychain-unavailable';
+    }
+    try {
+        const { byokAnthropicKey: _dropped, ...rest } = raw;
+        await writeAtomic0600(authFilePath(), JSON.stringify(rest, null, 2));
+    }
+    catch {
+        return 'failed';
+    }
+    return outcome;
+}
+/** The one-line startup notice for an outcome the user must know about, else null. */
+export function legacyByokKeyNotice(outcome) {
+    switch (outcome) {
+        case 'conflict':
+            return 'cspeach: ~/.cspeach/auth.json still holds a pasted Anthropic API key in plain text that is different from the one in your OS keychain (the one CSPeach uses). It was kept in case it is your only copy — remove the "byokAnthropicKey" line from auth.json once you no longer need it.';
+        case 'keychain-unavailable':
+            return 'cspeach: ~/.cspeach/auth.json still holds your Anthropic API key in plain text — the OS keychain is not available, so it could not be moved there (on Linux: install and unlock a Secret Service keyring such as gnome-keyring). CSPeach will move it on the next start once the keychain works.';
+        default:
+            return null;
+    }
+}
+async function defaultKeychainDeps() {
+    // Loaded only when there is something to migrate — most starts never pay
+    // for the native keychain module here.
+    const { default: keychain } = await import('./keychain.js');
+    return {
+        getKey: (s, a) => keychain.getPassword(s, a),
+        setKey: (s, a, k) => keychain.setPassword(s, a, k),
+    };
+}

package/dist/classifier/client.js

@@ -1,3 +1,7 @@
+/** Confidence for a `strong` match (≥ 0.85 ⇒ silent routing). */
+export const STRONG_CONFIDENCE = 0.85;
+/** Confidence for any other match (coach: preselected, the user confirms). */
+export const RULE_CONFIDENCE = 0.6;
 const RULES = [
     // abap-app (app lane routing slice 1, 2026-10-01) — building an app FROM a
     // spec / requirements document. FIRST so a spec-document build beats every
@@ -10,9 +14,11 @@ const RULES = [
             /^(?![\s\S]*\bspec\s+gaps?\b)[\s\S]*?\b(build|create|make|develop)\b[^.?!\n]{0,60}\b(app|application)\b[^.?!\n]{0,60}(\bspec(s|ification)?\b|\brequirements?\s+(doc|document|file|sheet)\b|\.(docx|pdf|xlsx)\b)/i,
             /^(?![\s\S]*\bspec\s+gaps?\b)[\s\S]*?(\bspec(s|ification)?\b|\brequirements?\s+(doc|document|file|sheet)\b|\.(docx|pdf|xlsx)\b)[^.?!\n]{0,60}\b(build|create|make|develop)\b[^.?!\n]{0,30}\b(app|application)\b/i,
         ] },
-    { skill: 'abap-atc-fix', patterns: [/atc\s+(fix|auto\s+fix)|abap\s+test\s+cockpit.*fix/i] },
+    { skill: 'abap-atc-fix', patterns: [/atc\s+(fix|auto\s+fix)|abap\s+test\s+cockpit.*fix|\brun\s+(the\s+)?atc\b|\batc\s+findings\b|\bfix\s+(the|all|these|those)\s+findings\b/i] },
     { skill: 'abap-cca', patterns: [/custom\s+code\s+analysis|\bcca\b|clean\s+core\s+(assessment|analysis)/i] },
-    { skill: 'abap-cloud-check', patterns: [/cloud\s+ready|clean\s+core(?!\s+(assessment|analysis))|s\/4hana\s+cloud\s+check/i] },
+    // abap-clean-core (2026-10-02) — took over the retired abap-cloud-check's
+    // "clean core" phrasing; "cloud ready" grading went to abap-review (cloud lens).
+    { skill: 'abap-clean-core', patterns: [/clean.?core(?!\s+(assessment|analysis))|\breleased\s+apis?\b/i] },
     // abap-cap (2026-10-01) MUST precede abap-data-model ("CDS domain model"
     // would hit its bare `domain`) and abap-fiori-build / abap-rap (a CAP app
     // ships a Fiori Elements UI). Side-by-side / BTP framing → CAP.
@@ -22,31 +28,48 @@ const RULES = [
     // A bare BTP mention counts only when no RAP/ABAP/Fiori/UI5/Z-object word
     // appears anywhere in the prompt.
     { skill: 'abap-cap', patterns: [/\b(sap\s+)?cap\b(?=\s+(app|application|project|service|model|backend|extension|handler)s?\b)|\b(in|with|using|use)\s+(sap\s+)?cap\b|cloud\s+application\s+programming|\bcds\s+(model|service)\b(?!\s+(definition|[zy]\w*))|side.?by.?side\s+(app|application|extension)|^(?![\s\S]*\b(rap|abap|fiori|ui5|[zy]\w*_\w+)\b)[\s\S]*\bbtp\b/i] },
-    { skill: 'abap-data-model', patterns: [/data\s+model|ddic\s+(design|structure)|domain|data\s+element|create\s+(a\s+)?z[_\w]*\s+(table|structure)|new\s+(z[_\w]*\s+)?(table|structure|domain)/i] },
+    { skill: 'abap-data-model', patterns: [/data\s+model|ddic\s+(design|structure)|domain|data\s+element|create\s+(a\s+)?z[_\w]*\s+(table|structure)|new\s+(z[_\w]*\s+)?(table|structure|domain)|\bcreate\s+(a\s+|an\s+|new\s+)?(z\w*\s+)?(table|structure)\b/i] },
     { skill: 'abap-design', patterns: [/solution\s+architecture|object\s+list|design\s+the\s+solution/i] },
-    { skill: 'abap-handover', patterns: [/technical\s+documentation|object\s+catalog|doc(ument)?\s+package|handover/i] },
-    { skill: 'abap-document', patterns: [/developer\s+documentation|document\s+this\s+(class|program|object)/i] },
     // abap-incident MUST precede dump rules — pipeline framing beats keyword-only matches
     { skill: 'abap-incident', patterns: [/incident|resolve.*dump.*to.*fix|pipeline.*(short\s+dump|st22|dump)|(dump|st22).*to.*transport|formal\s+(incident|dump)\s+report|end.to.end.*dump/i] },
     // abap-dump (2026-06-12) — merger of abap-dump-analyze + abap-dump-triage.
     // Triage-vs-fix is an intent decision INSIDE the skill now, so both
     // pattern sets route here.
-    { skill: 'abap-dump', patterns: [/short\s+dump|runtime\s+error|\bst22\b|dump\s+(analys|triage|forensic)|structured\s+investigation.*dump/i] },
+    { skill: 'abap-dump', strong: [/short\s+dump|\bst22\b|\bcx_sy_\w+/i],
+        patterns: [/runtime\s+error|dump\s+(analys|triage|forensic)|structured\s+investigation.*dump|\bdump(s|ed|ing)?\b/i] },
     { skill: 'abap-eml', patterns: [/\beml\b|entity\s+manipulation|behavior\s+handler/i] },
-    { skill: 'abap-enhance', patterns: [/\bbadi\b|enhancement\s+spot|implicit\s+enhancement|customer\s+exit|user\s+exit|(hook\s+into|extend)\s+(sap|standard|me\d+|migo|miro|va\d+|vf\d+|vl\d+|fb\d+)/i] },
-    { skill: 'abap-estimate', patterns: [/effort\s+estimat|ticket\s+estimat|size\s+this\s+(work|task|ticket|story)|how\s+(many|long).*(hours|days).*(build|develop|implement)/i] },
-    { skill: 'abap-explain', patterns: [/\bexplain\b|what\s+does\s+this\s+(do|code)|walk.*through/i] },
+    { skill: 'abap-enhance', strong: [/\bbadis?\b|enhancement\s+spot|customer\s+exit|user\s+exit/i],
+        patterns: [/implicit\s+enhancement|(hook\s+into|extend)\s+(sap|standard|me\d+|migo|miro|va\d+|vf\d+|vl\d+|fb\d+)/i] },
+    { skill: 'abap-estimate', patterns: [/\bestimat(e|es|ion)\b|effort\s+estimat|size\s+this\s+(work|task|ticket|story)|how\s+(many|long).*(hours|days).*(build|develop|implement)|how\s+long\s+(will|would)\s+it\s+take|how\s+long\s+to\s+(build|develop|implement|do)\b/i] },
+    // abap-extend-model (2026-10-02) MUST precede abap-generate ("add … to Z…")
+    // and abap-rap ("behavior"). Only CDS / RAP targets — Z?_ entity names
+    // (ZR_/ZI_/ZC_), a CDS view, the app or list — so "add a validation to
+    // ZCL_ORDER_SERVICE" (a class) and "add a column to ZSD_REPORT" (a classic
+    // report) stay on the ABAP code skills.
+    { skill: 'abap-extend-model', patterns: [
+            /\badd\b[^.?!\n]{0,40}\b(actions?|validations?|determinations?)\b[^.?!\n]{0,40}\bto\s+(the\s+|my\s+)?((z|y)[ric]_\w+|(rap\s+)?(bo|business\s+object|bdef|behaviou?r(\s+definition)?)\b)/i,
+            /\badd\b[^.?!\n]{0,40}\b(columns?|fields?)\b[^.?!\n]{0,40}\b(to|in)\s+(the\s+|my\s+)?((z|y)[ric]_\w+|cds\b|projection\b|ddlx\b|metadata\s+extension\b|list(\s+report)?\b|(fiori\s+)?app\b)/i,
+            /\bshow\b[^.?!\n]{0,40}\bin\s+(the\s+|my\s+)(list(\s+report)?|(fiori\s+)?app|object\s+page)\b/i,
+            /\bexpose\b[^.?!\n]{0,40}\baction\b[^.?!\n]{0,40}\bprojection\b|\btoolbar\s+button\b/i,
+        ] },
+    // abap-explain also takes the retired abap-radar's phrasing (technical orientation).
+    { skill: 'abap-explain', patterns: [/\bexplain\b|what\s+does\s+this\s+(do|code)|walk.*through|what\s+does\s+(z|y)\w+\s+do\b|\bradar\b|quick\s+look|overview\s+of\s+(this\s+)?(class|program|object)/i] },
     // abap-test MUST precede abap-generate so "generate tests" routes to the test skill
     // (test-gen merged into abap-test on 2026-05-02 — phrases preserved here).
-    { skill: 'abap-test', patterns: [/unit\s+test|abap\s+unit|test\s+(class|doubles)|generate\s+tests|test\s+generation|improve\s+test\s+coverage/i] },
+    { skill: 'abap-test', strong: [/unit\s+tests?|abap\s+unit/i],
+        patterns: [/test\s+(class|doubles)|generate\s+tests|test\s+generation|improve\s+test\s+coverage/i] },
     // abap-modernize MUST precede abap-rap so "rebuild as RAP" / "convert to RAP" stays
     // on modernize (rebuild intent) instead of falling to abap-rap's bare \brap\b match.
-    { skill: 'abap-modernize', patterns: [/modernise|modernize|classic.*to.*modern|convert.*to\s+(rap|fiori|odata)|rebuild.*as\s+(rap|fiori)/i] },
+    { skill: 'abap-modernize', patterns: [/modernise|modernize|classic.*(to|into).*modern|(convert|turn)\b.*\b(to|into)\s+(an?\s+)?(rap|fiori|odata)|rebuild.*as\s+(rap|fiori)/i] },
     // abap-fiori-build (D12, 2026-06-12) MUST follow abap-modernize ("convert
     // this WRITE report to Fiori" = rebuild intent) and precede abap-rap so
     // "fiori app for my RAP/OData service" lands on the UI skill, not the
     // backend scaffolder.
     { skill: 'abap-fiori-build', patterns: [/\bfiori\b|\b(sap)?ui5\b|freestyle\s+app|\bui\s+app\b|front.?end\s+(for|on)\s/i] },
+    // abap-impact (2026-10-02) MUST precede abap-generate: "before I change
+    // ZSD_X, what depends on it?" is an impact question, not an edit.
+    { skill: 'abap-impact', strong: [/where[\s-]?used/i],
+        patterns: [/impact\s+analysis|where.*used|what.*affected\s+by|what\s+(breaks|would\s+break|depends\s+on)|before\s+i\s+(change|touch|modify)/i] },
     // abap-rap MUST precede abap-generate so RAP-stack prompts route to rap, not the
     // generic generator (cluster I, 2026-05-03). Also captures "scaffold a CDS view +
     // BDEF + service binding" type prompts which collide with abap-generate.
@@ -60,43 +83,45 @@ const RULES = [
             /\badd\s+(a\s+|an\s+)?[\w\s-]{1,40}\bto\s+z[_a-z0-9]+/i,
             /\b(change|fix|update|modify|adjust)\s+(the\s+)?z[_a-z0-9]+\b/i,
         ] },
-    { skill: 'abap-impact', patterns: [/impact\s+analysis|where.*used|what.*affected\s+by/i] },
     // abap-upgrade-* must precede abap-migrate
     { skill: 'abap-upgrade-verify', patterns: [/upgrade\s+verify|remediation\s+report|verify\s+upgrade/i] },
     { skill: 'abap-upgrade-fix', patterns: [/upgrade\s+fix|atc\s+remediation|fix\s+upgrade\s+finding/i] },
     { skill: 'abap-upgrade-scan', patterns: [/upgrade\s+scan|scan.*s\/4|readiness\s+variant/i] },
     { skill: 'abap-migrate', patterns: [/ecc.*migration|migrate.*s\/4|api\s+successor/i] },
-    { skill: 'abap-performance', patterns: [/performance|\bn\+1\b|select\s+inside\s+loop|slow\s+(query|select)/i] },
     // abap-plan (B4, 2026-06-06): deliberately NO bare \bplan\b — "I plan to
     // refactor X" must keep falling through to the refactor/explain rules.
     // Multi-session / project-plan framing only; refine after real prompts.
     { skill: 'abap-plan', patterns: [/project\s+plan|implementation\s+plan|plan\s+(this|the|my)\s+(project|build|development)|multi.session\s+(project|plan|build)|resume\s+(the\s+|my\s+)?plan|step.by.step\s+plan/i] },
     { skill: 'abap-preflight', patterns: [/preflight|pre.release|go\/no.go|release\s+readiness/i] },
-    { skill: 'abap-radar', patterns: [/radar|quick\s+look|overview\s+of\s+(this\s+)?(class|program|object)/i] },
-    { skill: 'abap-refactor', patterns: [/refactor|clean\s+up\s+(code|abap)|procedural.*to\s+oo/i] },
-    { skill: 'abap-review', patterns: [/^review|code\s+review|code\s+quality|clean\s+abap(?!\s+conformity)/i] },
+    // abap-refactor also fixes syntax errors in existing Z code (an in-place change).
+    { skill: 'abap-refactor', patterns: [/refactor|clean\s+up\s+(code|abap)|procedural.*to\s+oo|syntax\s+errors?/i] },
+    // abap-review also takes the retired abap-performance (performance lens) and
+    // abap-cloud-check "cloud ready" grading (cloud lens).
+    { skill: 'abap-review', patterns: [/^review|code\s+review|code\s+quality|clean\s+abap(?!\s+conformity)|performance|\bn\+1\b|select\s+inside\s+loop|\bslow\b|takes?\s+(too|so)\s+long|cloud\s+read(y|iness)|s\/4hana\s+cloud\s+check/i] },
     { skill: 'abap-segw', patterns: [/segw|dpc_ext|mpc_ext|gateway\s+(project|service)|build.*odata.*(ecc|gateway)/i] },
     { skill: 'abap-spec-gap', patterns: [/spec\s+gap|missing\s+(spec|requirements)|business\s+questions|clarif(y|ying)\s+(question|requirement)|gaps?\s+in\s+the\s+(spec|story|requirement)/i] },
+    // abap-handover (moved here 2026-10-02) also takes the retired
+    // abap-document's phrasing; late, so "document" in a dump / spec / app
+    // prompt keeps the earlier, more specific skill.
+    { skill: 'abap-handover', patterns: [/technical\s+documentation|object\s+catalog|doc(ument)?\s+package|handover|developer\s+documentation|\bdocument(ation)?\b/i] },
     // abap-transport-analysis MUST precede abap-transport
     { skill: 'abap-transport-analysis', patterns: [/transport\s+analysis|pre.release\s+transport|transport\s+readiness/i] },
-    { skill: 'abap-transport', patterns: [/transport\s+(create|release|list)|\bcts\b|release.*request/i] },
+    { skill: 'abap-transport', patterns: [/transport\s+(create|release|list)|\bcts\b|release.*request|\btransport\b/i] },
 ];
 /** The skill each offline rule routes to, in rule order (one rule per skill). */
 export const RULE_SKILLS = Object.freeze(RULES.map((r) => r.skill));
-// 2026-10-01: 33 + abap-app + abap-cap = 35. The four merged-away donors
-// (abap-cloud-check, abap-document, abap-performance, abap-radar) keep their
-// rules: their .claude/skills folders are still on disk and still resolve.
-if (RULES.length !== 35) {
-    // Warn-not-throw — managed-mode users never exercise classify() (the proxy
-    // does server-side classification), so a module-load crash would break
-    // them for a local-only consistency check. Unit tests assert the exact
-    // count.
-    console.warn(`[classifier] RULES drift: expected 35, got ${RULES.length} — reconcile with .claude/skills/`);
-}
-export function classify(prompt) {
+// 2026-10-02: one rule per routed skill, every one in SKILL_CATALOG (the
+// four retired donors folded into their successors). Unit tests pin the set.
+/** First matching rule → its skill and confidence (strong 0.85, else 0.6). */
+export function classifyWithConfidence(prompt) {
     for (const rule of RULES) {
-        if (rule.patterns.some(p => p.test(prompt)))
-            return rule.skill;
+        if (rule.strong?.some((p) => p.test(prompt)))
+            return { skill: rule.skill, confidence: STRONG_CONFIDENCE };
+        if (rule.patterns.some((p) => p.test(prompt)))
+            return { skill: rule.skill, confidence: RULE_CONFIDENCE };
     }
     return undefined;
 }
+export function classify(prompt) {
+    return classifyWithConfidence(prompt)?.skill;
+}

package/dist/cli.js

@@ -5,6 +5,7 @@ import { runGcOnStartup } from './session/gc.js';
 import { checkForUpgrade } from './upgrade-check.js';
 import { extractSapAliasFlag, extractNoSapFlag } from './cli-args.js';
 import { applyColorMode } from './renderer/color-mode.js';
+import { migrateLegacyByokKey, legacyByokKeyNotice, cleanStaleAuthTemps } from './auth/auth-file.js';
 /**
  * The verbs that make `cspeach project …` a mistyped team command rather than
  * a prompt somebody meant to send. See the check in `main`.
@@ -16,6 +17,16 @@ export async function main(argv) {
     applyColorMode();
     runGcOnStartup().catch(() => { });
     checkForUpgrade().catch(() => { });
+    // 2026-10-02 — an older `cspeach login` left a pasted BYOK key in plaintext
+    // in ~/.cspeach/auth.json; move it to the OS keychain and delete it from
+    // the file. A file read on most starts; never throws.
+    // A key that could not be moved (keychain unavailable) or that differs from
+    // the keychain's gets one plain notice on stderr (one-shot stdout stays clean).
+    // Review S3: a crashed atomic write can leave auth.json.*.tmp (API key inside).
+    await cleanStaleAuthTemps();
+    const legacyNotice = legacyByokKeyNotice(await migrateLegacyByokKey().catch(() => 'failed'));
+    if (legacyNotice)
+        console.error(legacyNotice);
     let args = argv.slice(2);
     // Standalone mode (2026-09-16) — `--no-sap` is accepted ANYWHERE in the args
     // for both the REPL and one-shot, and stripped like `--sap-alias` below.

package/dist/commands/config-set.js

@@ -24,6 +24,7 @@ const MUTABLE_KEYS = new Set([
     'llm.mode',
     'llm.ai_hub_base_url',
     'llm.ai_hub_model_alias',
+    'llm.ai_hub_router_model',
     'llm.local_base_url',
     'llm.local_model',
     // Virtual keys that route to keychain (not saved to config.toml):
@@ -574,6 +575,12 @@ export async function runConfigSet(args) {
                 err('ai_hub_model_alias cannot be empty.');
             cfg.llm.ai_hub_model_alias = value;
             break;
+        case 'llm.ai_hub_router_model':
+            if (!isModelAlias(value)) {
+                err(`Invalid llm.ai_hub_router_model "${value}". Use your AI Hub deployment / model alias (letters, digits, . _ - : /; no spaces).`);
+            }
+            cfg.llm.ai_hub_router_model = value;
+            break;
         case 'llm.local_base_url':
             try {
                 new URL(value);
@@ -606,6 +613,10 @@ export async function runConfigSet(args) {
  * Does not load or mutate any config — safe to call in unit tests.
  * Keep in sync with the switch statement in `runConfigSet`.
  */
+/** A model / deployment alias: 1–128 chars, no spaces or control characters (2026-10-02). */
+function isModelAlias(value) {
+    return /^[A-Za-z0-9._:\/-]{1,128}$/.test(value);
+}
 export function validateValue(key, value) {
     // SAP-scoped key: sap.<alias>.auto_approve
     if (SAP_AUTO_APPROVE_RE.test(key)) {
@@ -684,6 +695,8 @@ export function validateValue(key, value) {
         case 'llm.ai_hub_model_alias':
         case 'llm.local_model':
             return value.length > 0;
+        case 'llm.ai_hub_router_model':
+            return isModelAlias(value);
         case 'llm.byok_key':
         case 'llm.ai_hub_token':
             return value.length > 0; // Secrets pass through if non-empty; no format check

package/dist/commands/config-show.js

@@ -59,7 +59,7 @@ function printLlmMissingHints(llm) {
     if (typeof mode !== 'string')
         return;
     const required = LLM_REQUIRED_KEYS_BY_MODE[mode];
-    if (!required || required.length === 0)
+    if (!required)
         return;
     for (const key of required) {
         const value = llm[key];
@@ -67,6 +67,10 @@ function printLlmMissingHints(llm) {
             console.log(`${key} = ${paint('bad', '<not set>')}`);
         }
     }
+    // 2026-10-02: the optional routing alias — say what routing uses instead.
+    if (mode === 'ai-hub' && !llm['ai_hub_router_model']) {
+        console.log(`ai_hub_router_model = ${paint('dim', '<not set — skill routing uses ai_hub_model_alias>')}`);
+    }
 }
 function printConfigAsToml(cfg, prefix = '') {
     // Emit scalars before nested objects — otherwise a top-level scalar that

package/dist/commands/cost.js

@@ -9,7 +9,7 @@
  * No mutation, no network. Safe to run anytime.
  */
 import chalk from 'chalk';
-import { readCostLog, summarise } from '../cost/cost-log.js';
+import { readCostLog, summarise, turnRows } from '../cost/cost-log.js';
 import { formatCost } from '../cost/pricing.js';
 import { creditsActive, formatCredits, globalCredits, CREDITS_PENDING, } from '../cost/credits.js';
 import { panelHeading, panelRow } from '../renderer/panel-rows.js';
@@ -22,14 +22,12 @@ import { sanitizeControlChars } from '../renderer/sanitize.js';
  * number — they are skipped, not counted as zero, and the caller says so.
  */
 function summariseCredits(entries) {
+    // 2026-10-03: counted per TURN (turnRows) — a turn writes one line per call.
     let total = 0;
     let unknown = 0;
-    for (const e of entries) {
-        // Final review I6 — a zero-token reader rollup line is not a turn.
-        if (e.kind === 'reader_rollup')
-            continue;
-        if (typeof e.credits_charged === 'number')
-            total += e.credits_charged;
+    for (const r of turnRows(entries)) {
+        if (typeof r.credits === 'number')
+            total += r.credits;
         else
             unknown++;
     }
@@ -52,8 +50,9 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     const s = summarise(entries);
     // Credits mode: the customer is billed in credits at a multiplier we do not
     // disclose, so NOTHING derived from cost/pricing.ts may be printed here —
-    // not the total, not the per-model split, not the per-turn figures. Tokens
-    // stay: they are a usage fact, not a COGS leak.
+    // not the total, not the per-model split, not the per-turn figures.
+    // 2026-10-02 (owner): tokens go too. Not a COGS leak on their own, but beside
+    // credits they invite "credits per token" maths — credits only for managed.
     const inCredits = creditsActive();
     const perTurn = summariseCredits(entries);
     const turnsNote = `${s.turns} turn${s.turns === 1 ? '' : 's'}`;
@@ -70,12 +69,14 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     else {
         emit(panelHeading(`Session cost so far: ${formatCost(s.totalCost)}`, turnsNote));
     }
-    emit('');
-    emit(chalk.bold('Tokens'));
-    emit(panelRow('input', s.totalTokens.input.toLocaleString().padStart(12)));
-    emit(panelRow('output', s.totalTokens.output.toLocaleString().padStart(12)));
-    emit(panelRow('cache read', s.totalTokens.cacheRead.toLocaleString().padStart(12)));
-    emit(panelRow('cache create', s.totalTokens.cacheCreate.toLocaleString().padStart(12)));
+    if (!inCredits) {
+        emit('');
+        emit(chalk.bold('Tokens'));
+        emit(panelRow('input', s.totalTokens.input.toLocaleString().padStart(12)));
+        emit(panelRow('output', s.totalTokens.output.toLocaleString().padStart(12)));
+        emit(panelRow('cache read', s.totalTokens.cacheRead.toLocaleString().padStart(12)));
+        emit(panelRow('cache create', s.totalTokens.cacheCreate.toLocaleString().padStart(12)));
+    }
     // Task 18 fix M3 — reader subagent spend (already inside the total above).
     // USD only: in credits mode the balance delta already carries it.
     if (s.readerCalls > 0 && !inCredits) {
@@ -99,22 +100,23 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     // Recent turns — last 5, most recent first. Piece 2: one count format, "N of M" (P1's countLabel).
     // Final review I6 — reader rollup lines (interrupted turns) are not turns:
     // they stay out of the list and the count (summarise() already skips them).
-    const turnEntries = entries.filter((e) => e.kind !== 'reader_rollup');
-    const recent = turnEntries.slice(-5).reverse();
+    // 2026-10-03: one row per TURN (a turn writes one line per model call).
+    const rows = turnRows(entries);
+    const recent = rows.slice(-5).reverse();
     emit('');
-    emit(chalk.bold(`Recent turns · ${countLabel(recent.length, turnEntries.length)}`));
+    emit(chalk.bold(`Recent turns · ${countLabel(recent.length, rows.length)}`));
     for (const e of recent) {
-        const tok = (e.tokens.input + e.tokens.output).toLocaleString();
+        const tok = e.tokens.toLocaleString();
         // Credits mode: the per-turn figure is what the LEDGER charged (a balance
         // delta recorded at turn end), never our computed USD. A turn whose
         // balance sample failed shows the pending marker rather than a number we
         // would have to invent.
         const tail = inCredits
-            ? (typeof e.credits_charged === 'number'
-                ? formatCredits(e.credits_charged, credits?.unitLabel ?? 'credits')
+            ? (typeof e.credits === 'number'
+                ? formatCredits(e.credits, credits?.unitLabel ?? 'credits')
                 : CREDITS_PENDING)
             : formatCost(e.cost);
-        emit(panelRow(`turn ${String(e.turn).padStart(3)}`, `${tok.padStart(10)} tok   ${tail}`, 8));
+        emit(panelRow(`turn ${String(e.turn).padStart(3)}`, inCredits ? tail : `${tok.padStart(10)} tok   ${tail}`, 8));
     }
     if (inCredits && perTurn.unknown > 0) {
         emit('');