@cspeach/cli 1.1.25 → 1.1.26

package/dist/tools/fiori/deploy/yaml-read.js

@@ -0,0 +1,236 @@
+// cspeach-cli/src/tools/fiori/deploy/yaml-read.ts
+/**
+ * fiori_deploy — read the deploy-to-abap task out of an app's ui5-deploy.yaml.
+ *
+ * The file sits in a folder the model can write, and what it says decides
+ * where the SAP logon is sent, so it is read STRICTLY: a small block-style
+ * YAML reader (the CLI ships no YAML library and the ruling forbids adding
+ * one — same stance as preview/app-guard.ts) that FAILS CLOSED on anything it
+ * cannot read with certainty: flow style, anchors / aliases, tags, block
+ * scalars, tabs, escapes in double quotes, duplicate keys, document markers.
+ *
+ * It reads exactly what the fiori engine writes (deploy-config.ts) and what
+ * `fiori add deploy-config` writes for an on-premise ABAP target. Anything a
+ * BTP / destination / cloud target needs is refused (out of scope, and a
+ * destination would send the logon somewhere this tool cannot check).
+ */
+class YamlUncertain extends Error {
+}
+function stripComment(text) {
+    // A comment starts at " #" outside quotes (or at the line start).
+    let quote = null;
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (quote) {
+            if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'")
+            quote = c;
+        else if (c === '#' && (i === 0 || /\s/.test(text[i - 1])))
+            return text.slice(0, i).trimEnd();
+    }
+    return text.trimEnd();
+}
+function toLines(src) {
+    const out = [];
+    const raw = src.replace(/^/, '').split(/\r?\n/);
+    raw.forEach((r, i) => {
+        if (/^\s*(#.*)?$/.test(r))
+            return;
+        if (/^[ ]*\t/.test(r))
+            throw new YamlUncertain(`line ${i + 1} is indented with a tab`);
+        if (/^(---|\.\.\.)(\s|$)/.test(r))
+            throw new YamlUncertain(`line ${i + 1} is a YAML document marker`);
+        if (/^\s*%/.test(r))
+            throw new YamlUncertain(`line ${i + 1} is a YAML directive`);
+        const indent = r.length - r.trimStart().length;
+        const text = stripComment(r.slice(indent));
+        if (text.length === 0)
+            return;
+        out.push({ indent, text, no: i + 1 });
+    });
+    return out;
+}
+function scalar(raw, no) {
+    const v = raw.trim();
+    if (v.startsWith('"')) {
+        if (!v.endsWith('"') || v.length < 2)
+            throw new YamlUncertain(`line ${no}: unterminated double-quoted value`);
+        const body = v.slice(1, -1);
+        if (body.includes('\\') || body.includes('"'))
+            throw new YamlUncertain(`line ${no}: escapes in a double-quoted value`);
+        return body;
+    }
+    if (v.startsWith("'")) {
+        if (!v.endsWith("'") || v.length < 2)
+            throw new YamlUncertain(`line ${no}: unterminated single-quoted value`);
+        const body = v.slice(1, -1);
+        if (body.replace(/''/g, '').includes("'"))
+            throw new YamlUncertain(`line ${no}: a stray quote`);
+        return body.replace(/''/g, "'");
+    }
+    if (/^[{[&*!|>%@`]/.test(v))
+        throw new YamlUncertain(`line ${no}: the value is not a plain value (flow style, anchor, alias, tag or block scalar)`);
+    return v;
+}
+const KEY_RE = /^([A-Za-z0-9_.\-/$]+)\s*:(?:\s+(.*))?$/;
+function parseNode(lines, i, indent) {
+    const line = lines[i];
+    if (!line || line.indent < indent)
+        return [null, i];
+    if (line.text === '-' || line.text.startsWith('- '))
+        return parseSeq(lines, i, line.indent);
+    return parseMap(lines, i, line.indent);
+}
+function parseSeq(lines, i, indent) {
+    const items = [];
+    while (i < lines.length && lines[i].indent === indent && (lines[i].text === '-' || lines[i].text.startsWith('- '))) {
+        const line = lines[i];
+        const rest = line.text.slice(1).trimStart();
+        if (rest.length === 0) {
+            const next = lines[i + 1];
+            if (next && next.indent > indent) {
+                const [v, ni] = parseNode(lines, i + 1, next.indent);
+                items.push(v);
+                i = ni;
+            }
+            else {
+                items.push(null);
+                i += 1;
+            }
+            continue;
+        }
+        const restIndent = indent + (line.text.length - rest.length);
+        if (KEY_RE.test(rest)) {
+            lines[i] = { indent: restIndent, text: rest, no: line.no };
+            const [v, ni] = parseMap(lines, i, restIndent);
+            items.push(v);
+            i = ni;
+        }
+        else {
+            items.push(scalar(rest, line.no));
+            i += 1;
+        }
+    }
+    if (i < lines.length && lines[i].indent > indent) {
+        throw new YamlUncertain(`line ${lines[i].no} is indented under nothing`);
+    }
+    return [items, i];
+}
+function parseMap(lines, i, indent) {
+    const obj = {};
+    while (i < lines.length && lines[i].indent === indent) {
+        const line = lines[i];
+        if (line.text === '-' || line.text.startsWith('- '))
+            break;
+        const m = KEY_RE.exec(line.text);
+        if (!m)
+            throw new YamlUncertain(`line ${line.no} is not a plain "key: value" line`);
+        const key = m[1];
+        if (Object.prototype.hasOwnProperty.call(obj, key))
+            throw new YamlUncertain(`line ${line.no}: duplicate key "${key}"`);
+        const value = m[2];
+        if (value !== undefined && value.length > 0) {
+            obj[key] = scalar(value, line.no);
+            i += 1;
+            continue;
+        }
+        const next = lines[i + 1];
+        if (next && next.indent > indent) {
+            const [v, ni] = parseNode(lines, i + 1, next.indent);
+            obj[key] = v;
+            i = ni;
+        }
+        else if (next && next.indent === indent && (next.text === '-' || next.text.startsWith('- '))) {
+            const [v, ni] = parseSeq(lines, i + 1, indent);
+            obj[key] = v;
+            i = ni;
+        }
+        else {
+            obj[key] = null;
+            i += 1;
+        }
+    }
+    if (i < lines.length && lines[i].indent > indent) {
+        throw new YamlUncertain(`line ${lines[i].no} is indented under nothing`);
+    }
+    return [obj, i];
+}
+export function parseStrictYaml(src) {
+    const lines = toLines(src);
+    if (lines.length === 0)
+        return null;
+    const [node, i] = parseNode(lines, 0, lines[0].indent);
+    if (i < lines.length)
+        throw new YamlUncertain(`line ${lines[i].no} could not be read`);
+    return node;
+}
+const isMap = (n) => !!n && typeof n === 'object' && !Array.isArray(n);
+const str = (n) => (typeof n === 'string' ? n : undefined);
+/** The only keys allowed under target: — anything else (destination, scp, cloud, service, …) is refused. */
+const TARGET_KEYS = new Set(['url', 'client']);
+/** The deploy-to-abap configuration keys fiori_deploy accepts. */
+const CONFIG_KEYS = new Set(['target', 'app', 'ignoreCertErrors', 'exclude']);
+const APP_KEYS = new Set(['name', 'description', 'package', 'transport']);
+export function readDeployYaml(src) {
+    let root;
+    try {
+        root = parseStrictYaml(src);
+    }
+    catch (e) {
+        return { ok: false, error: `ui5-deploy.yaml could not be read with certainty — ${e instanceof Error ? e.message : String(e)}` };
+    }
+    const tasks = isMap(root) && isMap(root.builder) ? root.builder.customTasks : undefined;
+    const deployTasks = Array.isArray(tasks) ? tasks.filter((t) => isMap(t) && t.name === 'deploy-to-abap') : [];
+    if (deployTasks.length !== 1) {
+        return {
+            ok: false,
+            error: deployTasks.length === 0
+                ? 'ui5-deploy.yaml has no deploy-to-abap task — write it with fiori_deploy_config first'
+                : 'ui5-deploy.yaml has more than one deploy-to-abap task',
+        };
+    }
+    const cfg = deployTasks[0].configuration;
+    if (!isMap(cfg))
+        return { ok: false, error: 'the deploy-to-abap task has no configuration block' };
+    if (cfg.credentials !== undefined) {
+        return { ok: false, error: 'ui5-deploy.yaml carries a credentials block — remove it; CSPeach supplies the logon from its own store' };
+    }
+    // Review 2026-10-03: only known keys pass. Others change what is deployed or how —
+    // safeMode: false (no server-side 412 guard), archivePath/archiveUrl (another archive),
+    // strictSsl / ignoreCertError (TLS), keep, lrep, verbose (logs the config) …
+    for (const k of Object.keys(cfg)) {
+        if (!CONFIG_KEYS.has(k)) {
+            return { ok: false, error: `configuration.${k} is not supported by fiori_deploy (allowed: ${[...CONFIG_KEYS].join(', ')}) — remove it from ui5-deploy.yaml` };
+        }
+    }
+    const target = cfg.target;
+    const app = cfg.app;
+    if (!isMap(target) || !isMap(app))
+        return { ok: false, error: 'the deploy-to-abap configuration needs a target and an app block' };
+    for (const k of Object.keys(app)) {
+        if (!APP_KEYS.has(k)) {
+            return { ok: false, error: `app.${k} is not supported by fiori_deploy (allowed: ${[...APP_KEYS].join(', ')}) — remove it from ui5-deploy.yaml` };
+        }
+    }
+    for (const k of Object.keys(target)) {
+        if (!TARGET_KEYS.has(k)) {
+            return { ok: false, error: `target.${k} is not supported — fiori_deploy deploys only to the on-premise ABAP system of the SAP alias (url + client)` };
+        }
+    }
+    const url = str(target.url);
+    const client = str(target.client);
+    const name = str(app.name);
+    const pkg = str(app.package);
+    const transport = app.transport === null ? '' : str(app.transport);
+    if (!url || !client || !name || !pkg || transport === undefined) {
+        return { ok: false, error: 'ui5-deploy.yaml must name target.url, target.client, app.name, app.package and app.transport (empty for $TMP)' };
+    }
+    const cert = cfg.ignoreCertErrors;
+    if (cert !== undefined && cert !== 'true' && cert !== 'false') {
+        return { ok: false, error: 'ignoreCertErrors must be true or false' };
+    }
+    return { ok: true, config: { url, client, name, package: pkg, transport, ignoreCertErrors: cert === 'true' } };
+}

package/dist/tools/fiori/deploy-config.js

@@ -9,22 +9,40 @@
 // take the NAMES of environment variables at deploy time.
 import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-export function writeDeployConfig(appDir, opts) {
-    const appName = opts.appName;
+/**
+ * The BSP name / package / transport rules, shared by the writer below and by
+ * `fiori_deploy` (which re-checks the yaml it is about to deploy — the file is
+ * in a folder the model can write, so it is never trusted on read).
+ * Returns the normalised (upper-cased) package and whether it is $TMP.
+ */
+export function validateDeployTarget(t) {
+    const appName = t.appName;
+    if (appName.length === 0) {
+        throw new Error('BSP app name is empty');
+    }
     if (appName.length > 15) {
         throw new Error(`BSP app name "${appName}" exceeds 15 characters (ABAP repository limit)`);
     }
     if (appName !== appName.toUpperCase()) {
         throw new Error(`BSP app name "${appName}" must be uppercase`);
     }
-    const pkg = opts.package.toUpperCase();
+    const pkg = t.package.toUpperCase();
     if (!/^(\$TMP|[ZY][A-Z0-9_]*|\/[A-Z0-9_]+\/[A-Z0-9_]+)$/.test(pkg)) {
-        throw new Error(`Package "${opts.package}" is not in the customer namespace (Z-/Y-prefixed, $TMP, or /namespace/pkg)`);
+        throw new Error(`Package "${t.package}" is not in the customer namespace (Z-/Y-prefixed, $TMP, or /namespace/pkg)`);
     }
     const isTmp = pkg === '$TMP';
-    if (!isTmp && !/^[A-Z0-9]{3}K[0-9]{6,}$/.test(opts.transport)) {
-        throw new Error(`A valid workbench transport (e.g. S4HK903359) is required unless package is $TMP — got "${opts.transport}"`);
+    if (isTmp && t.transport.trim() !== '') {
+        throw new Error(`Package $TMP is local-only and takes no transport, but transport "${t.transport}" is set — ` +
+            'either remove the transport (local-only app) or use the real Z/Y package that transport belongs to');
+    }
+    if (!isTmp && !/^[A-Z0-9]{3}K[0-9]{6,}$/.test(t.transport)) {
+        throw new Error(`A valid workbench transport (e.g. S4HK903359) is required unless package is $TMP — got "${t.transport}"`);
     }
+    return { package: pkg, isTmp };
+}
+export function writeDeployConfig(appDir, opts) {
+    const appName = opts.appName;
+    const { package: pkg, isTmp } = validateDeployTarget({ appName, package: opts.package, transport: opts.transport });
     const pkgJsonPath = join(appDir, 'package.json');
     const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
     const projectName = pkgJson.name ?? appName.toLowerCase();

package/dist/tools/fiori/tools.js

@@ -53,6 +53,8 @@ import { decodeHtmlEscapes } from './html-escapes.js';
 import { applyEntry } from './apply.js';
 import { listCatalog } from './catalog/index.js';
 import { writeDeployConfig } from './deploy-config.js';
+import { runFioriDeploy } from './deploy/run.js';
+import { FIORI_DEPLOY_HANDOVER_SCOPE } from './deploy/scope.js';
 import { scaffoldFioriElements } from './fe-scaffold.js';
 import { deriveExpectedColumns } from './smoke/audit-columns.js';
 import { PINNED_UI5_VERSION } from './ui5-version.js';
@@ -62,7 +64,7 @@ import { runDraftSmoke, draftSmokePreconditions } from './smoke/draft-smoke.js';
 import { customerService, isLoopbackAppUrl, capService, isCapDevIndex } from './smoke/draft-safety.js';
 import { verifyAndSpendApprovalId } from '../../approvals/jwt.js';
 import { deriveFreestyleSmokeSpec, FreestyleSmokeDerivationError } from './smoke/freestyle-spec.js';
-import { loadConfig, resolveRenderSmoke } from '../../config/loader.js';
+import { loadConfig, resolveRenderSmoke, resolveSapTls } from '../../config/loader.js';
 import { startPreview } from './preview/start.js';
 import { loginNeed, readStartScript } from './preview/app-guard.js';
 import { isCredentialHandoverApproved } from '../../repl/credential-handover-gate.js';
@@ -237,7 +239,7 @@ export async function fioriListHandler(_args, _ctx) {
     return { content: JSON.stringify(entries, null, 2) };
 }
 // ──────────────────────────── fiori_deploy_config ─────────────────────────
-export async function fioriDeployConfigHandler(args, ctx) {
+export async function fioriDeployConfigHandler(args, ctx, deps) {
     if (!args.appDir)
         return { content: 'error: appDir is required', is_error: true };
     if (!args.url)
@@ -251,6 +253,23 @@ export async function fioriDeployConfigHandler(args, ctx) {
     const resolved = await safeDir(ctx, args.appDir);
     if ('error' in resolved)
         return { content: `error: ${resolved.error}`, is_error: true };
+    // Review 2026-10-03 — TLS follows the alias: when the alias verifies
+    // certificates (a CA is configured, or the system trust store), the yaml
+    // never says ignoreCertErrors: true (fiori_deploy would override it anyway).
+    let ignoreCertErrors = args.ignoreCertErrors === true;
+    let tlsNote = '';
+    if (ignoreCertErrors) {
+        try {
+            const cfg = await (deps?.loadConfig ?? loadConfig)();
+            const sys = cfg.sap?.[ctx.sapAlias];
+            if (sys && resolveSapTls(sys).mode !== 'insecure') {
+                ignoreCertErrors = false;
+                tlsNote = `
+ignoreCertErrors was written as false: alias ${ctx.sapAlias} verifies certificates${sys.ca_cert_path ? ` (CA ${sys.ca_cert_path})` : ''}.`;
+            }
+        }
+        catch { /* no config — keep what was asked */ }
+    }
     try {
         writeDeployConfig(resolved.abs, {
             url: args.url,
@@ -259,7 +278,7 @@ export async function fioriDeployConfigHandler(args, ctx) {
             description: args.description,
             package: args.package,
             transport: args.transport ?? '',
-            ignoreCertErrors: args.ignoreCertErrors === true,
+            ignoreCertErrors,
         });
     }
     catch (err) {
@@ -271,9 +290,58 @@ export async function fioriDeployConfigHandler(args, ctx) {
     return {
         content: `Deploy config written: ${appDir}/ui5-deploy.yaml (BSP app ${args.name} → package ${args.package}` +
             `${args.transport ? `, transport ${args.transport}` : ''}).\n` +
-            `package.json gained "deploy" and "deploy-test" scripts. Run "npm run deploy-test" to validate without deploying.`,
+            `package.json gained "deploy" and "deploy-test" scripts. Next: fiori_deploy with mode "test" (the backend validates, ` +
+            'nothing is deployed), then mode "deploy" — it uses the SAP logon CSPeach already stores; no password or variable is needed.' +
+            tlsNote,
     };
 }
+/** The credential-handover scope: a fiori_preview approval for the alias does not cover a deploy. */
+export { FIORI_DEPLOY_HANDOVER_SCOPE };
+/**
+ * fiori_deploy — build + `fiori deploy` the app as a BSP with the SAP logon
+ * CSPeach already holds (deploy/run.ts has the full contract). The handler
+ * only sandboxes appDir, re-checks the credential-handover approval
+ * (TOCTOU, same as fiori_preview) and renders the result.
+ */
+export async function fioriDeployHandler(args, ctx, deps) {
+    if (!args || typeof args.appDir !== 'string' || args.appDir.trim() === '') {
+        return { content: 'error: appDir is required (the scaffolded app root, relative to the project root)', is_error: true };
+    }
+    const mode = args.mode ?? 'test';
+    if (mode !== 'test' && mode !== 'deploy') {
+        return { content: 'error: mode must be "test" (the backend validates, nothing is deployed) or "deploy"', is_error: true };
+    }
+    const resolved = await safeDir(ctx, args.appDir);
+    if ('error' in resolved)
+        return { content: `error: ${resolved.error}`, is_error: true };
+    const alias = args.alias ?? ctx.sapAlias;
+    const approved = (deps?.isLoginApproved ?? ((a) => isCredentialHandoverApproved(ctx.session?.id, a, FIORI_DEPLOY_HANDOVER_SCOPE)))(alias);
+    if (!approved) {
+        return {
+            content: `error: fiori_deploy refused (nothing was sent): handing the SAP logon for alias ${alias} to fiori deploy was not ` +
+                'approved in this session. Call fiori_deploy again so the approval prompt can be shown.',
+            is_error: true,
+        };
+    }
+    const { isLoginApproved: _gate, ...runDeps } = deps ?? {};
+    const r = await runFioriDeploy({
+        appDir: resolved.abs,
+        projectRoot: ctx.cwd,
+        mode,
+        alias,
+        ...(typeof args.approval_id === 'string' ? { approvalId: args.approval_id } : {}),
+    }, { log: (line) => ctx.chunkEmitter?.emit('info', line), ...runDeps });
+    if (!r.ok) {
+        const head = r.stage === 'refused' ? 'fiori_deploy refused (nothing was sent)' : `fiori_deploy failed at the ${r.stage} step`;
+        return { content: `error: ${head}: ${r.error}`, is_error: true };
+    }
+    const lines = [r.summary, ...r.notes.map((n) => `note: ${n}`)];
+    if (r.url)
+        lines.push(`deployedUrl: ${r.url}`);
+    else
+        lines.push('Next: run fiori_deploy with mode "deploy" (needs an approval_id for the BSP).');
+    return { content: lines.join('\n') };
+}
 // ──────────────────────────── fiori_scaffold_fe ───────────────────────────
 export async function fioriScaffoldFeHandler(args, ctx) {
     if (!args.basePath)
@@ -948,7 +1016,7 @@ registerTool({
     description: 'Write the ABAP-repository (BSP) deploy configuration for a scaffolded app: ui5-deploy.yaml ' +
         'plus "deploy" / "deploy-test" package.json scripts. Validates BSP app name (≤15 chars, ' +
         'uppercase), package namespace, and transport format. Credentials are NEVER written — ' +
-        'fiori deploy takes env-var NAMES at deploy time. appDir is sandboxed to the project root.',
+        'deploy with fiori_deploy, which uses the stored SAP logon. appDir is sandboxed to the project root.',
     isMutating: true,
     category: 'fiori',
     flagGated: true,
@@ -968,6 +1036,50 @@ registerTool({
     },
     handler: fioriDeployConfigHandler,
 });
+registerTool({
+    name: 'fiori_deploy',
+    description: 'Deploy a scaffolded UI5 app to the ABAP repository as a BSP application with the SAP "fiori deploy" tool, using ' +
+        'the SAP logon CSPeach already keeps for the alias in the OS credential store — the developer types no password ' +
+        'and sets no environment variable. Reads ui5-deploy.yaml in the app (write it first with fiori_deploy_config) and ' +
+        'REFUSES when it is not valid (BSP name, package, transport rules) or when its target url/port/client are not the ' +
+        'system of the SAP alias (a yaml that names the box by IP passes only when the alias host resolves to that IP); ' +
+        'the deploy then goes to the alias url. Runs the "build" script of the app first (without the logon). The logon ' +
+        'reaches only the fiori deploy process, by environment, and is scrubbed from all output. mode "test" (default): ' +
+        'the backend validates the upload and deploys nothing — no write approval needed. mode "deploy": a SAP WRITE — ' +
+        'call request_approval with a change {op:"create", object:"<BSP NAME>", type:"WAPA"} first and pass the id as ' +
+        'approval_id (one approval, one deploy; an auto-approval does not count); refused in advisory-only mode and on production-tagged aliases. On ' +
+        'success the tool GETs /sap/bc/ui5_ui5/sap/<bsp>/index.html over the alias connection and returns deployedUrl ' +
+        'only when it answered 200. Asks once per session per alias before handing the logon over. Flag-gated (enabled ' +
+        'with local_build).',
+    isMutating: true,
+    requiresSap: true,
+    category: 'fiori',
+    flagGated: true,
+    input_schema: {
+        type: 'object',
+        properties: {
+            appDir: { type: 'string', description: 'The scaffolded app root (relative to the project root, sandboxed). In a plan: phases[ui.build].work.app.dir.' },
+            mode: { type: 'string', enum: ['test', 'deploy'], description: '"test" (default): backend validation only, nothing deployed. "deploy": the real deploy.' },
+            alias: { type: 'string', description: 'SAP alias whose system and stored logon are used. Defaults to the session alias.' },
+            approval_id: { type: 'string', description: 'mode "deploy" only: from request_approval, change {op:"create", object:"<BSP NAME>", type:"WAPA"}.' },
+        },
+        required: ['appDir'],
+    },
+    // The logon is handed to a child process in BOTH modes — dispatchTool asks a
+    // human once per session per alias (scope fiori_deploy, so an earlier
+    // fiori_preview approval does not cover it). The /abap-plan deploy card
+    // records this approval when the developer confirms it.
+    credentialHandover: (args, ctx) => {
+        const alias = args?.alias ?? ctx.sapAlias;
+        return {
+            alias,
+            scope: FIORI_DEPLOY_HANDOVER_SCOPE,
+            summary: `CSPeach's stored SAP logon for alias ${alias} is passed to "fiori deploy" (${args?.appDir ?? '(no appDir given)'}) ` +
+                'through its environment only — never on the command line, never in a file. Asked once per session for each alias.',
+        };
+    },
+    handler: fioriDeployHandler,
+});
 registerTool({
     name: 'fiori_scaffold_fe',
     description: 'Scaffold a trivial Fiori Elements app shell (List Report Object Page, Worklist, Overview Page, or Analytical List Page) ' +

package/dist/tools/local-build.js

@@ -11,6 +11,7 @@
  *   filesystem: file_read, file_write, file_edit, glob, grep
  *   shell:      shell_exec
  *   fiori:      fiori_scaffold, fiori_apply, fiori_list, fiori_deploy_config,
+ *               fiori_deploy (BSP deploy with the stored SAP logon — approval-gated write),
  *               fiori_scaffold_fe, fiori_fe_extend, fiori_render_smoke,
  *               fiori_preview (L1-6 — the preview server every browser check
  *               depends on), fiori_metadata_audit, fiori_draft_smoke
@@ -66,6 +67,8 @@ export const LOCAL_BUILD_TOOLS = [
     'fiori_apply',
     'fiori_list',
     'fiori_deploy_config',
+    // Deploy with the stored SAP logon (2026-10-02) — a SAP write in mode 'deploy', approval-gated.
+    'fiori_deploy',
     'fiori_scaffold_fe',
     'fiori_fe_extend',
     'fiori_render_smoke',

package/dist/tools/subagent/read_agent.js

@@ -22,7 +22,7 @@ import { listTools, registerTool, toolsForContext } from '../index.js';
 import { runTurn } from '../../agent/loop.js';
 import { collectTurnAssistantText } from '../../agent/turn-assistant-text.js';
 import { newSession } from '../../session/schema.js';
-import { computeSessionCost } from '../../cost/session-cost.js';
+import { computeSessionModelCost } from '../../cost/session-cost.js';
 import { sessionIdOf, spillIfLarge } from '../result-spill.js';
 import { INTERRUPTED_LINE, READER_SKILL, READER_SYSTEM_PROMPT, READER_TOOLS, hasReaderReadTools } from './reader-prompt.js';
 export { INTERRUPTED_LINE, READER_SKILL, READER_SYSTEM_PROMPT, READER_TOOLS, hasReaderReadTools };
@@ -118,7 +118,9 @@ export async function readAgentHandler(args, ctx) {
     finally {
         // Spend counts whether or not the reader finished.
         if (ctx.readerSpend) {
-            ctx.readerSpend.cost += computeSessionCost(childSession);
+            // The child's own model cost only — the BYOK router spend is already in
+            // the session total once (review S1, 2026-10-02).
+            ctx.readerSpend.cost += computeSessionModelCost(childSession);
             ctx.readerSpend.calls += 1;
         }
     }

package/dist/tools/tool-loading.js

@@ -35,7 +35,7 @@ export const CORE_TOOLS = Object.freeze([
     'sap_create_object',
 ]);
 const FIORI_FAMILY = [
-    'fiori_apply', 'fiori_deploy_config', 'fiori_draft_smoke', 'fiori_fe_extend',
+    'fiori_apply', 'fiori_deploy', 'fiori_deploy_config', 'fiori_draft_smoke', 'fiori_fe_extend',
     'fiori_list', 'fiori_metadata_audit', 'fiori_preview', 'fiori_render_smoke',
     'fiori_sample_get', 'fiori_sample_search', 'fiori_scaffold', 'fiori_scaffold_fe',
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cspeach/cli",
-  "version": "1.1.25",
+  "version": "1.1.26",
   "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
   "keywords": [
     "abap",