@cspeach/cli 1.1.25 → 1.1.27

package/dist/commands/cost.js

@@ -9,7 +9,7 @@
  * No mutation, no network. Safe to run anytime.
  */
 import chalk from 'chalk';
-import { readCostLog, summarise } from '../cost/cost-log.js';
+import { readCostLog, summarise, turnRows } from '../cost/cost-log.js';
 import { formatCost } from '../cost/pricing.js';
 import { creditsActive, formatCredits, globalCredits, CREDITS_PENDING, } from '../cost/credits.js';
 import { panelHeading, panelRow } from '../renderer/panel-rows.js';
@@ -22,14 +22,12 @@ import { sanitizeControlChars } from '../renderer/sanitize.js';
  * number — they are skipped, not counted as zero, and the caller says so.
  */
 function summariseCredits(entries) {
+    // 2026-10-03: counted per TURN (turnRows) — a turn writes one line per call.
     let total = 0;
     let unknown = 0;
-    for (const e of entries) {
-        // Final review I6 — a zero-token reader rollup line is not a turn.
-        if (e.kind === 'reader_rollup')
-            continue;
-        if (typeof e.credits_charged === 'number')
-            total += e.credits_charged;
+    for (const r of turnRows(entries)) {
+        if (typeof r.credits === 'number')
+            total += r.credits;
         else
             unknown++;
     }
@@ -52,8 +50,9 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     const s = summarise(entries);
     // Credits mode: the customer is billed in credits at a multiplier we do not
     // disclose, so NOTHING derived from cost/pricing.ts may be printed here —
-    // not the total, not the per-model split, not the per-turn figures. Tokens
-    // stay: they are a usage fact, not a COGS leak.
+    // not the total, not the per-model split, not the per-turn figures.
+    // 2026-10-02 (owner): tokens go too. Not a COGS leak on their own, but beside
+    // credits they invite "credits per token" maths — credits only for managed.
     const inCredits = creditsActive();
     const perTurn = summariseCredits(entries);
     const turnsNote = `${s.turns} turn${s.turns === 1 ? '' : 's'}`;
@@ -70,12 +69,14 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     else {
         emit(panelHeading(`Session cost so far: ${formatCost(s.totalCost)}`, turnsNote));
     }
-    emit('');
-    emit(chalk.bold('Tokens'));
-    emit(panelRow('input', s.totalTokens.input.toLocaleString().padStart(12)));
-    emit(panelRow('output', s.totalTokens.output.toLocaleString().padStart(12)));
-    emit(panelRow('cache read', s.totalTokens.cacheRead.toLocaleString().padStart(12)));
-    emit(panelRow('cache create', s.totalTokens.cacheCreate.toLocaleString().padStart(12)));
+    if (!inCredits) {
+        emit('');
+        emit(chalk.bold('Tokens'));
+        emit(panelRow('input', s.totalTokens.input.toLocaleString().padStart(12)));
+        emit(panelRow('output', s.totalTokens.output.toLocaleString().padStart(12)));
+        emit(panelRow('cache read', s.totalTokens.cacheRead.toLocaleString().padStart(12)));
+        emit(panelRow('cache create', s.totalTokens.cacheCreate.toLocaleString().padStart(12)));
+    }
     // Task 18 fix M3 — reader subagent spend (already inside the total above).
     // USD only: in credits mode the balance delta already carries it.
     if (s.readerCalls > 0 && !inCredits) {
@@ -99,22 +100,23 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     // Recent turns — last 5, most recent first. Piece 2: one count format, "N of M" (P1's countLabel).
     // Final review I6 — reader rollup lines (interrupted turns) are not turns:
     // they stay out of the list and the count (summarise() already skips them).
-    const turnEntries = entries.filter((e) => e.kind !== 'reader_rollup');
-    const recent = turnEntries.slice(-5).reverse();
+    // 2026-10-03: one row per TURN (a turn writes one line per model call).
+    const rows = turnRows(entries);
+    const recent = rows.slice(-5).reverse();
     emit('');
-    emit(chalk.bold(`Recent turns · ${countLabel(recent.length, turnEntries.length)}`));
+    emit(chalk.bold(`Recent turns · ${countLabel(recent.length, rows.length)}`));
     for (const e of recent) {
-        const tok = (e.tokens.input + e.tokens.output).toLocaleString();
+        const tok = e.tokens.toLocaleString();
         // Credits mode: the per-turn figure is what the LEDGER charged (a balance
         // delta recorded at turn end), never our computed USD. A turn whose
         // balance sample failed shows the pending marker rather than a number we
         // would have to invent.
         const tail = inCredits
-            ? (typeof e.credits_charged === 'number'
-                ? formatCredits(e.credits_charged, credits?.unitLabel ?? 'credits')
+            ? (typeof e.credits === 'number'
+                ? formatCredits(e.credits, credits?.unitLabel ?? 'credits')
                 : CREDITS_PENDING)
             : formatCost(e.cost);
-        emit(panelRow(`turn ${String(e.turn).padStart(3)}`, `${tok.padStart(10)} tok   ${tail}`, 8));
+        emit(panelRow(`turn ${String(e.turn).padStart(3)}`, inCredits ? tail : `${tok.padStart(10)} tok   ${tail}`, 8));
     }
     if (inCredits && perTurn.unknown > 0) {
         emit('');

package/dist/commands/deploy-card.js

@@ -0,0 +1,135 @@
+// cspeach-cli/src/commands/deploy-card.ts
+/**
+ * The deploy card (owner, 2026-10-02) — the CLI-owned stop between ui.build
+ * and ui.deploy. Deploy is a chained step of a UI plan, so the chain does not
+ * just ask "run the next phase?": it shows WHERE the app will go (system,
+ * client, BSP name, package, transport) and that CSPeach's stored SAP logon
+ * will be used, and only then dispatches ui.deploy.
+ *
+ * ONE CLEAR APPROVAL
+ * ------------------
+ *  - This card = consent to run the deploy phase AND to hand the stored logon
+ *    to `fiori deploy` this session. Confirming it records the fiori_deploy
+ *    credential handover (scope fiori_deploy), so the tool does not ask that
+ *    question a second time.
+ *  - The real deploy is a SAP write: inside the phase it still needs ONE
+ *    request_approval for the BSP — the same approval box every SAP write
+ *    gets, which is where write_mode, the qas/prd role ceilings and the
+ *    guarded-run "no auto-approve" rule are enforced. The test-mode deploy
+ *    that runs first needs no approval (it writes nothing).
+ *  - A deploy that can never run (production alias, advisory-only, no SAP
+ *    system) is explained on the card and never asked or queued.
+ *
+ * Pure-ish: config + file reads are injectable; nothing here talks to SAP.
+ */
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { readDeployYaml } from '../tools/fiori/deploy/yaml-read.js';
+import { cardLine } from '../lane/card.js';
+/** The last value of a work field across phases (last written wins, as in planCompletionLines). */
+function lastWork(phases, pick) {
+    for (const p of [...phases].reverse()) {
+        const v = pick(p);
+        if (v !== undefined && v !== null && v !== '')
+            return v;
+    }
+    return undefined;
+}
+export async function gatherDeployCardFacts(a) {
+    const f = {};
+    f.appDir = lastWork(a.phases, (p) => (p.layer === 'ui' ? p.work?.app?.dir : undefined));
+    f.transport = lastWork(a.phases, (p) => p.work?.transport);
+    // The app's deploy config, when ui.build (or an earlier run) already wrote it.
+    if (f.appDir) {
+        try {
+            const abs = path.resolve(a.cwd, f.appDir);
+            const read = readDeployYaml(await fs.readFile(path.join(abs, 'ui5-deploy.yaml'), 'utf8'));
+            if (read.ok) {
+                f.bsp = read.config.name;
+                f.package = read.config.package.toUpperCase();
+                f.transport = read.config.transport || (f.package === '$TMP' ? undefined : f.transport);
+            }
+        }
+        catch { /* no deploy config yet — the phase writes it */ }
+    }
+    if (!a.sapAlias || a.sapAlias === 'none') {
+        f.blocked = 'no SAP system is connected in this session — start CSPeach with the SAP alias to deploy to';
+        return f;
+    }
+    f.alias = a.sapAlias;
+    let cfg;
+    try {
+        cfg = await (a.loadConfig ?? (async () => (await import('../config/loader.js')).loadConfig()))();
+    }
+    catch {
+        f.blocked = 'the CSPeach config could not be read';
+        return f;
+    }
+    const sys = cfg.sap?.[a.sapAlias];
+    if (!sys) {
+        f.blocked = `SAP alias ${a.sapAlias} is not configured`;
+        return f;
+    }
+    const host = sys.host.trim().replace(/^[a-z][a-z0-9+.-]*:\/\//i, '').replace(/[/?#].*$/, '').replace(/:\d+$/, '').toLowerCase();
+    f.systemUrl = `${sys.useSsl === false ? 'http' : 'https'}://${host}:${sys.port}`;
+    f.client = String(sys.client);
+    if (sys.role === 'prd') {
+        f.blocked = `${a.sapAlias} is tagged as a production system — CSPeach deploys in development; move the app with the transport`;
+        return f;
+    }
+    const effective = (a.effectiveWriteMode ?? (await import('../repl/mode-cycle.js')).getEffectiveWriteMode)(cfg.write_mode ?? 'approval-gated', sys.role);
+    if (effective === 'advisory-only') {
+        f.blocked = `write mode is advisory-only for ${a.sapAlias} — the deploy is a SAP write`;
+    }
+    return f;
+}
+export function renderDeployCard(f, nextPhaseId) {
+    const v = (s, fallback) => (s ? cardLine(s) : fallback);
+    const lines = [
+        '',
+        `Deploy the app to SAP (next phase: ${cardLine(nextPhaseId)})`,
+        `  System     ${v(f.alias, '(none)')}${f.systemUrl ? ` — ${cardLine(f.systemUrl)}` : ''}${f.client ? ` · client ${cardLine(f.client)}` : ''}`,
+        `  App        ${v(f.appDir, '(recorded by ui.build)')}`,
+        `  BSP name   ${v(f.bsp, 'set in this phase (max 15 characters, Z/Y, uppercase)')}`,
+        `  Package    ${v(f.package, 'set in this phase (the backend package)')}`,
+        `  Transport  ${f.package === '$TMP' ? '(none — $TMP, local only)' : v(f.transport, 'the session transport')}`,
+        `  Logon      CSPeach's stored SAP logon${f.alias ? ` for ${cardLine(f.alias)}` : ''} — no password is typed, nothing is written to a file`,
+    ];
+    if (f.blocked) {
+        lines.push(`  Blocked    ${cardLine(f.blocked)}`);
+    }
+    else {
+        lines.push('  The phase runs a test deploy first (nothing is written), then the real deploy asks for one write approval for the BSP, confirmed on screen — never an auto-approval.');
+    }
+    return lines;
+}
+/**
+ * Show the card and ask — the ONE implementation used by the post-phase chain
+ * (plan-chain.ts) and by a direct `/abap-plan --resume` into the deploy phase
+ * (plan-resume.ts). A "yes" records the fiori_deploy logon handover for the
+ * alias, which is also how a later resume knows the card was already shown.
+ */
+export async function askDeployCard(a) {
+    const facts = await gatherDeployCardFacts({
+        phases: a.phases,
+        cwd: a.cwd,
+        ...(a.sapAlias ? { sapAlias: a.sapAlias } : {}),
+        ...(a.deps?.loadConfig ? { loadConfig: a.deps.loadConfig } : {}),
+        ...(a.deps?.effectiveWriteMode ? { effectiveWriteMode: a.deps.effectiveWriteMode } : {}),
+    });
+    a.log(...renderDeployCard(facts, a.nextPhaseId));
+    if (facts.blocked)
+        return { outcome: 'blocked', reason: facts.blocked };
+    const { askYesNo, isYes } = await import('../projects/yes-no.js');
+    const answer = await askYesNo({
+        question: `Deploy now — run ${a.nextPhaseId} with the stored SAP logon for ${facts.alias}?`,
+        confirm: a.confirm,
+        prompt: a.prompt,
+    });
+    if (!isYes(answer))
+        return { outcome: 'no' };
+    const { markCredentialHandoverApproved } = await import('../repl/credential-handover-gate.js');
+    const { FIORI_DEPLOY_HANDOVER_SCOPE } = await import('../tools/fiori/deploy/scope.js');
+    markCredentialHandoverApproved(a.sessionId, facts.alias, FIORI_DEPLOY_HANDOVER_SCOPE);
+    return { outcome: 'yes' };
+}

package/dist/commands/login.js

@@ -7,8 +7,10 @@
  *   3) Print user_code prominently so customer can read it
  *   4) Poll /v1/auth/device/poll every interval until verified or maxAttempts
  *   5) Save api_key + customer_id to ~/.cspeach/auth.json
- *   6) Call GET /v1/me — if trial_mode === 'byok', prompt for the user's own API key
- *   7) Re-save auth file with byokAnthropicKey if provided
+ *   6) Call GET /v1/me — if trial_mode === 'byok', pull the org's Anthropic key,
+ *      or prompt for the user's own
+ *   7) Store that key in the OS keychain (cspeach.anthropic/api-key) — never
+ *      in auth.json (2026-10-02)
  *
  * Dependencies (open, print, prompt) are injected so the command is
  * unit-testable without stubbing platform globals.
@@ -94,7 +96,6 @@ export async function runLoginCommand(deps) {
     await writeAuthFile({
         apiKey: polled.api_key,
         customerId: polled.customer_id,
-        byokAnthropicKey: null,
     });
     deps.print(done('Saved your CSPeach key to ~/.cspeach/auth.json'));
     // 6) /v1/me — figure out if BYOK is required.
@@ -111,8 +112,8 @@ export async function runLoginCommand(deps) {
                 const setKey = deps.setKeychainKey ??
                     ((svc, acct, k) => keychain.setPassword(svc, acct, k));
                 if (orgKey !== null) {
-                    await setKey(ANTHROPIC_KEYCHAIN_SERVICE, ANTHROPIC_KEYCHAIN_ACCOUNT, orgKey);
-                    deps.print(done("Using your organization's API key"));
+                    if (await storeKey(setKey, orgKey, deps.print))
+                        deps.print(done("Using your organization's API key"));
                 }
                 else {
                     // Fall back to the manual paste prompt — behaviour unchanged.
@@ -121,14 +122,11 @@ export async function runLoginCommand(deps) {
                     // The key-entry row — the one place the vendor and its key page are named.
                     const ak = (await deps.prompt('Paste your Anthropic API key (sk-ant-..., from https://console.anthropic.com/settings/keys): ')).trim();
                     if (ak.startsWith('sk-ant-') && ak.length > 20) {
-                        // The non-BYOK save above just persisted these exact values,
-                        // so reading them back from disk would be redundant.
-                        await writeAuthFile({
-                            apiKey: polled.api_key,
-                            customerId: polled.customer_id,
-                            byokAnthropicKey: ak,
-                        });
-                        deps.print(done('API key saved'));
+                        // 2026-10-02: the OS keychain, the same entry as the org key above
+                        // and the one BYOK reads (byok-provider.ts). This used to go to
+                        // auth.json in PLAINTEXT, where nothing read it.
+                        if (await storeKey(setKey, ak, deps.print))
+                            deps.print(done('API key saved to your OS keychain'));
                     }
                     else {
                         deps.print(formatFailure({ what: 'That does not look like your own API key', detail: ['it must start with sk-ant-', 'skipped'], next: 'run cspeach login again later' }).trimEnd());
@@ -143,6 +141,26 @@ export async function runLoginCommand(deps) {
     deps.print(`  ${paint('dim', 'Next:')} run cspeach to start`);
     return 0;
 }
+/**
+ * 2026-10-02 (review nit): store the BYOK key in the OS keychain. A keychain
+ * failure (e.g. Linux without a Secret Service) gets its own plain notice —
+ * it used to surface as "Could not read your account details". The key is
+ * never written anywhere else.
+ */
+async function storeKey(setKey, key, print) {
+    try {
+        await setKey(ANTHROPIC_KEYCHAIN_SERVICE, ANTHROPIC_KEYCHAIN_ACCOUNT, key);
+        return true;
+    }
+    catch (err) {
+        print(formatFailure({
+            what: "Couldn't save your API key to the OS keychain",
+            detail: [err instanceof Error ? err.message : String(err), 'sign-in itself worked; the key was not stored anywhere'],
+            next: 'make the OS keychain available (on Linux: a Secret Service such as gnome-keyring), then run cspeach login again',
+        }).trimEnd());
+        return false;
+    }
+}
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }

package/dist/commands/plan-chain.js

@@ -24,6 +24,8 @@ import chalk from 'chalk';
 import { readProjectFile } from '../projects/status.js';
 import { parsePlanContent } from '../projects/plan-schema.js';
 import { statusesFromItems, computeNextPhase, isPhaseSatisfied, isAuditResolved, planCompletionLines, renderPlanTracker, } from '../projects/plan-run.js';
+import { isDeployPhase } from '../projects/plan-lane.js';
+import { askDeployCard } from './deploy-card.js';
 import { decideNextPhaseGate, getAndResetPlanPhaseSubagentDispatches, getAndResetPlanDeviation, } from './plan-gate.js';
 import { runPhaseAudit } from './plan-audit.js';
 import { applyAuditResult, applyPhaseResolution, buildResumeCommand, offerNextPhaseAutoRun, } from './plan-resume.js';
@@ -379,6 +381,35 @@ export async function runPostPhaseChain(args) {
         args.log(substitutePlanToken(decision.banner ?? '', path));
         ringBell();
     }
+    // 2026-10-02 — deploy is a chained step of a UI plan. Before ui.deploy the
+    // chain stops on the CLI-owned deploy card (deploy-card.ts), in step AND
+    // guarded mode, instead of the plain "run the next phase?" question.
+    if (isDeployPhase(next)) {
+        const card = await askDeployCard({
+            phases: loaded.content.phases,
+            cwd: args.cwd,
+            ...(args.sapAlias ? { sapAlias: args.sapAlias } : {}),
+            sessionId: args.sessionId,
+            nextPhaseId: next.id,
+            prompt: args.prompt,
+            ...(args.confirm ? { confirm: args.confirm } : {}),
+            log: args.log,
+            deps: {
+                ...(args.deps?.loadDeployCardConfig ? { loadConfig: args.deps.loadDeployCardConfig } : {}),
+                ...(args.deps?.effectiveWriteMode ? { effectiveWriteMode: args.deps.effectiveWriteMode } : {}),
+            },
+        });
+        if (card.outcome === 'blocked') {
+            args.log(`${next.id} cannot run here: ${card.reason}. Resume later with: ${resumeCmd(path)}`);
+            return path;
+        }
+        if (card.outcome === 'no') {
+            args.log(`Not deployed — resume later with: ${resumeCmd(path)}`);
+            return path;
+        }
+        args.queueDispatch(resumeCmd(path));
+        return path;
+    }
     await offerNextPhaseAutoRun({
         outcome: {
             savedPath: path,

package/dist/commands/plan-continue.js

@@ -176,6 +176,7 @@ export async function runContinuationChain(args) {
         executedPhaseId: args.marker.phaseId,
         sessionId: args.sessionId,
         cwd: args.cwd,
+        ...(args.sapAlias ? { sapAlias: args.sapAlias } : {}),
         mode: args.prepared.effectiveMode ?? 'step',
         modeFlag: args.prepared.mode,
         auditMode: args.prepared.auditMode,

package/dist/commands/plan-resume.js

@@ -54,7 +54,10 @@ import { FLOORPLAN_TO_TEMPLATE } from '../tools/fiori/floorplan-map.js';
 import { getCurrentTransport, setCurrentTransport } from '../repl/current-transport.js';
 import { askYesNo, isYes } from '../projects/yes-no.js';
 import { formatAttention, formatInfo } from '../renderer/notice-shape.js';
-import { checkLaneConsistency, loadPlanLaneForRun, renderLaneBlock } from '../projects/plan-lane.js';
+import { checkLaneConsistency, checkRequiredDeploy, isDeployPhase, loadPlanLaneForRun, renderLaneBlock } from '../projects/plan-lane.js';
+import { askDeployCard } from './deploy-card.js';
+import { isCredentialHandoverApproved } from '../repl/credential-handover-gate.js';
+import { FIORI_DEPLOY_HANDOVER_SCOPE } from '../tools/fiori/deploy/scope.js';
 /**
  * Parse and STRIP the per-run chaining-mode (`--guarded` / `--step`) and
  * audit off-switch (`--audit` / `--no-audit`) flags from a plan-resume body.
@@ -137,6 +140,18 @@ export function buildUiPhaseContext(phases, next) {
         lines.push(`- App directory (recorded by ui.build): ${appDir}`);
     if (service)
         lines.push(`- Service URL: ${service.url ?? ''}${service.path ?? ''} (OData ${service.version ?? '?'})`);
+    // 2026-10-02 — deploy is a chained, required step: inside a deploy phase it
+    // is EXPECTED (the developer already confirmed the CLI deploy card).
+    if (isDeployPhase(next)) {
+        const transport = [...phases].reverse().map((p) => p.work?.transport).find(Boolean);
+        lines.push(transport
+            ? `- Session transport: ${transport}`
+            : '- Session transport: NOT RECORDED in any phase work.transport — use the session transport (sap_transport list) or ask once.');
+        lines.push('- Deploy is expected in this phase (the developer confirmed the deploy card): if the app has no ui5-deploy.yaml, ' +
+            'write it with fiori_deploy_config (BSP name max 15 chars uppercase Z/Y, package = the backend package, transport = ' +
+            'the session transport); then fiori_deploy mode "test"; then request_approval {op:"create", object:"<BSP NAME>", ' +
+            'type:"WAPA"} and fiori_deploy mode "deploy" with that approval_id. Record the URL it returns in work.deployedUrl.');
+    }
     return lines;
 }
 /** Compact-example work keys for ui phases — the write-back contract
@@ -450,6 +465,32 @@ export async function preparePlanResume(args) {
             releaseRunLease(path);
         return null;
     }
+    // 2026-10-02 — a direct `/abap-plan --resume` into the deploy phase shows the
+    // same deploy card the post-phase chain shows. A "yes" there (or here)
+    // records the fiori_deploy logon handover for the alias, so a resume the
+    // chain itself queued after its card is not asked twice.
+    if (isDeployPhase(next) && args.sapAlias && args.prompt
+        && !isCredentialHandoverApproved(args.sessionId, args.sapAlias, FIORI_DEPLOY_HANDOVER_SCOPE)) {
+        const card = await askDeployCard({
+            phases: content.phases,
+            cwd: args.cwd,
+            sapAlias: args.sapAlias,
+            ...(args.sessionId ? { sessionId: args.sessionId } : {}),
+            nextPhaseId: next.id,
+            prompt: args.prompt,
+            ...(args.confirm ? { confirm: args.confirm } : {}),
+            log: args.log,
+            ...(args.deployCardDeps ? { deps: args.deployCardDeps } : {}),
+        });
+        if (card.outcome !== 'yes') {
+            args.log(card.outcome === 'blocked'
+                ? `${next.id} cannot run here: ${card.reason}. Resume later with: ${buildResumeCommand(path)}`
+                : `Not deployed — resume later with: ${buildResumeCommand(path)}`);
+            if (args.sessionId)
+                releaseRunLease(path);
+            return null;
+        }
+    }
     // Inline the phase's declared rule files (coarse v1: whole files).
     // Paths resolve against cwd — dogfood runs sit inside a repo carrying
     // .claude/rules/. A missing file is noted, not fatal: the skill falls
@@ -757,7 +798,13 @@ export async function finishPlanResume(args) {
     // App lane routing (Task 6, Review Focus 4) — the write-back may restructure
     // the plan (full shape) or overlay a phase; it must still fit the lane.
     if (args.prepared.laneRecord) {
-        const conflict = checkLaneConsistency(extract.content, args.prepared.laneRecord);
+        // 2026-10-02 — a write-back may not drop the required deploy phase. Only a
+        // plan that already met the rule is held to it, so a lane plan saved before
+        // the rule existed keeps running unchanged (no-regression).
+        const priorParsed = parsePlanContent(args.prepared.envelope.content);
+        const priorMetDeploy = priorParsed.ok && checkRequiredDeploy(priorParsed.content, args.prepared.laneRecord) === null;
+        const conflict = checkLaneConsistency(extract.content, args.prepared.laneRecord)
+            ?? (priorMetDeploy ? checkRequiredDeploy(extract.content, args.prepared.laneRecord) : null);
         if (conflict) {
             args.log('');
             args.log(`[plan] PHASE RESULT NOT PERSISTED — ${conflict}`);

package/dist/commands/whoami.js

@@ -28,7 +28,7 @@ export async function runWhoamiCommand(deps) {
         deps.print(formatFailure({
             what: 'Could not read your account',
             detail: [unreachable ? `could not reach the server (${me.error})` : `the server answered ${me.status} (${me.error})`],
-            next: unreachable ? 'check your network or VPN, then run cspeach whoami again' : 'cspeach login',
+            next: unreachable ? 'check this machine can reach cspeach.dev (company network or proxy settings), then run cspeach whoami again' : 'cspeach login',
         }).trimEnd());
         return 1;
     }

package/dist/cost/cost-log.js

@@ -68,6 +68,8 @@ export function buildEntry(opts) {
         entry.call_index = opts.call_index;
     if (opts.kind !== undefined)
         entry.kind = opts.kind;
+    if (opts.scope !== undefined)
+        entry.scope = opts.scope;
     if (opts.refusal_category !== undefined)
         entry.refusal_category = opts.refusal_category;
     if (opts.input_transformations !== undefined)
@@ -123,12 +125,76 @@ export async function readCostLog(sessionId) {
         return [];
     }
 }
+/**
+ * 2026-10-03 — one model call's own token counts: the session counters now
+ * minus the counters when the previous cost line was written (or turn start).
+ * Never negative (a counter reset — e.g. a compaction rewrite — reads as 0).
+ */
+export function perCallTokens(now, last) {
+    const d = (a, b) => Math.max(0, a - b);
+    return {
+        input: d(now.input, last.input),
+        output: d(now.output, last.output),
+        cacheRead: d(now.cacheRead, last.cacheRead),
+        cacheCreate: d(now.cacheCreate, last.cacheCreate),
+    };
+}
+/**
+ * 2026-10-03 — the lines that add up. Task-3-era lines (call_index, no
+ * scope: 1.1.19–1.1.25) each carry the running total since turn start, so a
+ * turn contributes only its LAST such line. Per-call lines (scope 'call'),
+ * pre-Task-3 lines and turn-0 labelled lines (audit) are each counted as-is.
+ * File order is preserved.
+ */
+export function countableEntries(entries) {
+    const lastLegacy = new Map(); // turn -> index of its last running-total line
+    entries.forEach((e, i) => {
+        if (isLegacyRunningTotal(e))
+            lastLegacy.set(e.turn, i);
+    });
+    return entries.filter((e, i) => !isLegacyRunningTotal(e) || lastLegacy.get(e.turn) === i);
+}
+function isLegacyRunningTotal(e) {
+    return e.call_index !== undefined && e.scope !== 'call' && e.turn > 0 && e.kind !== 'reader_rollup';
+}
+/**
+ * Per-turn rows in file order. Tokens/cost come from the countable lines
+ * (legacy running totals → the turn's last line); credits are per-call balance
+ * deltas in BOTH line generations, so every line's charge is summed.
+ * Reader rollup lines are not turns; turn-0 labelled lines are rows of their own.
+ */
+export function turnRows(entries) {
+    const countable = new Set(countableEntries(entries));
+    const rows = [];
+    const byKey = new Map();
+    entries.forEach((e, i) => {
+        if (e.kind === 'reader_rollup')
+            return;
+        const key = e.turn > 0 ? `t${e.turn}` : `z${i}`;
+        let row = byKey.get(key);
+        if (!row) {
+            row = { turn: e.turn, tokens: 0, cost: 0, credits: null };
+            byKey.set(key, row);
+            rows.push(row);
+        }
+        if (countable.has(e)) {
+            row.tokens += e.tokens.input + e.tokens.output;
+            row.cost += e.cost;
+        }
+        if (typeof e.credits_charged === 'number')
+            row.credits = (row.credits ?? 0) + e.credits_charged;
+    });
+    return rows;
+}
 export function summarise(entries) {
     const totals = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
     let total = 0;
     const perModel = new Map();
     const readerByTurn = new Map();
-    let lines = 0;
+    // Turns: distinct turn numbers (> 0) plus each turn-0 labelled line.
+    const turnKeys = new Set();
+    const modelTurnKeys = new Map();
+    const countable = new Set(countableEntries(entries));
     for (const e of entries) {
         if (typeof e.reader_calls === 'number' && e.reader_calls > 0) {
             const prev = readerByTurn.get(e.turn);
@@ -142,7 +208,10 @@ export function summarise(entries) {
         // Fix M3 — a zero-token reader rollup line (interrupted turn) is not a model call.
         if (e.kind === 'reader_rollup')
             continue;
-        lines += 1;
+        if (!countable.has(e))
+            continue;
+        const turnKey = e.turn > 0 ? `t${e.turn}` : `z${turnKeys.size}`;
+        turnKeys.add(turnKey);
         total += e.cost;
         totals.input += e.tokens.input;
         totals.output += e.tokens.output;
@@ -153,7 +222,10 @@ export function summarise(entries) {
             cost: 0,
             tokens: { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 },
         };
-        slot.turns += 1;
+        const mk = modelTurnKeys.get(e.model) ?? new Set();
+        mk.add(turnKey);
+        modelTurnKeys.set(e.model, mk);
+        slot.turns = mk.size;
         slot.cost += e.cost;
         slot.tokens.input += e.tokens.input;
         slot.tokens.output += e.tokens.output;
@@ -170,7 +242,7 @@ export function summarise(entries) {
     return {
         totalCost: Math.round((total + readerCost) * 10000) / 10000,
         totalTokens: totals,
-        turns: lines,
+        turns: turnKeys.size,
         byModel: [...perModel.entries()].map(([model, v]) => ({ model, ...v })),
         readerCost: Math.round(readerCost * 10000) / 10000,
         readerCalls,

package/dist/cost/credits-wire.js

@@ -64,6 +64,15 @@ export async function initCredits(cfg, getBearer) {
         setCostDisplayMode('usd');
     }
 }
+/**
+ * A user request is starting (2026-10-02): the receipt then shows every
+ * model round of it, not only the last. No-op outside credits mode.
+ */
+export function beginCreditsRequest() {
+    if (!creditsActive())
+        return;
+    globalCredits.beginRequest();
+}
 /**
  * Post-turn: sample the balance again and fold the delta into the session
  * total. Returns null (and makes no request) outside credits mode.