@cspeach/cli 1.1.26 → 1.1.27

package/dist/agent/loop.js

@@ -39,7 +39,7 @@ import { consumeTodoSetThisTurn } from '../ui/todo-emitter.js';
 import { runSaveCommand, runPromoteCommand, detectArtifactSkill, offerAnswerBlockers } from '../projects/index.js';
 import { planLaneBlockForTurn } from '../projects/plan-lane.js';
 import { clearAppFlow, getAppFlow, setGapConfirmed, startAppFlow } from '../lane/app-flow.js';
-import { afterPlanSave, afterSpecGapSave, cleanSpecToken, extractSpecToken, FLOW_ENDED_LINE, gateAppFlowForTurn, resolveAppSpec, sameRealFile, STEP_1, STEP_3, } from '../lane/app-chain.js';
+import { afterPlanSave, afterSpecGapNotSaved, afterSpecGapSave, cleanSpecToken, extractSpecToken, FLOW_ENDED_LINE, gateAppFlowForTurn, resolveAppSpec, sameRealFile, STEP_1, STEP_3, } from '../lane/app-chain.js';
 import { shownToken } from '../lane/card.js';
 import { parseFromFlag, coerceDocFromFlagToAttachment } from '../skills/promotion-dispatch.js';
 import { input } from '@inquirer/prompts';
@@ -300,6 +300,7 @@ export async function maybeOfferSave(p) {
             return 'y';
         }
         : inkAwarePrompt;
+    let notSaved;
     try {
         const savedPath = await runSaveCommand({
             skillOutput: p.assistantText,
@@ -320,6 +321,7 @@ export async function maybeOfferSave(p) {
             // the skill it saves (the /abap-plan turn that got the lane block); a plan
             // found in another skill's output (detectArtifactSkill) never gets it.
             ...(p.lane && p.skill === saveSkill ? { lane: p.lane } : {}),
+            onNotSaved: (reason) => { notSaved = reason; },
         });
         // After a spec-gap file is saved, let a developer answer the open BLOCKER
         // questions inline (recorded as `answered` items in the SAME file) — the
@@ -348,6 +350,11 @@ export async function maybeOfferSave(p) {
             else if (saveSkill === 'abap-plan')
                 await afterPlanSave(hooks, savedPath);
         }
+        // 2026-10-04 — a spec-gap that produced no file inside the chain says so
+        // (one line) instead of the chain stopping in silence.
+        if (!savedPath && notSaved && p.appChain && p.skill === saveSkill && saveSkill === 'abap-spec-gap') {
+            afterSpecGapNotSaved({ ...p.appChain, headless: isHeadless(), emit: p.emit }, notSaved, p.assistantText);
+        }
     }
     catch (err) {
         p.emit('\n' + formatAttention({ text: 'Not saved as a project file', fact: String(err?.message ?? err) }).trimEnd());

package/dist/commands/whoami.js

@@ -28,7 +28,7 @@ export async function runWhoamiCommand(deps) {
         deps.print(formatFailure({
             what: 'Could not read your account',
             detail: [unreachable ? `could not reach the server (${me.error})` : `the server answered ${me.status} (${me.error})`],
-            next: unreachable ? 'check your network or VPN, then run cspeach whoami again' : 'cspeach login',
+            next: unreachable ? 'check this machine can reach cspeach.dev (company network or proxy settings), then run cspeach whoami again' : 'cspeach login',
         }).trimEnd());
         return 1;
     }

package/dist/doctor/checks/skill.js

@@ -1,24 +1,73 @@
 import crypto from 'node:crypto';
 import { loadConfig } from '../../config/loader.js';
 import { getStore } from '../../auth/api-key.js';
-export async function checkSkill() {
-    const cfg = await loadConfig();
-    const store = await getStore();
-    const key = await store.get();
+import { ManifestClient, DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
+const PROBE_SKILL = 'abap-radar';
+/**
+ * Fetch one skill the way a managed session does and prove its integrity.
+ *
+ * 2026-10-04 — the first version of this check (561807b9) expected a plain
+ * text body plus an `x-skill-sha256` header. The proxy serves JSON
+ * `{ name, body, sha256, … }` and sends no such header, so the check hashed
+ * the whole JSON text, compared it with '' and always reported a mismatch.
+ * Now: hash the delivered `body` bytes (exactly as served — CRLF included,
+ * the same bytes the seed signed) and compare with the server's `sha256` and
+ * with the signed manifest entry, the real trust anchor.
+ */
+export async function checkSkill(deps = {}) {
+    const doFetch = deps.fetch ?? ((u, i) => fetch(u, i));
+    const proxyUrl = deps.proxyUrl ?? (await loadConfig()).proxy_url;
+    const key = deps.getKey ? await deps.getKey() : await (await getStore()).get();
     if (!key)
         return { name: 'skill', ok: false, message: 'skipped (no API key)' };
+    let body;
+    let claimed;
     try {
-        const r = await fetch(`${cfg.proxy_url}/v1/skills/abap-radar`, { headers: { Authorization: `Bearer ${key}` } });
+        const r = await doFetch(`${proxyUrl}/v1/skills/${PROBE_SKILL}`, { headers: { Authorization: `Bearer ${key}` } });
         if (!r.ok)
             return { name: 'skill', ok: false, message: `HTTP ${r.status}` };
-        const body = await r.text();
-        const sha256 = r.headers.get('x-skill-sha256') ?? '';
-        const computed = crypto.createHash('sha256').update(body, 'utf-8').digest('hex');
-        if (sha256 !== computed)
-            return { name: 'skill', ok: false, message: `SHA256 mismatch (header=${sha256}, body=${computed})`, hint: 'Possible tampering or proxy bug — contact support' };
-        return { name: 'skill', ok: true, message: `abap-radar fetched (${body.length} bytes, SHA ${sha256.slice(0, 8)}...)` };
+        const j = await r.json();
+        if (typeof j.body !== 'string')
+            return { name: 'skill', ok: false, message: `${PROBE_SKILL}: response has no skill body` };
+        body = j.body;
+        claimed = typeof j.sha256 === 'string' ? j.sha256 : '';
     }
     catch (err) {
         return { name: 'skill', ok: false, message: err.message };
     }
+    const computed = crypto.createHash('sha256').update(body, 'utf-8').digest('hex');
+    if (claimed !== computed) {
+        return {
+            name: 'skill', ok: false,
+            message: `${PROBE_SKILL}: SHA256 mismatch (served sha256=${claimed || 'none'}, body=${computed})`,
+            hint: 'Possible tampering or proxy bug — contact support',
+        };
+    }
+    const getManifest = deps.manifest ?? (() => new ManifestClient(DEFAULT_MANIFEST_URL).fetchAndVerifyManifest());
+    let manifestNote;
+    try {
+        const m = await getManifest();
+        const entry = m.skills.find((s) => s.name === PROBE_SKILL);
+        if (!entry) {
+            manifestNote = `not in the signed manifest`;
+        }
+        else if (entry.sha256 !== computed) {
+            return {
+                name: 'skill', ok: false,
+                message: `${PROBE_SKILL} differs from the signed manifest (manifest=${entry.sha256.slice(0, 12)}…, body=${computed.slice(0, 12)}…)`,
+                hint: 'The skills were updated without republishing the signed manifest — contact support',
+            };
+        }
+        else {
+            manifestNote = 'matches the signed manifest';
+        }
+    }
+    catch (err) {
+        const msg = err.message;
+        if (/signature invalid/i.test(msg)) {
+            return { name: 'skill', ok: false, message: msg.slice(0, 200), hint: 'Upgrade cspeach, or contact support if you are on the latest version' };
+        }
+        manifestNote = `signed manifest not checked: ${msg.slice(0, 120)}`;
+    }
+    return { name: 'skill', ok: true, message: `${PROBE_SKILL} fetched (${body.length} chars, SHA ${computed.slice(0, 8)}…, ${manifestNote})` };
 }

package/dist/doctor/run.js

@@ -4,7 +4,6 @@ import { checkProxy } from './checks/proxy.js';
 import { checkAuth } from './checks/auth.js';
 import { checkKeychain } from './checks/keychain.js';
 import { checkSap } from './checks/sap.js';
-import { checkZcspeach } from './checks/zcspeach.js';
 import { checkCert } from './checks/cert.js';
 import { checkSkill } from './checks/skill.js';
 import { checkKeychainFallback } from './checks/keychain-fallback.js';
@@ -111,7 +110,6 @@ export async function collectChecks() {
     checks.push(await checkSystemRoles(cfg));
     checks.push(await checkKeychain());
     checks.push(await checkSap());
-    checks.push(await checkZcspeach());
     checks.push(await checkCert());
     checks.push(await checkSkill());
     checks.push(await checkKeychainFallback());

package/dist/lane/app-chain.js

@@ -15,6 +15,7 @@
 import { promises as fs, statSync } from 'node:fs';
 import path from 'node:path';
 import { readProjectFile } from '../projects/status.js';
+import { looksLikeSpecGap } from '../projects/extract-spec-gap.js';
 import { parsePlanContent } from '../projects/plan-schema.js';
 import { buildResumeCommand } from '../commands/plan-resume.js';
 import { canonicalLanePath } from './paths.js';
@@ -248,6 +249,33 @@ export async function afterSpecGapSave(h, savedPath) {
     h.queueNext(cmd);
     h.emit(STEP_2);
 }
+/** The result was written but could not be read as a spec-gap: the flow waits at step 1. */
+export const SPEC_GAP_NOT_SAVED_LINE = (specToken) => `The /abap-app run is paused at step 1: the spec-gap result could not be saved. Ask CSPeach to "re-issue the spec gap in the standard structure", or run /abap-app ${shownToken(specToken, 'spec file')} again.`;
+/** The user said No to the save: the run ends here. */
+export const SPEC_GAP_DECLINED_LINE = (specToken) => `The /abap-app run stopped at step 1 because the spec-gap result was not saved. To start again, run /abap-app ${shownToken(specToken, 'spec file')}.`;
+/**
+ * 2026-10-04 — a spec-gap turn inside an app flow at its spec-gap step that
+ * produced no file must never end the chain in silence (live 1.1.26: the
+ * result was written, the save failed on its heading, nothing more was said).
+ * - unreadable + the text IS a spec-gap result → one line; the flow stays at
+ *   step 1, so a re-issued result saves and moves the chain on.
+ * - unreadable + no result (a question back to the user) → nothing: the
+ *   conversation is still in step 1.
+ * - declined → one line; the flow ends.
+ */
+export function afterSpecGapNotSaved(h, reason, assistantText) {
+    const flow = getAppFlow(h.session);
+    if (!flow || flow.expect !== 'spec-gap' || flow.specGapPath !== undefined)
+        return;
+    if (reason === 'declined') {
+        clearAppFlow(h.session);
+        h.emit(SPEC_GAP_DECLINED_LINE(flow.specToken));
+        return;
+    }
+    if (!looksLikeSpecGap(assistantText))
+        return;
+    h.emit(SPEC_GAP_NOT_SAVED_LINE(flow.specToken));
+}
 /**
  * After a plan save: when the saved plan carries `from.lane`, offer to start
  * the guarded run. Inside an active app flow the flow's lane must be the

package/dist/projects/extract-design.js

@@ -1,8 +1,9 @@
+import { matchTitleHeading } from './title-heading.js';
 // 2026-09-17 — tolerant on heading level and dash: the skill prescribes
 // "## ABAP Design — …" but a live standalone run wrote "# ABAP Design — …"
 // and the whole design was silently lost (no file, so /abap-rap --from had
 // nothing to start from). H1..H3 and em/en/plain dash all count.
-const TITLE_RE = /^#{1,3} ABAP Design [—–-] (.+)$/m;
+const TITLE_SPEC = { phrase: String.raw `abap[ \t]+design`, skillPrefix: 'abap-design' }; // 2026-10-04 — tolerant title, see title-heading.ts
 const OBJECTS_HEADING_RE = /^### Objects to Create\s*$/m;
 const DEPENDENCY_HEADING_RE = /^### Dependency Sequence\s*$/m;
 const NEXT_HEADING_RE = /^###\s/m;
@@ -93,11 +94,11 @@ function parseDependencySequence(section, nameToId) {
     return out;
 }
 export function extractDesign(markdown) {
-    const titleMatch = TITLE_RE.exec(markdown);
+    const titleMatch = matchTitleHeading(markdown, TITLE_SPEC);
     if (!titleMatch) {
         throw new Error('Input is not a design output (no "## ABAP Design — ..." heading found)');
     }
-    const title = titleMatch[1].trim();
+    const title = titleMatch.title || 'ABAP Design';
     const objectsSection = sliceSection(markdown, OBJECTS_HEADING_RE);
     if (!objectsSection) {
         throw new Error('No "### Objects to Create" section found');

package/dist/projects/extract-estimate.js

@@ -1,6 +1,7 @@
+import { matchTitleHeading } from './title-heading.js';
 // 2026-09-17 — tolerant on heading level (H1..H3) and dash, same reason as
 // extract-design.ts.
-const TITLE_RE = /^#{1,3} Effort Estimate [—–-] (.+)$/m;
+const TITLE_SPEC = { phrase: String.raw `effort[ \t]+estimate`, skillPrefix: 'abap-estimate' }; // 2026-10-04 — tolerant title, see title-heading.ts
 const COMPONENTS_HEADING_RE = /^### Component Breakdown\s*$/m;
 const NEXT_HEADING_RE = /^###\s/m;
 function sliceSection(markdown, headingRe) {
@@ -60,11 +61,11 @@ function parseComponentsTable(section) {
     return rows;
 }
 export function extractEstimate(markdown) {
-    const titleMatch = TITLE_RE.exec(markdown);
+    const titleMatch = matchTitleHeading(markdown, TITLE_SPEC);
     if (!titleMatch) {
         throw new Error('Input is not an estimate output (no "## Effort Estimate — ..." heading found)');
     }
-    const title = titleMatch[1].trim();
+    const title = titleMatch.title || 'Effort Estimate';
     const section = sliceSection(markdown, COMPONENTS_HEADING_RE);
     if (!section) {
         throw new Error('No "### Component Breakdown" section found');

package/dist/projects/extract-spec-gap.js

@@ -1,6 +1,9 @@
-// 2026-09-17 — tolerant on heading level (H1..H3) and dash, same reason as
-// extract-design.ts: a title written one level off must not lose the file.
-const TITLE_RE = /^#{1,3} Spec Gap Analysis [—–-] (.+)$/m;
+import { matchTitleHeading } from './title-heading.js';
+// 2026-09-17 — tolerant on heading level and dash. 2026-10-04 — and on the
+// separator (colon / none), casing, bold and an "abap-spec-gap —" prefix: a
+// live /abap-app run wrote "Spec Gap Analysis: …" and the chain stopped at
+// step 1 because nothing was saved. See title-heading.ts.
+const TITLE_SPEC = { phrase: String.raw `spec(?:ification)?[ \t-]*gap[ \t]+analysis`, skillPrefix: 'abap-spec-gap' };
 const DOMAIN_RE = /^\*\*Inferred Domain:\*\*\s*(.+?)(?:\s*\[INFERRED.*?\])?$/m;
 const INPUT_TYPE_RE = /^\*\*Input Type:\*\*\s*(.+)$/m;
 const SOURCE_DOC_RE = /^\*\*Source Document:\*\*\s*(.+)$/m;
@@ -54,14 +57,16 @@ const SKIP_SECTIONS = [
     'Recommended Next Steps', // is a paragraph
 ];
 export function extractSpecGap(markdown) {
-    const titleMatch = TITLE_RE.exec(markdown);
+    const titleMatch = matchTitleHeading(markdown, TITLE_SPEC);
     if (!titleMatch) {
         throw new Error('Input is not a spec-gap output (no "## Spec Gap Analysis — ..." heading found)');
     }
-    const title = titleMatch[1].trim();
     const inputType = (INPUT_TYPE_RE.exec(markdown)?.[1] ?? 'Unknown').trim();
     const inferredDomain = (DOMAIN_RE.exec(markdown)?.[1] ?? 'Unknown').trim();
     const sourceDocument = SOURCE_DOC_RE.exec(markdown)?.[1].trim() || undefined;
+    // A bare "## Spec Gap Analysis" heading still names the artefact: fall back
+    // to the source document, then to a plain label.
+    const title = titleMatch.title || sourceDocument || 'Spec Gap Analysis';
     const sectionStarts = [];
     let m;
     const reCopy = new RegExp(SECTION_HEADING_RE.source, SECTION_HEADING_RE.flags);
@@ -103,6 +108,24 @@ export function extractSpecGap(markdown) {
         items,
     };
 }
+/**
+ * True when the text has the body of a spec-gap result (a known gap section
+ * heading, or a numbered [BLOCKER]/[IMPORTANT]/[NICE TO KNOW] line). Tells a
+ * result that failed to save apart from a conversational turn (a question back
+ * to the user), which is not an artefact at all.
+ */
+export function looksLikeSpecGap(markdown) {
+    if (/^\s*\d+\.\s*(?:\*\*)?\[(?:BLOCKER|IMPORTANT|NICE TO KNOW)\]/m.test(markdown))
+        return true;
+    const re = new RegExp(SECTION_HEADING_RE.source, SECTION_HEADING_RE.flags);
+    let m;
+    while ((m = re.exec(markdown)) !== null) {
+        const name = m[1].toLowerCase();
+        if (KNOWN_GAP_SECTIONS.some((k) => name.includes(k.toLowerCase())))
+            return true;
+    }
+    return false;
+}
 function parseGapsFromSection(sectionBody, nextId) {
     const out = [];
     const gapRe = new RegExp(GAP_LINE_RE.source); // per-line, no /m — exec on each line

package/dist/projects/save-command.js

@@ -328,6 +328,7 @@ export async function runSaveCommand(args) {
             args.log(`[save] ${e instanceof Error ? e.message : String(e)}`);
             args.log(`[save] Ask CSPeach to "re-issue the ${spec.artefactType} in the standard structure" and it will be saved then.`);
         }
+        args.onNotSaved?.('unreadable');
         return null;
     }
     // App lane routing (Task 6) — a plan that carries a lane is checked against
@@ -366,8 +367,10 @@ export async function runSaveCommand(args) {
     // prompt, give maybeOfferSave's headless prompt a question-aware answer
     // first.
     const answer = await askYesNo({ question: 'Save as project file?', confirm: args.confirm, prompt: args.prompt });
-    if (!isYes(answer))
+    if (!isYes(answer)) {
+        args.onNotSaved?.('declined');
         return null;
+    }
     let env;
     if (planExtract && prior) {
         // C1 (D30) — the 49dd duplicate: the generic save used to mint a fresh

package/dist/projects/title-heading.js

@@ -0,0 +1,36 @@
+// 2026-10-04 — one tolerant title-heading matcher for the prose artefacts
+// (spec-gap, design, estimate). A live /abap-app run lost its spec-gap file
+// because the model wrote "Spec Gap Analysis: …" and the saver only accepted
+// "## Spec Gap Analysis — …". Models drift on the separator (dash, en/em dash,
+// colon, none), the heading level (#..######, or none), the casing and an
+// optional "<skill-name> —" prefix. All of those count; an unrelated heading
+// does not.
+// Horizontal whitespace only: a match never runs onto the next line.
+const SEP = String.raw `[ \t]*[—–:-][ \t]*`;
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+function strip(title) {
+    return title
+        .replace(/\s*\*\*\s*$/, '') // closing bold
+        .replace(/\s+#+\s*$/, '') // closing ATX hashes
+        .trim();
+}
+/**
+ * Find the artefact's title heading. Heading lines (`#`..`######`) are tried
+ * first and may use any separator or none; a plain line (no `#`, optionally
+ * bold) must use a dash or colon, so ordinary prose never counts. The first
+ * heading line wins over any plain line.
+ */
+export function matchTitleHeading(markdown, spec) {
+    const prefix = String.raw `(?:${escapeRe(spec.skillPrefix)}${SEP})?`;
+    const phrase = `(?:${spec.phrase})`;
+    // `## [**][abap-x — ]Phrase[ — | : | ' ']Title[**]`  or  `## abap-x — Title`
+    const heading = new RegExp(String.raw `^[ \t]{0,3}#{1,6}[ \t]+(?:\*\*)?(?:${prefix}${phrase}(?:(?:${SEP}|[ \t]+)(.*?))?|${escapeRe(spec.skillPrefix)}${SEP}(.+?))[ \t]*$`, 'im');
+    const h = heading.exec(markdown);
+    if (h)
+        return { title: strip(h[1] ?? h[2] ?? '') };
+    const plain = new RegExp(String.raw `^[ \t]{0,3}(?:\*\*)?(?:${prefix}${phrase}${SEP}(.+?)|${escapeRe(spec.skillPrefix)}${SEP}(.+?))[ \t]*$`, 'im');
+    const p = plain.exec(markdown);
+    if (p)
+        return { title: strip(p[1] ?? p[2] ?? '') };
+    return null;
+}

package/dist/renderer/thinking-heartbeat.js

@@ -49,7 +49,8 @@ const GENERIC_SUFFIXES = [
     { at: 30_000, suffix: ' (30s)' },
     { at: 60_000, suffix: ' (60s — still running, hold on)' },
     { at: 120_000, suffix: ' (2m — still running; Ctrl+C aborts the turn)' },
-    { at: 300_000, suffix: ' (5m — likely stuck; Ctrl+C and check the VPN)' },
+    // 2026-10-04: never assume a VPN — many users sit on the company network.
+    { at: 300_000, suffix: ' (5m — likely stuck; Ctrl+C and check network access to the SAP system)' },
 ];
 /**
  * 2026-07-06 (audit-timeout) — the plan-chain audit's own liveness schedule.

package/dist/sap/unreachable.js

@@ -23,6 +23,9 @@ export function unreachableCode(err) {
     return undefined;
 }
 export function unreachableMessage(alias, host, port, code) {
-    return (`Can't reach SAP system ${alias} (${host}:${port}) — ${code}. Check the VPN / network, ` +
+    return (
+    // 2026-10-04: never assume a VPN — many users sit on the company network.
+    `Can't reach SAP system ${alias} (${host}:${port}) from this machine — ${code}. ` +
+        'Check network access to the SAP system (company network or VPN), ' +
         'or run with --no-sap for work that does not need SAP.');
 }

package/dist/skills/bundled-skills.js

@@ -1,6 +1,6 @@
 // GENERATED FILE — bundled skills for local mode.
 // Source: https://manifest.cspeach.dev/v1.json
-// Generated: 2026-10-04T16:06:20.457Z
+// Generated: 2026-10-04T19:28:08.728Z
 // Manifest signature verified at build time.
 export const BUNDLED_SKILLS = {
     "abap-app": {

package/package.json

@@ -1,121 +1,121 @@
-{
-  "name": "@cspeach/cli",
-  "version": "1.1.26",
-  "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
-  "keywords": [
-    "abap",
-    "sap",
-    "ai",
-    "cli",
-    "ai-assisted-development",
-    "s4hana",
-    "abap-development",
-    "claude",
-    "anthropic"
-  ],
-  "homepage": "https://cspeach.dev",
-  "bugs": {
-    "email": "laeeq.siddique@cremencing.com"
-  },
-  "author": "Laeeq Siddique (Cremencing Solutions)",
-  "license": "SEE LICENSE IN LICENSE",
-  "private": false,
-  "publishConfig": {
-    "access": "public"
-  },
-  "type": "module",
-  "bin": {
-    "cspeach": "dist/index.js"
-  },
-  "scripts": {
-    "dev": "tsx src/index.ts",
-    "prebuild": "tsx scripts/prebuild.ts",
-    "build": "tsc && node scripts/make-bin-executable.js",
-    "install:global": "tsx scripts/install-global.ts",
-    "pretest": "tsx scripts/sync-signing-key.ts || node -e \"console.warn('WARN: sync-signing-key skipped — using stub')\"",
-    "start": "node dist/index.js",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:smoke-e2e": "vitest run --config vitest.smoke-e2e.config.ts",
-    "adt:smoke": "tsx scripts/adt-smoke.ts",
-    "smoke:all": "pnpm zcspeach:smoke && pnpm adt:smoke",
-    "zcspeach:smoke": "tsx scripts/zcspeach-smoke.ts",
-    "bench:models": "tsx scripts/bench-models.ts",
-    "bench:audit": "tsx scripts/bench-audit-task.ts",
-    "bench:replay": "tsx bench/replay/run.ts",
-    "fiori": "tsx src/tools/fiori/bin.ts",
-    "prepare": "husky",
-    "prepublishOnly": "node -e \"const deps=require('./package.json').dependencies||{}; for (const n of ['@cspeach/sap-client','@cspeach/register-core']) { const d=deps[n]||''; if(d.startsWith('file:')||d.startsWith('link:')){console.error('publish blocked: '+n+' is a local link ('+d+') — point it at the published version before npm publish'); process.exit(1)} }\""
-  },
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "dependencies": {
-    "@anthropic-ai/sdk": "^0.90.0",
-    "@cspeach/register-core": "0.1.0",
-    "@cspeach/sap-client": "0.1.15",
-    "@iarna/toml": "^2.2.5",
-    "@inkjs/ui": "^2.0.0",
-    "@inquirer/prompts": "^7.0.0",
-    "@napi-rs/keyring": "2.1.0",
-    "@noble/ed25519": "2.1.0",
-    "@noble/hashes": "1.4.0",
-    "@sap-ux/annotation-converter": "0.10.21",
-    "@sap-ux/edmx-parser": "0.10.0",
-    "@sap-ux/fe-fpm-writer": "0.43.7",
-    "@sap-ux/fiori-elements-writer": "^3.0.39",
-    "@sap-ux/fiori-freestyle-writer": "3.0.12",
-    "@sap-ux/vocabularies-types": "0.15.0",
-    "adm-zip": "0.5.17",
-    "chalk": "^5.3.0",
-    "cli-highlight": "^2.1.11",
-    "cli-table3": "^0.6.5",
-    "clipboardy": "^5.3.1",
-    "cross-spawn": "^7.0.6",
-    "diff": "^9.0.0",
-    "ejs": "3.1.10",
-    "fuse.js": "^7.0.0",
-    "ink": "^5.0.0",
-    "ink-text-input": "^6.0.0",
-    "jose": "^5.9.0",
-    "mammoth": "^1.8.0",
-    "marked": "^11.2.0",
-    "marked-terminal": "^6.2.0",
-    "mem-fs": "2.1.0",
-    "mem-fs-editor": "9.4.0",
-    "node-machine-id": "^1.1.12",
-    "openai": "^6.49.0",
-    "puppeteer-core": "24.10.2",
-    "react": "^18.3.0",
-    "string-width": "^7.2.0",
-    "turndown": "^7.2.0",
-    "unpdf": "1.7.0",
-    "zod": "^3.23.0"
-  },
-  "devDependencies": {
-    "@sap-ux/ui5-middleware-fe-mockserver": "2.4.17",
-    "@types/adm-zip": "0.5.8",
-    "@types/cross-spawn": "^6.0.6",
-    "@types/diff": "^7.0.2",
-    "@types/ejs": "^3.1.5",
-    "@types/node": "^20.17.0",
-    "@types/react": "^18.3.0",
-    "@types/turndown": "^5.0.5",
-    "@ui5/builder": "4.3.2",
-    "@ui5/fs": "4.0.6",
-    "docx": "^9.0.2",
-    "husky": "^9.1.7",
-    "ink-testing-library": "^4.0.0",
-    "pdf-lib": "^1.17.1",
-    "strip-ansi": "6.0.1",
-    "tsx": "^4.19.0",
-    "typescript": "^5.7.0",
-    "vitest": "^2.1.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ]
-  }
-}
+{
+  "name": "@cspeach/cli",
+  "version": "1.1.27",
+  "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
+  "keywords": [
+    "abap",
+    "sap",
+    "ai",
+    "cli",
+    "ai-assisted-development",
+    "s4hana",
+    "abap-development",
+    "claude",
+    "anthropic"
+  ],
+  "homepage": "https://cspeach.dev",
+  "bugs": {
+    "email": "laeeq.siddique@cremencing.com"
+  },
+  "author": "Laeeq Siddique (Cremencing Solutions)",
+  "license": "SEE LICENSE IN LICENSE",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "bin": {
+    "cspeach": "dist/index.js"
+  },
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "prebuild": "tsx scripts/prebuild.ts",
+    "build": "tsc && node scripts/make-bin-executable.js",
+    "install:global": "tsx scripts/install-global.ts",
+    "pretest": "tsx scripts/sync-signing-key.ts || node -e \"console.warn('WARN: sync-signing-key skipped — using stub')\"",
+    "start": "node dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:smoke-e2e": "vitest run --config vitest.smoke-e2e.config.ts",
+    "adt:smoke": "tsx scripts/adt-smoke.ts",
+    "smoke:all": "pnpm zcspeach:smoke && pnpm adt:smoke",
+    "zcspeach:smoke": "tsx scripts/zcspeach-smoke.ts",
+    "bench:models": "tsx scripts/bench-models.ts",
+    "bench:audit": "tsx scripts/bench-audit-task.ts",
+    "bench:replay": "tsx bench/replay/run.ts",
+    "fiori": "tsx src/tools/fiori/bin.ts",
+    "prepare": "husky",
+    "prepublishOnly": "node -e \"const deps=require('./package.json').dependencies||{}; for (const n of ['@cspeach/sap-client','@cspeach/register-core']) { const d=deps[n]||''; if(d.startsWith('file:')||d.startsWith('link:')){console.error('publish blocked: '+n+' is a local link ('+d+') — point it at the published version before npm publish'); process.exit(1)} }\""
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.90.0",
+    "@cspeach/register-core": "0.1.0",
+    "@cspeach/sap-client": "0.1.15",
+    "@iarna/toml": "^2.2.5",
+    "@inkjs/ui": "^2.0.0",
+    "@inquirer/prompts": "^7.0.0",
+    "@napi-rs/keyring": "2.1.0",
+    "@noble/ed25519": "2.1.0",
+    "@noble/hashes": "1.4.0",
+    "@sap-ux/annotation-converter": "0.10.21",
+    "@sap-ux/edmx-parser": "0.10.0",
+    "@sap-ux/fe-fpm-writer": "0.43.7",
+    "@sap-ux/fiori-elements-writer": "^3.0.39",
+    "@sap-ux/fiori-freestyle-writer": "3.0.12",
+    "@sap-ux/vocabularies-types": "0.15.0",
+    "adm-zip": "0.5.17",
+    "chalk": "^5.3.0",
+    "cli-highlight": "^2.1.11",
+    "cli-table3": "^0.6.5",
+    "clipboardy": "^5.3.1",
+    "cross-spawn": "^7.0.6",
+    "diff": "^9.0.0",
+    "ejs": "3.1.10",
+    "fuse.js": "^7.0.0",
+    "ink": "^5.0.0",
+    "ink-text-input": "^6.0.0",
+    "jose": "^5.9.0",
+    "mammoth": "^1.8.0",
+    "marked": "^11.2.0",
+    "marked-terminal": "^6.2.0",
+    "mem-fs": "2.1.0",
+    "mem-fs-editor": "9.4.0",
+    "node-machine-id": "^1.1.12",
+    "openai": "^6.49.0",
+    "puppeteer-core": "24.10.2",
+    "react": "^18.3.0",
+    "string-width": "^7.2.0",
+    "turndown": "^7.2.0",
+    "unpdf": "1.7.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@sap-ux/ui5-middleware-fe-mockserver": "2.4.17",
+    "@types/adm-zip": "0.5.8",
+    "@types/cross-spawn": "^6.0.6",
+    "@types/diff": "^7.0.2",
+    "@types/ejs": "^3.1.5",
+    "@types/node": "^20.17.0",
+    "@types/react": "^18.3.0",
+    "@types/turndown": "^5.0.5",
+    "@ui5/builder": "4.3.2",
+    "@ui5/fs": "4.0.6",
+    "docx": "^9.0.2",
+    "husky": "^9.1.7",
+    "ink-testing-library": "^4.0.0",
+    "pdf-lib": "^1.17.1",
+    "strip-ansi": "6.0.1",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
+  }
+}

package/dist/doctor/checks/zcspeach.js

@@ -1,96 +0,0 @@
-import keychain from '../../auth/keychain.js';
-import { readFile } from 'node:fs/promises';
-import { loadConfig, resolveSapTls } from '../../config/loader.js';
-import { probeGet } from './_http-probe.js';
-import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
-const SAP_SERVICE = 'cspeach-sap';
-export async function checkZcspeach() {
-    const cfg = await loadConfig();
-    // Standalone mode ONLY — an opted-in paste-mode user has nothing to probe.
-    // Everything below (including the no-alias failure) is unchanged.
-    if (sapChecksSkipped(cfg))
-        return standaloneSkip('zcspeach');
-    const systems = Object.entries(cfg.sap);
-    if (systems.length === 0) {
-        return {
-            name: 'zcspeach',
-            ok: false,
-            message: 'no SAP systems configured',
-            hint: 'Run: cspeach config add-sap',
-        };
-    }
-    const results = [];
-    let anyFailed = false;
-    for (const [alias, sys] of systems) {
-        const protocol = sys.useSsl ? 'https' : 'http';
-        const url = `${protocol}://${sys.host}:${sys.port}/sap/bc/zcspeach/discovery`;
-        let pwd = null;
-        try {
-            pwd = await keychain.getPassword(SAP_SERVICE, alias);
-        }
-        catch {
-            // keychain unavailable — fall through, will be skipped below
-        }
-        if (!pwd) {
-            results.push(`${alias}: skipped (no password in keychain)`);
-            continue;
-        }
-        // TLS posture (2026-06-14): verification ON by default; resolveSapTls maps
-        // the per-alias config (ca_cert_path / insecure_skip_tls_verify, legacy
-        // sslVerify:false fallback). See checks/_http-probe.ts.
-        const tls = resolveSapTls(sys);
-        let ca;
-        if (tls.mode === 'ca-trusted' && tls.caCertPath) {
-            try {
-                ca = await readFile(tls.caCertPath);
-            }
-            catch (e) {
-                results.push(`${alias}: CA unreadable at ${tls.caCertPath} (${e.message})`);
-                anyFailed = true;
-                continue;
-            }
-        }
-        const r = await probeGet(url, {
-            rejectUnauthorized: tls.mode !== 'insecure',
-            ca,
-            auth: `${sys.username}:${pwd}`,
-            accept: 'application/json',
-            timeoutMs: 5000,
-        });
-        if (r.error) {
-            results.push(`${alias}: ${r.error}`);
-            anyFailed = true;
-            continue;
-        }
-        if (r.status < 200 || r.status >= 300) {
-            results.push(`${alias}: HTTP ${r.status} from /zcspeach/discovery`);
-            anyFailed = true;
-            continue;
-        }
-        let body;
-        try {
-            body = JSON.parse(r.body);
-        }
-        catch {
-            results.push(`${alias}: invalid JSON from /zcspeach/discovery`);
-            anyFailed = true;
-            continue;
-        }
-        if (body.status !== 'ok') {
-            results.push(`${alias}: discovery returned status=${body.status ?? '<missing>'}`);
-            anyFailed = true;
-            continue;
-        }
-        const ver = body.data?.version ?? '<missing>';
-        const ops = body.data?.operations?.length ?? 0;
-        results.push(`${alias}: v${ver}, ${ops} ops`);
-    }
-    return {
-        name: 'zcspeach',
-        ok: !anyFailed,
-        message: results.join('; '),
-        hint: anyFailed
-            ? 'SICF node /sap/bc/zcspeach must be active; ensure SAP_BASIS supports the framework'
-            : undefined,
-    };
-}