@cspeach/cli 1.1.45 → 1.1.46

package/dist/agent/chat-prompt.js

@@ -0,0 +1,47 @@
+/**
+ * Chat lane (spec 2026-10-17 D3) — the `_chat` built-in prompt. OWNER COPY
+ * (spec §4.1): change it only through the owner. The PROXY holds the rendered
+ * text as a literal (cspeach-proxy/src/skills/chat-prompt.ts); this file
+ * renders the same text from SKILL_CATALOG for direct providers (BYOK, AI-hub,
+ * Azure, local). src/agent/__tests__/chat-prompt-pin.test.ts keeps them
+ * byte-equal — when a skill joins or leaves the catalog, paste the new
+ * CHAT_SYSTEM_PROMPT into the proxy literal.
+ *
+ * Imports only the pure catalog: tool-dispatch and the loop import this file.
+ */
+import { SKILL_CATALOG } from '../skill-catalog.js';
+/** The skill header a chat turn carries. Never session.skill, never a picker entry. */
+export const CHAT_SKILL = '_chat';
+export function isChatSkill(name) {
+    return name === CHAT_SKILL;
+}
+export const CHAT_PROMPT_TEMPLATE = `You are CSPeach, an AI coding agent for SAP development. In this conversation you are the developer's senior colleague: years of ABAP, S/4HANA, FI/CO, MM, SD, RAP, CDS and Fiori, and the person the team asks when something doesn't add up.
+
+How you talk
+- This is a chat, not a report. Answer what was asked, at the size it was asked: a quick question gets a short answer; "walk me through it" gets a walk-through.
+- Lead with the answer or what you found. Then why. Then what you'd do next, if anything.
+- Plain words, short sentences. Use headings, tables or lists only when they make this answer easier to read, never as a template.
+- Have a view. If something is a bad idea, say so and say why. If you're not sure, say what you'd check.
+- Don't restate the request, don't narrate at length what you're about to do, don't end with a menu of options unless there's a real choice to make. One clear recommendation beats five.
+- No flattery. Apologise only when you got something wrong.
+
+How you work
+- Look before you answer. When the question is about this developer's system or project — a program, a class, a table, a dump, a transport, data, a file — read the real thing with your tools instead of guessing. Say in a few words what you're checking.
+- Ground what you say in what you read: object names, line numbers, field names, counts, amounts. Never invent objects, fields, results or tool output. If a tool fails or no SAP system is connected, say so plainly and carry on with what you can do.
+- If you have no tools in this session, answer from experience and say what you would check on the system.
+- You can read freely, and you can write files in the developer's project folder when they ask (notes, a saved explanation, an export).
+- You never change anything in SAP from this chat. Creating, changing, activating or deleting objects, and creating or releasing transports, run through CSPeach's guided workflows, which snapshot, plan, ask for approval, check syntax, activate and verify. When the conversation turns into a change, say briefly what you'd change and call hand_off with the right workflow and a clear request. Do the same when the developer asks for a complete deliverable a workflow produces (a full code review, a handover document, an upgrade scan). Don't ask "shall I hand off?" — the workflow shows its plan and asks before it writes.
+- After a workflow finishes, you're back in this chat and can see what it did. Pick up from there.
+
+Workflows you can hand off to
+{{SKILL_CATALOG}}
+
+Ground rules
+- Follow the team's development standards when they are given in <development_standards>; they win over your own preferences.
+- Use the SAP system and profile given in <session_context>; never assume a different system.
+- Never ask for, print or store passwords or keys.`;
+/** One line per skill: "/abap-x — purpose". Backticks are dropped (no meaning in a prompt; keeps the proxy literal escape-free). */
+export function renderSkillCatalog(entries) {
+    return entries.map((e) => `/${e.name} — ${e.description.replace(/`/g, '').replace(/\s+/g, ' ').trim()}`).join('\n');
+}
+export const CHAT_SYSTEM_PROMPT = CHAT_PROMPT_TEMPLATE.replace('{{SKILL_CATALOG}}', renderSkillCatalog(SKILL_CATALOG));

package/dist/agent/chat-unavailable.js

@@ -0,0 +1,9 @@
+/** D11 — the managed proxy answered 404 skill_not_found / 403 for `_chat` (an older server). The REPL re-runs the message through today's router. */
+export class ChatUnavailableError extends Error {
+    status;
+    constructor(status) {
+        super(`chat lane unavailable on this server (HTTP ${status})`);
+        this.status = status;
+        this.name = 'ChatUnavailableError';
+    }
+}

package/dist/agent/level-state.js

@@ -0,0 +1,11 @@
+// Process-wide level (pattern: agent/style-state.ts). Set from
+// cfg.assistant.level at startup (REPL + one-shot, wherever setAssistantStyle
+// is called) and by /level; read by the loop when it builds the per-call headers.
+import { DEFAULT_LEVEL } from './level.js';
+let current = DEFAULT_LEVEL;
+export function getAssistantLevel() {
+    return current;
+}
+export function setAssistantLevel(level) {
+    current = level;
+}

package/dist/agent/level.js

@@ -0,0 +1,60 @@
+/**
+ * Level — who CSPeach is talking to (spec 2026-10-17 §10, D13–D16). Style is
+ * HOW it talks; level is WHO it talks to (how much it explains). OWNER COPY
+ * (spec §10.1): the two sentences and the D15 paragraph are product copy.
+ *
+ * Managed: the loop sends X-CSPeach-Level and the proxy appends the text
+ * after any style text. Direct providers append it locally. `developer` sends
+ * no header and no text, so every existing request stays byte-identical.
+ * The level never grants or removes a permission (D15): nothing here is read
+ * by dispatch or write_mode.
+ *
+ * The proxy holds the same constants (cspeach-proxy/src/skills/level-texts.ts);
+ * src/agent/__tests__/level-pin.test.ts keeps LEVEL_INVARIANT, LEVEL_SENTENCES
+ * and the marked composition byte-equal. Edit both files together.
+ */
+export const ASSISTANT_LEVELS = ['developer', 'learning', 'functional'];
+export const DEFAULT_LEVEL = 'developer';
+/** Header name as the loop sends it (the proxy reads headers case-insensitively). */
+export const LEVEL_HEADER = 'X-CSPeach-Level';
+export function parseLevel(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const v = raw.trim().toLowerCase();
+    return ASSISTANT_LEVELS.includes(v) ? v : null;
+}
+export const LEVEL_INVARIANT = `The level changes how much you explain, never what you found: findings, numbers, object names, warnings, risks, approvals, plan and safety prompts stay exact. It does not change what this person is allowed to do in SAP.`;
+export const LEVEL_SENTENCES = Object.freeze({
+    learning: 'You\'re talking to a developer who is still building experience. Explain the why, not just the what. The first time a technical term comes up, say in a few words what it means. When you show a fix, point out the pattern behind it so they can use it again. Stay encouraging and concrete; never talk down. Just before you ask them to approve anything or answer a yes/no question, say in one or two plain sentences what will happen, what could go wrong and how it can be undone, then ask. Keep it short; don\'t lecture.',
+    functional: 'You\'re talking to someone who knows SAP and the business process well but is not a developer. Start with what it means for the business: which documents, amounts, users or reports are affected. Avoid code and technical terms unless they are needed; when one is needed, explain it in plain words. Show code only when they ask for it. When a code change is needed, don\'t hand it to a workflow: write a developer request to the project folder as cspeach-out/developer-request-<object-or-topic>.md (if that name is taken, add -2, -3 and so on) with the sections Summary, What we found, Proposed change, How to test and Open questions, written so a developer can act on it without asking anything; then tell them where it is and that a developer can open it in CSPeach and continue from it. Hand off to a workflow only if they clearly ask to make the change themselves. Just before you ask them to approve anything or answer a yes/no question, say in one or two plain sentences what will happen, what could go wrong and how it can be undone, then ask. Keep it short; don\'t lecture.',
+});
+// ---- pinned: level text composition ----
+/** The text appended under a "Who you're talking to" heading; null for developer (today's behaviour). */
+export function levelText(level) {
+    if (level === 'developer')
+        return null;
+    return `Who you're talking to\n${LEVEL_SENTENCES[level]}\n\n${LEVEL_INVARIANT}`;
+}
+/** Appends the level text to the END of the last block, after any style text already there (no new block, so no extra cache breakpoint). Never mutates the input. */
+export function appendLevelText(blocks, level) {
+    const text = levelText(level);
+    if (text === null || blocks.length === 0)
+        return [...blocks];
+    const out = [...blocks];
+    const last = out[out.length - 1];
+    out[out.length - 1] = { ...last, text: `${last.text}\n\n${text}` };
+    return out;
+}
+// ---- end pinned ----
+/** The header to add to a model call: nothing for developer (§6.5 extended). */
+export function levelHeader(level) {
+    return level === 'developer' ? {} : { [LEVEL_HEADER]: level };
+}
+/** A direct provider reads the level the loop put in the per-call headers. Absent or unknown ⇒ developer. */
+export function levelFromHeaders(headers) {
+    for (const [k, v] of Object.entries(headers ?? {})) {
+        if (k.toLowerCase() === LEVEL_HEADER.toLowerCase())
+            return parseLevel(v) ?? DEFAULT_LEVEL;
+    }
+    return DEFAULT_LEVEL;
+}

package/dist/agent/loop.js

@@ -43,6 +43,7 @@ import { resetRule8State, shouldGateRule8 } from '../repl/rule8-detector.js';
 import { consumeTodoSetThisTurn } from '../ui/todo-emitter.js';
 import { runSaveCommand, runPromoteCommand, detectArtifactSkill, offerAnswerBlockers } from '../projects/index.js';
 import { planLaneBlockForTurn } from '../projects/plan-lane.js';
+import { DOCUMENT_SKILLS } from '../projects/document-skills.js';
 import { clearAppFlow, getAppFlow, setGapConfirmed, startAppFlow } from '../lane/app-flow.js';
 import { getLatestSkeletonDecision } from '../rap/skeleton-session.js';
 import { afterRebuildTurn } from '../journey/rebuild.js';
@@ -64,7 +65,7 @@ import { renderStandardsBlock } from '../standards/standards-file.js';
 import { composeSessionContextBlock } from './session-context.js';
 import { objectKeyFromInput } from './retry-key.js';
 import { repairPartialBlocks, stripPreFallbackBlocks, healSessionMessagesInPlace, healOrphanToolUses, isPartialJsonApiError, stripUnsignedThinking, isThinkingOnly, dropTrailingThinkingOnly } from './repair-partial.js';
-import { drainSteering } from './steering-queue.js';
+import { drainSteering, enqueueSteering } from './steering-queue.js';
 import { TurnStreamWriter } from './turn-stream.js';
 import { applyToolResultCheckpoint } from './skill-checkpoint.js';
 import { loadWatchdogConfig, evaluateWatchdog } from './turn-watchdog.js';
@@ -79,6 +80,12 @@ import { maybeColdPrune } from './cold-prune.js';
 import { createAdtLock, serializeAdt } from '../tools/subagent/adt-serial.js';
 import { hasReaderReadTools, INTERRUPTED_LINE } from '../tools/subagent/reader-prompt.js';
 import { openStatusPage } from '../util/open-in-browser.js';
+import { isChatSkill } from './chat-prompt.js';
+import { getAssistantStyle } from './style-state.js';
+import { styleHeader } from './style.js';
+import { getAssistantLevel } from './level-state.js';
+import { levelHeader } from './level.js';
+import { ChatUnavailableError } from './chat-unavailable.js';
 /**
  * Author identity for project-file metadata. Reads CSPEACH_AUTHOR_NAME first,
  * then platform USER/USERNAME, then a generic fallback. Role is fixed to
@@ -368,6 +375,33 @@ export async function inkAwareChoose(a) {
 export async function maybeOfferSave(p) {
     if (p.assistantText.trim().length === 0)
         return;
+    // Word export (2026-10-19): reviews and handovers are prose documents, not
+    // envelopes. They get a Markdown save under cspeach-out and the Word
+    // question (projects/document-save.ts). Nothing below this branch changes
+    // for any other skill.
+    // The skill check reads a tiny constant module; document-save.ts (and the
+    // docx package) loads only for these two skills, inside the catch, so a
+    // broken docx install costs one line on a review save and nothing else.
+    if (DOCUMENT_SKILLS[p.skill]) {
+        if (p.subagent)
+            return;
+        const d = new Date();
+        const today = `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
+        try {
+            const { offerDocumentSave } = await import('../projects/document-save.js');
+            const { isHeadless } = await import('../renderer/tty.js');
+            const { loadConfig, resolveWordCopy } = await import('../config/loader.js');
+            await offerDocumentSave({
+                skill: p.skill, markdown: p.assistantText, cwd: process.cwd(), sapSystem: p.sapSystem ?? null,
+                today, headless: isHeadless(), wordCopy: resolveWordCopy(await loadConfig()),
+                confirm: inkAwareConfirm, emit: p.emit,
+            });
+        }
+        catch (e) {
+            p.emit(formatInfo(`Not saved: ${e.message}`).trimEnd());
+        }
+        return;
+    }
     // C1 (2026-06-11, defect D22) — the hook fires on artifact EVIDENCE, not
     // only on the routed-skill label. The seed-session plan save was lost
     // because the turn was misrouted (label 'abap-rap', not in the set) while
@@ -901,6 +935,19 @@ ${imageExpansion.error}`));
     const finalUserContent = projectContextBlock
         ? `${projectContextBlock}\n\n${enriched}`
         : enriched;
+    // Chat lane (D11) — what a withdrawn `_chat` turn restores: the whole
+    // pre-turn message array (placeSystemMessagesInPlace may re-sort the tail
+    // after the last assistant message, so a length-based splice is not
+    // enough), the workflow state it would otherwise clear, the turn counter
+    // and any steering drained in round 0.
+    const preTurnMessages = session.messages.slice();
+    const preTurnState = {
+        skill: session.skill,
+        lane: session.lane,
+        tool_set_skill: session.tool_set_skill,
+        turn_seq: session.turn_seq,
+    };
+    let round0Steers = [];
     // Images (if any) ride as blocks ahead of the text; with none this is the
     // same plain string as before.
     session.messages.push({ role: 'user', content: buildUserContent(finalUserContent, imageExpansion.images) });
@@ -916,7 +963,13 @@ ${imageExpansion.error}`));
     if (droppedImages > 0) {
         emit(chalk.dim(`(${droppedImages} older image(s) removed from the conversation to keep it under the size limit)`));
     }
-    session.skill = params.skill;
+    // Chat lane (D7, D-B) — `_chat` is the wire name of a chat turn, never the
+    // session's skill: a chat turn CLEARS the active workflow so a later bare
+    // "y" goes to chat (D8). `lane` is what dispatch gates on (D4); a subagent
+    // or reader child keeps the lane it was spawned with (D-C).
+    session.skill = isChatSkill(params.skill) ? null : params.skill;
+    if (!params.ctx.subagent && !params.ctx.readerMode)
+        session.lane = isChatSkill(params.skill) ? 'chat' : 'skill';
     // Task 16 (spec D11) — deferred tool loading. The tools array is built ONE
     // way for the whole session: the core set plus the starters of the skill
     // pinned on `session.tool_set_skill` are loaded, every other tool is
@@ -1106,12 +1159,51 @@ ${imageExpansion.error}`));
             if (steers.length > 0) {
                 const text = steers.join('\n');
                 session.messages.push({ role: 'user', content: text });
+                if (roundIndex === 0)
+                    round0Steers = steers;
                 emit(chalk.cyan(`↳ steering: ${steers.join(' / ')}`));
             }
         }
         let buffer = initialBufferState();
         let machineBlocks = initialMachineBlockState();
         let writingCode = false; // piece 2 §11.2 — "writing code…" while a fence is held back
+        // D11 — a proxy without the chat lane answers 404 skill_not_found (or 403)
+        // for `_chat`, either from createStream or (managed SDK) on the first
+        // stream read. Only on the turn's first call, before anything streamed.
+        const isChatUnavailable = (e) => {
+            if (!isChatSkill(params.skill))
+                return false;
+            const st = e?.status ?? e?.response?.status;
+            const raw = e?.error ?? e?.response?.data ?? e?.body;
+            let b = raw;
+            if (typeof raw === 'string') {
+                try {
+                    b = JSON.parse(raw);
+                }
+                catch {
+                    b = undefined;
+                }
+            }
+            return (st === 404 && b?.error === 'skill_not_found') || (st === 403 && b?.error === 'skill_not_in_entitlements');
+        };
+        // Withdraw this turn (its messages and the workflow state it cleared) so
+        // the REPL re-runs the same text through today's router. Nothing of the
+        // withdrawn turn is persisted or printed (no interrupted flag, no cost line).
+        const withdrawChatTurn = (st) => {
+            session.messages.splice(0, session.messages.length, ...preTurnMessages);
+            session.skill = preTurnState.skill;
+            session.lane = preTurnState.lane;
+            session.tool_set_skill = preTurnState.tool_set_skill;
+            session.turn_seq = preTurnState.turn_seq;
+            // Steering drained in round 0 goes back to the queue, ahead of any
+            // typed since, so the re-run turn still sees it.
+            if (round0Steers.length > 0) {
+                const later = drainSteering();
+                for (const t of [...round0Steers, ...later])
+                    enqueueSteering(t);
+            }
+            throw new ChatUnavailableError(st);
+        };
         let stream;
         // 2026-05-06: paint a "thinking" spinner during the LLM round-trip
         // wait so the user sees activity instead of staring at a silent
@@ -1263,6 +1355,10 @@ ${imageExpansion.error}`));
                     'X-CSForge-Skill': params.skill,
                     'X-CSPeach-Model-Role': params.modelRole ?? 'session_default',
                     ...(params.delegateSkill ? { 'X-CSPeach-Delegate-Skill': params.delegateSkill } : {}),
+                    // D9 — professional sends nothing (byte-identical requests).
+                    ...styleHeader(getAssistantStyle()),
+                    // §10 D14 — developer sends nothing (byte-identical requests).
+                    ...levelHeader(getAssistantLevel()),
                 };
                 sentParams = streamParams;
                 sentHeaders = headers;
@@ -1316,6 +1412,12 @@ ${imageExpansion.error}`));
             const status = err?.status ?? err?.response?.status;
             const bodyRaw = err?.error ?? err?.response?.data ?? err?.body;
             const body = typeof bodyRaw === 'string' ? JSON.parse(bodyRaw) : bodyRaw;
+            // D11 — a proxy without the chat lane answers 404 skill_not_found (or
+            // 403) for `_chat`. Withdraw this turn (its messages and the workflow
+            // state it cleared) and let the REPL re-run the same text through
+            // today's router. First call of the turn only.
+            if (roundIndex === 0 && isChatUnavailable(err))
+                withdrawChatTurn(status);
             if (status === 409 && body?.error === 'upgrade_required') {
                 emit('\n' + formatFailure({
                     what: 'This skill needs a newer CSPeach',
@@ -1552,6 +1654,10 @@ ${imageExpansion.error}`));
             interruptedError = err;
             thinkingSpinner.stop();
             thinkingHeartbeat.stop();
+            // D11 on the first stream read: withdraw before the persist block runs.
+            if (callIndex === 0 && currentAssistantContent.length === 0 && isChatUnavailable(err)) {
+                withdrawChatTurn((err?.status ?? err?.response?.status));
+            }
         }
         // Final flush: emit any pending partial line after the stream ends.
         // Runs on both clean completion and mid-stream interruption.
@@ -1854,6 +1960,8 @@ ${imageExpansion.error}`));
                         // they are the only modelOverride caller — kept honest anyway).
                         model: params.modelOverride ?? resolveModelRole('session_default', cfg) ?? session.model ?? 'unknown',
                         emit,
+                        sapSystem: session.sap_system,
+                        ...(params.ctx.subagent ? { subagent: true } : {}),
                         promotedFrom: promotedFromForSave,
                         ...(promotedFromPathForSave ? { promotedFromPath: promotedFromPathForSave } : {}),
                         ...(() => {

package/dist/agent/provider-shape.js

@@ -1,5 +1,7 @@
 import { TOOL_CHANGES_BETA, isToolSearchEntry } from '../tools/tool-loading.js';
 import { DELEGATE_SKILL_HEADER } from './system-prompt.js';
+import { STYLE_HEADER } from './style.js';
+import { LEVEL_HEADER } from './level.js';
 /** Betas the proxy sends on every managed turn (messages.ts `betas: [...]`). */
 export const BASE_BETAS = ['compact-2026-01-12'];
 /** Task 6 — beta that enables `fallbacks: 'default'` (server-side fallback). */
@@ -267,13 +269,15 @@ export function withoutInternalHeaders(headers) {
 }
 /**
  * Task 9 — the role header is new proxy plumbing; AI-hub keeps today's header
- * set, so X-CSPeach-Model-Role (and, 2026-10-04, the delegate header) are removed.
+ * set, so X-CSPeach-Model-Role (and, 2026-10-04, the delegate header; and,
+ * 2026-10-17, the talking-style and level headers — applied locally) are
+ * removed.
  */
 export function withoutRoleHeader(headers) {
     const out = {};
     for (const [k, v] of Object.entries(headers ?? {})) {
         const lk = k.toLowerCase();
-        if (lk === 'x-cspeach-model-role' || lk === DELEGATE_SKILL_HEADER.toLowerCase())
+        if (lk === 'x-cspeach-model-role' || lk === DELEGATE_SKILL_HEADER.toLowerCase() || lk === STYLE_HEADER.toLowerCase() || lk === LEVEL_HEADER.toLowerCase())
             continue;
         out[k] = v;
     }

package/dist/agent/providers/ai-hub-provider.js

@@ -3,6 +3,8 @@ import keychain from '../../auth/keychain.js';
 import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, requireSkillName, toLegacyShape, withoutRoleHeader } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
+import { styleFromHeaders } from '../style.js';
+import { levelFromHeaders } from '../level.js';
 import { AI_HUB_PROFILE } from '../connection-profile.js';
 const KEYCHAIN_SERVICE = 'cspeach.ai-hub';
 const KEYCHAIN_ACCOUNT = 'token';
@@ -26,7 +28,7 @@ export function createAiHubProvider(cfg, getBearer = defaultBearer) {
             const skillName = requireSkillName(options, 'AI Hub');
             const token = await getToken();
             // Task 18 — the `_reader` header uses the pinned reader prompt, no lookup.
-            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: AI_HUB_PROFILE.cacheMarkers }, delegateSkillName(options));
+            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: AI_HUB_PROFILE.cacheMarkers }, delegateSkillName(options), styleFromHeaders(options.headers), levelFromHeaders(options.headers));
             const request = {
                 ...toLegacyShape(params),
                 system,

package/dist/agent/providers/azure-provider.js

@@ -17,6 +17,8 @@ import { AZURE_PROFILE } from '../azure-profile.js';
 import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, headersForProfile, requireSkillName, withoutToolChanges, withSkillPrompt } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
+import { styleFromHeaders } from '../style.js';
+import { levelFromHeaders } from '../level.js';
 import { familyAcceptsEffort, familyFromTable } from '../../models/model-identity.js';
 import { getActiveConnection } from '../../connection/cache.js';
 import { azureTurnVerdict, AzureConnectionRefusedError } from '../../connection/state.js';
@@ -64,7 +66,7 @@ export function createAzureProvider(cfg, getBearer = defaultBearer, deps = {}) {
             throw new AzureConnectionRefusedError(v.message);
         const conn = cached.connection;
         const skillName = requireSkillName(options, 'Azure');
-        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: profile.cacheMarkers }, delegateSkillName(options));
+        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: profile.cacheMarkers }, delegateSkillName(options), styleFromHeaders(options.headers), levelFromHeaders(options.headers));
         const base = profile.toolChanges ? params : withoutToolChanges(params);
         const family = familyFromTable(params.model, conn.deployments);
         const body = withAzureEffort(shapeForAzure(withSkillPrompt(base, system, { cacheMarkers: profile.cacheMarkers }), profile), profile, roleOf(options.headers), family);

package/dist/agent/providers/byok-provider.js

@@ -3,6 +3,8 @@ import keychain from '../../auth/keychain.js';
 import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, modelAcceptsFallbacks, requiredBetas, requireSkillName, withoutInternalHeaders, withSkillPrompt } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
+import { styleFromHeaders } from '../style.js';
+import { levelFromHeaders } from '../level.js';
 import { BYOK_PROFILE } from '../connection-profile.js';
 const KEYCHAIN_SERVICE = 'cspeach.anthropic';
 const KEYCHAIN_ACCOUNT = 'api-key';
@@ -19,7 +21,7 @@ export function createByokProvider(cfg, getBearer = defaultBearer) {
         const skillName = requireSkillName(options, 'BYOK');
         const key = await getKey();
         // Task 18 — the `_reader` header uses the pinned reader prompt, no lookup.
-        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: BYOK_PROFILE.cacheMarkers }, delegateSkillName(options));
+        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: BYOK_PROFILE.cacheMarkers }, delegateSkillName(options), styleFromHeaders(options.headers), levelFromHeaders(options.headers));
         // Task 6 — opt into server-side fallback, only for the families probe
         // P3 proved (allow-list); requiredBetas adds its beta.
         const prompted = withSkillPrompt(params, system, { cacheMarkers: BYOK_PROFILE.cacheMarkers });

package/dist/agent/providers/local-provider.js

@@ -4,6 +4,8 @@ import crypto from 'node:crypto';
 import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, requireSkillName } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
+import { styleFromHeaders } from '../style.js';
+import { levelFromHeaders } from '../level.js';
 import { LOCAL_PROFILE } from '../connection-profile.js';
 export function createLocalProvider(cfg, getBearer = defaultBearer) {
     if (!cfg.llm.local_base_url) {
@@ -27,7 +29,7 @@ export function createLocalProvider(cfg, getBearer = defaultBearer) {
             // message (no cache markers). anthropicParamsToOpenAI copies only
             // max_tokens / messages / system, so newer fields never reach the endpoint.
             const skillName = requireSkillName(options, 'Local');
-            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: false }, delegateSkillName(options));
+            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: false }, delegateSkillName(options), styleFromHeaders(options.headers), levelFromHeaders(options.headers));
             const OpenAI = await loadOpenAI();
             const sdk = new OpenAI({ apiKey: 'local-ignored', baseURL });
             const openAiParams = anthropicParamsToOpenAI({ ...params, system }, model);

package/dist/agent/style-state.js

@@ -0,0 +1,11 @@
+// Process-wide talking style (pattern: renderer/look.ts). Set from
+// cfg.assistant.style at startup (REPL + one-shot) and by /style; read by the
+// loop when it builds the per-call headers.
+import { DEFAULT_STYLE } from './style.js';
+let current = DEFAULT_STYLE;
+export function getAssistantStyle() {
+    return current;
+}
+export function setAssistantStyle(style) {
+    current = style;
+}

package/dist/agent/style.js

@@ -0,0 +1,59 @@
+/**
+ * Talking style (spec 2026-10-17 D9/D10). Words change; findings, numbers,
+ * warnings and safety prompts never do. OWNER COPY (spec §4.2): the sentences
+ * and the D10 paragraph are product copy.
+ *
+ * Managed: the loop sends X-CSPeach-Style and the proxy appends the text.
+ * Direct providers append it locally. `professional` sends no header and no
+ * text, so every existing request stays byte-identical.
+ *
+ * The proxy holds the same constants (cspeach-proxy/src/skills/style-texts.ts);
+ * src/agent/__tests__/style-pin.test.ts keeps STYLE_INVARIANT, STYLE_SENTENCES
+ * and the marked composition byte-equal. Edit both files together.
+ */
+export const ASSISTANT_STYLES = ['professional', 'conversational', 'humor', 'blunt'];
+export const DEFAULT_STYLE = 'professional';
+/** Header name as the loop sends it (the proxy reads headers case-insensitively). */
+export const STYLE_HEADER = 'X-CSPeach-Style';
+export function parseStyle(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const v = raw.trim().toLowerCase();
+    return ASSISTANT_STYLES.includes(v) ? v : null;
+}
+export const STYLE_INVARIANT = `Style changes your wording only. It never changes findings, numbers, object names, warnings, risks, approvals, plan or safety prompts, or error messages — keep those exact and plain. No jokes or attitude around errors, approvals, writes or data loss. Anything saved to a file for other people is written professionally. No profanity, no remarks about people.`;
+export const STYLE_SENTENCES = Object.freeze({
+    conversational: 'Talk like a teammate in a chat: relaxed, warm, first names fine, contractions fine. Still brief and specific.',
+    humor: 'A light, dry sense of humour is welcome — at most one small aside when it fits naturally. Never forced, never at anyone\'s expense.',
+    blunt: 'Be blunt. No softening, no padding: say what\'s wrong and what to do, in as few words as it takes. Critique the code, never the person.',
+});
+// ---- pinned: style text composition ----
+/** The text appended under a "Talking style" heading; null for professional (today's voice). */
+export function styleText(style) {
+    if (style === 'professional')
+        return null;
+    return `Talking style\n${STYLE_SENTENCES[style]}\n\n${STYLE_INVARIANT}`;
+}
+/** Appends the style text to the END of the last block (no new block, so no extra cache breakpoint). Never mutates the input. */
+export function appendStyleText(blocks, style) {
+    const text = styleText(style);
+    if (text === null || blocks.length === 0)
+        return [...blocks];
+    const out = [...blocks];
+    const last = out[out.length - 1];
+    out[out.length - 1] = { ...last, text: `${last.text}\n\n${text}` };
+    return out;
+}
+// ---- end pinned ----
+/** The header to add to a model call: nothing for professional (§6.5). */
+export function styleHeader(style) {
+    return style === 'professional' ? {} : { [STYLE_HEADER]: style };
+}
+/** A direct provider reads the style the loop put in the per-call headers. Absent or unknown ⇒ professional. */
+export function styleFromHeaders(headers) {
+    for (const [k, v] of Object.entries(headers ?? {})) {
+        if (k.toLowerCase() === STYLE_HEADER.toLowerCase())
+            return parseStyle(v) ?? DEFAULT_STYLE;
+    }
+    return DEFAULT_STYLE;
+}

package/dist/agent/system-prompt.js

@@ -9,6 +9,9 @@
  */
 import { FORGE_PRINCIPLES_PREAMBLE } from '../skills/preamble.js';
 import { READER_SKILL, READER_SYSTEM_PROMPT } from '../tools/subagent/reader-prompt.js';
+import { CHAT_SKILL, CHAT_SYSTEM_PROMPT } from './chat-prompt.js';
+import { appendStyleText, DEFAULT_STYLE } from './style.js';
+import { appendLevelText, DEFAULT_LEVEL } from './level.js';
 /** 2026-10-04 (continuous run) — the phase's delegate skill travels as this header. */
 export const DELEGATE_SKILL_HEADER = 'X-CSPeach-Delegate-Skill';
 /** The line that tells the model how the two bodies relate. Same text in cspeach-proxy. */
@@ -40,16 +43,34 @@ export function buildReaderSystemPrompt(opts) {
     const marker = opts.cacheMarkers ? { cache_control: { type: 'ephemeral' } } : {};
     return [{ type: 'text', text: READER_SYSTEM_PROMPT, ...marker }];
 }
+/**
+ * Chat lane (spec 2026-10-17 D3) — one block, the pinned chat prompt, as the
+ * proxy sends it for the `_chat` skill header. The coding-workflow preamble is
+ * NOT sent on chat turns. A non-professional style is appended to that block;
+ * a non-developer level (§10 D14) follows the style text.
+ */
+export function buildChatSystemPrompt(opts, style = DEFAULT_STYLE, level = DEFAULT_LEVEL) {
+    const marker = opts.cacheMarkers ? { cache_control: { type: 'ephemeral' } } : {};
+    // D-K order: style, then level, one block.
+    return appendLevelText(appendStyleText([{ type: 'text', text: CHAT_SYSTEM_PROMPT, ...marker }], style), level);
+}
 /**
  * The system prompt for the skill named in the X-CSForge-Skill header, plus —
  * on a plan phase turn — the delegate playbook named in X-CSPeach-Delegate-Skill.
  * A delegate that cannot be fetched degrades to the plain prompt (never throws);
  * a delegate equal to the skill itself is ignored. The internal `_reader` skill
- * has no SKILL.md, so it never reaches the skill source (a lookup would fail).
+ * has no SKILL.md, so it never reaches the skill source (a lookup would fail);
+ * nor does the built-in `_chat` (D3). A non-professional `style` (D9) is
+ * appended to the END of the last block — professional changes nothing, and a
+ * reader (which reports facts) never gets style. A non-developer `level`
+ * (§10 D14) follows the style text; developer changes nothing; a reader never
+ * gets it.
  */
-export async function systemPromptForSkill(skillName, skillSource, opts, delegateName) {
+export async function systemPromptForSkill(skillName, skillSource, opts, delegateName, style = DEFAULT_STYLE, level = DEFAULT_LEVEL) {
     if (skillName === READER_SKILL)
         return buildReaderSystemPrompt(opts);
+    if (skillName === CHAT_SKILL)
+        return buildChatSystemPrompt(opts, style, level);
     const skill = await skillSource.getSkillBody(skillName);
     let delegate;
     if (delegateName && delegateName !== skillName) {
@@ -61,5 +82,5 @@ export async function systemPromptForSkill(skillName, skillSource, opts, delegat
             delegate = undefined;
         }
     }
-    return buildSystemPrompt(skill.body, opts, delegate);
+    return appendLevelText(appendStyleText(buildSystemPrompt(skill.body, opts, delegate), style), level);
 }

package/dist/agent/tool-dispatch.js

@@ -11,7 +11,47 @@ import { READER_TOOLS } from '../tools/subagent/reader-prompt.js';
 import { riskOf } from './risk-gate.js';
 import { NOT_ON_THIS_RELEASE, gateWithVerify } from '../sap/profile-gate.js';
 import { INTERRUPTED_TOOL_RESULT } from './repair-partial.js';
+import { WRITE_TOOLS } from '../tools/write-mode.js';
 const READER_TOOL_SET = new Set(READER_TOOLS);
+/** Chat lane (spec 2026-10-17 D4) — the model-facing reason; names hand_off. */
+export const CHAT_READ_ONLY_REASON = 'This chat reads but never changes SAP. To make this change, call hand_off with the right workflow (for example abap-refactor, abap-generate, abap-transport) and a clear request — the workflow shows its plan and asks before it writes.';
+/** sap_run_unit_test in chat — unit test code can COMMIT; same footing as sap_run. */
+export const CHAT_UNIT_TEST_REASON = 'This chat reads but never runs code on SAP — unit tests can change data. To run them, call hand_off with skill abap-test and a clear request.';
+/** dispatch_skill in chat — hand_off is the chat's one switch (spec D5). */
+export const CHAT_DISPATCH_SKILL_REASON = 'In this chat, dispatch_skill is not available. To start a guided workflow, call hand_off with the workflow name and a clear request.';
+/** A call carrying an approval_id in chat — approvals belong to workflows, never to chat. */
+export const CHAT_APPROVAL_ID_REASON = 'This chat never uses an approval. To make this change, call hand_off with the right workflow and a clear request — the workflow asks before it writes.';
+/**
+ * Tools refused in chat beyond the generic rule: the two smokes write SAP
+ * data over OData although requiresSap is false; sap_run_unit_test runs code
+ * that can COMMIT; dispatch_skill could queue any slash command (hand_off is
+ * chat's switch, D5).
+ */
+const CHAT_EXTRA_REFUSED = new Map([
+    ['fiori_draft_smoke', CHAT_READ_ONLY_REASON],
+    ['cap_link_smoke', CHAT_READ_ONLY_REASON],
+    ['sap_run_unit_test', CHAT_UNIT_TEST_REASON],
+    ['dispatch_skill', CHAT_DISPATCH_SKILL_REASON],
+]);
+/**
+ * Chat lane refusal set (D-F): WRITE_TOOLS ∪ {request_approval} ∪ every tool
+ * that is both mutating and SAP-bound (sap_transport_create, sap_lock, … that
+ * WRITE_TOOLS leaves out; this also catches fiori_preview, sap_link,
+ * cap_metadata_import — safe side) ∪ CHAT_EXTRA_REFUSED. hand_off / reads /
+ * local files: no.
+ */
+export function isChatRefusedTool(tool) {
+    return WRITE_TOOLS.has(tool.name) || tool.name === 'request_approval' || CHAT_EXTRA_REFUSED.has(tool.name)
+        || (tool.isMutating === true && tool.requiresSap === true);
+}
+/** The model-facing chat refusal for this call, or null when chat allows it. */
+export function chatRefusal(tool, args) {
+    if (isChatRefusedTool(tool))
+        return CHAT_EXTRA_REFUSED.get(tool.name) ?? CHAT_READ_ONLY_REASON;
+    if (args && typeof args === 'object' && Object.prototype.hasOwnProperty.call(args, 'approval_id'))
+        return CHAT_APPROVAL_ID_REASON;
+    return null;
+}
 export async function dispatchTool(name, args, ctx) {
     const tool = getTool(name);
     if (!tool) {
@@ -23,6 +63,21 @@ export async function dispatchTool(name, args, ctx) {
     if (ctx.readerMode && !READER_TOOL_SET.has(name)) {
         return { content: `error: read-only reader — ${name} is not allowed here`, is_error: true };
     }
+    // Chat lane (spec 2026-10-17 D4, §6.3) — chat reads freely and never changes
+    // SAP. The prompt says so; THIS is the guarantee: every SAP-mutating tool and
+    // request_approval are refused while the session's last turn ran in chat,
+    // with a reason that points the model at hand_off. It sits before the
+    // standalone, profile, credential, risk and Rule 8 gates, so no card is ever
+    // shown for a call chat cannot make. An agent_run child spreads the parent
+    // session (lane included) and is refused the same way. Reads, project files
+    // and the shell keep their existing gates below. Belt and braces: any call
+    // carrying an approval_id is refused too, so an approval minted in an
+    // earlier skill turn (reusable 30 min) can never be replayed from chat.
+    if (ctx.session?.lane === 'chat') {
+        const refusal = chatRefusal(tool, args);
+        if (refusal)
+            return { content: JSON.stringify({ error: 'chat_read_only', tool: name, message: refusal }), is_error: true };
+    }
     // Standalone safety net (2026-09-16). SAP-dependent tools are already
     // filtered out of the list the model sees (agent/loop.ts), but a model can
     // still call a tool it remembers from an earlier turn or from training. Fail