@cspeach/cli 1.1.47 → 1.1.48

package/dist/commands/config-set.js

@@ -598,17 +598,17 @@ export async function runConfigSet(args) {
             break;
         }
         case 'show_cogs': {
-            // Operator escape hatch — render OUR Anthropic COGS in USD even on a
-            // managed, metered account (where the customer-facing unit is credits).
-            // Off/absent is the product default; see cost/display-mode.ts.
+            // Operator view — our cost in USD on a managed account. Works only when
+            // the server also grants the account `cost_view` (2026-10-19); on its
+            // own this setting changes nothing. See cost/display-mode.ts.
             const b = coerceBool(value);
             if (b === null) {
                 err(`${key} must be on/off (also accepts true/false, 1/0).`);
             }
             cfg.show_cogs = b;
             console.log(chalk.dim(b
-                ? '  → cost figures will show USD (our Anthropic cost), not credits.'
-                : '  → cost figures will show credits on a managed, metered account.'));
+                ? '  → applies only to accounts allowed to see costs; everyone else keeps credits.'
+                : '  → cost figures show credits.'));
             break;
         }
         case 'word_copy': {

package/dist/commands/cost.js

@@ -141,6 +141,7 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     emit('');
     if (inCredits)
         emit(formatInfo('This month and your top skills: /usage').trimEnd());
-    emit(formatInfo(`Detailed JSONL: ~/.cspeach/sessions/${sessionId}-cost.jsonl`).trimEnd());
+    if (!inCredits)
+        emit(formatInfo(`Detailed JSONL: ~/.cspeach/sessions/${sessionId}-cost.jsonl`).trimEnd());
     emit('');
 }

package/dist/config/loader.js

@@ -6,6 +6,8 @@ import { DEFAULT_SESSION_MODEL } from './model-defaults.js';
 import { sanitiseStandaloneProfile } from '../sap/standalone-profile.js';
 import { DEFAULT_STYLE, parseStyle } from '../agent/style.js';
 import { DEFAULT_LEVEL, parseLevel } from '../agent/level.js';
+import { setProvisionalCostDisplayMode } from '../cost/credits.js';
+import { provisionalDisplayMode } from '../cost/display-mode.js';
 /**
  * Whitelist guard for WriteMode — rejects typos / stale values from disk so
  * downstream code that trusts the WriteMode type doesn't see garbage.
@@ -148,7 +150,18 @@ export function resolveSapTls(sys) {
 }
 /** Tracks whether the one-time legacy-sslVerify deprecation note has printed. */
 let legacySslVerifyNoticeShown = false;
+/**
+ * Load the config, then set the cost display mode it implies until the server
+ * answers (2026-10-19). Every command loads the config first, so no path — one
+ * that never reaches initCredits included — can show dollars on a managed
+ * account by default.
+ */
 export async function loadConfig() {
+    const cfg = await readConfig();
+    setProvisionalCostDisplayMode(provisionalDisplayMode(cfg));
+    return cfg;
+}
+async function readConfig() {
     try {
         const raw = await fs.readFile(configFile(), 'utf-8');
         // Strip a leading UTF-8 BOM (U+FEFF). Node's 'utf-8' read does NOT remove it,

package/dist/cost/cost-log.js

@@ -15,7 +15,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { sessionsDir } from '../config/paths.js';
 import { computeCost } from './pricing.js';
-import { tokensOnlyActive } from './credits.js';
+import { activeCostDisplayMode } from './credits.js';
 /**
  * Task 7 — summarise `message_start.message.input_transformations` (probe P4
  * shape: `[{ type: 'thinking_dropped', path, reason }]`). Counts the
@@ -56,8 +56,10 @@ export function buildEntry(opts) {
         turn: opts.turn,
         model: opts.model,
         tokens: opts.tokens,
-        // Azure: no price for the customer's deployment — never consult one.
-        cost: tokensOnlyActive() ? 0 : computeCost(opts.model, opts.tokens),
+        // Only where dollars are shown (own key, or a permitted operator). Credits:
+        // this file sits on the customer's disk, so it never holds our cost
+        // (2026-10-19). Azure: no price for the customer's deployment.
+        cost: activeCostDisplayMode() === 'usd' ? computeCost(opts.model, opts.tokens) : 0,
         duration_ms: opts.duration_ms,
     };
     if (opts.credits) {
@@ -77,7 +79,8 @@ export function buildEntry(opts) {
     if (opts.input_transformations !== undefined)
         entry.input_transformations = opts.input_transformations;
     if (opts.reader && opts.reader.calls > 0) {
-        entry.reader_cost_usd = Math.round(opts.reader.cost * 10000) / 10000;
+        if (activeCostDisplayMode() === 'usd')
+            entry.reader_cost_usd = Math.round(opts.reader.cost * 10000) / 10000;
         entry.reader_calls = opts.reader.calls;
     }
     return entry;

package/dist/cost/credits-wire.js

@@ -22,7 +22,7 @@
  * a one-liner and no module has to re-derive the display mode for itself.
  */
 import { fetchBalance, globalCredits, setCostDisplayMode, creditsActive, } from './credits.js';
-import { costDisplayMode } from './display-mode.js';
+import { costDisplayMode, provisionalDisplayMode } from './display-mode.js';
 import { globalStore } from '../ui/sap-state-store.js';
 let wiredCfg = null;
 let wiredBearer = null;
@@ -39,14 +39,14 @@ function publish() {
 }
 /**
  * Startup: resolve the display mode and seed the opening balance.
- * Never throws; on any failure the process stays in USD mode, which is the
- * pre-credits behaviour.
+ * Never throws. On any failure a managed account stays in credits (2026-10-19:
+ * this used to fall back to dollars — our cost on the customer's screen).
  */
 export async function initCredits(cfg, getBearer) {
     try {
         // Non-managed modes can't be metered by us — skip the round-trip entirely.
         if (cfg.llm?.mode !== 'managed') {
-            setCostDisplayMode(cfg.llm?.mode === 'azure' ? 'tokens' : 'usd');
+            setCostDisplayMode(provisionalDisplayMode(cfg));
             return;
         }
         const info = await fetchBalance(cfg, getBearer);
@@ -60,8 +60,13 @@ export async function initCredits(cfg, getBearer) {
         publish();
     }
     catch {
-        // Startup must never be blocked by the meter.
-        setCostDisplayMode('usd');
+        // Startup must never be blocked by the meter — and never shows our cost.
+        setCostDisplayMode(provisionalDisplayMode(cfg));
+        // The footer reads the store's flag, so publish the mode here too.
+        if (creditsActive()) {
+            globalCredits.start(null);
+            publish();
+        }
     }
 }
 /**

package/dist/cost/credits.js

@@ -61,6 +61,8 @@ export async function fetchBalance(cfg, getBearer) {
         };
         if (b.unprovisioned === true)
             info.unprovisioned = true;
+        if (b.cost_view === true)
+            info.cost_view = true;
         return info;
     }
     catch {
@@ -198,9 +200,21 @@ export function formatCreditsLine(s) {
  */
 export const globalCredits = new CreditsTracker();
 let activeMode = 'usd';
+/** True once startup (initCredits) has resolved the mode with the server's answer. */
+let resolved = false;
 /** Publish the resolved display mode for the whole process. */
 export function setCostDisplayMode(mode) {
     activeMode = mode;
+    resolved = true;
+}
+/**
+ * The mode implied by the config alone, set when the config loads. Applies
+ * only until startup resolves the real mode, so a later config reload never
+ * overrides the server's answer (2026-10-19).
+ */
+export function setProvisionalCostDisplayMode(mode) {
+    if (!resolved)
+        activeMode = mode;
 }
 /** The resolved display mode. Defaults to 'usd' until startup resolves it —
  *  fail-safe for BYOK/local/one-shot paths that never call the setter. */
@@ -218,4 +232,5 @@ export function tokensOnlyActive() {
 /** Test seam — reset the process-wide mode between cases. */
 export function resetCostDisplayMode() {
     activeMode = 'usd';
+    resolved = false;
 }

package/dist/cost/display-mode.js

@@ -15,8 +15,10 @@
  *   - managed but unmetered (or the balance fetch failed): we have no
  *     credit truth to show. Fall back to the existing dollar rendering so
  *     the meter is never blank.
- *   - `show_cogs = on`: our own operator escape hatch for reading real COGS
- *     on a managed account (margin analysis, pricing work). Never a default.
+ *   - `show_cogs = on` AND the server's `cost_view` for this account: our own
+ *     operator view of real COGS on a managed account (margin analysis,
+ *     pricing work). The laptop setting alone does nothing (owner 2026-10-19:
+ *     any customer could type it); the server must say yes as well.
  *
  * Callers must treat this as the single source of truth — no site may
  * re-derive the mode from `cfg.llm.mode` alone.
@@ -28,13 +30,23 @@ export function costDisplayMode(cfg, balanceInfo) {
         return 'tokens';
     if (cfg.llm?.mode !== 'managed')
         return 'usd';
-    if (cfg.show_cogs === true)
+    if (cfg.show_cogs === true && balanceInfo?.cost_view === true)
         return 'usd';
     // 2026-09-17 — a managed account NEVER falls back to dollars. Before, a
     // balance lookup that failed or took over 2.5s at start (slow network on a
     // customer laptop) dropped the display to USD — our cost on their screen,
     // exactly what credits mode exists to prevent. Unknown or unmetered
     // balances render "credits: updating…" until the next good sample.
-    void balanceInfo;
     return 'credits';
 }
+/**
+ * The mode before the server has answered — set the moment the config loads,
+ * so nothing printed early can show dollars on a managed account.
+ */
+export function provisionalDisplayMode(cfg) {
+    if (cfg.llm?.mode === 'azure')
+        return 'tokens';
+    if (cfg.llm?.mode === 'managed')
+        return 'credits';
+    return 'usd';
+}

package/dist/renderer/status-footer.js

@@ -47,7 +47,8 @@ export function largeSessionNotice(sessionInputTokens) {
         return '';
     return formatAttention({
         text: 'session getting large',
-        fact: `${sessionInputTokens.toLocaleString('en-US')} input tokens`,
+        // Credits: no token count beside the credits receipt (owner 2026-10-02).
+        fact: creditsActive() ? 'long conversation' : `${sessionInputTokens.toLocaleString('en-US')} input tokens`,
         next: 'type /compact to summarise older turns, or /exit and start fresh for a new topic',
     });
 }

package/dist/session/audit-export.js

@@ -515,7 +515,10 @@ export function buildAuditReport(input) {
     else {
         L(`- **Total:** $${cost.totalCost.toFixed(4)} over ${cost.turns} turn${cost.turns === 1 ? '' : 's'}`);
     }
-    L(`- **Tokens:** ${cost.totalTokens.input.toLocaleString('en-US')} in · ${cost.totalTokens.output.toLocaleString('en-US')} out · ${cost.totalTokens.cacheRead.toLocaleString('en-US')} cache-read · ${cost.totalTokens.cacheCreate.toLocaleString('en-US')} cache-write`);
+    // Credits: no token counts beside credits (owner 2026-10-02, same as /cost).
+    if (!inCredits) {
+        L(`- **Tokens:** ${cost.totalTokens.input.toLocaleString('en-US')} in · ${cost.totalTokens.output.toLocaleString('en-US')} out · ${cost.totalTokens.cacheRead.toLocaleString('en-US')} cache-read · ${cost.totalTokens.cacheCreate.toLocaleString('en-US')} cache-write`);
+    }
     if (inCredits && credits?.balance != null) {
         L(`- **Remaining:** balance ${Math.round(credits.balance).toLocaleString('en-US')}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cspeach/cli",
-  "version": "1.1.47",
+  "version": "1.1.48",
   "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, signed skills, safety gates.",
   "keywords": [
     "abap",