@cspeach/cli 1.1.47 → 1.1.49

package/dist/config/loader.js

@@ -6,6 +6,8 @@ import { DEFAULT_SESSION_MODEL } from './model-defaults.js';
 import { sanitiseStandaloneProfile } from '../sap/standalone-profile.js';
 import { DEFAULT_STYLE, parseStyle } from '../agent/style.js';
 import { DEFAULT_LEVEL, parseLevel } from '../agent/level.js';
+import { setProvisionalCostDisplayMode } from '../cost/credits.js';
+import { provisionalDisplayMode } from '../cost/display-mode.js';
 /**
  * Whitelist guard for WriteMode — rejects typos / stale values from disk so
  * downstream code that trusts the WriteMode type doesn't see garbage.
@@ -148,7 +150,18 @@ export function resolveSapTls(sys) {
 }
 /** Tracks whether the one-time legacy-sslVerify deprecation note has printed. */
 let legacySslVerifyNoticeShown = false;
+/**
+ * Load the config, then set the cost display mode it implies until the server
+ * answers (2026-10-19). Every command loads the config first, so no path — one
+ * that never reaches initCredits included — can show dollars on a managed
+ * account by default.
+ */
 export async function loadConfig() {
+    const cfg = await readConfig();
+    setProvisionalCostDisplayMode(provisionalDisplayMode(cfg));
+    return cfg;
+}
+async function readConfig() {
     try {
         const raw = await fs.readFile(configFile(), 'utf-8');
         // Strip a leading UTF-8 BOM (U+FEFF). Node's 'utf-8' read does NOT remove it,

package/dist/cost/cost-log.js

@@ -15,7 +15,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { sessionsDir } from '../config/paths.js';
 import { computeCost } from './pricing.js';
-import { tokensOnlyActive } from './credits.js';
+import { activeCostDisplayMode } from './credits.js';
 /**
  * Task 7 — summarise `message_start.message.input_transformations` (probe P4
  * shape: `[{ type: 'thinking_dropped', path, reason }]`). Counts the
@@ -56,8 +56,10 @@ export function buildEntry(opts) {
         turn: opts.turn,
         model: opts.model,
         tokens: opts.tokens,
-        // Azure: no price for the customer's deployment — never consult one.
-        cost: tokensOnlyActive() ? 0 : computeCost(opts.model, opts.tokens),
+        // Only where dollars are shown (own key, or a permitted operator). Credits:
+        // this file sits on the customer's disk, so it never holds our cost
+        // (2026-10-19). Azure: no price for the customer's deployment.
+        cost: activeCostDisplayMode() === 'usd' ? computeCost(opts.model, opts.tokens) : 0,
         duration_ms: opts.duration_ms,
     };
     if (opts.credits) {
@@ -77,7 +79,8 @@ export function buildEntry(opts) {
     if (opts.input_transformations !== undefined)
         entry.input_transformations = opts.input_transformations;
     if (opts.reader && opts.reader.calls > 0) {
-        entry.reader_cost_usd = Math.round(opts.reader.cost * 10000) / 10000;
+        if (activeCostDisplayMode() === 'usd')
+            entry.reader_cost_usd = Math.round(opts.reader.cost * 10000) / 10000;
         entry.reader_calls = opts.reader.calls;
     }
     return entry;

package/dist/cost/credits-wire.js

@@ -22,7 +22,7 @@
  * a one-liner and no module has to re-derive the display mode for itself.
  */
 import { fetchBalance, globalCredits, setCostDisplayMode, creditsActive, } from './credits.js';
-import { costDisplayMode } from './display-mode.js';
+import { costDisplayMode, provisionalDisplayMode } from './display-mode.js';
 import { globalStore } from '../ui/sap-state-store.js';
 let wiredCfg = null;
 let wiredBearer = null;
@@ -39,14 +39,14 @@ function publish() {
 }
 /**
  * Startup: resolve the display mode and seed the opening balance.
- * Never throws; on any failure the process stays in USD mode, which is the
- * pre-credits behaviour.
+ * Never throws. On any failure a managed account stays in credits (2026-10-19:
+ * this used to fall back to dollars — our cost on the customer's screen).
  */
 export async function initCredits(cfg, getBearer) {
     try {
         // Non-managed modes can't be metered by us — skip the round-trip entirely.
         if (cfg.llm?.mode !== 'managed') {
-            setCostDisplayMode(cfg.llm?.mode === 'azure' ? 'tokens' : 'usd');
+            setCostDisplayMode(provisionalDisplayMode(cfg));
             return;
         }
         const info = await fetchBalance(cfg, getBearer);
@@ -60,8 +60,13 @@ export async function initCredits(cfg, getBearer) {
         publish();
     }
     catch {
-        // Startup must never be blocked by the meter.
-        setCostDisplayMode('usd');
+        // Startup must never be blocked by the meter — and never shows our cost.
+        setCostDisplayMode(provisionalDisplayMode(cfg));
+        // The footer reads the store's flag, so publish the mode here too.
+        if (creditsActive()) {
+            globalCredits.start(null);
+            publish();
+        }
     }
 }
 /**

package/dist/cost/credits.js

@@ -61,6 +61,8 @@ export async function fetchBalance(cfg, getBearer) {
         };
         if (b.unprovisioned === true)
             info.unprovisioned = true;
+        if (b.cost_view === true)
+            info.cost_view = true;
         return info;
     }
     catch {
@@ -198,9 +200,21 @@ export function formatCreditsLine(s) {
  */
 export const globalCredits = new CreditsTracker();
 let activeMode = 'usd';
+/** True once startup (initCredits) has resolved the mode with the server's answer. */
+let resolved = false;
 /** Publish the resolved display mode for the whole process. */
 export function setCostDisplayMode(mode) {
     activeMode = mode;
+    resolved = true;
+}
+/**
+ * The mode implied by the config alone, set when the config loads. Applies
+ * only until startup resolves the real mode, so a later config reload never
+ * overrides the server's answer (2026-10-19).
+ */
+export function setProvisionalCostDisplayMode(mode) {
+    if (!resolved)
+        activeMode = mode;
 }
 /** The resolved display mode. Defaults to 'usd' until startup resolves it —
  *  fail-safe for BYOK/local/one-shot paths that never call the setter. */
@@ -218,4 +232,5 @@ export function tokensOnlyActive() {
 /** Test seam — reset the process-wide mode between cases. */
 export function resetCostDisplayMode() {
     activeMode = 'usd';
+    resolved = false;
 }

package/dist/cost/display-mode.js

@@ -15,8 +15,10 @@
  *   - managed but unmetered (or the balance fetch failed): we have no
  *     credit truth to show. Fall back to the existing dollar rendering so
  *     the meter is never blank.
- *   - `show_cogs = on`: our own operator escape hatch for reading real COGS
- *     on a managed account (margin analysis, pricing work). Never a default.
+ *   - `show_cogs = on` AND the server's `cost_view` for this account: our own
+ *     operator view of real COGS on a managed account (margin analysis,
+ *     pricing work). The laptop setting alone does nothing (owner 2026-10-19:
+ *     any customer could type it); the server must say yes as well.
  *
  * Callers must treat this as the single source of truth — no site may
  * re-derive the mode from `cfg.llm.mode` alone.
@@ -28,13 +30,23 @@ export function costDisplayMode(cfg, balanceInfo) {
         return 'tokens';
     if (cfg.llm?.mode !== 'managed')
         return 'usd';
-    if (cfg.show_cogs === true)
+    if (cfg.show_cogs === true && balanceInfo?.cost_view === true)
         return 'usd';
     // 2026-09-17 — a managed account NEVER falls back to dollars. Before, a
     // balance lookup that failed or took over 2.5s at start (slow network on a
     // customer laptop) dropped the display to USD — our cost on their screen,
     // exactly what credits mode exists to prevent. Unknown or unmetered
     // balances render "credits: updating…" until the next good sample.
-    void balanceInfo;
     return 'credits';
 }
+/**
+ * The mode before the server has answered — set the moment the config loads,
+ * so nothing printed early can show dollars on a managed account.
+ */
+export function provisionalDisplayMode(cfg) {
+    if (cfg.llm?.mode === 'azure')
+        return 'tokens';
+    if (cfg.llm?.mode === 'managed')
+        return 'credits';
+    return 'usd';
+}

package/dist/doctor/checks/zcspeach.js

@@ -0,0 +1,96 @@
+import keychain from '../../auth/keychain.js';
+import { readFile } from 'node:fs/promises';
+import { loadConfig, resolveSapTls } from '../../config/loader.js';
+import { probeGet } from './_http-probe.js';
+import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
+const SAP_SERVICE = 'cspeach-sap';
+export async function checkZcspeach() {
+    const cfg = await loadConfig();
+    // Standalone mode ONLY — an opted-in paste-mode user has nothing to probe.
+    // Everything below (including the no-alias failure) is unchanged.
+    if (sapChecksSkipped(cfg))
+        return standaloneSkip('zcspeach');
+    const systems = Object.entries(cfg.sap);
+    if (systems.length === 0) {
+        return {
+            name: 'zcspeach',
+            ok: false,
+            message: 'no SAP systems configured',
+            hint: 'Run: cspeach config add-sap',
+        };
+    }
+    const results = [];
+    let anyFailed = false;
+    for (const [alias, sys] of systems) {
+        const protocol = sys.useSsl ? 'https' : 'http';
+        const url = `${protocol}://${sys.host}:${sys.port}/sap/bc/zcspeach/discovery`;
+        let pwd = null;
+        try {
+            pwd = await keychain.getPassword(SAP_SERVICE, alias);
+        }
+        catch {
+            // keychain unavailable — fall through, will be skipped below
+        }
+        if (!pwd) {
+            results.push(`${alias}: skipped (no password in keychain)`);
+            continue;
+        }
+        // TLS posture (2026-06-14): verification ON by default; resolveSapTls maps
+        // the per-alias config (ca_cert_path / insecure_skip_tls_verify, legacy
+        // sslVerify:false fallback). See checks/_http-probe.ts.
+        const tls = resolveSapTls(sys);
+        let ca;
+        if (tls.mode === 'ca-trusted' && tls.caCertPath) {
+            try {
+                ca = await readFile(tls.caCertPath);
+            }
+            catch (e) {
+                results.push(`${alias}: CA unreadable at ${tls.caCertPath} (${e.message})`);
+                anyFailed = true;
+                continue;
+            }
+        }
+        const r = await probeGet(url, {
+            rejectUnauthorized: tls.mode !== 'insecure',
+            ca,
+            auth: `${sys.username}:${pwd}`,
+            accept: 'application/json',
+            timeoutMs: 5000,
+        });
+        if (r.error) {
+            results.push(`${alias}: ${r.error}`);
+            anyFailed = true;
+            continue;
+        }
+        if (r.status < 200 || r.status >= 300) {
+            results.push(`${alias}: HTTP ${r.status} from /zcspeach/discovery`);
+            anyFailed = true;
+            continue;
+        }
+        let body;
+        try {
+            body = JSON.parse(r.body);
+        }
+        catch {
+            results.push(`${alias}: invalid JSON from /zcspeach/discovery`);
+            anyFailed = true;
+            continue;
+        }
+        if (body.status !== 'ok') {
+            results.push(`${alias}: discovery returned status=${body.status ?? '<missing>'}`);
+            anyFailed = true;
+            continue;
+        }
+        const ver = body.data?.version ?? '<missing>';
+        const ops = body.data?.operations?.length ?? 0;
+        results.push(`${alias}: v${ver}, ${ops} ops`);
+    }
+    return {
+        name: 'zcspeach',
+        ok: !anyFailed,
+        message: results.join('; '),
+        hint: anyFailed
+            ? 'SICF node /sap/bc/zcspeach must be active; ensure SAP_BASIS supports the framework'
+            : undefined,
+    };
+}