@cspeach/cli 1.1.7 → 1.1.9

package/dist/agent/providers/ai-hub-provider.js

@@ -1,5 +1,5 @@
 import Anthropic from '@anthropic-ai/sdk';
-import keytar from 'keytar';
+import keychain from '../../auth/keychain.js';
 import { createManifestSkillSource } from '../../skills/source-manifest.js';
 import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
 const KEYCHAIN_SERVICE = 'cspeach.ai-hub';
@@ -26,7 +26,7 @@ export function createAiHubProvider(cfg) {
             return sdk.messages.stream({ ...params, model: modelAlias }, options.signal ? { signal: options.signal } : undefined);
         },
         async healthCheck() {
-            const token = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+            const token = await keychain.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
             if (!token)
                 return { ok: false, message: 'AI Hub token not in keychain', hint: 'Run: cspeach config set llm.ai_hub_token <token>' };
             try {
@@ -51,7 +51,7 @@ export function createAiHubProvider(cfg) {
     };
 }
 async function getToken() {
-    const t = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    const t = await keychain.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
     if (!t)
         throw new Error('AI Hub token not configured');
     return t;

package/dist/agent/providers/byok-provider.js

@@ -1,5 +1,5 @@
 import Anthropic from '@anthropic-ai/sdk';
-import keytar from 'keytar';
+import keychain from '../../auth/keychain.js';
 import { createManifestSkillSource } from '../../skills/source-manifest.js';
 import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
 const KEYCHAIN_SERVICE = 'cspeach.anthropic';
@@ -21,7 +21,7 @@ export function createByokProvider(_cfg) {
             return sdk.messages.stream(params, options.signal ? { signal: options.signal } : undefined);
         },
         async healthCheck() {
-            const key = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+            const key = await keychain.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
             if (!key)
                 return { ok: false, message: 'Anthropic API key not in keychain', hint: 'Run: cspeach config set llm.byok_key <your-anthropic-key>' };
             try {
@@ -46,7 +46,7 @@ export function createByokProvider(_cfg) {
     };
 }
 async function getKey() {
-    const key = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    const key = await keychain.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
     if (!key)
         throw new Error('BYOK Anthropic API key not configured — run: cspeach config set llm.byok_key <key>');
     return key;

package/dist/auth/api-key.js

@@ -1,16 +1,16 @@
-import keytar from 'keytar';
+import keychain from './keychain.js';
 const SERVICE = 'cspeach';
 const ACCOUNT = 'api-key';
-class KeytarStore {
-    async get() { return keytar.getPassword(SERVICE, ACCOUNT); }
-    async set(key) { await keytar.setPassword(SERVICE, ACCOUNT, key); }
-    async delete() { await keytar.deletePassword(SERVICE, ACCOUNT); }
+class KeychainStore {
+    async get() { return keychain.getPassword(SERVICE, ACCOUNT); }
+    async set(key) { await keychain.setPassword(SERVICE, ACCOUNT, key); }
+    async delete() { await keychain.deletePassword(SERVICE, ACCOUNT); }
     async isKeychainAvailable() {
         try {
             const probe = `probe-${Date.now()}`;
-            await keytar.setPassword(SERVICE, 'probe', probe);
-            const ok = (await keytar.getPassword(SERVICE, 'probe')) === probe;
-            await keytar.deletePassword(SERVICE, 'probe');
+            await keychain.setPassword(SERVICE, 'probe', probe);
+            const ok = (await keychain.getPassword(SERVICE, 'probe')) === probe;
+            await keychain.deletePassword(SERVICE, 'probe');
             return ok;
         }
         catch {
@@ -29,7 +29,7 @@ let store;
 export async function getStore() {
     if (store)
         return store;
-    const ktr = new KeytarStore();
+    const ktr = new KeychainStore();
     if (await ktr.isKeychainAvailable()) {
         store = ktr;
     }

package/dist/cli.js

@@ -162,32 +162,32 @@ export async function main(argv) {
     return runRepl({ sapAlias, noSap });
 }
 function printHelp() {
-    console.log(`
-CSPeach — AI-assisted ABAP development CLI
-
-Usage:
-  cspeach                           Start interactive REPL
-  cspeach "<prompt>"                One-shot — runs one turn and exits
-  cspeach --one-shot "<prompt>"     Same as above, explicit flag
-  cspeach --sap-alias <name>        Use a specific SAP alias (overrides default)
-  cspeach --no-sap                  Start without a SAP system (paste-mode skills only)
-  cspeach --resume [id]             Resume a previous session (list if no id)
-  cspeach config add-sap            Add a SAP system interactively
-  cspeach config standalone         Set the standalone SAP profile (no system)
-  cspeach standards init            Capture your team's ABAP development standards
-  cspeach configure                 Alias for \`cspeach config add-sap\`
-  cspeach config set <key> <value>  Update a config key
-  cspeach config unset <key>        Remove a config key (revert to default)
-  cspeach config show [key]         Show config (full or single key)
-  cspeach doctor                    Diagnose install + connectivity
-  cspeach login                     Sign in via device-code flow
-  cspeach logout                    Sign out (keep keytar key, if any)
-  cspeach whoami                    Print current account info
-  cspeach analyze project-context   Compare flag-on vs flag-off session metrics
-  cspeach --upgrade                 Upgrade to latest via npm
-  cspeach --version                 Print version
-  cspeach --help                    Show this help
-
-Docs: https://cspeach.dev
+    console.log(`
+CSPeach — AI-assisted ABAP development CLI
+
+Usage:
+  cspeach                           Start interactive REPL
+  cspeach "<prompt>"                One-shot — runs one turn and exits
+  cspeach --one-shot "<prompt>"     Same as above, explicit flag
+  cspeach --sap-alias <name>        Use a specific SAP alias (overrides default)
+  cspeach --no-sap                  Start without a SAP system (paste-mode skills only)
+  cspeach --resume [id]             Resume a previous session (list if no id)
+  cspeach config add-sap            Add a SAP system interactively
+  cspeach config standalone         Set the standalone SAP profile (no system)
+  cspeach standards init            Capture your team's ABAP development standards
+  cspeach configure                 Alias for \`cspeach config add-sap\`
+  cspeach config set <key> <value>  Update a config key
+  cspeach config unset <key>        Remove a config key (revert to default)
+  cspeach config show [key]         Show config (full or single key)
+  cspeach doctor                    Diagnose install + connectivity
+  cspeach login                     Sign in via device-code flow
+  cspeach logout                    Sign out (keep keychain key, if any)
+  cspeach whoami                    Print current account info
+  cspeach analyze project-context   Compare flag-on vs flag-off session metrics
+  cspeach --upgrade                 Upgrade to latest via npm
+  cspeach --version                 Print version
+  cspeach --help                    Show this help
+
+Docs: https://cspeach.dev
 `);
 }

package/dist/commands/config-set.js

@@ -400,12 +400,12 @@ export async function runConfigSet(args) {
         else {
             console.log(chalk.yellow(`WARN: secret passed as shell argument — will land in shell history. Prefer: cat key.txt | cspeach config set ${key} -`));
         }
-        const { default: keytar } = await import('keytar');
+        const { default: keychain } = await import('../auth/keychain.js');
         if (key === 'llm.byok_key') {
-            await keytar.setPassword('cspeach.anthropic', 'api-key', secret);
+            await keychain.setPassword('cspeach.anthropic', 'api-key', secret);
         }
         else {
-            await keytar.setPassword('cspeach.ai-hub', 'token', secret);
+            await keychain.setPassword('cspeach.ai-hub', 'token', secret);
         }
         console.log(chalk.green(`✓ Secret stored in OS keychain (service: ${key === 'llm.byok_key' ? 'cspeach.anthropic' : 'cspeach.ai-hub'})`));
         return;

package/dist/commands/login.js

@@ -13,7 +13,7 @@
  * Dependencies (open, print, prompt) are injected so the command is
  * unit-testable without stubbing platform globals.
  */
-import keytar from 'keytar';
+import keychain from '../auth/keychain.js';
 import { writeAuthFile } from '../auth/auth-file.js';
 import { fetchOrgAnthropicKey } from '../auth/org-anthropic-key.js';
 const ANTHROPIC_KEYCHAIN_SERVICE = 'cspeach.anthropic';
@@ -101,7 +101,7 @@ export async function runLoginCommand(deps) {
                     fetchImpl: deps.fetchImpl,
                 });
                 const setKey = deps.setKeychainKey ??
-                    ((svc, acct, k) => keytar.setPassword(svc, acct, k));
+                    ((svc, acct, k) => keychain.setPassword(svc, acct, k));
                 if (orgKey !== null) {
                     await setKey(ANTHROPIC_KEYCHAIN_SERVICE, ANTHROPIC_KEYCHAIN_ACCOUNT, orgKey);
                     deps.print('Using your organization\'s Anthropic key.');

package/dist/commands/logout.js

@@ -8,7 +8,7 @@ export async function runLogoutCommand(deps) {
     await deleteAuthFile();
     if (before) {
         deps.print('✓ Signed out — removed ~/.cspeach/auth.json');
-        deps.print('  (the REPL will use the keytar-stored key if you have one)');
+        deps.print('  (the REPL will use the keychain-stored key if you have one)');
     }
     else {
         deps.print('Already signed out — no auth.json present.');

package/dist/commands/whoami.js

@@ -10,7 +10,7 @@ export async function runWhoamiCommand(deps) {
     const auth = await readAuthFile();
     if (!auth) {
         deps.print('Not signed in via cspeach login (no ~/.cspeach/auth.json).');
-        deps.print('Your REPL may still authenticate via the keytar-stored key — run `cspeach` to check.');
+        deps.print('Your REPL may still authenticate via the keychain-stored key — run `cspeach` to check.');
         return 0;
     }
     const me = await fetchMe({ proxyUrl: deps.proxyUrl, apiKey: auth.apiKey });

package/dist/doctor/checks/keychain.js

@@ -1,10 +1,10 @@
-import keytar from 'keytar';
+import keychain from '../../auth/keychain.js';
 export async function checkKeychain() {
     try {
         const probe = `probe-${Date.now()}`;
-        await keytar.setPassword('cspeach', 'probe', probe);
-        const ok = (await keytar.getPassword('cspeach', 'probe')) === probe;
-        await keytar.deletePassword('cspeach', 'probe');
+        await keychain.setPassword('cspeach', 'probe', probe);
+        const ok = (await keychain.getPassword('cspeach', 'probe')) === probe;
+        await keychain.deletePassword('cspeach', 'probe');
         if (ok)
             return { name: 'keychain', ok: true, message: 'OS keychain working' };
         return { name: 'keychain', ok: false, message: 'probe write/read mismatch', hint: 'Per-session fallback mode will be used' };

package/dist/doctor/checks/zcspeach.js

@@ -1,4 +1,4 @@
-import keytar from 'keytar';
+import keychain from '../../auth/keychain.js';
 import { readFile } from 'node:fs/promises';
 import { loadConfig, resolveSapTls } from '../../config/loader.js';
 import { probeGet } from './_http-probe.js';
@@ -26,7 +26,7 @@ export async function checkZcspeach() {
         const url = `${protocol}://${sys.host}:${sys.port}/sap/bc/zcspeach/discovery`;
         let pwd = null;
         try {
-            pwd = await keytar.getPassword(SAP_SERVICE, alias);
+            pwd = await keychain.getPassword(SAP_SERVICE, alias);
         }
         catch {
             // keychain unavailable — fall through, will be skipped below

package/dist/repl.js

@@ -384,9 +384,9 @@ export async function runRepl(opts) {
     // Having aliases configured does NOT override the request.
     // A session that WAS standalone stays standalone on `--resume`: its
     // sap_system is the reserved 'none' alias, which has no entry in cfg.sap.
-    const standalone = resolveStandalone(cfg, opts?.noSap === true) ||
+    let standalone = resolveStandalone(cfg, opts?.noSap === true) ||
         opts?.resumedSession?.sap_system === STANDALONE_ALIAS;
-    if (standalone) {
+    const enterStandalone = async () => {
         console.log(chalk.dim('\nStandalone mode: no SAP system connected — skills work from pasted code. ' +
             'Connect later with: cspeach config add-sap'));
         // Ask the profile questions ONCE — they become the <sap_system> element
@@ -396,11 +396,30 @@ export async function runRepl(opts) {
             await runStandaloneProfileWizard({ cwd: process.cwd() });
             cfg = await loadConfig();
         }
+    };
+    if (standalone) {
+        await enterStandalone();
     }
     else if (Object.keys(cfg.sap).length === 0) {
-        console.log(chalk.yellow('\nNo SAP systems configured. Starting onboarding wizard.'));
-        await runAddSapWizard();
-        cfg = await loadConfig();
+        // First run with nothing configured (2026-09-17): let the user choose.
+        // Someone without SAP access used to be pushed into the SAP wizard with
+        // no way out except knowing --no-sap. Non-TTY runs skip the question and
+        // keep the previous behaviour exactly.
+        const { chooseFirstRunMode } = await import('./sap/first-run-choice.js');
+        const mode = await chooseFirstRunMode();
+        if (mode === 'standalone') {
+            // Persist so the next plain `cspeach` is standalone too — same effect
+            // as `cspeach config set no_sap on`, which the user can undo any time.
+            cfg.no_sap = true;
+            await saveConfig(cfg);
+            standalone = true;
+            await enterStandalone();
+        }
+        else {
+            console.log(chalk.yellow('\nNo SAP systems configured. Starting onboarding wizard.'));
+            await runAddSapWizard();
+            cfg = await loadConfig();
+        }
     }
     // model-governance step 2d — fire-and-forget fetch of the served model-config
     // (managed mode only). NEVER blocks startup: a turn that starts before the

package/dist/sap/connection-manager.js

@@ -1,4 +1,4 @@
-import keytar from 'keytar';
+import keychain from '../auth/keychain.js';
 import { SapConnection } from '@cspeach/sap-client';
 import { resolveSapTls } from '../config/loader.js';
 import { password as promptPassword } from '@inquirer/prompts';
@@ -12,7 +12,7 @@ export async function getConnection(alias, cfg) {
     let passwordValue;
     if (cfg.authType === 'basic') {
         try {
-            passwordValue = (await keytar.getPassword(SAP_SERVICE, alias)) ?? undefined;
+            passwordValue = (await keychain.getPassword(SAP_SERVICE, alias)) ?? undefined;
         }
         catch { /* keychain unavailable */ }
         if (!passwordValue) {

package/dist/sap/first-run-choice.js

@@ -0,0 +1,34 @@
+/**
+ * First-run choice (2026-09-17). Before this, a fresh install that started
+ * with plain `cspeach` (no --no-sap flag, no persisted no_sap) was pushed
+ * straight into the "Add SAP system" wizard — someone with no SAP access had
+ * no way forward except to know the flag. Seen live on Laeeq's dry run.
+ *
+ * Now, when no SAP alias is configured, the user picks how to start. The
+ * standalone answer is listed first: it needs nothing, and it is the path a
+ * trial user is on. Non-interactive runs (piped stdin, CI) never see the
+ * prompt and keep the exact pre-existing behaviour (the SAP wizard branch).
+ */
+import { select } from '@inquirer/prompts';
+export const FIRST_RUN_CHOICES = [
+    {
+        name: 'Work standalone — no SAP connection',
+        value: 'standalone',
+        description: 'Paste code or a requirement in; get code, reviews, designs and step-by-step implementation guides out. Connect a system later with: cspeach config add-sap',
+    },
+    {
+        name: 'Connect to an SAP system now',
+        value: 'sap',
+        description: 'Host, client, user and password for an SAP system CSPeach may read and write through ADT.',
+    },
+];
+export async function chooseFirstRunMode(deps = {}) {
+    const isTTY = deps.isTTY ?? process.stdin.isTTY === true;
+    if (!isTTY)
+        return 'sap';
+    const ask = deps.select ?? select;
+    return ask({
+        message: 'No SAP system is set up yet. How do you want to start?',
+        choices: FIRST_RUN_CHOICES,
+    });
+}

package/dist/sap/onboarding.js

@@ -1,6 +1,6 @@
 import { input, select, password, confirm } from '@inquirer/prompts';
 import chalk from 'chalk';
-import keytar from 'keytar';
+import keychain from '../auth/keychain.js';
 import { loadConfig, saveConfig } from '../config/loader.js';
 const SAP_SERVICE = 'cspeach-sap';
 export async function runAddSapWizard() {
@@ -87,7 +87,7 @@ export async function runAddSapWizard() {
             mask: '*',
         });
         try {
-            await keytar.setPassword(SAP_SERVICE, alias, pwd);
+            await keychain.setPassword(SAP_SERVICE, alias, pwd);
         }
         catch {
             console.log(chalk.yellow('Warning: keychain unavailable; password will be prompted per session.'));
@@ -166,7 +166,7 @@ export async function runAddSapWizard() {
                 mask: '*',
             });
             try {
-                await keytar.setPassword('cspeach.ai-hub', 'token', aiHubToken);
+                await keychain.setPassword('cspeach.ai-hub', 'token', aiHubToken);
             }
             catch {
                 console.log(chalk.yellow('Warning: keychain unavailable; AI Hub token will be prompted per session.'));
@@ -188,7 +188,7 @@ export async function runAddSapWizard() {
                 mask: '*',
             });
             try {
-                await keytar.setPassword('cspeach.anthropic', 'api-key', byokKey);
+                await keychain.setPassword('cspeach.anthropic', 'api-key', byokKey);
             }
             catch {
                 console.log(chalk.yellow('Warning: keychain unavailable; Anthropic key will be prompted per session.'));

package/dist/skills/bundled-skills.js

@@ -1,6 +1,6 @@
 // GENERATED FILE — bundled skills for local mode.
 // Source: https://manifest.cspeach.dev/v1.json
-// Generated: 2026-09-17T15:05:10.303Z
+// Generated: 2026-09-17T16:36:01.136Z
 // Manifest signature verified at build time.
 export const BUNDLED_SKILLS = {
     "abap-atc-fix": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cspeach/cli",
-  "version": "1.1.7",
+  "version": "1.1.9",
   "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
   "keywords": [
     "abap",
@@ -71,7 +71,7 @@
     "ink": "^5.0.0",
     "ink-text-input": "^6.0.0",
     "jose": "^5.9.0",
-    "keytar": "^7.9.0",
+    "@napi-rs/keyring": "2.1.0",
     "mammoth": "^1.8.0",
     "marked": "^11.2.0",
     "marked-terminal": "^6.2.0",
@@ -102,7 +102,6 @@
   },
   "pnpm": {
     "onlyBuiltDependencies": [
-      "keytar",
       "esbuild"
     ]
   }