@cspeach/cli 1.1.32 → 1.1.34

package/dist/repl.js

@@ -27,7 +27,12 @@ import { applyResumedSkill, isShortFollowUp } from './router/resume-routing.js';
 import { readableInterruptReason, isUserStopReason } from './session/interrupt-reason.js';
 import { getStore } from './auth/api-key.js';
 import { readAuthFile } from './auth/auth-file.js';
+import { resolveApiKey } from './auth/key-resolver.js';
 import { fetchMe } from './auth/me.js';
+import { runLicenceCheck, licenceCheckHeaders } from './licence/licence-check.js';
+import { LicenceTurnGate } from './licence/turn-gate.js';
+import { runStartupAccount } from './repl/startup-account.js';
+import { startSkillsCacheWarmup } from './skills/source-authed.js';
 import { formatLoginBanner, signInFragment } from './ui/login-banner.js';
 import { printStartupBanner, printKeytarFallbackBanner, keychainFallbackNotice } from './renderer/banners.js';
 import { paint } from './renderer/theme.js';
@@ -39,15 +44,18 @@ import { AdtClient, snapshots } from '@cspeach/sap-client';
 import { makeSessionId, saveSession, sessionSaved } from './session/store.js';
 import { newSession } from './session/schema.js';
 import { resolveModelRole } from './models/resolve.js';
+import { familyOf, planTierModelFor, getActiveDeployments } from './models/model-identity.js';
 import { loadServerModelConfig, loadCustomerModelConfig, fetchToolLoadingMode } from './models/server-config.js';
 import { prefetchRouterPrompt } from './router/router-prompt.js';
+import { profileForMode } from './agent/connection-profile.js';
 import { repinResumedSessionModel } from './session/repin-model.js';
 import { computeCost } from './cost/pricing.js';
 import { formatSessionSpendValue } from './repl/session-spend-line.js';
 import { formatGoodbye } from './renderer/goodbye.js';
-import { globalCredits } from './cost/credits.js';
+import { globalCredits, tokensOnlyActive } from './cost/credits.js';
 import { initCredits } from './cost/credits-wire.js';
 import { createProviderForMode } from './agent/providers/factory.js';
+import { startUsageFlushAtStartup } from './usage/usage-reporter.js';
 import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
 import { IdleKeepalive } from './agent/cache-keepalive.js';
@@ -294,7 +302,8 @@ function existingStreamDir(sessionId) {
 }
 function printGoodbye(session) {
     const userTurns = session.messages.filter((m) => m.role === 'user' && typeof m.content === 'string').length;
-    const sessionCost = computeCost(session.model, {
+    // Azure: no price for the customer's deployment — never consult one.
+    const sessionCost = tokensOnlyActive() ? 0 : computeCost(session.model, {
         input: session.usage.input_tokens ?? 0,
         output: session.usage.output_tokens ?? 0,
         cacheRead: session.usage.cache_read_input_tokens ?? 0,
@@ -457,46 +466,51 @@ export async function runRepl(opts) {
         }
     }
     catch { /* startup banner is best-effort */ }
-    // Customer-onboarding (Task 9): if the new auth-file is present, hit /v1/me
-    // and render the verbose login banner. Falls through to the legacy keytar
-    // flow below when the file is absent (back-compat for pre-`cspeach login`
-    // users).
+    // Customer-onboarding (Task 9) + security batch item 1.
+    // Managed: today's call exactly — only when auth.json exists, the key is
+    // resolved only then, the same request, and a 401 exits. Falls through to the
+    // legacy keytar flow below when the file is absent (back-compat for
+    // pre-`cspeach login` users).
+    // byok / ai-hub / local: the shared licence check — server verdict, 72-hour
+    // offline grace, licence.json — whether or not auth.json exists. It IS this
+    // start-up /v1/me call (one request, the same 5 s budget), never a second one.
+    // The block lives in repl/startup-account.ts (behaviour-identical lift, driven
+    // by repl/__tests__/startup-account.test.ts).
     let signIn;
     let signedInAs;
-    try {
-        const authFile = await readAuthFile();
-        if (authFile) {
-            const cfgEarly = await loadConfig();
-            const meResult = await fetchMe({ proxyUrl: cfgEarly.proxy_url, apiKey: authFile.apiKey });
-            if (!meResult.ok) {
-                if (meResult.status === 401) {
-                    earlyBrand?.close();
-                    console.log(formatFailure({ what: 'Your CSPeach sign-in is no longer valid', next: 'cspeach login' }));
-                    return 1;
-                }
-                const note = formatInfo(`Could not refresh your account (${meResult.error})`);
-                if (getLook() === 'panels')
-                    startupNotices.push(note);
-                else
-                    console.log(note.trimEnd());
-            }
-            else {
-                signedInAs = meResult.profile.email;
-                const banner = formatLoginBanner(meResult.profile);
-                if (getLook() === 'panels') {
-                    signIn = signInFragment(meResult.profile);
-                    if (banner.warningLine)
-                        startupNotices.push(formatAttention({ text: banner.warningLine }));
-                }
-                else {
-                    console.log(banner.line);
-                    if (banner.warningLine)
-                        console.log(formatAttention({ text: banner.warningLine }).trimEnd());
-                }
-            }
+    const showProfile = (profile) => {
+        signedInAs = profile.email;
+        const banner = formatLoginBanner(profile);
+        if (getLook() === 'panels') {
+            signIn = signInFragment(profile);
+            if (banner.warningLine)
+                startupNotices.push(formatAttention({ text: banner.warningLine }));
         }
-    }
-    catch { /* banner is best-effort — never block REPL startup */ }
+        else {
+            console.log(banner.line);
+            if (banner.warningLine)
+                console.log(formatAttention({ text: banner.warningLine }).trimEnd());
+        }
+    };
+    const startupAccount = await runStartupAccount({
+        loadConfig, readAuthFile, resolveApiKey: () => resolveApiKey(), fetchMe, runLicenceCheck, licenceCheckHeaders,
+        // Final review finding 1 — fill the skills cache for offline use. Fire-and-forget.
+        startSkillsWarmup: (c, verdict) => { void startSkillsCacheWarmup(c, verdict); },
+    }, {
+        print: (line) => console.log(line),
+        notice: (note) => {
+            if (getLook() === 'panels')
+                startupNotices.push(note);
+            else
+                console.log(note.trimEnd());
+        },
+        showProfile,
+        closeBrand: () => earlyBrand?.close(),
+    });
+    if (startupAccount.exit === 1)
+        return 1;
+    // Read by the between-turns recheck (Task 6): the 4-hour clock starts here.
+    const licenceCheckedAtMs = startupAccount.licenceCheckedAtMs;
     earlyBrand?.finish(signIn);
     const store = await getStore();
     const keychainMissing = !(await store.isKeychainAvailable());
@@ -601,8 +615,55 @@ export async function runRepl(opts) {
         fetchToolLoadingMode(cfg, async () => apiKey ?? '', { timeoutMs: 1500 }),
         // 2026-10-02 — BYOK / ai-hub route on the laptop: prefetch the signed
         // router prompt (public manifest, no prompt data) under the same cap.
-        cfg.llm?.mode === 'byok' || cfg.llm?.mode === 'ai-hub' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
+        profileForMode(cfg.llm?.mode).router === 'direct' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
     ]);
+    // Azure tenant mode (Task 4) — the company's connection settings, before
+    // the session model is pinned (resolveModelRole reads the deployments).
+    // Cached connection.json, refreshed under the same 1.5 s cap; a changed
+    // endpoint is shown and asked about. A refusal is shown now and the gate
+    // refuses turns — never a fall-back to managed.
+    if (cfg.llm.mode === 'azure') {
+        const { refreshAzureConnection } = await import('./connection/startup.js');
+        const { confirm } = await import('./repl/themed-prompts.js');
+        const { askOrNo } = await import('./repl/ask-or-no.js');
+        const note = (line) => {
+            if (getLook() === 'panels')
+                startupNotices.push(line.endsWith('\n') ? line : `${line}\n`);
+            else
+                console.log(line.trimEnd());
+        };
+        // The "endpoint changed" rows must be on screen BEFORE the question, so
+        // they are held here and printed straight away when a question opens;
+        // anything left over joins the start-up notices.
+        const held = [];
+        const az = await refreshAzureConnection({
+            proxyUrl: cfg.proxy_url, apiKey: apiKey ?? null, interactive: true,
+            print: (line) => { held.push(line); },
+            confirm: async (message) => {
+                for (const line of held.splice(0))
+                    console.log(line.trimEnd());
+                // Ctrl+C here is a no (pending kept), never an unhandled ExitPromptError.
+                return askOrNo((m) => confirm({ message: m, default: false }))(message);
+            },
+        });
+        for (const line of held)
+            note(line);
+        if (!az.verdict.allow)
+            note(az.verdict.message);
+        else if (az.cached) {
+            // Task 6b — the Microsoft sign-in, before the first turn: asks first,
+            // then the browser. Esc / Ctrl+C during it stops it at once (the
+            // listener closes). Its own lines (the address to copy when no browser
+            // opens) print straight away, never held for after the sign-in.
+            const { azureSignInAtStart } = await import('./auth/azure/startup-sign-in.js');
+            const { loginOpener } = await import('./util/open-in-browser.js');
+            const s = await azureSignInAtStart(az.cached.connection, {
+                ask: askOrNo((message) => confirm({ message, default: true })), print: (line) => console.log(line.trimEnd()), open: loginOpener(),
+            });
+            if (!s.ok)
+                note(s.message);
+        }
+    }
     // Credits (2026-09-16) — resolve ONCE, before any cost figure can render.
     // A managed customer is billed in credits at a multiplier we do not
     // disclose, so the dollar figures (our Anthropic COGS) must never reach
@@ -815,6 +876,41 @@ export async function runRepl(opts) {
             throw new Error('No API key configured');
         return key;
     });
+    // Security batch item 1 — licence re-check between turns (byok / ai-hub /
+    // local, every 4 hours from the start-up check). Managed: never calls.
+    const licenceGate = new LicenceTurnGate({
+        mode: cfg.llm.mode,
+        proxyUrl: cfg.proxy_url,
+        getKey: async () => (await store.get()) ?? null,
+        // No start-up check ran (no key yet, e.g. pasted at the prompt below):
+        // non-managed checks on the very first turn. Managed never reads it.
+        lastCheckAtMs: licenceCheckedAtMs ?? (cfg.llm.mode === 'managed' ? Date.now() : -Infinity),
+        ...(cfg.llm.mode === 'azure' ? {
+            extra: async () => (await import('./connection/azure-gate.js')).azureGateCheck(),
+            // Plan D13 — never a prompt between turns (no inquirer inside the Ink
+            // UI): a changed endpoint or tenant is held as pending and the `extra`
+            // gate refuses with "…waiting for you to confirm it · start cspeach to
+            // review it". Nothing is printed here; the gate's refusal is the notice.
+            // So on this 4-hourly path the cache-write-failure line and the ignored
+            // env-override lines are dropped (they show again at the next start).
+            onRecheck: async () => {
+                const { refreshAzureConnection } = await import('./connection/startup.js');
+                await refreshAzureConnection({
+                    proxyUrl: cfg.proxy_url, apiKey: (await store.get()) ?? null, interactive: false,
+                    print: () => { }, confirm: async () => false,
+                });
+            },
+        } : {}),
+    });
+    // Security batch item 3 — send the usage counts still waiting from earlier
+    // runs. Non-managed only (a managed seat makes no call); fire-and-forget:
+    // never awaited, never throws into start-up.
+    if (cfg.llm.mode !== 'managed') {
+        try {
+            startUsageFlushAtStartup(cfg);
+        }
+        catch { /* best effort */ }
+    }
     // Task 15 — keep the prompt cache warm while the user is idle between
     // turns: armed after a turn, disarmed on the next submit and on exit;
     // `[keepalive] idle_pings` per idle period (managed / BYOK only).
@@ -1068,6 +1164,12 @@ export async function runRepl(opts) {
                 printHelp((line) => chunkEmitter.emit('chunk', line + '\n'));
                 return;
             }
+            // /usage (2026-10-09) — this month in credits, from the proxy's ledger.
+            if (trimmed === '/usage') {
+                const { runUsageCommand } = await import('./commands/usage.js');
+                await runUsageCommand((l) => chunkEmitter.emit('chunk', l + '\n'));
+                return;
+            }
             // Phase 1 cost tracking (2026-05-16) — /cost prints session $ summary
             // from the JSONL log written each turn. Read-only, no network.
             if (trimmed === '/cost') {
@@ -1142,6 +1244,16 @@ export async function runRepl(opts) {
             // older turns via Haiku so subsequent turns ingest ~5k tokens of
             // context instead of 500k+. Saves \$3-8 per follow-up turn.
             if (trimmed === '/compact') {
+                // Security batch item 1 — /compact makes a model call: gated like a turn.
+                {
+                    const g = await licenceGate.beforeTurn();
+                    if (!g.allow) {
+                        chunkEmitter.emit('chunk', '\n' + g.message + '\n');
+                        return;
+                    }
+                    if (g.line)
+                        chunkEmitter.emit('chunk', formatInfo(g.line));
+                }
                 const { runCompact, formatCompactResult, buildSummarisationPrompt, serialiseForSummariser } = await import('./commands/compact.js');
                 const { summariseViaProvider } = await import('./agent/summarise-via-provider.js');
                 const { loadConfig } = await import('./config/loader.js');
@@ -1150,7 +1262,7 @@ export async function runRepl(opts) {
                     return await summariseViaProvider(provider, buildSummarisationPrompt(), serialiseForSummariser(toSummarise), 
                     // model-governance step 2d — compact model resolves env > local >
                     // server > built-in (== COMPACTION_MODEL when nothing set).
-                    { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' } });
+                    { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' }, sessionId: session.id });
                 };
                 try {
                     chunkEmitter.emit('chunk', '\n' + formatInfo('Compacting older turns into a summary…'));
@@ -1213,6 +1325,15 @@ export async function runRepl(opts) {
                 chunkEmitter.emit('chunk', '\n' + formatInfo(`Rerouting "${preview}" to /${rr.skill}`));
                 if (rr.warning)
                     chunkEmitter.emit('chunk', chalk.dim(`  (${rr.warning})\n`));
+                {
+                    const g = await licenceGate.beforeTurn();
+                    if (!g.allow) {
+                        chunkEmitter.emit('chunk', '\n' + g.message + '\n');
+                        return;
+                    }
+                    if (g.line)
+                        chunkEmitter.emit('chunk', formatInfo(g.line));
+                }
                 // Re-review 1 — its own AbortController, wired like the main path, so
                 // Ctrl+C and `/exit` stop a rerouted turn the same way.
                 const rerouteAbort = new AbortController();
@@ -1570,6 +1691,20 @@ export async function runRepl(opts) {
                 session.last_object = extractedObject ?? previousObject ?? null;
                 return;
             }
+            // Security batch item 1 — never mid-turn: checked here, before the turn
+            // and before any plan-resume work (run lease, object-list grant,
+            // re-audit, phase context, plan_in_flight). A plan step refused here
+            // never starts; the plan file keeps its state, so `/abap-plan --resume`
+            // continues later.
+            {
+                const g = await licenceGate.beforeTurn();
+                if (!g.allow) {
+                    chunkEmitter.emit('chunk', '\n' + g.message + '\n');
+                    return;
+                }
+                if (g.line)
+                    chunkEmitter.emit('chunk', formatInfo(g.line));
+            }
             // B3 (2026-06-06) — `/abap-plan --resume @plan-file`. Token-free
             // pre-work (load envelope, pick next eligible phase, print the
             // tracker board, inline the phase's rule files) happens in
@@ -1718,7 +1853,7 @@ export async function runRepl(opts) {
                     const { beginPlanPhaseContext, makePhaseBoundarySummariser } = await import('./commands/plan-boundary.js');
                     await beginPlanPhaseContext({
                         session,
-                        summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg)),
+                        summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg), session.id),
                         log: (line) => chunkEmitter.emit('chunk', line + '\n'),
                     });
                 }
@@ -1746,7 +1881,9 @@ export async function runRepl(opts) {
                         delegateTo: planResume.nextDelegateTo,
                         // model-governance step 2d — the session default now resolves
                         // env > local > server > built-in (== cfg.default_model when nothing set).
-                        defaultModel: resolveModelRole('session_default', cfg),
+                        defaultModel: familyOf(resolveModelRole('session_default', cfg), provider),
+                        // Azure tenant mode (Task 2) — undefined (today's Sonnet) with no connection table.
+                        tierModel: planTierModelFor(getActiveDeployments()),
                     });
                     if (choice.model) {
                         planModelOverride = choice.model;
@@ -2172,7 +2309,7 @@ export async function runRepl(opts) {
                         session,
                         config: { ...cfg.compact, auto_threshold_tokens: resolveAutoCompactThreshold(cfg) },
                         queued: pendingDispatchAccessor.get() !== null,
-                        summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg)),
+                        summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg), session.id),
                         emit: (line) => chunkEmitter.emit('chunk', line + '\n'),
                     });
                 }
@@ -2992,6 +3129,12 @@ export async function runRepl(opts) {
             printHelp();
             continue;
         }
+        // /usage (2026-10-09) — classic mirror of the Ink handler above.
+        if (trimmed === '/usage') {
+            const { runUsageCommand } = await import('./commands/usage.js');
+            await runUsageCommand();
+            continue;
+        }
         // Phase 1 cost tracking (2026-05-16) — classic-mode /cost.
         // Mirrors the Ink-mode handler above. /cost prints session $ summary
         // from the JSONL log written each turn. Read-only, no network.
@@ -3062,6 +3205,16 @@ export async function runRepl(opts) {
         // Summarises older turns via Haiku 4.5 so subsequent turns ingest ~5k
         // tokens of context instead of 500k+. Backs up session pre-mutation.
         if (trimmed === '/compact') {
+            // Security batch item 1 — /compact makes a model call: gated like a turn.
+            {
+                const g = await licenceGate.beforeTurn();
+                if (!g.allow) {
+                    console.log(g.message);
+                    continue;
+                }
+                if (g.line)
+                    console.log(formatInfo(g.line).trimEnd());
+            }
             const { runCompact, formatCompactResult, buildSummarisationPrompt, serialiseForSummariser } = await import('./commands/compact.js');
             const { summariseViaProvider } = await import('./agent/summarise-via-provider.js');
             const { loadConfig } = await import('./config/loader.js');
@@ -3070,7 +3223,7 @@ export async function runRepl(opts) {
                 return await summariseViaProvider(provider, buildSummarisationPrompt(), serialiseForSummariser(toSummarise), 
                 // model-governance step 2d — compact model resolves env > local >
                 // server > built-in (== COMPACTION_MODEL when nothing set).
-                { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' } });
+                { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' }, sessionId: session.id });
             };
             try {
                 console.log('\n' + formatInfo('Compacting older turns into a summary…').trimEnd());
@@ -3142,6 +3295,15 @@ export async function runRepl(opts) {
             console.log(formatInfo(`Rerouting "${preview}" to /${rr.skill}`).trimEnd());
             if (rr.warning)
                 console.log(chalk.dim(`  (${rr.warning})`));
+            {
+                const g = await licenceGate.beforeTurn();
+                if (!g.allow) {
+                    console.log(g.message);
+                    continue;
+                }
+                if (g.line)
+                    console.log(formatInfo(g.line).trimEnd());
+            }
             // A turn error prints the same stderr block as the normal turn path.
             await runRerouteTurn({
                 run: () => runTurn({
@@ -3562,6 +3724,17 @@ export async function runRepl(opts) {
             session.last_object = extractedObject ?? previousObject ?? null;
             continue;
         }
+        // Security batch item 1 — checked before the turn and before any
+        // plan-resume work (classic mirror of the Ink path).
+        {
+            const g = await licenceGate.beforeTurn();
+            if (!g.allow) {
+                console.log(g.message);
+                continue;
+            }
+            if (g.line)
+                console.log(formatInfo(g.line).trimEnd());
+        }
         // B3 (2026-06-06) — `/abap-plan --resume @plan-file` (classic-mode
         // mirror of the Ink path above; see that block for the full design
         // note). Token-free pre-work; terminal states end the turn with no
@@ -3688,7 +3861,7 @@ export async function runRepl(opts) {
                 const { beginPlanPhaseContext, makePhaseBoundarySummariser } = await import('./commands/plan-boundary.js');
                 await beginPlanPhaseContext({
                     session,
-                    summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg)),
+                    summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg), session.id),
                     log: (line) => console.log(line),
                 });
             }
@@ -3711,7 +3884,9 @@ export async function runRepl(opts) {
                     delegateTo: planResume.nextDelegateTo,
                     // model-governance step 2d — the session default now resolves
                     // env > local > server > built-in (== cfg.default_model when nothing set).
-                    defaultModel: resolveModelRole('session_default', cfg),
+                    defaultModel: familyOf(resolveModelRole('session_default', cfg), provider),
+                    // Azure tenant mode (Task 2) — undefined (today's Sonnet) with no connection table.
+                    tierModel: planTierModelFor(getActiveDeployments()),
                 });
                 if (choice.model) {
                     planModelOverride = choice.model;
@@ -4115,7 +4290,7 @@ export async function runRepl(opts) {
                     session,
                     config: { ...cfg.compact, auto_threshold_tokens: resolveAutoCompactThreshold(cfg) },
                     queued: pendingDispatchAccessor.get() !== null,
-                    summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg)),
+                    summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg), session.id),
                     emit: (line) => console.log(line),
                 });
             }

package/dist/router/byok-classifier.js

@@ -33,7 +33,9 @@ import Anthropic from '@anthropic-ai/sdk';
 import keychain from '../auth/keychain.js';
 import { byokRouterModel } from '../models/server-config.js';
 import { addRouterSpend } from '../cost/router-spend.js';
+import { reportCallUsage } from '../usage/usage-reporter.js';
 import { loadRouterPrompt } from './router-prompt.js';
+import { azureSdkOptions } from '../connection/azure-auth.js';
 import { ROUTER_UNPARSEABLE_RESULT, buildRouterRequest, runRouterCalls, } from './router-core.js';
 /** Same keychain entry the BYOK provider reads (byok-provider.ts) and login writes. */
 export const BYOK_KEYCHAIN_SERVICE = 'cspeach.anthropic';
@@ -65,6 +67,17 @@ export class ByokRouterFailure extends Error {
         this.name = 'ByokRouterFailure';
     }
 }
+/** Final fix wave B — fire-and-forget, never throws: usage counts are best effort. */
+function reportAzureRouterCall(family, u) {
+    try {
+        void reportCallUsage({
+            mode: 'azure', skill: '_router', model: family,
+            input: u.input, output: u.output, cacheRead: u.cacheRead, cacheWrite: u.cacheCreate,
+            sessionId: '', started: true,
+        }).catch(() => { });
+    }
+    catch { /* best effort */ }
+}
 function causeOf(err) {
     const e = err;
     if (e?.cause)
@@ -86,10 +99,13 @@ export async function classifyByok(prompt, context, images, opts = {}) {
     const target = opts.target ?? { mode: 'byok' };
     if (opts.signal?.aborted)
         throw cancelled();
-    const key = target.mode === 'byok'
-        ? await keychain.getPassword(BYOK_KEYCHAIN_SERVICE, BYOK_KEYCHAIN_ACCOUNT)
-        : await keychain.getPassword(AI_HUB_KEYCHAIN_SERVICE, AI_HUB_KEYCHAIN_ACCOUNT);
-    if (!key) {
+    // Azure signs in through target.auth() (Entra token or Azure key), never the keychain entries here.
+    const key = target.mode === 'azure'
+        ? null
+        : target.mode === 'byok'
+            ? await keychain.getPassword(BYOK_KEYCHAIN_SERVICE, BYOK_KEYCHAIN_ACCOUNT)
+            : await keychain.getPassword(AI_HUB_KEYCHAIN_SERVICE, AI_HUB_KEYCHAIN_ACCOUNT);
+    if (target.mode !== 'azure' && !key) {
         throw new Error(target.mode === 'byok'
             ? 'BYOK Anthropic API key not configured — run: cspeach config set llm.byok_key <key>'
             : 'AI Hub token not configured — run: cspeach config set llm.ai_hub_token <token>');
@@ -104,18 +120,23 @@ export async function classifyByok(prompt, context, images, opts = {}) {
     const userCancelled = () => opts.signal?.aborted === true;
     try {
         const { prompt: routerPrompt } = await loadRouterPrompt({ signal: ctrl.signal });
-        const model = target.mode === 'byok' ? byokRouterModel() : (target.modelAlias ?? AI_HUB_DEFAULT_MODEL);
+        const model = target.mode === 'byok' ? byokRouterModel() : target.mode === 'azure' ? target.model : (target.modelAlias ?? AI_HUB_DEFAULT_MODEL);
         const full = buildRouterRequest(model, prompt, context, images, routerPrompt);
         // ai-hub: today's field set only (the hub has no flag for newer fields).
-        const request = target.mode === 'byok'
+        // azure: output_config only when the profile allows structured outputs.
+        const request = target.mode === 'byok' || (target.mode === 'azure' && target.structuredOutputs)
             ? full
             : (({ output_config: _dropped, ...rest }) => rest)(full);
-        const sdk = new Anthropic({
-            apiKey: key,
-            maxRetries: 1,
-            timeout: ROUTER_CALL_TIMEOUT_MS,
-            ...(target.mode === 'ai-hub' ? { baseURL: target.baseURL } : {}),
-        });
+        // Azure: the guarded options (host allow-list on every request URL, no
+        // redirects, the other auth field null so no ANTHROPIC_* env var leaks).
+        const sdk = target.mode === 'azure'
+            ? new Anthropic({ ...azureSdkOptions(target.baseURL, await target.auth()), maxRetries: 1, timeout: ROUTER_CALL_TIMEOUT_MS })
+            : new Anthropic({
+                apiKey: key,
+                maxRetries: 1,
+                timeout: ROUTER_CALL_TIMEOUT_MS,
+                ...(target.mode === 'ai-hub' ? { baseURL: target.baseURL } : {}),
+            });
         const { result } = await runRouterCalls((req) => sdk.messages.create(req, { signal: ctrl.signal }), request, {
             // Once per session — a model that rejects structured outputs would
             // otherwise print this on every prompt.
@@ -129,8 +150,14 @@ export async function classifyByok(prompt, context, images, opts = {}) {
             // call finishes, so a deadline / cancel after call 1 keeps call 1
             // (review S1). ai-hub is billed by their BTP account at rates we
             // don't know: not priced here.
-            onCall: (c) => { if (target.mode === 'byok')
-                addRouterSpend(model, c.usage); },
+            // Azure (final fix wave B): each router call is counted like any other
+            // azure call — a usage record and the local limit count.
+            onCall: (c) => {
+                if (target.mode === 'byok')
+                    addRouterSpend(model, c.usage);
+                else if (target.mode === 'azure')
+                    reportAzureRouterCall(target.family, c.usage);
+            },
         });
         return result ?? { ...ROUTER_UNPARSEABLE_RESULT, alternates: [] };
     }

package/dist/router/classifier.js

@@ -6,6 +6,7 @@ import { isBuiltinCommandHead } from '../repl/builtin-commands.js';
 import { expandImageAttachments } from '../projects/image-attachments.js';
 import { expandImageChips } from '../ui/clipboard-image.js';
 import { classifyByok, ByokRouterFailure } from './byok-classifier.js';
+import { routerRouteFor } from './router-target.js';
 /** A non-2xx answer from the classify endpoint (fix 9: carries the kind). */
 export class ClassifyHttpError extends Error {
     status;
@@ -165,26 +166,14 @@ export async function classifyPrompt(prompt, context, opts = {}) {
     // with the customer's own key; ai-hub through the customer's own hub;
     // local by the bundled rules (byok-classifier.ts / localModeResult).
     // Managed keeps /v1/classify below, byte-identical.
-    const mode = cfg.llm?.mode;
-    if (mode === 'local') {
+    const route = routerRouteFor(cfg);
+    if (route.kind === 'local-rules') {
         if (opts.signal?.aborted)
             throw routingCancelled();
         return localModeResult(prompt);
     }
-    if (mode === 'byok')
-        return classifyPromptByok(prompt, context, opts, { mode: 'byok' });
-    if (mode === 'ai-hub') {
-        const baseURL = cfg.llm.ai_hub_base_url;
-        if (!baseURL)
-            throw new Error('ai-hub mode requires llm.ai_hub_base_url — run: cspeach config set llm.ai_hub_base_url <url>');
-        // llm.ai_hub_router_model (optional, 2026-10-02) routes on a cheaper /
-        // faster deployment; unset ⇒ the session alias.
-        return classifyPromptByok(prompt, context, opts, {
-            mode: 'ai-hub',
-            baseURL,
-            modelAlias: cfg.llm.ai_hub_router_model ?? cfg.llm.ai_hub_model_alias,
-        });
-    }
+    if (route.kind === 'direct')
+        return classifyPromptByok(prompt, context, opts, route.target);
     const store = await getStore();
     const key = await store.get();
     if (!key)

package/dist/router/router-target.js

@@ -0,0 +1,41 @@
+import { profileForMode } from '../agent/connection-profile.js';
+import { getActiveConnection } from '../connection/cache.js';
+import { azureTurnVerdict, AzureConnectionRefusedError } from '../connection/state.js';
+import { selectAzureAuth } from '../connection/azure-auth.js';
+import { routerDeployment } from '../models/model-identity.js';
+export function routerRouteFor(cfg, profileFor = profileForMode) {
+    const mode = cfg.llm?.mode;
+    const p = profileFor(mode);
+    if (p.router === 'local-rules')
+        return { kind: 'local-rules' };
+    if (p.router === 'proxy')
+        return { kind: 'proxy' };
+    switch (mode) {
+        case 'byok':
+            return { kind: 'direct', target: { mode: 'byok' } };
+        case 'ai-hub': {
+            const baseURL = cfg.llm.ai_hub_base_url;
+            if (!baseURL)
+                throw new Error('ai-hub mode requires llm.ai_hub_base_url — run: cspeach config set llm.ai_hub_base_url <url>');
+            // llm.ai_hub_router_model (optional, 2026-10-02) routes on a cheaper /
+            // faster deployment; unset ⇒ the session alias.
+            return { kind: 'direct', target: { mode: 'ai-hub', baseURL, modelAlias: cfg.llm.ai_hub_router_model ?? cfg.llm.ai_hub_model_alias } };
+        }
+        case 'azure': {
+            const cached = getActiveConnection();
+            const v = azureTurnVerdict(cached);
+            if (!v.allow)
+                throw new AzureConnectionRefusedError(v.message);
+            const c = cached.connection;
+            return {
+                kind: 'direct',
+                target: {
+                    mode: 'azure', baseURL: c.endpoint, model: routerDeployment(c.deployments).name, family: routerDeployment(c.deployments).model,
+                    auth: async () => (await selectAzureAuth(c)).getAuth(), structuredOutputs: p.structuredOutputs,
+                },
+            };
+        }
+        default:
+            throw new Error(`no direct router for llm.mode ${String(mode)}`);
+    }
+}