@cspeach/cli 1.1.32 → 1.1.34

package/dist/auth/azure/startup-sign-in.js

@@ -0,0 +1,64 @@
+/**
+ * Azure tenant mode, Task 6b — the Microsoft sign-in that starts with the
+ * REPL. The question comes first (inquirer owns the keyboard then); only
+ * while the sign-in itself runs does Esc or Ctrl+C stop it, through the
+ * SAME signal ensureAzureSignIn hands to signInAzure, so the loopback
+ * listener closes at once (owner decision: the listener is always closed).
+ * The keyboard is handed back exactly as it was found.
+ */
+import { ensureAzureSignIn, signInAzure } from './sign-in.js';
+import { askOrNo } from '../../repl/ask-or-no.js';
+const CTRL_C = 0x03;
+const ESC = 0x1b;
+/** Ctrl+C anywhere in the chunk, or a lone Esc (an arrow key is Esc + more bytes). */
+export function isStopKey(chunk) {
+    const b = typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk;
+    return b.includes(CTRL_C) || (b.length === 1 && b[0] === ESC);
+}
+/** Aborts `ac` on Esc / Ctrl+C (raw TTY) or SIGINT until released. */
+export function armStopKeys(ac, input, signals) {
+    const stop = () => { if (!ac.signal.aborted)
+        ac.abort(); };
+    const onData = (chunk) => { if (isStopKey(chunk))
+        stop(); };
+    const raw = input.isTTY === true && typeof input.setRawMode === 'function';
+    const wasRaw = input.isRaw === true;
+    const wasFlowing = input.readableFlowing === true;
+    signals.on('SIGINT', stop);
+    if (raw) {
+        input.setRawMode(true);
+        input.on('data', onData);
+        input.resume();
+    }
+    return () => {
+        signals.removeListener('SIGINT', stop);
+        if (raw) {
+            input.removeListener('data', onData);
+            input.setRawMode(wasRaw);
+            // Hand the keyboard back as found: still flowing if something else was
+            // reading it, paused otherwise (readline / Ink resume it themselves).
+            if (!wasFlowing)
+                input.pause();
+        }
+    };
+}
+export async function azureSignInAtStart(conn, o) {
+    const ac = new AbortController();
+    const input = o.input ?? process.stdin;
+    const signals = o.signals ?? process;
+    const run = o.signIn ?? signInAzure;
+    return (o.ensure ?? ensureAzureSignIn)(conn, {
+        // Ctrl+C at the question (ExitPromptError) is a no.
+        interactive: true, ask: askOrNo(o.ask), print: o.print, open: o.open, signal: ac.signal,
+        // The keys are armed only while the sign-in runs, never during the question.
+        signIn: async (c, opts, deps) => {
+            const release = armStopKeys(ac, input, signals);
+            try {
+                return await run(c, opts, deps);
+            }
+            finally {
+                release();
+            }
+        },
+    });
+}

package/dist/auth/azure/token-provider.js

@@ -0,0 +1,116 @@
+/**
+ * Azure tenant mode — Entra tokens for the Foundry endpoint. Silent before
+ * EVERY request (MSAL serves the cached token, refreshing with the refresh
+ * token near expiry); a token with < 120 s left by this laptop's clock is
+ * force-refreshed (plan D12). Never interactive here: interaction required ⇒
+ * AzureSignInRequiredError ("Your Microsoft sign-in has ended."). A token
+ * from another tenant is refused. No token ever goes into an error or a log.
+ */
+import { AZURE_FACTS } from '../../connection/azure-facts.js';
+import { AzureSignInRequiredError } from '../../connection/azure-auth.js';
+import { cspeachRoot } from '../../config/paths.js';
+import { getAzureKey } from './azure-key.js';
+import { openCacheStore } from './cache-store.js';
+import { azureLog } from './azure-log.js';
+import { createMsal, isInteractionRequired, tenantOf, AzureWrongTenantError } from './msal-client.js';
+export const NEAR_EXPIRY_MS = 120_000;
+const apps = new Map();
+/** One MSAL client per CSPeach home and tenant per process, with that home's encrypted cache. */
+export function msalFor(tenantId, o = {}) {
+    const slot = `${cspeachRoot()}|${tenantId.toLowerCase()}`;
+    let p = apps.get(slot);
+    if (!p) {
+        p = (async () => {
+            const { plugin } = await (o.store ?? (() => openCacheStore({ notice: o.notice })))();
+            return (o.factory ?? createMsal)({ clientId: AZURE_FACTS.clientId, tenantId, cachePlugin: plugin, log: azureLog });
+        })();
+        apps.set(slot, p);
+        p.catch(() => apps.delete(slot));
+    }
+    return p;
+}
+const appFor = (conn, deps) => (deps.msal ?? (() => msalFor(conn.entra_tenant_id)))();
+/** Every cached account for this tenant (MSAL's raw objects). */
+export async function accountsForTenant(app, tenantId) {
+    const t = tenantId.toLowerCase();
+    return (await app.getAllAccounts()).filter((a) => (a.tenantId ?? '').toLowerCase() === t);
+}
+/** More than one account for the company's tenant: never guess which one. A fresh `cspeach login azure` keeps only the one signed in. */
+export class AzureSeveralAccountsError extends AzureSignInRequiredError {
+    constructor() {
+        super('entra');
+        this.message = 'More than one Microsoft account is signed in for your company on this computer.';
+        this.name = 'AzureSeveralAccountsError';
+    }
+}
+async function accountFor(app, tenantId) {
+    const found = await accountsForTenant(app, tenantId);
+    if (found.length > 1)
+        throw new AzureSeveralAccountsError();
+    return found[0] ?? null;
+}
+const scopes = () => [AZURE_FACTS.entraScope];
+async function silent(app, account, forceRefresh) {
+    try {
+        return await app.acquireTokenSilent({ scopes: scopes(), account, ...(forceRefresh ? { forceRefresh: true } : {}) });
+    }
+    catch (e) {
+        if (isInteractionRequired(e))
+            throw new AzureSignInRequiredError('entra');
+        throw e;
+    }
+}
+export function createEntraAuthProvider(conn, deps = {}) {
+    const now = deps.now ?? Date.now;
+    return {
+        method: 'entra',
+        async getAuth(opts = {}) {
+            const a = await appFor(conn, deps);
+            const account = await accountFor(a, conn.entra_tenant_id);
+            if (!account)
+                throw new AzureSignInRequiredError('entra');
+            let r = await silent(a, account, opts.forceRefresh === true);
+            if (!opts.forceRefresh && r.expiresOn && r.expiresOn.getTime() - now() < NEAR_EXPIRY_MS)
+                r = await silent(a, account, true);
+            if (tenantOf(r) !== conn.entra_tenant_id.toLowerCase())
+                throw new AzureWrongTenantError();
+            return { kind: 'entra', token: r.accessToken };
+        },
+    };
+}
+/**
+ * SelectAuthDeps.entra: Entra when this machine has an Entra account (or
+ * several) for the tenant; when it has none and the company allows keys and a key is stored,
+ * null (use the key); otherwise Entra (which asks for sign-in).
+ */
+export async function entraForSelect(conn, deps = {}) {
+    const provider = createEntraAuthProvider(conn, deps);
+    let hasAccount = false;
+    try {
+        hasAccount = (await accountsForTenant(await appFor(conn, deps), conn.entra_tenant_id)).length > 0;
+    }
+    catch {
+        hasAccount = false;
+    }
+    if (hasAccount)
+        return provider;
+    if (conn.sign_in.includes('key') && (await (deps.getKey ?? getAzureKey)().catch(() => null)))
+        return null;
+    return provider;
+}
+/** whoami / doctor: the account and token expiry, silently. */
+export async function describeEntraSignIn(conn, deps = {}) {
+    try {
+        const a = await appFor(conn, deps);
+        const account = await accountFor(a, conn.entra_tenant_id);
+        if (!account)
+            return { state: 'needs-sign-in' };
+        const r = await silent(a, account, false);
+        if (tenantOf(r) !== conn.entra_tenant_id.toLowerCase())
+            return { state: 'needs-sign-in' };
+        return { state: 'signed-in', username: account.username, expiresOn: r.expiresOn };
+    }
+    catch {
+        return { state: 'needs-sign-in' };
+    }
+}

package/dist/auth/key-resolver.js

@@ -0,0 +1,258 @@
+/**
+ * Security batch item 6 — the ONE CSPeach key resolver. Every reader (REPL
+ * requests, banner, whoami, logout, licence check, usage reporter) reaches it
+ * through getStore().get() (api-key.ts).
+ *
+ * Where the key lives:
+ *   - the OS credential store, service `cspeach`, one account per CSPeach
+ *     home: `api-key` for the default ~/.cspeach, `api-key:<12 hex of
+ *     sha256(home)>` for any other CSPEACH_HOME — two homes never share one;
+ *   - auth.json `apiKey` only where no credential store works, or where an
+ *     older CLI left it (moved at start: copy → read back → only then remove).
+ *
+ * When both hold DIFFERENT keys, the newer login wins:
+ *   - auth.json carries `savedAt` (this CLI wrote it while the store was
+ *     unavailable) newer than the last store write → auth.json;
+ *   - auth.json has no `savedAt` (an older CLI wrote it) → auth.json only when
+ *     key-store.json proves our store write came BEFORE the file changed;
+ *   - otherwise the credential store — the key REPL requests already used
+ *     before this batch (managed stays byte-identical) — plus one notice.
+ *
+ * key-store.json (beside auth.json) holds { account, storedAt, legacyChecked }:
+ * no secret.
+ */
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { promises as fs } from 'node:fs';
+import { cspeachRoot, defaultCspeachRoot } from '../config/paths.js';
+import { readAuthFile, writeAuthFile, deleteAuthFile, authFileMtimeMs, authFileDir } from './auth-file.js';
+import { licenceCachePath } from '../licence/paths.js';
+export const KEYCHAIN_SERVICE = 'cspeach';
+export const DEFAULT_ACCOUNT = 'api-key';
+async function defaultIo() {
+    const { default: keychain } = await import('./keychain.js');
+    return {
+        get: (a) => keychain.getPassword(KEYCHAIN_SERVICE, a),
+        set: (a, k) => keychain.setPassword(KEYCHAIN_SERVICE, a, k),
+        del: (a) => keychain.deletePassword(KEYCHAIN_SERVICE, a),
+    };
+}
+function normHome(p) {
+    const r = path.resolve(p).replace(/[\\/]+$/, '');
+    return process.platform === 'win32' ? r.toLowerCase() : r;
+}
+export function keychainAccountForHome(home = cspeachRoot(), defaultHome = defaultCspeachRoot()) {
+    const h = normHome(home);
+    if (h === normHome(defaultHome))
+        return DEFAULT_ACCOUNT;
+    return `${DEFAULT_ACCOUNT}:${crypto.createHash('sha256').update(h).digest('hex').slice(0, 12)}`;
+}
+const metaPath = () => path.join(authFileDir(), 'key-store.json');
+async function readMeta() {
+    try {
+        const m = JSON.parse(await fs.readFile(metaPath(), 'utf-8'));
+        if (typeof m.account !== 'string')
+            return null;
+        return { account: m.account, storedAt: typeof m.storedAt === 'string' ? m.storedAt : null, legacyChecked: m.legacyChecked === true };
+    }
+    catch {
+        return null;
+    }
+}
+async function writeMeta(m) {
+    const p = metaPath();
+    await fs.mkdir(path.dirname(p), { recursive: true });
+    // Unique per write: two writes in one process must never share a temp file.
+    const tmp = `${p}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(m, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    try {
+        await fs.rename(tmp, p);
+    }
+    finally {
+        await fs.rm(tmp, { force: true }).catch(() => { });
+    }
+}
+/** Note that this CLI just wrote the credential store (drives "newer login wins"). */
+export async function recordStoreWrite(account = keychainAccountForHome(), at = new Date().toISOString()) {
+    const prev = await readMeta();
+    await writeMeta({ account, storedAt: at, legacyChecked: prev?.legacyChecked ?? false });
+}
+export function pickKey(i) {
+    const store = i.store?.trim() || null;
+    const fileKey = i.auth?.apiKey?.trim() || null;
+    if (!store && !fileKey)
+        return { key: null, source: 'none', conflict: false };
+    if (store && !fileKey)
+        return { key: store, source: 'store', conflict: false };
+    if (!store && fileKey)
+        return { key: fileKey, source: 'auth-file', conflict: false };
+    if (store === fileKey)
+        return { key: store, source: 'store', conflict: false };
+    const storedAtMs = i.storedAt ? Date.parse(i.storedAt) : NaN;
+    const fileNewer = i.auth?.savedAt
+        ? !Number.isFinite(storedAtMs) || Date.parse(i.auth.savedAt) > storedAtMs
+        : Number.isFinite(storedAtMs) && i.authMtimeMs !== null && i.authMtimeMs > storedAtMs;
+    return fileNewer
+        ? { key: fileKey, source: 'auth-file', conflict: false }
+        : { key: store, source: 'store', conflict: true };
+}
+export async function resolveApiKey(deps = {}) {
+    let store = null;
+    try {
+        store = await (deps.io ?? (await defaultIo())).get(keychainAccountForHome());
+    }
+    catch {
+        store = null; // no credential store on this machine: auth.json is the fallback
+    }
+    const [auth, authMtimeMs, meta] = await Promise.all([readAuthFile(), authFileMtimeMs(), readMeta()]);
+    return pickKey({ store, auth, authMtimeMs, storedAt: meta?.storedAt ?? null });
+}
+const exists = async (p) => fs.access(p).then(() => true, () => false);
+/**
+ * Run once at start (cli.ts). Idempotent. The common start is one file read
+ * and no keychain call: there is nothing to move.
+ */
+export async function migrateSignIn(deps = {}) {
+    const now = deps.now ?? (() => new Date());
+    const account = keychainAccountForHome();
+    const auth = await readAuthFile();
+    const meta = await readMeta();
+    // (a) A non-default home that predates per-home accounts kept its key in the
+    // shared `api-key` entry. Copy it once — only for a home already in use, so a
+    // brand-new home never inherits another seat's key. Fix round 1 (F1): a home
+    // whose auth.json holds its own key has no claim on the shared key — that
+    // key is this home's sign-in, moved in (b).
+    const needsLegacyCheck = account !== DEFAULT_ACCOUNT && !meta?.legacyChecked && !auth?.apiKey
+        && (auth !== null || await exists(path.join(cspeachRoot(), 'config.toml')));
+    if (!auth?.apiKey && !needsLegacyCheck)
+        return 'none';
+    let io;
+    try {
+        io = deps.io ?? (await defaultIo());
+    }
+    catch {
+        return auth?.apiKey ? 'store-unavailable' : 'none';
+    }
+    let outcome = 'none';
+    try {
+        if (needsLegacyCheck) {
+            if (!(await io.get(account))) {
+                const shared = await io.get(DEFAULT_ACCOUNT);
+                if (shared) {
+                    await io.set(account, shared);
+                    if ((await io.get(account)) !== shared)
+                        return 'copy-verify-failed';
+                    // A copy is not a login: keep the previous storedAt, never "now" (F1).
+                    await writeMeta({ account, storedAt: meta?.storedAt ?? null, legacyChecked: true });
+                    outcome = 'copied-shared';
+                }
+            }
+            if (outcome !== 'copied-shared')
+                await writeMeta({ account, storedAt: meta?.storedAt ?? null, legacyChecked: true });
+        }
+        // (b) A key in auth.json: copy → read back → only then remove.
+        if (!auth?.apiKey)
+            return outcome;
+        const store = await io.get(account);
+        const pick = pickKey({ store, auth, authMtimeMs: await authFileMtimeMs(), storedAt: (await readMeta())?.storedAt ?? null });
+        if (pick.conflict)
+            return 'conflict';
+        const fileKey = auth.apiKey.trim();
+        if (store !== fileKey) {
+            await io.set(account, fileKey);
+            if ((await io.get(account)) !== fileKey)
+                return 'verify-failed'; // never remove the only copy
+            outcome = 'migrated';
+        }
+        else {
+            outcome = 'removed';
+        }
+        // key-store.json is bookkeeping (no secret): its failure never turns a good
+        // store write into a "no credential store" notice (F7).
+        // Final review (Task 4 N1): a non-default home now holds its own key, so
+        // the shared-account check has nothing left to do — mark it done.
+        await (account !== DEFAULT_ACCOUNT
+            ? writeMeta({ account, storedAt: now().toISOString(), legacyChecked: true })
+            : recordStoreWrite(account, now().toISOString())).catch(() => { });
+    }
+    catch {
+        // No key in auth.json (only the shared-account check ran): nothing stays
+        // behind, so no notice — the check simply runs again on the next start.
+        return auth?.apiKey ? 'store-unavailable' : 'none';
+    }
+    try {
+        await writeAuthFile({ customerId: auth.customerId, ...(auth.savedAt ? { savedAt: auth.savedAt } : {}) });
+    }
+    catch {
+        return 'failed'; // the store holds the key; the next start removes the copy ('removed')
+    }
+    return outcome;
+}
+/** The one start-up notice for an outcome the user must know about, else null. */
+export function signInMigrationNotice(o) {
+    switch (o) {
+        case 'conflict':
+            return 'cspeach: auth.json in your CSPeach home holds a different CSPeach key than your OS credential store. CSPeach uses the credential store\'s key. Run cspeach login to sign in again and clear this up.';
+        case 'store-unavailable':
+            return 'cspeach: your OS credential store is not available, so your CSPeach key stays in auth.json in your CSPeach home (on Linux: install and unlock a Secret Service keyring such as gnome-keyring).';
+        case 'verify-failed':
+            return 'cspeach: your CSPeach key could not be confirmed in your OS credential store, so it stays in auth.json for now. CSPeach tries again on the next start.';
+        case 'copy-verify-failed':
+            return 'cspeach: the CSPeach key for this CSPeach home could not be confirmed in your OS credential store. CSPeach tries again on the next start, or run cspeach login to sign in this home.';
+        default:
+            return null;
+    }
+}
+/** `cspeach login`: the store first; auth.json keeps customerId + savedAt. */
+export async function saveSignIn(a, deps = {}) {
+    const account = keychainAccountForHome();
+    const savedAt = (deps.now ?? (() => new Date()))().toISOString();
+    // Fix round 1 (F7): only the store calls decide store vs file.
+    let stored = false;
+    try {
+        const io = deps.io ?? (await defaultIo());
+        await io.set(account, a.apiKey);
+        stored = (await io.get(account)) === a.apiKey;
+    }
+    catch {
+        stored = false;
+    }
+    if (!stored) {
+        await writeAuthFile({ apiKey: a.apiKey, customerId: a.customerId, savedAt });
+        return 'file';
+    }
+    await recordStoreWrite(account, savedAt).catch(() => { }); // bookkeeping only, no secret
+    await writeAuthFile({ customerId: a.customerId, savedAt });
+    return 'store';
+}
+/**
+ * `cspeach logout`: the store entry, auth.json and licence.json. Fix round 1
+ * (F2): verified — `cleared` is false when a delete failed or a key still
+ * resolves afterwards, so logout never says "removed" while a key is left.
+ * (A start running its migration at the same moment can re-store the key it
+ * read before this delete; the verify below catches that too.)
+ */
+export async function clearSignIn(deps = {}) {
+    const account = keychainAccountForHome();
+    const auth = await readAuthFile();
+    let hadStore = false;
+    let storeOk = true;
+    let io = null;
+    try {
+        io = deps.io ?? (await defaultIo());
+        hadStore = (await io.get(account)) !== null;
+        if (hadStore && (await io.del(account)) === false)
+            storeOk = false;
+    }
+    catch {
+        // No credential store: nothing to delete there. A store that held a key
+        // but threw on delete is caught by the verify below.
+    }
+    const fileOk = await deleteAuthFile();
+    await fs.rm(licenceCachePath(), { force: true }).catch(() => { });
+    // Keep legacyChecked so a signed-out non-default home is never re-filled
+    // from the shared account on the next start.
+    await writeMeta({ account, storedAt: null, legacyChecked: true }).catch(() => { });
+    const left = (await resolveApiKey(io ? { io } : {})).key;
+    return { hadSignIn: hadStore || auth !== null, cleared: storeOk && fileOk && left === null };
+}

package/dist/auth/me.js

@@ -18,20 +18,26 @@ export async function fetchMe(opts) {
     try {
         return await Promise.race([
             (async () => {
-                const r = await fetch(url, { headers: { Authorization: `Bearer ${opts.apiKey}` }, signal });
+                // No extra headers → exactly `{ Authorization }`, as before the batch.
+                const r = await fetch(url, { headers: { ...(opts.headers ?? {}), Authorization: `Bearer ${opts.apiKey}` }, signal });
+                const serverDate = r.headers.get('date');
                 if (!r.ok) {
                     const body = await r.json().catch(() => ({}));
-                    return { ok: false, status: r.status, error: body.error ?? 'unknown' };
+                    return {
+                        ok: false, status: r.status, error: body?.error ?? 'unknown',
+                        ...(typeof body?.reason === 'string' ? { reason: body.reason } : {}),
+                        serverDate,
+                    };
                 }
                 const profile = await r.json();
-                return { ok: true, profile };
+                return { ok: true, profile, serverDate };
             })(),
             timedOut,
         ]);
     }
     catch (err) {
         if (signal.aborted)
-            return { ok: false, status: 0, error: `timed out after ${timeoutMs} ms` };
-        return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err) };
+            return { ok: false, status: 0, error: `timed out after ${timeoutMs} ms`, serverDate: null };
+        return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err), serverDate: null };
     }
 }

package/dist/cli.js

@@ -27,6 +27,15 @@ export async function main(argv) {
     const legacyNotice = legacyByokKeyNotice(await migrateLegacyByokKey().catch(() => 'failed'));
     if (legacyNotice)
         console.error(legacyNotice);
+    // Security batch item 6 — move the CSPeach key from auth.json into this
+    // home's OS credential store entry (copy → read back → only then remove).
+    // Once; idempotent; one notice when it cannot.
+    {
+        const { migrateSignIn, signInMigrationNotice } = await import('./auth/key-resolver.js');
+        const notice = signInMigrationNotice(await migrateSignIn().catch(() => 'failed'));
+        if (notice)
+            console.error(notice);
+    }
     let args = argv.slice(2);
     // Standalone mode (2026-09-16) — `--no-sap` is accepted ANYWHERE in the args
     // for both the REPL and one-shot, and stripped like `--sap-alias` below.
@@ -162,6 +171,14 @@ export async function main(argv) {
         const { runDoctor } = await import('./doctor/run.js');
         return runDoctor();
     }
+    // Azure tenant mode (Task 6b) — the Microsoft sign-in alone, with the
+    // company settings already on this machine. Same opener as `cspeach login`:
+    // no shell, the authorize URL (full of &) as one argument.
+    if (args[0] === 'login' && args[1] === 'azure') {
+        const { runLoginAzureCommand } = await import('./commands/login-azure.js');
+        const { loginOpener } = await import('./util/open-in-browser.js');
+        return runLoginAzureCommand({ deviceCode: args.includes('--device-code'), print: (s) => console.log(s), open: loginOpener() });
+    }
     if (args[0] === 'login') {
         const { runLoginCommand } = await import('./commands/login.js');
         const { input } = await import('@inquirer/prompts');
@@ -176,6 +193,7 @@ export async function main(argv) {
             open,
             print: (s) => console.log(s),
             prompt: (q) => input({ message: q }),
+            deviceCode: args.includes('--device-code'),
         });
     }
     if (args[0] === 'logout') {
@@ -186,7 +204,7 @@ export async function main(argv) {
         const { runWhoamiCommand } = await import('./commands/whoami.js');
         const { loadConfig } = await import('./config/loader.js');
         const cfg = await loadConfig();
-        return runWhoamiCommand({ proxyUrl: cfg.proxy_url, print: (s) => console.log(s) });
+        return runWhoamiCommand({ proxyUrl: cfg.proxy_url, print: (s) => console.log(s), mode: cfg.llm.mode });
     }
     // A team project — many laptops, one picture (spec 2026-09-18).
     if (args[0] === 'team') {
@@ -297,7 +315,8 @@ Usage:
   cspeach sap link [alias] [--project dir]  Let a local CAP app reach its S/4 services (Ctrl+C stops)
   cspeach doctor                    Diagnose install + connectivity
   cspeach login                     Sign in via device-code flow
-  cspeach logout                    Sign out (keep keychain key, if any)
+  cspeach login azure               Sign in to Microsoft for your company's Azure (--device-code: use a code instead of the browser)
+  cspeach logout                    Sign out (removes the CSPeach key from this home)
   cspeach whoami                    Print current account info
   cspeach team discover            Read the whole estate from SAP into this folder (read only)
   cspeach team start <packages>     Start a team project in this folder: object list, first check, you own it all

package/dist/commands/compact.js

@@ -33,6 +33,7 @@ import { paint } from '../renderer/theme.js';
 import { getGlyphs } from '../renderer/glyphs.js';
 import { saveSession } from '../session/store.js';
 import { isUserPrompt } from '../session/user-prompt.js';
+import { getActiveDeployments } from '../models/model-identity.js';
 /** Keep this many recent user-prompt anchored turns verbatim. */
 export const KEEP_RECENT_TURNS = 5;
 /** Don't bother compacting if there's only a handful of older turns. */
@@ -200,6 +201,16 @@ export function renderTodoSection(todos) {
  * turns are where the list was built, and Haiku isn't trusted to
  * reproduce it verbatim.
  */
+/**
+ * Azure tenant mode, Task 5a — the model the summary line names. With a
+ * company deployment table (azure only) compaction runs on the small
+ * deployment, so the line names it and its family; every other mode keeps
+ * the COMPACTION_MODEL text byte for byte.
+ */
+function compactionModelLabel() {
+    const table = getActiveDeployments();
+    return table ? `${table.small.name} (${table.small.model})` : COMPACTION_MODEL;
+}
 export function buildSummaryMessage(summary, droppedTurns, todos) {
     const ts = new Date().toISOString();
     const todoSection = renderTodoSection(todos);
@@ -207,7 +218,7 @@ export function buildSummaryMessage(summary, droppedTurns, todos) {
         role: 'user',
         content: [
             `[Context summary auto-generated by /compact at ${ts}.`,
-            `Original turns (${droppedTurns}) were summarised by ${COMPACTION_MODEL} to`,
+            `Original turns (${droppedTurns}) were summarised by ${compactionModelLabel()} to`,
             `reduce cache cost on subsequent turns. The original session is backed up`,
             `to ~/.cspeach/sessions/${'<session-id>'}.pre-compact-<timestamp>.json]`,
             '',