@cspeach/cli 1.1.32 → 1.1.34

package/dist/commands/config-set.js

@@ -20,6 +20,7 @@ const MUTABLE_KEYS = new Set([
     'write_mode',
     'plan_mode',
     'plan_audit',
+    'usage_reporting',
     'approvals',
     'no_sap',
     'llm.mode',
@@ -31,6 +32,7 @@ const MUTABLE_KEYS = new Set([
     // Virtual keys that route to keychain (not saved to config.toml):
     'llm.byok_key',
     'llm.ai_hub_token',
+    'llm.azure_key',
 ]);
 // SAP-scoped key pattern: sap.<alias>.auto_approve
 const SAP_AUTO_APPROVE_RE = /^sap\.([A-Z0-9_-]{2,32})\.auto_approve$/;
@@ -70,9 +72,10 @@ const EFFORT_VALUES = ['low', 'medium', 'high', 'xhigh', 'max'];
 const TELEMETRY_VALUES = ['minimal', 'full'];
 const AUTO_APPROVE_VALUES = ['never', 'low', 'medium'];
 const SYSTEM_ROLE_VALUES = ['dev', 'qas', 'prd'];
-const LLM_MODE_VALUES = ['managed', 'byok', 'ai-hub', 'local'];
+const LLM_MODE_VALUES = ['managed', 'byok', 'ai-hub', 'local', 'azure'];
 const PLAN_MODE_VALUES = ['step', 'guarded'];
 const PLAN_AUDIT_VALUES = ['on', 'off'];
+const USAGE_REPORTING_VALUES = ['on', 'off'];
 const APPROVALS_VALUES = ['plan', 'per-write'];
 /**
  * Thrown on validation failure. The outer CLI dispatcher converts to
@@ -105,7 +108,7 @@ const INTERNAL_KEYS = new Set(['default_model_set', 'effort_set', 'file_keys']);
  * unset` cannot remove them — that is a keychain operation — so they are
  * rejected with a pointer rather than silently no-op'd.
  */
-const VIRTUAL_KEYCHAIN_KEYS = new Set(['llm.byok_key', 'llm.ai_hub_token']);
+const VIRTUAL_KEYCHAIN_KEYS = new Set(['llm.byok_key', 'llm.ai_hub_token', 'llm.azure_key']);
 /**
  * MUTABLE_KEYS that `config unset` can act on (excludes keychain virtuals and
  * the deprecated `local_files` alias — the canonical name is `local_build`).
@@ -392,6 +395,38 @@ export async function runConfigSet(args) {
         console.log(chalk.green(`Set ${key} = ${value}`));
         return;
     }
+    // Azure tenant mode (Task 5a) — the admin-issued Azure key, only when the
+    // company allows keys. Stored in the OS credential store per CSPEACH_HOME.
+    if (key === 'llm.azure_key') {
+        const { readConnectionCache } = await import('../connection/cache.js');
+        const company = await readConnectionCache();
+        if (!company || company.removed)
+            err('Your company has no Azure settings in CSPeach. Run cspeach login first.');
+        if (!company.connection.sign_in.includes('key'))
+            err('Your company does not allow Azure keys in CSPeach. Use cspeach login azure.');
+        let secret = value;
+        if (secret === '-') {
+            if (process.stdin.isTTY) {
+                const { password } = await import('@inquirer/prompts');
+                secret = await password({ message: 'Azure key (input masked):', mask: '*' });
+            }
+            else {
+                const chunks = [];
+                for await (const c of process.stdin)
+                    chunks.push(c);
+                secret = Buffer.concat(chunks).toString('utf8').trim();
+            }
+        }
+        else {
+            console.log(chalk.yellow('WARN: the key was passed as a shell argument and is now in your shell history. Prefer: cspeach config set llm.azure_key -'));
+        }
+        if (!secret || !secret.trim())
+            err('No key was given.');
+        const { setAzureKey } = await import('../auth/azure/azure-key.js');
+        await setAzureKey(secret.trim());
+        console.log(chalk.green('✓ Azure key stored in your OS credential store'));
+        return;
+    }
     // Virtual keys that store secrets in the OS keychain instead of config.toml.
     if (key === 'llm.byok_key' || key === 'llm.ai_hub_token') {
         // Support stdin piping for secrets: `echo "key" | cspeach config set llm.byok_key -`
@@ -557,6 +592,25 @@ export async function runConfigSet(args) {
             }
             cfg.plan_audit = value;
             break;
+        case 'usage_reporting':
+            // Security batch item 3 — usage counts from non-managed turns.
+            if (!USAGE_REPORTING_VALUES.includes(value)) {
+                err(`Invalid usage_reporting "${value}". Allowed: ${USAGE_REPORTING_VALUES.join(', ')}`);
+            }
+            // Azure tenant mode, Task 8b (plan D11) — the company decides: when its
+            // settings require usage counts, or this seat has a monthly limit (which
+            // needs the counts; fix round 1, ruling 1), "off" is refused and nothing
+            // changes. Every other mode keeps today's switch exactly.
+            if (value === 'off' && cfg.llm?.mode === 'azure') {
+                const { companyUsageRule } = await import('../usage/usage-reporter.js');
+                const rule = await companyUsageRule(cfg);
+                if (rule === 'required')
+                    err('Your company requires usage counts for CSPeach on Azure');
+                if (rule === 'limit')
+                    err('Your company sets a monthly CSPeach limit for you, so usage counts stay on.');
+            }
+            cfg.usage_reporting = value;
+            break;
         case 'approvals':
             // 'plan' = the plan's one approval covers its listed objects (default);
             // 'per-write' = a card before every write.
@@ -565,12 +619,21 @@ export async function runConfigSet(args) {
             }
             cfg.approvals = value;
             break;
-        case 'llm.mode':
+        case 'llm.mode': {
             if (!LLM_MODE_VALUES.includes(value)) {
                 err(`Invalid llm.mode "${value}". Allowed: ${LLM_MODE_VALUES.join(', ')}`);
             }
+            // Azure tenant mode — the org setting wins (spec "How settings reach the
+            // CLI"). The cache is this CSPeach home's connection.json.
+            const { readConnectionCache } = await import('../connection/cache.js');
+            const company = await readConnectionCache();
+            if (value !== 'azure' && company && !company.removed)
+                err('Your company set CSPeach to use your Azure. Run cspeach logout to leave it.');
+            if (value === 'azure' && !company)
+                err('Your company has no Azure settings on this machine. Run cspeach login to load them.');
             cfg.llm.mode = value;
             break;
+        }
         case 'llm.ai_hub_base_url':
             try {
                 new URL(value);
@@ -613,6 +676,11 @@ export async function runConfigSet(args) {
     // value-diff can't see — e.g. `config set default_model claude-opus-4-8`).
     markExplicit(cfg, key);
     await saveConfig(cfg);
+    // F15 — off means off: the counts already waiting are deleted too.
+    if (key === 'usage_reporting' && value === 'off') {
+        const { deleteUsageQueue } = await import('../usage/usage-queue.js');
+        await deleteUsageQueue().catch(() => { });
+    }
     console.log(chalk.green(`Set ${key} = ${value}`));
 }
 /**
@@ -689,6 +757,8 @@ export function validateValue(key, value) {
             return PLAN_MODE_VALUES.includes(value);
         case 'plan_audit':
             return PLAN_AUDIT_VALUES.includes(value);
+        case 'usage_reporting':
+            return USAGE_REPORTING_VALUES.includes(value);
         case 'approvals':
             return APPROVALS_VALUES.includes(value);
         case 'no_sap':
@@ -711,6 +781,7 @@ export function validateValue(key, value) {
             return isModelAlias(value);
         case 'llm.byok_key':
         case 'llm.ai_hub_token':
+        case 'llm.azure_key':
             return value.length > 0; // Secrets pass through if non-empty; no format check
         default:
             return false;

package/dist/commands/config-show.js

@@ -51,6 +51,7 @@ const LLM_REQUIRED_KEYS_BY_MODE = {
     byok: [],
     'ai-hub': ['ai_hub_base_url', 'ai_hub_model_alias'],
     local: ['local_base_url', 'local_model'],
+    azure: [],
 };
 function printLlmMissingHints(llm) {
     if (typeof llm !== 'object' || llm === null)
@@ -134,6 +135,24 @@ function resolveDottedKey(cfg, keyPath) {
     }
     return current;
 }
+/** Azure tenant mode (Task 7) — the company's settings, read-only, never a secret. */
+export function formatAzureBlock(c) {
+    const d = c.connection.deployments;
+    const entry = (e) => (e ? `${e.name} (${e.model})` : '<none: plan reviews run on main>');
+    return [
+        '',
+        `${chalk.bold('[azure]')} ${chalk.gray('# set by your company · read-only · change it through your CSPeach admin')}`,
+        `endpoint = "${c.connection.endpoint}"`,
+        `tenant = "${c.connection.entra_tenant_id}"`,
+        `main = "${entry(d.main)}"`,
+        `small = "${entry(d.small)}"`,
+        `review = "${entry(d.review)}"`,
+        `sign_in = "${c.connection.sign_in.join(', ')}"`,
+        `usage_counts = "${c.connection.usage_counts}"`,
+        ...(c.pending ? [chalk.yellow(`# a changed endpoint is waiting for you: ${c.pending.endpoint} (start cspeach to review it)`)] : []),
+        ...(c.removed ? [chalk.yellow('# your company removed these settings: run cspeach login')] : []),
+    ];
+}
 /**
  * Executes `cspeach config show [key]`.
  * Without argument: prints full config as TOML (secrets redacted).
@@ -153,6 +172,12 @@ export async function runConfigShow(args) {
         if (customer?.model && customer.enforced) {
             console.log(chalk.gray(`# model set by your account admin: ${customer.model} (enforced)`));
         }
+        if (cfg.llm.mode === 'azure') {
+            const { readConnectionCache } = await import('../connection/cache.js');
+            const c = await readConnectionCache();
+            for (const l of c ? formatAzureBlock(c) : ['', chalk.yellow("# [azure] your company's settings are not on this machine: run cspeach login")])
+                console.log(l);
+        }
         return;
     }
     const keyPath = args[0];

package/dist/commands/cost.js

@@ -11,7 +11,7 @@
 import chalk from 'chalk';
 import { readCostLog, summarise, turnRows } from '../cost/cost-log.js';
 import { formatCost } from '../cost/pricing.js';
-import { creditsActive, formatCredits, globalCredits, CREDITS_PENDING, } from '../cost/credits.js';
+import { creditsActive, tokensOnlyActive, formatCredits, globalCredits, CREDITS_PENDING, } from '../cost/credits.js';
 import { panelHeading, panelRow } from '../renderer/panel-rows.js';
 import { formatInfo } from '../renderer/notice-shape.js';
 import { countLabel } from '../renderer/checklist-format.js';
@@ -54,6 +54,9 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     // 2026-10-02 (owner): tokens go too. Not a COGS leak on their own, but beside
     // credits they invite "credits per token" maths — credits only for managed.
     const inCredits = creditsActive();
+    // Azure (Task 5b): tokens only — CSPeach has no price for the customer's
+    // deployments, so no formatCost() figure is printed anywhere below.
+    const tokensOnly = tokensOnlyActive();
     const perTurn = summariseCredits(entries);
     const turnsNote = `${s.turns} turn${s.turns === 1 ? '' : 's'}`;
     emit('');
@@ -66,6 +69,9 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
         if (credits?.balance != null)
             emit(panelRow('Balance', formatCredits(credits.balance, unit)));
     }
+    else if (tokensOnly) {
+        emit(panelHeading('Session tokens so far', turnsNote));
+    }
     else {
         emit(panelHeading(`Session cost so far: ${formatCost(s.totalCost)}`, turnsNote));
     }
@@ -75,25 +81,33 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
         emit(panelRow('input', s.totalTokens.input.toLocaleString().padStart(12)));
         emit(panelRow('output', s.totalTokens.output.toLocaleString().padStart(12)));
         emit(panelRow('cache read', s.totalTokens.cacheRead.toLocaleString().padStart(12)));
-        emit(panelRow('cache create', s.totalTokens.cacheCreate.toLocaleString().padStart(12)));
+        // Azure (Task 7, ruling 7): the spec's wording; other modes unchanged.
+        emit(panelRow(tokensOnly ? 'cache write' : 'cache create', s.totalTokens.cacheCreate.toLocaleString().padStart(12)));
+    }
+    if (tokensOnly) {
+        emit('');
+        emit(panelRow('Cost', 'billed on your Azure invoice · CSPeach has no price for your deployments'));
     }
     // Task 18 fix M3 — reader subagent spend (already inside the total above).
     // USD only: in credits mode the balance delta already carries it.
     if (s.readerCalls > 0 && !inCredits) {
         emit('');
-        emit(panelRow('Readers', `${s.readerCalls} run${s.readerCalls === 1 ? '' : 's'}   ${formatCost(s.readerCost)}`));
+        const readerTail = tokensOnly ? '' : `   ${formatCost(s.readerCost)}`;
+        emit(panelRow('Readers', `${s.readerCalls} run${s.readerCalls === 1 ? '' : 's'}${readerTail}`));
     }
-    if (s.byModel.length > 1) {
+    if (s.byModel.length > 1 && !inCredits) {
         emit('');
         emit(chalk.bold('By model:'));
         for (const m of s.byModel) {
             // Credits mode: turn counts only. A per-model dollar split is a direct
             // read on our per-model COGS.
-            const tail = inCredits ? '' : `   ${formatCost(m.cost)}`;
+            const tail = inCredits || tokensOnly ? '' : `   ${formatCost(m.cost)}`;
             emit(panelRow(modelText(m.model), `${m.turns} turn${m.turns === 1 ? '' : 's'}${tail}`, 24));
         }
     }
-    else if (s.byModel[0]) {
+    else if (s.byModel[0] && !inCredits) {
+        // 2026-10-09 (owner): no model line for managed customers — they pay in
+        // credits and cannot change the model here; it only invites questions.
         emit('');
         emit(panelRow('Model', modelText(s.byModel[0].model)));
     }
@@ -115,8 +129,9 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
             ? (typeof e.credits === 'number'
                 ? formatCredits(e.credits, credits?.unitLabel ?? 'credits')
                 : CREDITS_PENDING)
-            : formatCost(e.cost);
-        emit(panelRow(`turn ${String(e.turn).padStart(3)}`, inCredits ? tail : `${tok.padStart(10)} tok   ${tail}`, 8));
+            : tokensOnly ? '' : formatCost(e.cost);
+        const row = inCredits ? tail : tokensOnly ? `${tok.padStart(10)} tok` : `${tok.padStart(10)} tok   ${tail}`;
+        emit(panelRow(`turn ${String(e.turn).padStart(3)}`, row, 8));
     }
     if (inCredits && perTurn.unknown > 0) {
         emit('');
@@ -124,6 +139,8 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
             + `their usage is included in a later turn's figure.`).trimEnd());
     }
     emit('');
+    if (inCredits)
+        emit(formatInfo('This month and your top skills: /usage').trimEnd());
     emit(formatInfo(`Detailed JSONL: ~/.cspeach/sessions/${sessionId}-cost.jsonl`).trimEnd());
     emit('');
 }

package/dist/commands/help.js

@@ -1,6 +1,6 @@
 import chalk from 'chalk';
 import { SKILL_CATALOG } from '../skill-catalog.js';
-import { costCommandDescription } from '../repl/builtin-commands.js';
+import { costCommandDescription, usageCommandDescription } from '../repl/builtin-commands.js';
 import { panelHeading } from '../renderer/panel-rows.js';
 import { paint } from '../renderer/theme.js';
 import { uiWidth, truncateToWidth } from '../renderer/ui-width.js';
@@ -52,6 +52,7 @@ export const HELP_GROUPS = [
             { name: '/new', description: fixed('Next prompt picks a skill afresh (also /reset)') },
             { name: '/recap', description: fixed('Show the recap (last session, open tasks, plan)') },
             { name: '/cost', description: costCommandDescription },
+            { name: '/usage', description: usageCommandDescription },
             { name: '/context', description: fixed("Show what fills the model's context window") },
             { name: '/compact', description: fixed('Shrink a long session and keep the facts') },
             { name: '/help', description: fixed('This screen (also /skills)') },

package/dist/commands/login-azure.js

@@ -0,0 +1,33 @@
+/**
+ * `cspeach login azure [--device-code]` — the Microsoft sign-in alone (token
+ * expired, password changed, a new policy). Uses the company settings already
+ * on this machine; `cspeach login` fetches them.
+ */
+import { formatFailure } from '../renderer/notice-shape.js';
+import { paint } from '../renderer/theme.js';
+import { getGlyphs } from '../renderer/glyphs.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { readConnectionCache } from '../connection/cache.js';
+import { signInAzure } from '../auth/azure/sign-in.js';
+export async function runLoginAzureCommand(deps) {
+    const cached = await (deps.read ?? readConnectionCache)();
+    if (!cached || cached.removed) {
+        deps.print(formatFailure({ what: "Your company's Azure settings are not on this machine.", next: 'cspeach login' }).trimEnd());
+        return 2;
+    }
+    const conn = cached.connection;
+    if (!conn.sign_in.includes('entra')) {
+        deps.print(formatFailure({ what: 'Your company uses Azure keys, not Microsoft sign-in.', next: 'ask IT for your key, then cspeach config set llm.azure_key -' }).trimEnd());
+        return 2;
+    }
+    const r = await (deps.signIn ?? signInAzure)(conn, { deviceCode: deps.deviceCode }, { open: deps.open, print: deps.print });
+    if (!r.ok) {
+        deps.print(formatFailure({ what: r.what, next: r.next }).trimEnd());
+        return 2;
+    }
+    const until = r.expiresOn ? ` · token valid until ${r.expiresOn.toISOString()}` : '';
+    // The account name comes from Microsoft: one line, no control characters.
+    const who = sanitizeControlChars(r.username).replace(/\s+/g, ' ').trim();
+    deps.print(`${paint('ok', getGlyphs().done)} Signed in to Microsoft as ${who}${until}`);
+    return 0;
+}

package/dist/commands/login.js

@@ -6,23 +6,30 @@
  *   2) Open the browser to verification_url_complete (or print URL if open fails)
  *   3) Print user_code prominently so customer can read it
  *   4) Poll /v1/auth/device/poll every interval until verified or maxAttempts
- *   5) Save api_key + customer_id to ~/.cspeach/auth.json
+ *   5) Save api_key to the OS credential store (this CSPeach home's account);
+ *      auth.json keeps customer_id + savedAt (the key only without a store)
  *   6) Call GET /v1/me — if trial_mode === 'byok', pull the org's Anthropic key,
  *      or prompt for the user's own
  *   7) Store that key in the OS keychain (cspeach.anthropic/api-key) — never
  *      in auth.json (2026-10-02)
+ *   8) GET /v1/me/connection — Azure tenant mode: the company's Azure
+ *      settings are shown and saved only on a yes (a no exits 6)
+ *   9) Azure with Entra: the Microsoft sign-in (browser, or a device code
+ *      with --device-code); a failure exits 7 and keeps the CSPeach sign-in
  *
  * Dependencies (open, print, prompt) are injected so the command is
  * unit-testable without stubbing platform globals.
  */
 import keychain from '../auth/keychain.js';
-import { writeAuthFile } from '../auth/auth-file.js';
+import { saveSignIn } from '../auth/key-resolver.js';
 import { fetchOrgAnthropicKey } from '../auth/org-anthropic-key.js';
 import { formatFailure, formatAttention, formatInfo } from '../renderer/notice-shape.js';
 import { panelRow } from '../renderer/panel-rows.js';
 import { paint } from '../renderer/theme.js';
 import { getGlyphs } from '../renderer/glyphs.js';
 import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { runConnectionStep } from '../connection/login-step.js';
+import { clientIdConfigured } from '../connection/azure-facts.js';
 const ANTHROPIC_KEYCHAIN_SERVICE = 'cspeach.anthropic';
 const ANTHROPIC_KEYCHAIN_ACCOUNT = 'api-key';
 /** Server-supplied text (user code, URL, email, plan) is one line with no control characters. */
@@ -92,12 +99,13 @@ export async function runLoginCommand(deps) {
         deps.print(formatFailure({ what: 'Timed out waiting for the browser sign-in', next: 'cspeach login' }).trimEnd());
         return 5;
     }
-    // 5) Save (non-BYOK part).
-    await writeAuthFile({
-        apiKey: polled.api_key,
-        customerId: polled.customer_id,
-    });
-    deps.print(done('Saved your CSPeach key to auth.json in your CSPeach home'));
+    // 5) Save (non-BYOK part). Security batch item 6 — the OS credential store
+    // first; auth.json keeps customerId + savedAt, and the key only when no
+    // credential store works on this machine.
+    const savedTo = await (deps.saveSignIn ?? saveSignIn)({ apiKey: polled.api_key, customerId: polled.customer_id });
+    deps.print(done(savedTo === 'store'
+        ? 'Saved your CSPeach key to your OS credential store'
+        : 'Saved your CSPeach key to auth.json in your CSPeach home (no OS credential store is available)'));
     // 6) /v1/me — figure out if BYOK is required.
     try {
         const r = await fetch(`${proxy}/v1/me`, { headers: { Authorization: `Bearer ${polled.api_key}` } });
@@ -138,6 +146,46 @@ export async function runLoginCommand(deps) {
     catch (err) {
         deps.print(formatInfo(`Could not read your account details (${err instanceof Error ? err.message : String(err)}) · sign-in still worked`).trimEnd());
     }
+    // 8) Azure tenant mode — the company's connection settings (no secrets).
+    // { kind: 'none' } changes nothing; an Azure answer is confirmed on screen.
+    const step = await (deps.connectionStep ?? runConnectionStep)({
+        proxyUrl: proxy, apiKey: polled.api_key, print: deps.print,
+        confirm: async (q) => /^y(es)?$/i.test((await deps.prompt(`${q} [y/n] `)).trim()),
+    });
+    if (step.result === 'declined')
+        return 6;
+    // Azure tenant mode (Task 6b) — with Entra the Microsoft sign-in follows
+    // the settings. A failed one keeps the CSPeach sign-in (exit 7).
+    if (step.result === 'azure') {
+        if (step.connection.sign_in.includes('entra')) {
+            // Only when this build can sign in to Microsoft at all; otherwise the
+            // sign-in's own refusal is the one line.
+            if (clientIdConfigured())
+                deps.print(formatInfo("Now sign in to Microsoft for your company's Azure").trimEnd());
+            const signIn = deps.azureSignIn ?? (await import('../auth/azure/sign-in.js')).signInAzure;
+            const r = await signIn(step.connection, { deviceCode: deps.deviceCode === true }, { open: deps.open, print: deps.print });
+            if (!r.ok) {
+                deps.print(formatFailure({ what: r.what, next: r.next }).trimEnd());
+                deps.print(formatInfo('Your CSPeach sign-in worked · when the Microsoft sign-in is sorted out, run cspeach login azure').trimEnd());
+                return 7;
+            }
+            deps.print(done(`Signed in to Microsoft as ${serverText(r.username)}`));
+        }
+        else {
+            deps.print(formatInfo('Your company uses Azure keys · ask IT for yours, then run cspeach config set llm.azure_key -').trimEnd());
+        }
+    }
+    // Fix round 1 (I3): still set to azure (e.g. after cspeach logout) but the
+    // company has no settings. Never suggest managed: that would move prompts
+    // to our service without the company's say.
+    // Ruling 1 (Task 7): only a real { kind: 'none' } answer says so; a service
+    // without the settings route ('no_route') stays silent.
+    if (step.result === 'none') {
+        const { loadConfig } = await import('../config/loader.js');
+        const mode = await loadConfig().then((c) => c.llm?.mode).catch(() => undefined);
+        if (mode === 'azure')
+            deps.print(formatInfo('Your company has no Azure settings in CSPeach · ask your CSPeach admin which setup to use').trimEnd());
+    }
     deps.print(`  ${paint('dim', 'Next:')} run cspeach to start`);
     return 0;
 }

package/dist/commands/logout.js

@@ -1,21 +1,45 @@
 /**
- * `cspeach logout` — delete the device-code-flow auth file. The REPL
- * will fall back to the keytar-stored API key if one is present.
+ * `cspeach logout` — security batch item 6: delete this home's credential
+ * store entry, auth.json and licence.json; Azure tenant mode adds the
+ * company's Azure entries in this home (clearAzureSignIn). Other CSPeach
+ * homes are untouched.
  */
-import { deleteAuthFile, readAuthFile } from '../auth/auth-file.js';
-import { formatInfo } from '../renderer/notice-shape.js';
+import { clearSignIn } from '../auth/key-resolver.js';
+import { clearAzureSignIn } from '../auth/azure/clear.js';
+import { formatFailure, formatInfo } from '../renderer/notice-shape.js';
 import { paint } from '../renderer/theme.js';
 import { getGlyphs } from '../renderer/glyphs.js';
 export async function runLogoutCommand(deps) {
-    const before = await readAuthFile();
-    await deleteAuthFile();
-    if (before) {
-        deps.print(`${paint('ok', getGlyphs().done)} Signed out · removed auth.json from your CSPeach home`);
-        deps.print(`  ${paint('dim', 'The REPL uses the keychain-stored key if you have one.')}`);
+    const { hadSignIn, cleared } = await (deps.clear ?? (() => clearSignIn()))();
+    // Fix round 1 (F2): never say "removed" while a key is still in this home.
+    if (cleared === false) {
+        deps.print(formatFailure({
+            what: 'Could not sign out completely',
+            detail: ['a CSPeach key is still in this CSPeach home (OS credential store or auth.json)'],
+            next: 'close other cspeach windows, then run cspeach logout again',
+        }).trimEnd());
+        return 1;
+    }
+    const az = await (deps.clearAzure ?? (() => clearAzureSignIn()))()
+        .catch(() => ({ removed: [], failed: ['your Azure sign-in details'] }));
+    if (hadSignIn) {
+        deps.print(`${paint('ok', getGlyphs().done)} Signed out · removed your CSPeach key from this CSPeach home`);
         deps.print(`  ${paint('dim', 'Next:')} cspeach login   (to sign in again)`);
     }
     else {
-        deps.print(formatInfo('Already signed out · no auth.json present').trimEnd());
+        deps.print(formatInfo('Already signed out · no CSPeach key in this CSPeach home').trimEnd());
+    }
+    for (const what of az.removed)
+        deps.print(`${paint('ok', getGlyphs().done)} Removed ${what} from this CSPeach home`);
+    // Fix round 1: outside azure mode an Azure clean-up error (e.g. EPERM on a
+    // stale connection.json) neither prints nor changes the exit code.
+    const mode = az.failed.length > 0
+        ? await (deps.mode ?? (async () => (await (await import('../config/loader.js')).loadConfig()).llm?.mode))().catch(() => undefined)
+        : undefined;
+    // An unreadable mode still reports the failure.
+    if (az.failed.length > 0 && (mode === undefined || mode === 'azure')) {
+        deps.print(formatFailure({ what: `Could not remove ${az.failed.join(', ')}`, next: 'close other cspeach windows, then run cspeach logout again' }).trimEnd());
+        return 1;
     }
     return 0;
 }

package/dist/commands/plan-boundary.js

@@ -67,12 +67,12 @@ const COMPACT_CALL = {
     maxTokens: 4000,
     headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' },
 };
-export function makePhaseBoundarySummariser(provider, model) {
-    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), buildPhaseBoundaryPrompt() + '\n\n' + serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers } });
+export function makePhaseBoundarySummariser(provider, model, sessionId) {
+    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), buildPhaseBoundaryPrompt() + '\n\n' + serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers }, ...(sessionId ? { sessionId } : {}) });
 }
 /** The standard /compact summarisation (the compact skill carries the instructions). */
-export function makeAutoCompactSummariser(provider, model) {
-    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers } });
+export function makeAutoCompactSummariser(provider, model, sessionId) {
+    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers }, ...(sessionId ? { sessionId } : {}) });
 }
 /** Auto-compact after a plan turn whose revision is already saved and that queued no next step. */
 export async function maybeAutoCompactAfterPlanTurn(a) {

package/dist/commands/plan-model-tier.js

@@ -67,7 +67,9 @@ const NO_OVERRIDE = { model: null, notice: null };
  *
  * Anything ambiguous resolves to "no override". The returned model is
  * claude-sonnet-4-6 or nothing — Haiku is unreachable by construction
- * (pinned in plan-model-tier.test.ts).
+ * (pinned in plan-model-tier.test.ts). Azure tenant mode: `tierModel`
+ * replaces the target with the company's review deployment, or turns
+ * tiering off (null).
  */
 export function selectPlanPhaseModel(args) {
     if (!args.enabled)
@@ -76,8 +78,11 @@ export function selectPlanPhaseModel(args) {
         return NO_OVERRIDE;
     if (!/opus/i.test(args.defaultModel))
         return NO_OVERRIDE;
+    if (args.tierModel === null)
+        return NO_OVERRIDE;
+    const target = args.tierModel ?? PLAN_TIER_SONNET_MODEL;
     return {
-        model: PLAN_TIER_SONNET_MODEL,
-        notice: `phase ${args.phaseId} → ${PLAN_TIER_SONNET_MODEL} (plan model tiering)`,
+        model: target,
+        notice: `phase ${args.phaseId} → ${target} (plan model tiering)`,
     };
 }

package/dist/commands/usage.js

@@ -0,0 +1,112 @@
+/**
+ * `/usage` slash command (2026-10-09) — this month at a glance, in credits:
+ * a bar of what this month used against what was available, the balance,
+ * the top skills and this session. `/cost` stays the per-turn detail.
+ *
+ * Managed only: the numbers come from the proxy's credit ledger
+ * (GET /v1/me/usage). Own key / local mode: no CSPeach ledger exists, so the
+ * panel says where monthly usage lives instead. Never a dollar figure.
+ * Colours: the panels palette only (panelHeading / panelRow / paint).
+ */
+import { loadConfig } from '../config/loader.js';
+import { getStore } from '../auth/api-key.js';
+import { creditsActive, formatCredits, globalCredits } from '../cost/credits.js';
+import { fetchMonthUsage } from '../cost/month-usage.js';
+import { panelHeading, panelRow } from '../renderer/panel-rows.js';
+import { formatInfo } from '../renderer/notice-shape.js';
+import { paint } from '../renderer/theme.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { shouldUseUnicodeBoxChars } from '../renderer/tty.js';
+const BAR_WIDTH = 20;
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+/** used / (used + left), as filled cells of BAR_WIDTH; a non-zero use shows at least one cell. */
+export function usageBar(used, left, unicode = shouldUseUnicodeBoxChars()) {
+    const total = used + Math.max(0, left ?? 0);
+    let filled = total > 0 ? Math.round((BAR_WIDTH * used) / total) : 0;
+    if (used > 0 && filled === 0)
+        filled = 1;
+    filled = Math.min(BAR_WIDTH, filled);
+    const [on, off] = unicode ? ['█', '░'] : ['#', '-'];
+    return paint('brand', on.repeat(filled)) + paint('frame', off.repeat(BAR_WIDTH - filled));
+}
+function monthName(iso) {
+    const d = iso ? new Date(iso) : new Date();
+    return MONTHS[(Number.isNaN(d.getTime()) ? new Date() : d).getUTCMonth()];
+}
+async function defaultDeps() {
+    const cfg = await loadConfig();
+    return {
+        mode: cfg.llm?.mode ?? 'managed',
+        fetchUsage: () => fetchMonthUsage(cfg, async () => (await (await getStore()).get()) ?? ''),
+        // Credits seen this run (balance deltas); unknown outside credits mode.
+        sessionCredits: creditsActive() ? globalCredits.snapshot().sessionTotal : null,
+    };
+}
+export async function runUsageCommand(emit = (l) => console.log(l), deps) {
+    // Review fix: a config that fails to load mid-session must not throw out of
+    // the REPL handler — fall back to the "could not reach" line.
+    let d;
+    try {
+        d = deps ?? await defaultDeps();
+    }
+    catch {
+        d = { mode: 'managed', fetchUsage: async () => null, sessionCredits: null };
+    }
+    emit('');
+    if (d.mode === 'azure') {
+        emit(panelHeading('Usage'));
+        emit(formatInfo("CSPeach on your Azure shows tokens only. /cost shows this session's tokens. Your company's usage report is in the CSPeach portal. Your Azure invoice is the record.").trimEnd());
+        emit('');
+        return;
+    }
+    if (d.mode !== 'managed') {
+        emit(panelHeading('Usage'));
+        emit(formatInfo('You are on your own model key, so CSPeach keeps no monthly usage. It is in your provider account. /cost shows this session.').trimEnd());
+        emit('');
+        return;
+    }
+    const u = await d.fetchUsage();
+    if (!u) {
+        emit(panelHeading('Usage'));
+        emit(formatInfo('Could not reach CSPeach for this month’s usage. Try again in a moment. /cost shows this session.').trimEnd());
+        emit('');
+        return;
+    }
+    if (!u.metered) {
+        emit(panelHeading('Usage'));
+        emit(formatInfo('This account is not billed in credits, so there is no monthly credit usage to show. /cost shows this session.').trimEnd());
+        emit('');
+        return;
+    }
+    const unit = u.unitLabel;
+    const used = u.monthUsed ?? 0;
+    emit(panelHeading('Usage', `this month (${monthName(u.monthStart)}, UTC)`));
+    emit('');
+    emit(panelRow('This month', `${usageBar(used, u.balance)}  ${formatCredits(used, unit)} used`, 14));
+    if (u.balance !== null) {
+        const split = u.subscription !== null && u.purchased !== null
+            ? paint('dim', `   monthly ${Math.round(u.subscription).toLocaleString('en-US')} · bought ${Math.round(u.purchased).toLocaleString('en-US')}`)
+            : '';
+        emit(panelRow('Balance', `${formatCredits(u.balance, unit)} left${split}`, 14));
+    }
+    if (u.topSkills.length > 0) {
+        emit('');
+        emit(panelHeading('Top skills this month'));
+        const width = Math.max(14, ...u.topSkills.map((s) => sanitizeControlChars(s.skill).length + 2));
+        const valueWidth = Math.max(...u.topSkills.map((s) => Math.round(s.credits).toLocaleString('en-US').length));
+        for (const s of u.topSkills) {
+            emit(panelRow(sanitizeControlChars(s.skill), Math.round(s.credits).toLocaleString('en-US').padStart(valueWidth), width));
+        }
+        if (u.otherSkills > 0) {
+            emit(panelRow('other skills', Math.round(u.otherSkills).toLocaleString('en-US').padStart(valueWidth), width));
+        }
+    }
+    emit('');
+    if (d.sessionCredits !== null) {
+        emit(panelRow('This session', `${formatCredits(d.sessionCredits, unit)}${paint('dim', '   details: /cost')}`, 14));
+    }
+    else {
+        emit(formatInfo('Details for this session: /cost').trimEnd());
+    }
+    emit('');
+}