@cspeach/cli 1.1.32 → 1.1.34

package/dist/connection/guard.js

@@ -0,0 +1,94 @@
+export const AZURE_ENDPOINT_RE = /^https:\/\/[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.services\.ai\.azure\.com\/anthropic$/;
+const AZURE_HOST_RE = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.services\.ai\.azure\.com$/;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Same rule as the proxy (customer-connections.ts DEPLOYMENT_NAME_RE): 1–64 of A-Z a-z 0-9 . _ -, not only dots. */
+const NAME_RE = /^(?!\.+$)[A-Za-z0-9._-]{1,64}$/;
+const FAMILY_RE = /^claude-[a-z0-9-]{1,60}$/;
+export class AzureHostRefusedError extends Error {
+    host;
+    constructor(host) {
+        super(`CSPeach will not send your sign-in to ${host}.`);
+        this.name = 'AzureHostRefusedError';
+        this.host = host;
+    }
+}
+export function isAllowedAzureEndpoint(endpoint) {
+    return typeof endpoint === 'string' && AZURE_ENDPOINT_RE.test(endpoint);
+}
+export function assertAllowedAzureUrl(url) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        throw new AzureHostRefusedError(String(url).slice(0, 80));
+    }
+    const pathOk = u.pathname === '/anthropic' || u.pathname.startsWith('/anthropic/');
+    if (u.protocol !== 'https:' || u.port !== '' || u.username !== '' || u.password !== '' || !AZURE_HOST_RE.test(u.hostname) || !pathOk) {
+        throw new AzureHostRefusedError(u.host || String(url).slice(0, 80));
+    }
+}
+function entry(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return null;
+    const r = v;
+    return typeof r.name === 'string' && NAME_RE.test(r.name) && typeof r.model === 'string' && FAMILY_RE.test(r.model)
+        ? { name: r.name, model: r.model } : null;
+}
+/** A settings answer the CLI accepts, or null (treated like a failed fetch: the cache is kept). */
+export function parseConnectionAnswer(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const r = raw;
+    if (r.kind === 'none')
+        return { kind: 'none' };
+    if (r.kind !== 'azure')
+        return null;
+    if (!isAllowedAzureEndpoint(r.endpoint))
+        return null;
+    if (typeof r.entra_tenant_id !== 'string' || !UUID_RE.test(r.entra_tenant_id))
+        return null;
+    const s = r.sign_in;
+    if (!Array.isArray(s) || s.length === 0 || !s.every((x) => x === 'entra' || x === 'key'))
+        return null;
+    const d = r.deployments;
+    if (!d || typeof d !== 'object')
+        return null;
+    const main = entry(d.main);
+    const small = entry(d.small);
+    const review = d.review === undefined ? undefined : entry(d.review);
+    if (!main || !small || review === null)
+        return null;
+    const usage = r.usage_counts === undefined ? 'required' : r.usage_counts;
+    if (usage !== 'required' && usage !== 'optional')
+        return null;
+    if (typeof r.updated_at !== 'string')
+        return null;
+    const deployments = review ? { main, small, review } : { main, small };
+    const limit = seatLimit(r.limit);
+    const out = {
+        kind: 'azure', endpoint: r.endpoint, entra_tenant_id: r.entra_tenant_id.toLowerCase(),
+        sign_in: [...new Set(s)], deployments, usage_counts: usage, updated_at: r.updated_at,
+        ...(limit ? { limit } : {}),
+    };
+    return out;
+}
+const LIMIT_MONTH_RE = /^\d{4}-(0[1-9]|1[0-2])$/;
+/**
+ * Task 8b — this seat's monthly limit, only when well-formed: a positive whole
+ * limit, a whole non-negative `used`, a UTC month 'YYYY-MM'. Anything else is
+ * ignored (no limit applied, no crash); the rest of the settings still parse.
+ */
+function seatLimit(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return undefined;
+    const l = v;
+    const { monthly_tokens: m, used: u, month } = l;
+    if (typeof m !== 'number' || !Number.isInteger(m) || m <= 0)
+        return undefined;
+    if (typeof u !== 'number' || !Number.isInteger(u) || u < 0)
+        return undefined;
+    if (typeof month !== 'string' || !LIMIT_MONTH_RE.test(month))
+        return undefined;
+    return { monthly_tokens: m, used: u, month };
+}

package/dist/connection/limit-gate.js

@@ -0,0 +1,26 @@
+/**
+ * Azure tenant mode, Task 8b — the per-developer monthly limit, applied by
+ * CSPeach on the laptop against the counts it reports (Azure budgets and
+ * quotas are the hard stop). Checked before each NEW turn; a running turn
+ * finishes. One 80% line per session. Offline: the last known `used` plus the
+ * local count. The month is UTC.
+ */
+import { formatFailure } from '../renderer/notice-shape.js';
+import { utcMonth } from './local-usage.js';
+export { countedTokens } from './local-usage.js';
+export const WARN_AT = 0.8;
+export function limitVerdict(limit, local, now, warned) {
+    if (!limit)
+        return { allow: true };
+    const month = utcMonth(now);
+    // A `used` from an earlier month is not this month's: a new UTC month starts at 0.
+    const used = limit.month === month ? limit.used : 0;
+    const mine = local && local.month === month ? local.tokens : 0;
+    const total = used + mine;
+    if (total >= limit.monthly_tokens) {
+        return { allow: false, message: formatFailure({ what: "You have reached your company's CSPeach limit for this month.", next: 'ask your CSPeach admin to raise it' }).trimEnd() };
+    }
+    if (!warned && total >= WARN_AT * limit.monthly_tokens)
+        return { allow: true, warn: "You have used 80% of this month's CSPeach limit." };
+    return { allow: true };
+}

package/dist/connection/local-usage.js

@@ -0,0 +1,71 @@
+/**
+ * Azure tenant mode, Task 8b — <CSPEACH_HOME>/azure-usage-local.json: counted
+ * tokens since the last good limit refresh, in the current UTC month.
+ * Survives restarts, so the limit holds offline (plan D6). A damaged or
+ * hand-edited file reads as "no local count", never a crash.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { cspeachRoot } from '../config/paths.js';
+/**
+ * The tokens a limit counts: input + output + cache-write. Cache reads are
+ * not counted. The one place the CLI computes it (the proxy's seat total,
+ * seatMonthTokens in cspeach-proxy/src/db/azure-usage.ts, sums the same three).
+ */
+export function countedTokens(r) {
+    return (r.input_tokens || 0) + (r.output_tokens || 0) + (r.cache_write_tokens || 0);
+}
+const MONTH_RE = /^\d{4}-(0[1-9]|1[0-2])$/;
+export function utcMonth(d) {
+    return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, '0')}`;
+}
+export function localUsagePath() {
+    return path.join(cspeachRoot(), 'azure-usage-local.json');
+}
+export async function readLocalUsage() {
+    try {
+        const r = JSON.parse(await fs.readFile(localUsagePath(), 'utf-8'));
+        if (!r || typeof r.month !== 'string' || !MONTH_RE.test(r.month) || typeof r.since !== 'string'
+            || typeof r.tokens !== 'number' || !Number.isFinite(r.tokens) || r.tokens < 0)
+            return null;
+        return { month: r.month, since: r.since, tokens: Math.floor(r.tokens) };
+    }
+    catch {
+        return null;
+    }
+}
+async function write(u) {
+    const f = localUsagePath();
+    await fs.mkdir(path.dirname(f), { recursive: true });
+    const tmp = `${f}.${process.pid}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(u), 'utf-8');
+    await fs.rename(tmp, f);
+}
+export async function addLocalUsage(tokens, now = new Date()) {
+    if (!Number.isFinite(tokens) || tokens <= 0)
+        return;
+    const month = utcMonth(now);
+    const cur = await readLocalUsage();
+    const base = cur && cur.month === month ? cur : { month, since: now.toISOString(), tokens: 0 };
+    await write({ ...base, tokens: base.tokens + Math.floor(tokens) });
+}
+/**
+ * A good limit refresh restarts the count. D6: it restarts at `tokens` — this
+ * seat's records still queued, which the fresh `used` does not hold yet.
+ */
+export async function resetLocalUsage(now = new Date(), tokens = 0) {
+    const t = Number.isFinite(tokens) ? Math.max(0, Math.floor(tokens)) : 0;
+    await write({ month: utcMonth(now), since: now.toISOString(), tokens: t });
+}
+/** Logout (final fix wave E): remove this home's local count. True when a file was removed. */
+export async function deleteLocalUsage() {
+    try {
+        await fs.unlink(localUsagePath());
+        return true;
+    }
+    catch (e) {
+        if (e?.code === 'ENOENT')
+            return false;
+        throw e;
+    }
+}

package/dist/connection/login-step.js

@@ -0,0 +1,62 @@
+/**
+ * Azure tenant mode — the connection step of `cspeach login`, after the
+ * CSPeach key is stored. { kind: 'none' } leaves everything as it was. An
+ * Azure answer is shown (endpoint + tenant) and saved only on a yes; then
+ * llm.mode = "azure" is written. Task 6 adds the Microsoft sign-in after it.
+ */
+import { formatFailure, formatInfo } from '../renderer/notice-shape.js';
+import { panelHeading, panelRow } from '../renderer/panel-rows.js';
+import { fetchConnection } from './fetch.js';
+import { readConnectionCache, writeConnectionCache, deleteConnectionCache } from './cache.js';
+import { freshCache } from './state.js';
+async function setModeAzure() {
+    const { loadConfig, saveConfig } = await import('../config/loader.js');
+    const { markExplicit } = await import('../commands/config-set.js');
+    const cfg = await loadConfig();
+    cfg.llm = { ...cfg.llm, mode: 'azure' };
+    markExplicit(cfg, 'llm.mode');
+    await saveConfig(cfg);
+}
+export async function runConnectionStep(d) {
+    const f = await (d.fetch ?? fetchConnection)({ proxyUrl: d.proxyUrl, apiKey: d.apiKey });
+    // No such route (an older service): silent, changes nothing — its own result.
+    if (!f.ok && f.status === 404)
+        return { result: 'no_route' };
+    if (!f.ok) {
+        d.print(formatInfo(`Could not read your company's CSPeach settings (${f.status === 0 ? f.error : `HTTP ${f.status}`}) · sign-in still worked · if your company uses its own Azure, run cspeach login again`).trimEnd());
+        return { result: 'unavailable' };
+    }
+    if (f.answer.kind === 'none')
+        return { result: 'none' };
+    const conn = f.answer;
+    d.print('');
+    d.print(panelHeading('Your company set CSPeach to use its own Azure'));
+    d.print(panelRow('Endpoint', conn.endpoint, 9));
+    d.print(panelRow('Tenant', conn.entra_tenant_id, 9));
+    if (!(await d.confirm("Is this your company's Azure endpoint?"))) {
+        d.print(formatFailure({ what: 'CSPeach did not switch to your Azure.', next: 'ask your CSPeach admin to check the endpoint, then run cspeach login again' }).trimEnd());
+        // Final fix wave A: our service refuses this company's seats on the
+        // managed path, so say plainly that nothing runs until this is sorted.
+        d.print(formatInfo("Your CSPeach mode is unchanged. CSPeach will not run until your company's Azure settings are confirmed.").trimEnd());
+        return { result: 'declined' };
+    }
+    // Fix round 1 (I2): a failed save leaves "nothing happened" — the mode is
+    // not switched — and says so in one plain line. Ruling 2 (Task 7): only a
+    // cache THIS login created is removed; good settings that were already here
+    // (a seat already on azure, logging in again) are kept or written back.
+    const write = d.write ?? writeConnectionCache;
+    const previous = await (d.read ?? readConnectionCache)().catch(() => null);
+    try {
+        await write(freshCache(conn, (d.now ?? (() => new Date()))().toISOString()));
+        await (d.setMode ?? (async () => setModeAzure()))('azure');
+    }
+    catch {
+        if (previous)
+            await write(previous).catch(() => { });
+        else
+            await (d.deleteCache ?? deleteConnectionCache)().catch(() => { });
+        d.print(formatFailure({ what: "Could not save your company's Azure settings on this machine.", next: 'run cspeach login again' }).trimEnd());
+        return { result: 'unavailable' };
+    }
+    return { result: 'azure', connection: conn };
+}

package/dist/connection/startup.js

@@ -0,0 +1,67 @@
+/**
+ * Azure tenant mode — load the company's settings at start and at the
+ * 4-hour licence boundaries (between turns only). Offline keeps the cache.
+ * A changed endpoint or tenant is shown and asked about before use;
+ * one-shot / CI never asks and refuses until a person confirms.
+ */
+import { formatAttention, formatInfo } from '../renderer/notice-shape.js';
+import { panelRow } from '../renderer/panel-rows.js';
+import { ignoredEnvOverrides } from '../models/model-identity.js';
+import { fetchConnection } from './fetch.js';
+import { readConnectionCache, writeConnectionCache, setActiveConnection } from './cache.js';
+import { applyRefresh, azureTurnVerdict, confirmPending } from './state.js';
+import { resetLocalUsage } from './local-usage.js';
+/** Loaded on demand: only azure refreshes read the usage queue. */
+async function defaultQueuedTokens(apiKey) {
+    const q = await import('../usage/usage-queue.js');
+    return q.queuedTokens(q.keyPrefixFor(apiKey));
+}
+export async function refreshAzureConnection(d) {
+    let cached = await (d.read ?? readConnectionCache)();
+    let change = 'offline';
+    if (d.apiKey) {
+        const f = await (d.fetch ?? fetchConnection)({ proxyUrl: d.proxyUrl, apiKey: d.apiKey, timeoutMs: d.timeoutMs ?? 1500 });
+        if (f.ok) {
+            // Task 8b (plan D6) — a good refresh brings a fresh `used`, so the local
+            // running count restarts here, at the tokens of THIS seat's records still
+            // in the usage queue: those are exactly the ones `used` does not hold yet
+            // (D6 fix — not 0, which under-counts a backlog, and not "unchanged",
+            // which double counts what was acked). An unreadable queue keeps the
+            // count. A failed reset never blocks the refresh.
+            if (f.answer.kind === 'azure') {
+                const now = (d.now ?? (() => new Date()))();
+                let pending = null;
+                try {
+                    pending = d.queuedTokens ? await d.queuedTokens() : await defaultQueuedTokens(d.apiKey);
+                }
+                catch {
+                    pending = null;
+                }
+                if (pending !== null)
+                    await (d.resetLocal ?? resetLocalUsage)(now, pending).catch(() => { });
+            }
+            const r = applyRefresh(cached, f.answer, (d.now ?? (() => new Date()))().toISOString());
+            change = r.change;
+            let next = r.next;
+            if (r.change === 'endpoint' && next?.pending && d.interactive) {
+                d.print(formatAttention({ text: "Your company's Azure endpoint changed in CSPeach" }).trimEnd());
+                d.print(panelRow('Was', `${next.connection.endpoint} · tenant ${next.connection.entra_tenant_id}`, 6));
+                d.print(panelRow('Now', `${next.pending.endpoint} · tenant ${next.pending.entra_tenant_id}`, 6));
+                if (await d.confirm("Is the new one your company's Azure endpoint?"))
+                    next = confirmPending(next);
+            }
+            if (next) {
+                // The in-memory copy still applies this run; say once that it was not saved.
+                await (d.write ?? writeConnectionCache)(next).catch(() => {
+                    d.print(formatInfo("Could not save your company's Azure settings. CSPeach will ask again at the next start.").trimEnd());
+                });
+                cached = next;
+            }
+        }
+    }
+    setActiveConnection(cached);
+    for (const v of ignoredEnvOverrides(d.env ?? process.env)) {
+        d.print(formatInfo(`${v} is ignored: your company's Azure settings choose the models.`).trimEnd());
+    }
+    return { cached, verdict: azureTurnVerdict(cached), change };
+}

package/dist/connection/state.js

@@ -0,0 +1,68 @@
+/**
+ * Azure tenant mode — what a settings refresh does (spec "How settings reach
+ * the CLI"): a changed deployment name applies with no question; a changed
+ * endpoint or tenant waits for a person; removed settings refuse turns and
+ * never switch to managed on their own.
+ */
+import { formatFailure } from '../renderer/notice-shape.js';
+import { isAllowedAzureEndpoint } from './guard.js';
+export function freshCache(conn, nowIso) {
+    return { connection: conn, confirmed: { endpoint: conn.endpoint, entra_tenant_id: conn.entra_tenant_id }, pending: null, removed: false, fetchedAt: nowIso };
+}
+const sameEntry = (a, b) => (a?.name ?? '') === (b?.name ?? '') && (a?.model ?? '') === (b?.model ?? '');
+export function applyRefresh(cached, answer, nowIso) {
+    if (!cached)
+        return answer.kind === 'none' ? { next: null, change: 'none' } : { next: null, change: 'new' };
+    if (answer.kind === 'none')
+        return { next: { ...cached, removed: true, pending: null, fetchedAt: nowIso }, change: 'removed' };
+    const sameTarget = answer.endpoint === cached.confirmed.endpoint && answer.entra_tenant_id === cached.confirmed.entra_tenant_id;
+    if (!sameTarget)
+        return { next: { ...cached, pending: answer, removed: false, fetchedAt: nowIso }, change: 'endpoint' };
+    const c = cached.connection;
+    const deploymentsChanged = !sameEntry(c.deployments.main, answer.deployments.main)
+        || !sameEntry(c.deployments.small, answer.deployments.small)
+        || !sameEntry(c.deployments.review, answer.deployments.review);
+    const otherChanged = c.sign_in.join() !== answer.sign_in.join() || c.usage_counts !== answer.usage_counts
+        || JSON.stringify(c.limit ?? null) !== JSON.stringify(answer.limit ?? null) || cached.removed;
+    const change = deploymentsChanged ? 'deployments' : otherChanged ? 'other' : 'none';
+    return { next: { connection: answer, confirmed: cached.confirmed, pending: null, removed: false, fetchedAt: nowIso }, change };
+}
+export function confirmPending(c) {
+    if (!c.pending)
+        return c;
+    return { ...c, connection: c.pending, confirmed: { endpoint: c.pending.endpoint, entra_tenant_id: c.pending.entra_tenant_id }, pending: null };
+}
+/** Ruling 3 (Task 7): trimmed, like the licence refusals (licence-check.ts) and the login/logout lines. */
+const refusal = (p) => formatFailure(p).trimEnd();
+/**
+ * Why turns are refused with these settings ({ what, next }), or null when
+ * they are allowed. The one source for the turn refusal and for the doctor's
+ * settings row (final fix wave D).
+ */
+export function azureRefusalReason(c) {
+    if (!c)
+        return { what: "Your company's Azure settings are not on this machine.", next: 'cspeach login (while online)' };
+    if (c.removed)
+        return { what: "Your company's Azure settings were removed from CSPeach.", next: 'cspeach login' };
+    if (c.pending)
+        return { what: "Your company's Azure endpoint changed and is waiting for you to confirm it.", next: 'start cspeach to review it, or run cspeach login' };
+    // Typed unknown so the guard's narrowing does not turn the refused branch into `never`.
+    const endpoint = c.connection.endpoint;
+    if (!isAllowedAzureEndpoint(endpoint)) {
+        let host = String(endpoint);
+        try {
+            host = new URL(host).host;
+        }
+        catch { /* keep the raw text */ }
+        return { what: `CSPeach will not send your sign-in to ${host}.`, next: 'cspeach login (settings changed)' };
+    }
+    return null;
+}
+export function azureTurnVerdict(c) {
+    const why = azureRefusalReason(c);
+    return why ? { allow: false, message: refusal(why) } : { allow: true };
+}
+/** A request refused before it left the laptop (settings missing, removed, unconfirmed or off the allow-list). */
+export class AzureConnectionRefusedError extends Error {
+    constructor(message) { super(message); this.name = 'AzureConnectionRefusedError'; }
+}

package/dist/connection/types.js

@@ -0,0 +1 @@
+export {};

package/dist/cost/cost-log.js

@@ -15,6 +15,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { sessionsDir } from '../config/paths.js';
 import { computeCost } from './pricing.js';
+import { tokensOnlyActive } from './credits.js';
 /**
  * Task 7 — summarise `message_start.message.input_transformations` (probe P4
  * shape: `[{ type: 'thinking_dropped', path, reason }]`). Counts the
@@ -55,7 +56,8 @@ export function buildEntry(opts) {
         turn: opts.turn,
         model: opts.model,
         tokens: opts.tokens,
-        cost: computeCost(opts.model, opts.tokens),
+        // Azure: no price for the customer's deployment — never consult one.
+        cost: tokensOnlyActive() ? 0 : computeCost(opts.model, opts.tokens),
         duration_ms: opts.duration_ms,
     };
     if (opts.credits) {

package/dist/cost/credits-wire.js

@@ -46,7 +46,7 @@ export async function initCredits(cfg, getBearer) {
     try {
         // Non-managed modes can't be metered by us — skip the round-trip entirely.
         if (cfg.llm?.mode !== 'managed') {
-            setCostDisplayMode('usd');
+            setCostDisplayMode(cfg.llm?.mode === 'azure' ? 'tokens' : 'usd');
             return;
         }
         const info = await fetchBalance(cfg, getBearer);

package/dist/cost/credits.js

@@ -211,6 +211,10 @@ export function activeCostDisplayMode() {
 export function creditsActive() {
     return activeMode === 'credits';
 }
+/** Azure tenant mode — tokens only, never a price (the customer's Azure invoice is the record). */
+export function tokensOnlyActive() {
+    return activeMode === 'tokens';
+}
 /** Test seam — reset the process-wide mode between cases. */
 export function resetCostDisplayMode() {
     activeMode = 'usd';

package/dist/cost/display-mode.js

@@ -6,6 +6,9 @@
  *   credits; the USD number we compute locally is our Anthropic COGS and
  *   must never reach their screen.
  *
+ * `'tokens'` — azure: the customer's own Azure bill at their rates; CSPeach
+ *   has no price, so tokens only.
+ *
  * `'usd'` — everything else:
  *   - byok / ai-hub / local: the customer holds the provider relationship,
  *     so the dollar figure IS their bill. Showing it is the whole point.
@@ -18,7 +21,11 @@
  * Callers must treat this as the single source of truth — no site may
  * re-derive the mode from `cfg.llm.mode` alone.
  */
+/** What azure mode shows wherever a price would be. */
+export const AZURE_INVOICE_LINE = 'billed on your Azure invoice';
 export function costDisplayMode(cfg, balanceInfo) {
+    if (cfg.llm?.mode === 'azure')
+        return 'tokens';
     if (cfg.llm?.mode !== 'managed')
         return 'usd';
     if (cfg.show_cogs === true)

package/dist/cost/month-usage.js

@@ -0,0 +1,45 @@
+export const MONTH_USAGE_TIMEOUT_MS = 5_000;
+function num(v) {
+    return typeof v === 'number' && Number.isFinite(v) ? v : null;
+}
+export async function fetchMonthUsage(cfg, getBearer, fetchFn = fetch) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), MONTH_USAGE_TIMEOUT_MS);
+    try {
+        const key = await getBearer();
+        if (!key)
+            return null;
+        const r = await fetchFn(`${cfg.proxy_url.replace(/\/$/, '')}/v1/me/usage`, {
+            headers: { Authorization: `Bearer ${key}` },
+            signal: controller.signal,
+        });
+        if (!r.ok)
+            return null;
+        const b = await r.json();
+        if (typeof b !== 'object' || b === null)
+            return null;
+        const o = b;
+        const skills = Array.isArray(o.top_skills) ? o.top_skills : [];
+        return {
+            metered: o.metered === true,
+            unitLabel: typeof o.unit_label === 'string' && o.unit_label ? o.unit_label : 'credits',
+            monthStart: typeof o.month_start === 'string' ? o.month_start : null,
+            monthUsed: num(o.month_used_credits),
+            topSkills: skills.flatMap((s) => {
+                const e = s;
+                const credits = num(e?.credits);
+                return typeof e?.skill === 'string' && credits !== null ? [{ skill: e.skill, credits }] : [];
+            }),
+            otherSkills: num(o.other_skills_credits) ?? 0,
+            balance: num(o.balance_credits),
+            subscription: num(o.subscription_credits),
+            purchased: num(o.purchased_credits),
+        };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/cost/router-spend.js

@@ -10,8 +10,11 @@
  * (the proxy's router cost is ours, never shown).
  */
 import { computeCost } from './pricing.js';
+import { tokensOnlyActive } from './credits.js';
 let usd = 0;
 export function addRouterSpend(model, usage) {
+    if (tokensOnlyActive())
+        return; // azure: no price of ours for their deployment
     usd += computeCost(model, usage);
 }
 /** USD spent on BYOK router calls in this process. */

package/dist/cost/session-cost.js

@@ -17,6 +17,7 @@
  * ran. Same caveat as the footer's session line.
  */
 import { computeCost } from './pricing.js';
+import { tokensOnlyActive } from './credits.js';
 import { routerSpendUsd } from './router-spend.js';
 /**
  * USD cost of ONE session's lifetime usage, priced at `session.model` — no
@@ -25,6 +26,9 @@ import { routerSpendUsd } from './router-spend.js';
  * spend must not ride along — review S1, 2026-10-02).
  */
 export function computeSessionModelCost(session) {
+    // Azure: no price for the customer's deployment — never consult one.
+    if (tokensOnlyActive())
+        return 0;
     return computeCost(session.model, {
         input: session.usage.input_tokens,
         output: session.usage.output_tokens,

package/dist/doctor/checks/azure.js

@@ -0,0 +1,100 @@
+/**
+ * Azure tenant mode — `cspeach doctor` (spec "Commands"): settings + host,
+ * sign-in (silent), each deployment answers a 1-token call and the model it
+ * answers as is compared with the declared family; review optional; 403/404
+ * plain; the data-zone note. The calls cost a few tokens on the customer's
+ * Azure, and the first row says so.
+ *
+ * Every probe goes through the guarded Azure client (azureSdkOptions: host
+ * allow-list on the final URL, redirects refused), with no SDK retries.
+ */
+import Anthropic from '@anthropic-ai/sdk';
+import { probeTargets } from '../../models/model-identity.js';
+import { readConnectionCache, setActiveConnection } from '../../connection/cache.js';
+import { azureRefusalReason } from '../../connection/state.js';
+import { azureSdkOptions, selectAzureAuth } from '../../connection/azure-auth.js';
+import { azureErrorNotice } from '../../connection/azure-errors.js';
+import { AZURE_FACTS } from '../../connection/azure-facts.js';
+const KEY_NEXT = 'ask IT for a current key, then cspeach config set llm.azure_key -';
+async function defaultCall(conn, auth, deployment) {
+    try {
+        const sdk = new Anthropic({ ...azureSdkOptions(conn.endpoint, auth), maxRetries: 0, timeout: 20_000 });
+        const r = await sdk.messages.create({ model: deployment, max_tokens: 1, messages: [{ role: 'user', content: 'hi' }] });
+        return { ok: true, model: typeof r?.model === 'string' ? r.model : null };
+    }
+    catch (err) {
+        return { ok: false, err };
+    }
+}
+const sameFamily = (model, family) => model === family || model.startsWith(`${family}-`);
+/**
+ * The doctor process has no REPL start-up: make the saved settings the active
+ * ones so the llm-mode row (the azure provider's health check) reads them.
+ * Managed and the other modes: nothing is read or set.
+ */
+export async function activateAzureForDoctor(cfg, read = readConnectionCache) {
+    if (cfg.llm?.mode !== 'azure')
+        return;
+    setActiveConnection(await read().catch(() => null));
+}
+export async function checkAzure(cfg, deps = {}) {
+    if (cfg.llm?.mode !== 'azure')
+        return [];
+    const cached = await (deps.cached ?? readConnectionCache)().catch(() => null);
+    // Final fix wave D: the same what / next as the turn refusal (missing,
+    // removed, waiting for confirmation, host refused).
+    const why = azureRefusalReason(cached);
+    if (why || !cached) {
+        const r = why ?? azureRefusalReason(null);
+        return [{ name: 'azure settings', ok: false, message: r.what, hint: r.next }];
+    }
+    const conn = cached.connection;
+    const rows = [{
+            name: 'azure settings', ok: true,
+            message: `${new URL(conn.endpoint).host} · tenant ${conn.entra_tenant_id} · the deployment checks below send a few tokens to your company's Azure`,
+        }];
+    let auth = null;
+    let provider = null;
+    try {
+        provider = await (deps.select ?? ((c) => selectAzureAuth(c)))(conn);
+        auth = await provider.getAuth();
+        rows.push({ name: 'azure sign-in', ok: true, message: provider.method === 'entra' ? 'Microsoft sign-in ok' : 'Azure key ok' });
+    }
+    catch (e) {
+        const named = e?.method;
+        const method = named === 'entra' || named === 'key' ? named : (provider?.method ?? 'entra');
+        rows.push({
+            name: 'azure sign-in', ok: false, message: e?.message ?? 'Azure sign-in failed',
+            hint: method === 'entra' ? 'cspeach login azure' : KEY_NEXT,
+        });
+    }
+    for (const t of probeTargets(conn.deployments)) {
+        const name = `azure deployment ${t.role}`;
+        if (!auth || !provider) {
+            rows.push({ name, ok: true, skipped: true, message: 'not checked: sign in first' });
+            continue;
+        }
+        const r = await (deps.call ?? defaultCall)(conn, auth, t.name);
+        if (r.ok) {
+            if (r.model && r.model.startsWith('claude-') && !sameFamily(r.model, t.family)) {
+                rows.push({ name, ok: !t.required, ...(t.required ? {} : { skipped: true }), message: `${t.name} answers as ${r.model}, but CSPeach settings say ${t.family}`, hint: 'ask IT to check the deployment, or ask us to fix the settings' });
+            }
+            else if (r.model && r.model.startsWith('claude-')) {
+                rows.push({ name, ok: true, message: `${t.name} answers as ${r.model}` });
+            }
+            else {
+                rows.push({ name, ok: true, message: `${t.name} answers (Azure ${AZURE_FACTS.messageStartModel === 'deployment-name' ? 'reports the deployment name' : 'did not report the model id'})` });
+            }
+            continue;
+        }
+        const n = azureErrorNotice(r.err, { method: provider.method, deployment: t.name });
+        const message = n && 'what' in n ? n.what : `${t.name} did not answer (${r.err?.message ?? 'error'})`;
+        const hint = n && 'next' in n ? n.next : 'run cspeach doctor again, then send us the output';
+        rows.push(t.required ? { name, ok: false, message, hint } : { name, ok: true, skipped: true, message, hint });
+    }
+    // A missing review is info (spec), not a warning: an ok row.
+    if (!conn.deployments.review)
+        rows.push({ name: 'azure deployment review', ok: true, message: 'no review deployment: plan reviews run on main' });
+    rows.push({ name: 'azure data zone', ok: true, skipped: true, message: 'CSPeach cannot check the data zone; confirm it in the Azure portal' });
+    return rows;
+}

package/dist/doctor/checks/credits.js

@@ -18,9 +18,10 @@ function defaultProbe(cfg) {
     });
 }
 export async function checkCredits(cfg, probe = defaultProbe(cfg)) {
-    // BYOK / ai-hub / local never touch our ledger — no reason to call the proxy.
+    // BYOK / ai-hub / local / azure never touch our ledger — no reason to call the proxy.
+    // Azure Task 5b: the line says "not metered" for every non-managed mode (spec, Cost display).
     if (cfg.llm?.mode !== 'managed') {
-        return { name: 'credits', ok: true, message: 'not metered (BYOK)' };
+        return { name: 'credits', ok: true, message: 'not metered' };
     }
     const info = await probe().catch(() => null);
     if (!info) {
@@ -30,7 +31,7 @@ export async function checkCredits(cfg, probe = defaultProbe(cfg)) {
         };
     }
     if (!info.metered) {
-        return { name: 'credits', ok: true, message: 'not metered (BYOK)' };
+        return { name: 'credits', ok: true, message: 'not metered' };
     }
     if (info.balance_credits === null) {
         return {