@cspeach/cli 1.1.32 → 1.1.34

package/dist/repl/builtin-commands.js

@@ -8,19 +8,30 @@
  * read of the process-wide cost display mode (cost/credits.ts); no
  * inquirer, so the router can import it.
  */
-import { creditsActive } from '../cost/credits.js';
+import { creditsActive, tokensOnlyActive } from '../cost/credits.js';
 // Pure generated data (type-only import inside), so this file stays light.
 import { BUNDLED_RUNS } from '../runs/bundled-runs.js';
 export const COST_DESCRIPTION_USD = 'Show this session\'s spend so far ($ and tokens)';
 export const COST_DESCRIPTION_CREDITS = 'Show the credits this session has used so far';
+/** Azure tenant mode (Task 7, ruling 5): tokens only — never "$" or credits. */
+export const COST_DESCRIPTION_TOKENS = "Show this session's tokens so far";
 /** Piece 2 §10: managed customers see credits, never "$" (cost/display-mode.ts). */
+/** /usage (2026-10-09): this month in credits — see commands/usage.ts. */
+export const USAGE_DESCRIPTION = 'Show this month’s credits, your balance and the top skills';
+export const USAGE_DESCRIPTION_TOKENS = "Show where your usage is: your company's Azure invoice";
 export function costCommandDescription() {
+    if (tokensOnlyActive())
+        return COST_DESCRIPTION_TOKENS;
     return creditsActive() ? COST_DESCRIPTION_CREDITS : COST_DESCRIPTION_USD;
 }
+export function usageCommandDescription() {
+    return tokensOnlyActive() ? USAGE_DESCRIPTION_TOKENS : USAGE_DESCRIPTION;
+}
 export const BUILTIN_ENTRIES = [
     // Piece 2: /cancel is not listed — it exists only in the classic loop
     // (repl.tsx), and Esc / Ctrl+C already cancel under Ink.
     { name: '/cost', get description() { return costCommandDescription(); } },
+    { name: '/usage', get description() { return usageCommandDescription(); } },
     { name: '/compact', description: 'Shrink a long session and keep the facts (later turns cost far less)' },
     { name: '/export', description: 'Export the signable session audit record — /export audit [filename]' },
     { name: '/context', description: 'Show what fills the model context window — a composition grid of bars' },

package/dist/repl/post-turn-status.js

@@ -21,7 +21,7 @@ import { computeCost } from '../cost/pricing.js';
 import { computeSessionCost } from '../cost/session-cost.js';
 import { globalStore } from '../ui/sap-state-store.js';
 import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
-import { globalCredits } from '../cost/credits.js';
+import { globalCredits, tokensOnlyActive } from '../cost/credits.js';
 import { printStatusFooter, formatStatusFooter } from '../renderer/status-footer.js';
 import { shouldUseInk } from '../renderer/tty.js';
 import { isUserPrompt } from '../session/user-prompt.js';
@@ -49,7 +49,8 @@ export function computeTurnFacts(session, snapshot, turnModel) {
     const userTurns = session.messages.filter(isUserPrompt).length;
     const lifetimeAfter = session.usage.input_tokens + session.usage.output_tokens;
     const turnTokens = Math.max(0, lifetimeAfter - (snapshot.input + snapshot.output));
-    const turnCost = computeCost(turnModel ?? session.model, {
+    // Azure: no price for the customer's deployment — never consult one.
+    const turnCost = tokensOnlyActive() ? 0 : computeCost(turnModel ?? session.model, {
         input: session.usage.input_tokens - snapshot.input,
         output: session.usage.output_tokens - snapshot.output,
         cacheRead: session.usage.cache_read_input_tokens - snapshot.cacheRead,

package/dist/repl/safety-confirm.js

@@ -29,6 +29,8 @@ const RULE_LABEL = {
     RULE_9_TRANSPORT_ISOLATION: 'RULE 9 — transport isolation',
     RULE_10_VERIFY_AFTER_WRITE: 'RULE 10 — verify after write',
     CREDENTIAL_HANDOVER: 'SAP login handed to a local process',
+    RISKY_COMMAND: 'risky command (known pattern)',
+    CREDENTIAL_FILE_READ: 'credential file read',
 };
 /** Piece 2 §5 — plain-words heading: what could go wrong. No rule codes, no tool names. */
 export const SAFETY_HEADING = {
@@ -39,6 +41,8 @@ export const SAFETY_HEADING = {
     RULE_9_TRANSPORT_ISOLATION: 'This change may land in a transport shared with other work',
     RULE_10_VERIFY_AFTER_WRITE: 'This change is not proven until it is checked',
     CREDENTIAL_HANDOVER: 'Your SAP login will be handed to a local program',
+    RISKY_COMMAND: 'This command matches a known risky pattern',
+    CREDENTIAL_FILE_READ: 'This reads a file that may hold passwords or keys',
 };
 /** Bottom-edge note: which rule is asking. */
 export const SAFETY_FOOTNOTE = {
@@ -49,6 +53,8 @@ export const SAFETY_FOOTNOTE = {
     RULE_9_TRANSPORT_ISOLATION: 'Forge Rule 9',
     RULE_10_VERIFY_AFTER_WRITE: 'Forge Rule 10',
     CREDENTIAL_HANDOVER: 'Credential handover',
+    RISKY_COMMAND: 'Risky command check',
+    CREDENTIAL_FILE_READ: 'Credential file check',
 };
 /** Rule 7 covers both overwrite and delete; the delete says so. */
 export function safetyHeading(a) {
@@ -103,8 +109,40 @@ function whatLabel(a) {
         return fallback;
     return toolActivityLabel(tool, args);
 }
+/** The risk gate's two rules — their subject is a model-written command or path. */
+function isRiskRule(a) {
+    return a.rule === 'RISKY_COMMAND' || a.rule === 'CREDENTIAL_FILE_READ';
+}
+/**
+ * Fix round 1 (F9) — the most of a risky command or path the card shows. A
+ * longer one shows its head and its tail with the hidden length between them
+ * (fix round 2, L2: a command padded past the cap cannot hide its target on
+ * the classic card, which has no scrollback copy). Ink also writes the whole
+ * text to scrollback first, like the Rule 8 summary. Never redacted.
+ */
+export const RISK_SUBJECT_MAX = 300;
+const RISK_SUBJECT_HEAD = 200;
+const RISK_SUBJECT_TAIL = 80;
+/** The subject as shown on a card: display-cleaned (F8), cut to head + tail past RISK_SUBJECT_MAX (F9, L2). */
+function riskSubject(name) {
+    const c = clean(name);
+    if (c.length <= RISK_SUBJECT_MAX)
+        return c;
+    const hidden = c.length - RISK_SUBJECT_HEAD - RISK_SUBJECT_TAIL;
+    return `${c.slice(0, RISK_SUBJECT_HEAD)} ${getGlyphs().more} (+${hidden} chars) ${c.slice(-RISK_SUBJECT_TAIL)}`;
+}
 /** What / Where / Undo rows (plain text; the card paints them dim). */
 export function safetyFacts(a) {
+    // Security batch item 4 — the risk gate's cards: the exact command or path,
+    // why it was flagged, and that it runs on this computer.
+    if (isRiskRule(a)) {
+        return [
+            `What   ${a.rule === 'RISKY_COMMAND' ? 'Run' : 'Read'} ${riskSubject(a.object.name)}`,
+            ...boundedWhatLines(whatLines(a)).map((t) => `       ${t}`),
+            'Where  this computer',
+            `Undo   ${a.rule === 'RISKY_COMMAND' ? 'Cannot be undone' : 'Once read, its text goes to the model'}`,
+        ];
+    }
     const what = a.rule === 'CREDENTIAL_HANDOVER'
         ? `Hand the SAP login for ${clean(a.object.name)} to a local program`
         : whatLabel(a);
@@ -162,6 +200,10 @@ async function confirmOnCards(action) {
         // The card keeps the header and the last lines; the whole text lands above it.
         emitTrace(what.join('\n'));
     }
+    if (isRiskRule(action) && clean(action.object.name).length > RISK_SUBJECT_MAX) {
+        // F9 — the card shows the cut; the whole (cleaned) command lands above it.
+        emitTrace(clean(action.object.name));
+    }
     const first = await askConfirm({
         id: 'safety-confirm',
         tag: release ? 'CANNOT BE UNDONE' : 'SAFETY CHECK',
@@ -260,14 +302,17 @@ function renderCard(action) {
     lines.push('');
     lines.push(`${chalk.yellow(getGlyphs().attention)}  ${chalk.yellow.bold(RULE_LABEL[action.rule])}`);
     lines.push(`   ${chalk.dim('op:       ')} ${action.op}`);
-    lines.push(`   ${chalk.dim('object:   ')} ${action.object.type} ${action.object.name}`);
+    // F8 — a risk card's subject is model-written: cleaned (no terminal escapes)
+    // and cut (F9). Other rules print exactly as before.
+    const risk = isRiskRule(action);
+    lines.push(`   ${chalk.dim('object:   ')} ${action.object.type} ${risk ? riskSubject(action.object.name) : action.object.name}`);
     lines.push(`   ${chalk.dim('transport:')} ${transport}`);
     if (action.rule === 'RULE_8_BATCH_PLAN' && typeof action.batch_count === 'number') {
         lines.push(`   ${chalk.dim('batch:    ')} ${action.batch_count} objects this turn`);
     }
     // what_will_happen may include embedded newlines (e.g. Rule 8 plan summary).
     // Indent the continuation lines so they align under the header field.
-    const whatLines = action.what_will_happen.split('\n');
+    const whatLines = risk ? action.what_will_happen.split('\n').map(clean) : action.what_will_happen.split('\n');
     if (whatLines.length === 1) {
         lines.push(`   ${chalk.dim('what:     ')} ${whatLines[0]}`);
     }

package/dist/repl/session-spend-line.js

@@ -6,9 +6,12 @@
  * credits existed: `  spend:     $1.37`.
  */
 import { formatCost } from '../cost/pricing.js';
-import { creditsActive, formatCredits, CREDITS_PENDING } from '../cost/credits.js';
+import { creditsActive, tokensOnlyActive, formatCredits, CREDITS_PENDING } from '../cost/credits.js';
+import { AZURE_INVOICE_LINE } from '../cost/display-mode.js';
 /** The spend VALUE in the current display mode (piece 2: goodbye block). */
 export function formatSessionSpendValue(sessionCostUsd, credits) {
+    if (tokensOnlyActive())
+        return AZURE_INVOICE_LINE;
     if (!creditsActive())
         return formatCost(sessionCostUsd);
     if (!credits)

package/dist/repl/slash-completer.js

@@ -22,6 +22,7 @@ const BUILTIN_COMMANDS = [
     '/cancel',
     '/compact',
     '/cost',
+    '/usage',
     '/context',
     '/export',
     '/exit',

package/dist/repl/startup-account.js

@@ -0,0 +1,51 @@
+import { formatFailure, formatInfo } from '../renderer/notice-shape.js';
+export async function runStartupAccount(deps, io) {
+    let licenceCheckedAtMs;
+    try {
+        const cfgEarly = await deps.loadConfig();
+        if (cfgEarly.llm.mode === 'managed') {
+            const authFile = await deps.readAuthFile();
+            const startupKey = authFile ? (await deps.resolveApiKey()).key : null;
+            if (authFile && startupKey) {
+                const meResult = await deps.fetchMe({ proxyUrl: cfgEarly.proxy_url, apiKey: startupKey });
+                if (!meResult.ok) {
+                    if (meResult.status === 401) {
+                        io.closeBrand();
+                        io.print(formatFailure({ what: 'Your CSPeach sign-in is no longer valid', next: 'cspeach login' }));
+                        return { exit: 1 };
+                    }
+                    io.notice(formatInfo(`Could not refresh your account (${meResult.error})`));
+                }
+                else {
+                    io.showProfile(meResult.profile);
+                }
+            }
+        }
+        else {
+            const { key: startupKey } = await deps.resolveApiKey();
+            if (startupKey) {
+                const licence = await deps.runLicenceCheck({ proxyUrl: cfgEarly.proxy_url, apiKey: startupKey }, { headers: await deps.licenceCheckHeaders(cfgEarly.llm.mode).catch(() => ({})) });
+                licenceCheckedAtMs = (deps.now ?? Date.now)();
+                if (!licence.allow) {
+                    io.closeBrand();
+                    io.print(licence.message);
+                    return { exit: 1 };
+                }
+                if (licence.verdict === 'unknown') {
+                    io.notice(formatInfo(licence.line));
+                }
+                else if (licence.profile) {
+                    io.showProfile(licence.profile);
+                }
+                if (licence.verdict === 'ok') {
+                    try {
+                        deps.startSkillsWarmup?.(cfgEarly, licence.verdict);
+                    }
+                    catch { /* never blocks start-up */ }
+                }
+            }
+        }
+    }
+    catch { /* banner is best-effort — never block REPL startup */ }
+    return licenceCheckedAtMs === undefined ? { exit: null } : { exit: null, licenceCheckedAtMs };
+}