@cspeach/cli 1.1.33 → 1.1.34

package/dist/agent/anthropic-provider.js

@@ -10,6 +10,7 @@ import Anthropic from '@anthropic-ai/sdk';
 import { getDeviceFingerprint } from '../auth/device.js';
 import { createManagedSkillSource } from '../skills/source-managed.js';
 import { CLI_VERSION } from '../lib/version.js';
+import { MANAGED_PROFILE } from './connection-profile.js';
 export function createManagedProvider(cfg, getBearer) {
     const skillSource = createManagedSkillSource(cfg, getBearer);
     // Headers every managed request carries (the real call and the keepalive
@@ -28,6 +29,7 @@ export function createManagedProvider(cfg, getBearer) {
     return {
         name: 'anthropic-managed',
         mode: 'managed',
+        profile: MANAGED_PROFILE,
         skillSource,
         async createStream(params, options = {}) {
             const sdk = new Anthropic({

package/dist/agent/azure-profile.js

@@ -0,0 +1,7 @@
+export const AZURE_PROFILE_V0 = Object.freeze({
+    id: 'azure', shaping: 'direct', cacheMarkers: true, betas: Object.freeze([]), serverFallbacks: false,
+    blockBinding: 'off', toolChanges: false, deferredTools: 'static', effort: 'main-only',
+    structuredOutputs: true, keepalive: false, stripInternalHeaders: 'all', servedConfig: 'none', router: 'direct',
+    adoptServedModel: false, modelIdentity: 'deployment',
+});
+export const AZURE_PROFILE = AZURE_PROFILE_V0;

package/dist/agent/connection-profile.js

@@ -0,0 +1,49 @@
+import { AZURE_PROFILE } from './azure-profile.js';
+export const MANAGED_PROFILE = Object.freeze({
+    id: 'managed', shaping: 'proxy', cacheMarkers: false, betas: Object.freeze(['compact-2026-01-12']), serverFallbacks: false,
+    blockBinding: 'allow-list-when-proxy-serves', toolChanges: true, deferredTools: 'served', effort: 'all',
+    structuredOutputs: true, keepalive: true, stripInternalHeaders: 'none', servedConfig: 'full', router: 'proxy',
+    adoptServedModel: true, modelIdentity: 'model-id',
+});
+export const BYOK_PROFILE = Object.freeze({
+    id: 'byok', shaping: 'direct', cacheMarkers: true, betas: Object.freeze(['compact-2026-01-12']), serverFallbacks: true,
+    blockBinding: 'allow-list', toolChanges: true, deferredTools: 'served', effort: 'all',
+    structuredOutputs: true, keepalive: true, stripInternalHeaders: 'all', servedConfig: 'router-only', router: 'direct',
+    adoptServedModel: false, modelIdentity: 'model-id',
+});
+export const AI_HUB_PROFILE = Object.freeze({
+    id: 'ai-hub', shaping: 'legacy', cacheMarkers: false, betas: Object.freeze([]), serverFallbacks: false,
+    blockBinding: 'allow-list', toolChanges: false, deferredTools: 'static', effort: 'all',
+    structuredOutputs: false, keepalive: false, stripInternalHeaders: 'role-only', servedConfig: 'none', router: 'direct',
+    adoptServedModel: false, modelIdentity: 'model-id',
+});
+export const LOCAL_PROFILE = Object.freeze({
+    id: 'local', shaping: 'openai', cacheMarkers: false, betas: Object.freeze([]), serverFallbacks: false,
+    blockBinding: 'allow-list', toolChanges: false, deferredTools: 'static', effort: 'all',
+    structuredOutputs: false, keepalive: false, stripInternalHeaders: 'all', servedConfig: 'none', router: 'local-rules',
+    adoptServedModel: false, modelIdentity: 'model-id',
+});
+/** Test fakes and undefined modes: today's fall-through behaviour at every call site. */
+export const UNKNOWN_PROFILE = Object.freeze({
+    id: 'unknown', shaping: 'direct', cacheMarkers: false, betas: Object.freeze([]), serverFallbacks: false,
+    blockBinding: 'allow-list', toolChanges: false, deferredTools: 'env-only', effort: 'all',
+    structuredOutputs: false, keepalive: false, stripInternalHeaders: 'all', servedConfig: 'none', router: 'proxy',
+    adoptServedModel: false, modelIdentity: 'model-id',
+});
+const BY_MODE = new Map([
+    ['managed', MANAGED_PROFILE], ['byok', BYOK_PROFILE], ['ai-hub', AI_HUB_PROFILE], ['local', LOCAL_PROFILE],
+    ['azure', AZURE_PROFILE],
+]);
+export function profileForMode(mode) {
+    return (mode !== undefined && BY_MODE.get(mode)) || UNKNOWN_PROFILE;
+}
+/** The provider's own profile, else the one its mode names (plan D2). */
+export function profileOf(p) {
+    return p.profile ?? profileForMode(p.mode);
+}
+/** Whether the loop may send output_config.effort on a call with this role. */
+export function sendsEffortFor(profile, role) {
+    if (profile.effort === 'off')
+        return false;
+    return profile.effort === 'all' || (role ?? 'session_default') === 'session_default';
+}

package/dist/agent/loop.js

@@ -8,6 +8,7 @@ import { recordCompletedToolCall } from '../session/pending.js';
 import { loadConfig } from '../config/loader.js';
 import { resolveModelRole, resolveEffort, modelAcceptsEffort, resolveAutoCompactThreshold, callModelFor } from '../models/resolve.js';
 import { getCustomerModelConfig, managedProxyServesNewShapes, servedToolLoading } from '../models/server-config.js';
+import { familyOf, familyAcceptsEffort } from '../models/model-identity.js';
 import { buildToolList, buildSkillToolAddition, placeSystemMessagesInPlace, resolveToolLoading, } from '../tools/tool-loading.js';
 import { settleSessionToolLoading } from './tool-loading-pin.js';
 import { resolveSkillAlias } from '../skill-catalog.js';
@@ -29,8 +30,10 @@ import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
 // (progress-chatter import removed 2026-05-01 — superseded by CC-style
 //  two-line dispatch renderer; re-add if a future in-place spinner returns)
 import { buildRetryCapPausePayload, buildSkippedSiblingResults } from './retry-cap.js';
+import { reportCallUsage } from '../usage/usage-reporter.js';
 import { appendCostLine, buildEntry as buildCostEntry, perCallTokens, summariseInputTransformations } from '../cost/cost-log.js';
-import { modelAcceptsBinding, sessionMaxTokens, clampMaxTokens } from './provider-shape.js';
+import { sessionMaxTokens, clampMaxTokens, sendsBlockBinding } from './provider-shape.js';
+import { profileOf, sendsEffortFor } from './connection-profile.js';
 import { computeSessionCost } from '../cost/session-cost.js';
 import { refreshCreditsAfterTurn, creditsForCostLog, beginCreditsRequest } from '../cost/credits-wire.js';
 import { globalStore } from '../ui/sap-state-store.js';
@@ -822,9 +825,12 @@ ${imageExpansion.error}`));
     // Standalone hides the SAP tools (toolsForContext); the agent_run
     // read-only filter (toolFilter) applies before the split, so a filtered-out
     // tool is neither loaded nor deferred (cannot be found by search either).
+    // Azure tenant mode (Task 1) — this connection's wire capabilities.
+    const profile = profileOf(params.provider);
     session.tool_set_skill ??= params.skill;
     const toolLoadingMode = resolveToolLoading({
         providerMode: params.provider.mode,
+        profile,
         env: process.env,
         served: servedToolLoading(),
     });
@@ -849,7 +855,7 @@ ${imageExpansion.error}`));
     // fetch, a model off the allow-list) has its deferred shapes stripped ONCE
     // (a deliberate rewrite like /compact) and is re-pinned static.
     const callToolMode = (model) => {
-        const settled = settleSessionToolLoading(session, { resolved: toolLoadingMode, model });
+        const settled = settleSessionToolLoading(session, { resolved: toolLoadingMode, model: familyOf(model, params.provider) });
         if (settled.stripped > 0) {
             emit(chalk.dim('(this session now sends the full tool list — earlier tool-search steps were removed from the conversation)'));
         }
@@ -1040,6 +1046,9 @@ ${imageExpansion.error}`));
                 // Final review C1/I2 + N1 (b) — the turn's mode, settled at turn
                 // start (any one-time deferred → static strip ran there).
                 const model = sentModel();
+                // Azure tenant mode (Task 2) — capability lookups take the FAMILY;
+                // `model` stays the wire name. Identity for every other connection.
+                const family = familyOf(model, params.provider);
                 const tools = turnTools;
                 // Bug 11a (proactive heal, 2026-06-07) — strip any residual
                 // `partial_json` from tool_use blocks on EVERY outgoing request.
@@ -1088,7 +1097,11 @@ ${imageExpansion.error}`));
                 // Task 4 — effort only from an explicit act (ruling F2); never to a
                 // model that rejects it (probe P1: claude-haiku-4-5* ⇒ 400).
                 const effort = params.effortOverride ?? resolveEffort(cfg);
-                const sendEffort = effort !== undefined && modelAcceptsEffort(model);
+                // Azure tenant mode (Task 5a) — deployment connections use the
+                // effort ALLOW-list: an unknown deployment name maps to itself and
+                // would pass the deny-list. Model-id connections are unchanged.
+                const familyTakesEffort = profile.modelIdentity === 'deployment' ? familyAcceptsEffort(family) : modelAcceptsEffort(family);
+                const sendEffort = effort !== undefined && familyTakesEffort && sendsEffortFor(profile, params.modelRole);
                 const streamParams = {
                     // A4 — per-turn override (plan model tiering) wins over the
                     // session model; absent on every non-plan turn. Task 3 (2026-09-27)
@@ -1116,7 +1129,7 @@ ${imageExpansion.error}`));
                     // I1 (2026-09-28) — clamped to the sent model's output ceiling:
                     // an agent_run child asks for 100000, which an enforced
                     // sonnet/haiku model rejects with a 400.
-                    max_tokens: clampMaxTokens(model, params.maxTokensOverride ?? sessionMaxTokens(model)),
+                    max_tokens: clampMaxTokens(family, params.maxTokensOverride ?? sessionMaxTokens(family)),
                     messages: session.messages,
                     tools,
                     // Task 7 — preserved thinking. Opus 5.5 binds each thinking block
@@ -1125,9 +1138,10 @@ ${imageExpansion.error}`));
                     // input_transformations) instead of rejecting the request. Only to
                     // the families probe P4 proved (allow-list, dated ids stripped).
                     // Task 21 fix round (controller ruling) — on the managed path only
-                    // when the proxy serves tool_loading (an old proxy adds no binding
+                    // when the proxy serves tool_loading — the managed profile's
+                    // 'allow-list-when-proxy-serves' rule (an old proxy adds no binding
                     // beta); BYOK adds its own beta; AI-hub/local strip the field.
-                    thinking: modelAcceptsBinding(model) && (params.provider.mode !== 'managed' || managedProxyServesNewShapes())
+                    thinking: sendsBlockBinding(profile, family, managedProxyServesNewShapes)
                         ? { type: 'adaptive', display: 'summarized', block_binding: { prefix_mismatch_behavior: 'drop_block' } }
                         : { type: 'adaptive', display: 'summarized' },
                     ...(sendEffort ? { output_config: { effort } } : {}),
@@ -1208,6 +1222,10 @@ ${imageExpansion.error}`));
         // reported in `message_start` (may differ from the requested id).
         const callIndex = roundIndex++;
         let lastServedModel;
+        // Security batch item 3 — this call's provider message id (usage request id).
+        let lastMessageId;
+        // F2 — a call that never saw message_start ran nothing: no usage record.
+        let sawMessageStart = false;
         // 2026-09-27 — blocks whose content_block_stop arrived. A thinking block
         // not in here was cut mid-stream and must never be persisted.
         const completedBlocks = new WeakSet();
@@ -1345,6 +1363,12 @@ ${imageExpansion.error}`));
                     const servedModel = event.message?.model;
                     if (typeof servedModel === 'string' && servedModel)
                         lastServedModel = servedModel;
+                    // Security batch item 3 — the provider's message id becomes the usage
+                    // record's request id (the server drops resends by it).
+                    sawMessageStart = true;
+                    const messageId = event.message?.id;
+                    if (typeof messageId === 'string' && messageId)
+                        lastMessageId = messageId;
                     // Task 7 — present only when the binding beta was sent; [] when
                     // nothing was dropped (summarised to undefined ⇒ no cost-line key).
                     inputTransformations = summariseInputTransformations(event.message?.input_transformations);
@@ -1471,7 +1495,7 @@ ${imageExpansion.error}`));
         // unpriced. Never on a per-turn override, and never on a message carrying
         // a `fallback` block (a refusal fallback must not pin the fallback model
         // for the rest of the session). Otherwise the served id is only logged.
-        if (params.provider.mode === 'managed'
+        if (profile.adoptServedModel
             && !params.modelOverride
             && typeof lastServedModel === 'string'
             && lastServedModel
@@ -1594,6 +1618,35 @@ ${imageExpansion.error}`));
             });
             readerCallsLogged = params.ctx.readerSpend?.calls ?? 0;
             void appendCostLine(session.id, entry);
+            // Security batch item 3 — usage counts for byok / ai-hub / local (the
+            // proxy counts managed, so a managed turn never reaches the reporter:
+            // no config read, no file, no network). Counts only; fire-and-forget;
+            // a sync throw or a rejection is swallowed so the turn never notices.
+            if (params.provider.mode !== 'managed') {
+                try {
+                    void reportCallUsage({
+                        mode: params.provider.mode,
+                        requestId: lastMessageId,
+                        skill: params.skill,
+                        // Azure tenant mode (Task 5a) — the usage `model` is the FAMILY of
+                        // the deployment this call was sent to (spec "Usage reporter and
+                        // licence"). Not the served id: Foundry's message_start model
+                        // string is unknown until the probe and may be a dated id, which
+                        // familyOf would return unchanged. Every other mode keeps today's
+                        // expression byte for byte.
+                        model: profile.modelIdentity === 'deployment'
+                            ? familyOf(params.modelOverride ?? session.model, params.provider)
+                            : (lastServedModel ?? params.modelOverride ?? session.model),
+                        input: callTokens.input,
+                        output: callTokens.output,
+                        cacheRead: callTokens.cacheRead,
+                        cacheWrite: callTokens.cacheCreate,
+                        sessionId: session.id,
+                        started: sawMessageStart,
+                    }).catch(() => { });
+                }
+                catch { /* usage counts are best effort */ }
+            }
         }
         // Close the stream-to-disk mirror with a footer (lightweight diagnostics).
         // Best-effort — failure here is invisible to the turn flow. Awaited
@@ -1779,7 +1832,7 @@ ${imageExpansion.error}`));
                         summarise: async (toSummarise) => summariseViaProvider(params.provider, buildSummarisationPrompt(), serialiseForSummariser(toSummarise), 
                         // model-governance step 2d — compact model resolves env > local >
                         // server > built-in (== COMPACTION_MODEL when nothing set).
-                        { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' } }),
+                        { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' }, sessionId: session.id }),
                     });
                 }
                 catch (err) {

package/dist/agent/provider-shape.js

@@ -36,6 +36,19 @@ export const BINDING_MODELS = new Set([
 export function modelAcceptsBinding(model) {
     return BINDING_MODELS.has(model.trim().toLowerCase().replace(/-\d{8}$/, ''));
 }
+/**
+ * Azure tenant mode, Task 1 — whether the loop adds thinking.block_binding,
+ * read from the connection profile. Managed: allow-list AND the proxy serves
+ * the new shapes (an old proxy adds no binding beta). The callback is only
+ * called for that rule.
+ */
+export function sendsBlockBinding(profile, model, proxyServesNewShapes) {
+    switch (profile.blockBinding) {
+        case 'off': return false;
+        case 'allow-list': return modelAcceptsBinding(model);
+        case 'allow-list-when-proxy-serves': return modelAcceptsBinding(model) && proxyServesNewShapes();
+    }
+}
 /**
  * Task 8 (ruling F5, spec D9) — ALLOW-list of the families probe P2 proved
  * accept `max_tokens: 65536` (claude-opus-5, claude-opus-5-5). Same matching
@@ -222,6 +235,21 @@ export function toLegacyShape(params) {
     }
     return out;
 }
+/**
+ * Azure tenant mode, Task 5a — for a connection whose profile says
+ * `toolChanges: false`: deferred tools load in full, the tool search entry
+ * and `role: 'system'` tool_addition messages (and server tool blocks) are
+ * removed. Unlike toLegacyShape it keeps every other field, so cache markers
+ * added afterwards (withSkillPrompt) still apply. Never mutates the input.
+ */
+export function withoutToolChanges(params) {
+    const out = { ...params };
+    if (Array.isArray(params.tools))
+        out.tools = legacyTools(params.tools);
+    if (Array.isArray(params.messages))
+        out.messages = legacyMessages(params.messages);
+    return out;
+}
 /**
  * Task 9 (Task 5 carry) — headers only our proxy understands. On a direct
  * path (BYOK talks to the public API) they would leak CSPeach plumbing to a
@@ -251,6 +279,14 @@ export function withoutRoleHeader(headers) {
     }
     return out;
 }
+/** Azure tenant mode, Task 5a — the headers a profile lets leave the laptop. */
+export function headersForProfile(profile, headers) {
+    switch (profile.stripInternalHeaders) {
+        case 'all': return withoutInternalHeaders(headers);
+        case 'role-only': return withoutRoleHeader(headers);
+        case 'none': return { ...(headers ?? {}) };
+    }
+}
 /** 2026-10-04 — the plan phase's delegate skill, when the loop sent one. */
 export function delegateSkillName(options) {
     const v = options.headers?.[DELEGATE_SKILL_HEADER];

package/dist/agent/providers/ai-hub-provider.js

@@ -1,21 +1,22 @@
 import Anthropic from '@anthropic-ai/sdk';
 import keychain from '../../auth/keychain.js';
-import { createManifestSkillSource } from '../../skills/source-manifest.js';
-import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
+import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, requireSkillName, toLegacyShape, withoutRoleHeader } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
+import { AI_HUB_PROFILE } from '../connection-profile.js';
 const KEYCHAIN_SERVICE = 'cspeach.ai-hub';
 const KEYCHAIN_ACCOUNT = 'token';
-export function createAiHubProvider(cfg) {
+export function createAiHubProvider(cfg, getBearer = defaultBearer) {
     if (!cfg.llm.ai_hub_base_url) {
         throw new Error('ai-hub mode requires llm.ai_hub_base_url — run: cspeach config set llm.ai_hub_base_url <url>');
     }
     const baseURL = cfg.llm.ai_hub_base_url;
     const modelAlias = cfg.llm.ai_hub_model_alias ?? 'anthropic--claude-opus-4-6';
-    const skillSource = createManifestSkillSource(DEFAULT_MANIFEST_URL);
+    const skillSource = createAuthedSkillSource(cfg, getBearer);
     return {
         name: 'sap-ai-hub',
         mode: 'ai-hub',
+        profile: AI_HUB_PROFILE,
         skillSource,
         async createStream(params, options = {}) {
             // Task 5 (ruling F3) — AI-hub keeps today's field set only (newer
@@ -25,7 +26,7 @@ export function createAiHubProvider(cfg) {
             const skillName = requireSkillName(options, 'AI Hub');
             const token = await getToken();
             // Task 18 — the `_reader` header uses the pinned reader prompt, no lookup.
-            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: false }, delegateSkillName(options));
+            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: AI_HUB_PROFILE.cacheMarkers }, delegateSkillName(options));
             const request = {
                 ...toLegacyShape(params),
                 system,

package/dist/agent/providers/azure-provider.js

@@ -0,0 +1,125 @@
+/**
+ * Azure tenant mode — the customer's own Microsoft Foundry resource. The
+ * request goes straight from the laptop to
+ * https://<resource>.services.ai.azure.com/anthropic/v1/messages with an
+ * Entra token or the company's Azure key; our service never sees it.
+ *
+ * Every wire choice is read from the connection profile (v0 until the probe,
+ * azure-profile.ts): cache markers, betas, block binding, tool changes,
+ * effort (main role only, and only for a family on the effort allow-list),
+ * keepalive and which internal headers are stripped. Fallbacks are always
+ * dropped (Foundry has none). The host guard runs before any client exists
+ * and again on every request URL (the guarded fetch in azure-auth.ts).
+ */
+import Anthropic from '@anthropic-ai/sdk';
+import { sendsEffortFor } from '../connection-profile.js';
+import { AZURE_PROFILE } from '../azure-profile.js';
+import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
+import { delegateSkillName, headersForProfile, requireSkillName, withoutToolChanges, withSkillPrompt } from '../provider-shape.js';
+import { systemPromptForSkill } from '../system-prompt.js';
+import { familyAcceptsEffort, familyFromTable } from '../../models/model-identity.js';
+import { getActiveConnection } from '../../connection/cache.js';
+import { azureTurnVerdict, AzureConnectionRefusedError } from '../../connection/state.js';
+import { azureSdkOptions, selectAzureAuth } from '../../connection/azure-auth.js';
+import { noteAzureCall } from '../../connection/azure-last-call.js';
+const ROLE_HEADER = 'x-cspeach-model-role';
+/** The role header, whatever its case (the same rule as withoutRoleHeader in provider-shape.ts). */
+function roleOf(headers) {
+    for (const [k, v] of Object.entries(headers ?? {}))
+        if (k.toLowerCase() === ROLE_HEADER)
+            return v;
+    return undefined;
+}
+export function shapeForAzure(p, profile) {
+    const out = { ...p };
+    delete out.fallbacks;
+    if (profile.blockBinding === 'off' && out.thinking?.block_binding) {
+        const { block_binding: _drop, ...thinking } = out.thinking;
+        out.thinking = thinking;
+    }
+    return out;
+}
+/** Effort only on the roles the profile allows, and only to a family known to accept it (never an unknown deployment). */
+function withAzureEffort(p, profile, role, family) {
+    if (p.output_config === undefined)
+        return p;
+    if (sendsEffortFor(profile, role) && familyAcceptsEffort(family))
+        return p;
+    // Drop only effort; any other output_config field (e.g. format) stays.
+    const { output_config, ...rest } = p;
+    const { effort: _drop, ...others } = output_config;
+    return Object.keys(others).length > 0 ? { ...rest, output_config: others } : rest;
+}
+export function createAzureProvider(cfg, getBearer = defaultBearer, deps = {}) {
+    const profile = deps.profile ?? AZURE_PROFILE;
+    if (profile.shaping !== 'direct')
+        throw new Error(`The azure provider shapes requests itself (direct); profile says ${profile.shaping}.`);
+    const skillSource = createAuthedSkillSource(cfg, getBearer);
+    const current = () => (deps.connection ?? getActiveConnection)();
+    const authFor = deps.auth ?? ((c) => selectAzureAuth(c));
+    async function shapeRequest(params, options) {
+        const cached = current();
+        const v = azureTurnVerdict(cached);
+        if (!v.allow)
+            throw new AzureConnectionRefusedError(v.message);
+        const conn = cached.connection;
+        const skillName = requireSkillName(options, 'Azure');
+        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: profile.cacheMarkers }, delegateSkillName(options));
+        const base = profile.toolChanges ? params : withoutToolChanges(params);
+        const family = familyFromTable(params.model, conn.deployments);
+        const body = withAzureEffort(shapeForAzure(withSkillPrompt(base, system, { cacheMarkers: profile.cacheMarkers }), profile), profile, roleOf(options.headers), family);
+        // The guard runs inside azureSdkOptions, before any client exists, and
+        // its fetch re-checks every real request URL.
+        const authProvider = await authFor(conn);
+        const auth = await authProvider.getAuth();
+        const sdk = new Anthropic({ ...azureSdkOptions(conn.endpoint, auth), defaultHeaders: headersForProfile(profile, options.headers) });
+        noteAzureCall(params.model, authProvider.method);
+        return { sdk, body };
+    }
+    const withBetas = (body) => (profile.betas.length > 0 ? { ...body, betas: [...profile.betas] } : body);
+    const provider = {
+        name: 'azure-foundry',
+        mode: 'azure',
+        profile,
+        skillSource,
+        modelFamily: (wire) => familyFromTable(wire, current()?.connection.deployments ?? null),
+        async createStream(params, options = {}) {
+            const { sdk, body } = await shapeRequest(params, options);
+            const opts = options.signal ? { signal: options.signal } : undefined;
+            return profile.betas.length > 0
+                ? sdk.beta.messages.stream(withBetas(body), opts)
+                : sdk.messages.stream(body, opts);
+        },
+        async healthCheck() {
+            const cached = current();
+            if (!azureTurnVerdict(cached).allow)
+                return { ok: false, message: "Your company's Azure settings are not ready on this machine", hint: 'cspeach login' };
+            try {
+                await (await authFor(cached.connection)).getAuth();
+            }
+            catch (e) {
+                return { ok: false, message: e?.message ?? 'Azure sign-in failed', hint: cached.connection.sign_in.includes('entra') ? 'cspeach login azure' : 'cspeach config set llm.azure_key -' };
+            }
+            try {
+                await skillSource.listAvailableSkills();
+            }
+            catch (e) {
+                return { ok: false, message: `Azure sign-in ok, but skills could not be loaded: ${e.message}`, hint: 'cspeach login' };
+            }
+            return { ok: true, message: `Azure settings ok (${cached.connection.endpoint}) · deployments are checked below` };
+        },
+    };
+    if (profile.keepalive) {
+        // Same shaped body as createStream, max_tokens 0, no stream, no retries.
+        provider.keepalive = async (params, options = {}) => {
+            const { sdk, body } = await shapeRequest(params, options);
+            const ping = { ...withBetas(body), max_tokens: 0 };
+            const opts = { maxRetries: 0, timeout: 20_000 };
+            if (profile.betas.length > 0)
+                await sdk.beta.messages.create(ping, opts);
+            else
+                await sdk.messages.create(ping, opts);
+        };
+    }
+    return provider;
+}

package/dist/agent/providers/byok-provider.js

@@ -1,15 +1,15 @@
 import Anthropic from '@anthropic-ai/sdk';
 import keychain from '../../auth/keychain.js';
-import { createManifestSkillSource } from '../../skills/source-manifest.js';
-import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
+import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, modelAcceptsFallbacks, requiredBetas, requireSkillName, withoutInternalHeaders, withSkillPrompt } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
+import { BYOK_PROFILE } from '../connection-profile.js';
 const KEYCHAIN_SERVICE = 'cspeach.anthropic';
 const KEYCHAIN_ACCOUNT = 'api-key';
 // Cheapest Anthropic model available at doctor-probe time.
 const HEALTH_PROBE_MODEL = 'claude-haiku-4-6-latest';
-export function createByokProvider(_cfg) {
-    const skillSource = createManifestSkillSource(DEFAULT_MANIFEST_URL);
+export function createByokProvider(cfg, getBearer = defaultBearer) {
+    const skillSource = createAuthedSkillSource(cfg, getBearer);
     // Task 5 (ruling F3) — the loop's request is provider-neutral; BYOK talks to
     // the model directly, so it adds what the proxy adds for managed: preamble +
     // skill body as `system`, cache markers, and the betas matching the fields
@@ -19,11 +19,11 @@ export function createByokProvider(_cfg) {
         const skillName = requireSkillName(options, 'BYOK');
         const key = await getKey();
         // Task 18 — the `_reader` header uses the pinned reader prompt, no lookup.
-        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: true }, delegateSkillName(options));
+        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: BYOK_PROFILE.cacheMarkers }, delegateSkillName(options));
         // Task 6 — opt into server-side fallback, only for the families probe
         // P3 proved (allow-list); requiredBetas adds its beta.
-        const prompted = withSkillPrompt(params, system, { cacheMarkers: true });
-        const shaped = modelAcceptsFallbacks(params.model)
+        const prompted = withSkillPrompt(params, system, { cacheMarkers: BYOK_PROFILE.cacheMarkers });
+        const shaped = BYOK_PROFILE.serverFallbacks && modelAcceptsFallbacks(params.model)
             ? { ...prompted, fallbacks: 'default' }
             : prompted;
         const betas = requiredBetas(shaped);
@@ -34,6 +34,7 @@ export function createByokProvider(_cfg) {
     return {
         name: 'anthropic-byok',
         mode: 'byok',
+        profile: BYOK_PROFILE,
         skillSource,
         async createStream(params, options = {}) {
             const { sdk, body } = await shapeRequest(params, options);

package/dist/agent/providers/factory.js

@@ -2,12 +2,17 @@ import { createManagedProvider } from '../anthropic-provider.js';
 import { createByokProvider } from './byok-provider.js';
 import { createAiHubProvider } from './ai-hub-provider.js';
 import { createLocalProvider } from './local-provider.js';
+import { createAzureProvider } from './azure-provider.js';
 export function createProviderForMode(cfg, getBearer) {
     switch (cfg.llm.mode) {
         case 'managed': return createManagedProvider(cfg, getBearer);
-        case 'byok': return createByokProvider(cfg);
-        case 'ai-hub': return createAiHubProvider(cfg);
-        case 'local': return createLocalProvider(cfg);
+        // Security batch item 2 — the CSPeach bearer now reaches every mode: skill
+        // bodies come from the signed-in route.
+        case 'byok': return createByokProvider(cfg, getBearer);
+        case 'ai-hub': return createAiHubProvider(cfg, getBearer);
+        case 'local': return createLocalProvider(cfg, getBearer);
+        // Azure tenant mode — the company's own Foundry resource (Task 5a).
+        case 'azure': return createAzureProvider(cfg, getBearer);
         default: throw new Error(`unknown llm.mode: ${cfg.llm.mode}`);
     }
 }

package/dist/agent/providers/local-provider.js

@@ -1,28 +1,29 @@
 // Loaded on use (fix round 3, item 11e): only local mode needs the OpenAI SDK.
 const loadOpenAI = async () => (await import('openai')).default;
 import crypto from 'node:crypto';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex } from '@noble/hashes/utils';
-import { createBundledSkillSource } from '../../skills/source-bundled.js';
-import { BUNDLED_SKILLS } from '../../skills/bundled-skills.js';
+import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, requireSkillName } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
-export function createLocalProvider(cfg) {
+import { LOCAL_PROFILE } from '../connection-profile.js';
+export function createLocalProvider(cfg, getBearer = defaultBearer) {
     if (!cfg.llm.local_base_url) {
         throw new Error('local mode requires llm.local_base_url — run: cspeach config set llm.local_base_url http://localhost:11434/v1');
     }
     const baseURL = cfg.llm.local_base_url;
     const model = cfg.llm.local_model ?? 'llama3.1:70b';
-    const skillSource = createBundledSkillSource();
+    // Security batch item 2 — local follows the same rule as byok / ai-hub:
+    // sign in once, skills cached on disk, then offline within the 72-hour grace.
+    const skillSource = createAuthedSkillSource(cfg, getBearer);
     return {
         name: 'local-openai-compat',
         mode: 'local',
+        profile: LOCAL_PROFILE,
         skillSource,
         async createStream(params, options = {}) {
             if (params.tools && params.tools.length > 0) {
                 throw new Error('Tool calling not supported in local mode (Plan A). Switch to managed/byok/ai-hub, or wait for the local-mode tool-calling follow-up PR.');
             }
-            // Task 5 (ruling F3) — preamble + bundled skill body as the system
+            // Task 5 (ruling F3) — preamble + skill body as the system
             // message (no cache markers). anthropicParamsToOpenAI copies only
             // max_tokens / messages / system, so newer fields never reach the endpoint.
             const skillName = requireSkillName(options, 'Local');
@@ -49,24 +50,19 @@ export function createLocalProvider(cfg) {
             catch (e) {
                 return { ok: false, message: `Local endpoint unreachable: ${e.message}`, hint: `Is Ollama/vLLM running at ${baseURL}? Is ${model} loaded?` };
             }
-            const bundled = Object.entries(BUNDLED_SKILLS);
-            if (bundled.length === 0) {
-                return { ok: false, message: 'No skills bundled in this CLI build', hint: 'This CLI was built without running `npm run prebuild`. Rebuild from source or install the published CLI.' };
+            // Key presence only (no network): a signed-out seat cannot load skills.
+            const key = await getBearer().catch(() => '');
+            if (typeof key !== 'string' || key.trim() === '') {
+                return { ok: false, message: 'Local endpoint responding, but CSPeach is not signed in, so skills cannot be loaded.', hint: 'Run cspeach login once while online; skills are then kept on disk for offline use.' };
             }
-            const mismatches = [];
-            for (const [name, body] of bundled) {
-                const actual = bytesToHex(sha256(new TextEncoder().encode(body.body)));
-                if (actual !== body.sha256)
-                    mismatches.push(`${name} (manifest=${body.sha256}, actual=${actual})`);
+            let names;
+            try {
+                names = await skillSource.listAvailableSkills();
             }
-            if (mismatches.length > 0) {
-                return {
-                    ok: false,
-                    message: `bundled skill(s) sha256 mismatch: ${mismatches.join('; ')}`,
-                    hint: 'CLI binary may have been tampered with; reinstall from a trusted source.',
-                };
+            catch (e) {
+                return { ok: false, message: `Local endpoint responding, but skills could not be loaded: ${e.message}`, hint: 'Run cspeach login once while online; skills are then kept on disk for offline use.' };
             }
-            return { ok: true, message: `Local model ${model} at ${baseURL} responding; ${bundled.length} skills bundled (sha256 verified)` };
+            return { ok: true, message: `Local model ${model} at ${baseURL} responding; ${names.length} skills available to this signed-in seat` };
         },
     };
 }