@cspeach/cli 1.1.33 → 1.1.34

package/dist/usage/usage-queue.js

@@ -0,0 +1,323 @@
+/**
+ * Security batch item 3 — <CSPeach home>/usage-queue.jsonl: usage counts
+ * waiting to be sent. Capped at 1,000 lines or 1 MB (oldest dropped).
+ *
+ * Safe with several cspeach processes: every read-modify-write holds an
+ * exclusive lock file (O_EXCL create). The holder writes "<pid> <ms> <host>
+ * <token>"; a contender clears the lock at once when that pid is gone on this
+ * host, or when the lock is older than 10 s. A contender waits longer than
+ * the stale age, so an orphaned lock never drops a record (F5).
+ *
+ * The network send happens OUTSIDE the lock as a lease (F1): leaseBatch
+ * returns the oldest records WITHOUT removing them; ackBatch removes exactly
+ * those request ids once the proxy answered. A crash mid-send therefore
+ * resends the batch next time, and the proxy drops the repeat by request id.
+ *
+ * Each line carries a local-only `keyPrefix` (a short sha256 fingerprint of
+ * the seat's key, never the key or a piece of it). leaseBatch keeps only the
+ * current seat's lines, drops the rest, and strips the tag: it is never sent
+ * (F10).
+ */
+import { promises as fs } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { cspeachRoot } from '../config/paths.js';
+import { countedTokens } from '../connection/local-usage.js';
+/** The exact fields sent; anything else on a queue line stays on disk. */
+const RECORD_KEYS = [
+    'request_id', 'mode', 'skill', 'model', 'input_tokens', 'output_tokens',
+    'cache_read_tokens', 'cache_write_tokens', 'cli_version', 'session_id', 'at',
+];
+export const QUEUE_MAX_LINES = 1000;
+export const QUEUE_MAX_BYTES = 1_000_000;
+const LOCK_STALE_MS = 10_000;
+/** Longer than LOCK_STALE_MS: a holder that died is always outwaited (F5). */
+const LOCK_WAIT_MS = 15_000;
+/**
+ * Final review finding 6 — the rename retry runs while the lock is held, so it
+ * must give up before a contender may judge that lock stale (LOCK_STALE_MS):
+ * otherwise two writers are possible in the last seconds.
+ */
+const RENAME_WAIT_MS = 8_000;
+/** A queue temp file older than this is a crash leftover (a live write renames within ms). */
+const STALE_TMP_MS = 60_000;
+/** Pinned by tests: RENAME_WAIT_MS < LOCK_STALE_MS < LOCK_WAIT_MS. */
+export const QUEUE_TIMINGS = { LOCK_STALE_MS, LOCK_WAIT_MS, RENAME_WAIT_MS };
+const LOCK_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+export function usageQueuePath() {
+    return path.join(cspeachRoot(), 'usage-queue.jsonl');
+}
+const lockPath = () => `${usageQueuePath()}.lock`;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** The seat tag on a queue line: a fingerprint of the key, never the key. */
+export function keyPrefixFor(key) {
+    return createHash('sha256').update(`cspeach-usage-seat:${key}`).digest('hex').slice(0, 16);
+}
+/** True only when the lock's holder is provably gone (same host, pid not running). */
+function holderIsDead(content) {
+    const [pidText, , host] = content.trim().split(' ');
+    const pid = Number(pidText);
+    if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid)
+        return false;
+    if (host !== os.hostname())
+        return false;
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (err) {
+        return err.code === 'ESRCH';
+    }
+}
+/**
+ * Remove a lock judged dead or stale. Renamed to a unique name first (only one
+ * contender can win the rename); if what was renamed is not the lock that was
+ * judged (a fresh holder took over in between), it is put back.
+ */
+async function clearLock(lp, judged) {
+    const aside = `${lp}.${process.pid}.${randomUUID()}.stale`;
+    try {
+        await fs.rename(lp, aside);
+    }
+    catch {
+        return;
+    }
+    const got = await fs.readFile(aside, 'utf-8').catch(() => judged);
+    if (got !== judged)
+        await fs.link(aside, lp).catch(() => { });
+    await fs.rm(aside, { force: true }).catch(() => { });
+}
+async function withQueueLock(fn) {
+    const lp = lockPath();
+    await fs.mkdir(path.dirname(lp), { recursive: true });
+    const token = `${process.pid} ${Date.now()} ${os.hostname()} ${randomUUID()}`;
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    for (;;) {
+        try {
+            const h = await fs.open(lp, 'wx');
+            try {
+                await h.writeFile(token);
+            }
+            finally {
+                await h.close();
+            }
+            break;
+        }
+        catch (err) {
+            const code = err.code ?? '';
+            // F14 — on Windows a lock file being created or deleted by another
+            // process answers EPERM / EACCES / EBUSY instead of EEXIST: that is
+            // contention too, so wait and retry (never drop the record).
+            if (code === 'EEXIST') {
+                try {
+                    const [content, st] = await Promise.all([fs.readFile(lp, 'utf-8'), fs.stat(lp)]);
+                    if (holderIsDead(content) || Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+                        await clearLock(lp, content);
+                        continue;
+                    }
+                }
+                catch { /* gone or busy: retry after the pause */ }
+            }
+            else if (!LOCK_CODES.has(code)) {
+                return undefined;
+            }
+            if (Date.now() > deadline)
+                return undefined;
+            await sleep(10 + Math.floor(Math.random() * 20));
+        }
+    }
+    await sweepStaleTemps();
+    try {
+        return await fn();
+    }
+    finally {
+        // Release only our own lock (it may have been cleared as stale meanwhile).
+        const now = await fs.readFile(lp, 'utf-8').catch(() => '');
+        if (now === token)
+            await fs.unlink(lp).catch(() => { });
+    }
+}
+/**
+ * Task 9 I3 — remove usage-queue.jsonl.<pid>.tmp files left by a crash.
+ * Runs under the queue lock; only our own temp names, only when older than
+ * STALE_TMP_MS (same rule as the skills cache). Never throws.
+ */
+async function sweepStaleTemps() {
+    const p = usageQueuePath();
+    const dir = path.dirname(p);
+    const prefix = `${path.basename(p)}.`;
+    try {
+        for (const f of await fs.readdir(dir)) {
+            if (!f.startsWith(prefix) || !/^\d+\.tmp$/.test(f.slice(prefix.length)))
+                continue;
+            const full = path.join(dir, f);
+            const st = await fs.stat(full).catch(() => null);
+            if (st && Date.now() - st.mtimeMs > STALE_TMP_MS)
+                await fs.rm(full, { force: true }).catch(() => { });
+        }
+    }
+    catch { /* no directory yet */ }
+}
+async function readLines() {
+    try {
+        return (await fs.readFile(usageQueuePath(), 'utf-8')).split('\n').filter((l) => l.trim().length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+async function writeLines(lines) {
+    const p = usageQueuePath();
+    if (lines.length === 0) {
+        await fs.rm(p, { force: true });
+        return;
+    }
+    const tmp = `${p}.${process.pid}.tmp`;
+    await fs.writeFile(tmp, lines.join('\n') + '\n', 'utf-8');
+    // F14 — a reader outside the lock (queueStats, doctor) can hold the file
+    // open on Windows for a moment: EPERM / EACCES / EBUSY is retried until a
+    // deadline, never treated as a lost write.
+    const deadline = Date.now() + RENAME_WAIT_MS;
+    for (let attempt = 0;; attempt++) {
+        try {
+            await fs.rename(tmp, p);
+            return;
+        }
+        catch (err) {
+            if (!LOCK_CODES.has(err.code ?? '') || Date.now() > deadline) {
+                await fs.rm(tmp, { force: true }).catch(() => { });
+                throw err;
+            }
+            await sleep(Math.min(20 * (attempt + 1), 200));
+        }
+    }
+}
+/** Newest lines kept: at most QUEUE_MAX_LINES and QUEUE_MAX_BYTES (newline included). */
+export function capLines(lines) {
+    let out = lines.slice(-QUEUE_MAX_LINES);
+    let bytes = out.reduce((n, l) => n + Buffer.byteLength(l) + 1, 0);
+    while (out.length > 0 && bytes > QUEUE_MAX_BYTES) {
+        bytes -= Buffer.byteLength(out[0]) + 1;
+        out = out.slice(1);
+    }
+    return out;
+}
+/** A line → the record (exactly RECORD_KEYS) and its seat tag; null when unreadable. */
+function parseLine(l) {
+    try {
+        const o = JSON.parse(l);
+        if (!o || typeof o !== 'object' || Array.isArray(o) || typeof o.request_id !== 'string')
+            return null;
+        const rec = Object.fromEntries(RECORD_KEYS.map((k) => [k, o[k]]));
+        return { rec, keyPrefix: typeof o.keyPrefix === 'string' ? o.keyPrefix : '' };
+    }
+    catch {
+        return null;
+    }
+}
+/** True when the record is in the queue, tagged with its seat. Never throws. */
+export async function enqueueUsage(rec, keyPrefix) {
+    try {
+        const line = JSON.stringify({ ...rec, keyPrefix });
+        return (await withQueueLock(async () => { await writeLines(capLines([...(await readLines()), line])); return true; })) === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Up to `max` of the oldest records of this seat, NOT removed (F1). Lines
+ * that cannot be read and lines of another seat are dropped here (F10); the
+ * returned records never carry the seat tag. Never throws.
+ */
+export async function leaseBatch(max, keyPrefix) {
+    try {
+        return (await withQueueLock(async () => {
+            const lines = await readLines();
+            const keep = [];
+            const out = [];
+            for (const l of lines) {
+                const q = parseLine(l);
+                if (!q || q.keyPrefix !== keyPrefix)
+                    continue;
+                keep.push(l);
+                if (out.length < max)
+                    out.push(q.rec);
+            }
+            if (keep.length !== lines.length)
+                await writeLines(keep);
+            return out;
+        })) ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Remove the records with these request ids (the proxy answered for them). False when the queue could not be changed. */
+export async function ackBatch(requestIds) {
+    if (requestIds.length === 0)
+        return true;
+    const done = new Set(requestIds);
+    try {
+        return (await withQueueLock(async () => {
+            const lines = await readLines();
+            const keep = lines.filter((l) => { const q = parseLine(l); return q !== null && !done.has(q.rec.request_id); });
+            if (keep.length !== lines.length)
+                await writeLines(keep);
+            return true;
+        })) === true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function queueStats() {
+    try {
+        const text = await fs.readFile(usageQueuePath(), 'utf-8');
+        return { lines: text.split('\n').filter((l) => l.trim().length > 0).length, bytes: Buffer.byteLength(text) };
+    }
+    catch {
+        return { lines: 0, bytes: 0 };
+    }
+}
+/**
+ * Azure limit (D6) — the counted tokens (input + output + cache-write; cache
+ * reads excluded) of THIS seat's records still waiting in the queue: exactly
+ * the tokens the server's `used` does not hold yet. Only azure records count,
+ * as the server's `used` counts azure usage only. Reads without the lock,
+ * as queueStats does. No file → 0; any other read error throws, so the caller
+ * keeps its count. Unreadable lines, other seats' lines and other modes are skipped.
+ */
+export async function queuedTokens(keyPrefix) {
+    let text;
+    try {
+        text = await fs.readFile(usageQueuePath(), 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return 0;
+        throw err;
+    }
+    const n = (v) => (typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : 0);
+    let sum = 0;
+    for (const l of text.split('\n')) {
+        if (l.trim().length === 0)
+            continue;
+        const q = parseLine(l);
+        if (!q || q.keyPrefix !== keyPrefix || q.rec.mode !== 'azure')
+            continue;
+        sum += countedTokens({ input_tokens: n(q.rec.input_tokens), output_tokens: n(q.rec.output_tokens), cache_write_tokens: n(q.rec.cache_write_tokens) });
+    }
+    return sum;
+}
+/** Cheap when there is nothing to delete (no lock taken): called on every call while reporting is off. */
+export async function deleteUsageQueue() {
+    try {
+        await fs.access(usageQueuePath());
+    }
+    catch {
+        return;
+    }
+    await withQueueLock(async () => { await fs.rm(usageQueuePath(), { force: true }); }).catch(() => { });
+}

package/dist/usage/usage-reporter.js

@@ -0,0 +1,270 @@
+/**
+ * Security batch item 3 — usage counts from byok / ai-hub / local model
+ * calls (managed calls are counted by the proxy). Counts only: seat (the
+ * bearer), skill, model, four token counters, turn time, CLI version, session
+ * id, request id. Never prompts, responses, source, object names, SAP system
+ * ids or file paths. Queued, sent in background batches; never blocks a turn.
+ */
+import { randomUUID } from 'node:crypto';
+import { loadConfig } from '../config/loader.js';
+import { CLI_VERSION } from '../lib/version.js';
+import { enqueueUsage, leaseBatch, ackBatch, deleteUsageQueue, keyPrefixFor } from './usage-queue.js';
+import { countedTokens, addLocalUsage } from '../connection/local-usage.js';
+/**
+ * The dated default (spec item 3, "Rollout"): with usage_reporting unset,
+ * reporting is OFF before this instant and ON from it — the 2 weeks' notice.
+ * Task 13 sets it to the publish day + 14 days.
+ */
+export const USAGE_REPORTING_DEFAULT_ON_FROM = '2026-10-26T00:00:00.000Z';
+export const BATCH_SIZE = 100;
+const FLUSH_DELAY_MS = 1500;
+const SEND_TIMEOUT_MS = 5000;
+const MAX_ROUNDS = 10;
+/** Statuses that mean "this batch will never be accepted": drop it, never retry (F3). */
+const DROP_STATUSES = new Set([400, 413, 422]);
+const REQUEST_ID_RE = /^[A-Za-z0-9_-]{8,128}$/;
+/** The proxy's per-field limits (cspeach-proxy/src/routes/usage.ts): a label it would reject is made safe here, never dropped. */
+const MAX_TOKENS = 50_000_000;
+const VERSION_RE = /^(\d{1,4})\.(\d{1,5})\.(\d{1,6})(?:[-+].*)?$/;
+function label(v, bad, max, fallback) {
+    const s = (typeof v === 'string' ? v : '').replace(bad, '-').slice(0, max);
+    return s.length > 0 ? s : fallback;
+}
+const count = (v) => typeof v === 'number' && Number.isFinite(v) && v > 0 ? Math.min(Math.floor(v), MAX_TOKENS) : 0;
+/** F6 — x.y.z the proxy accepts: prerelease / build metadata stripped; anything else '0.0.0'. */
+export function normaliseCliVersion(v) {
+    const m = VERSION_RE.exec(String(v ?? '').trim());
+    return m ? `${m[1]}.${m[2]}.${m[3]}` : '0.0.0';
+}
+/**
+ * F7 — a local model may be configured as a file path (a gguf on disk). Only
+ * its file name, without the extension, is reported; a plain model name
+ * (`llama3.1:70b`) has no path and is left as it is.
+ */
+function localModelName(m) {
+    if (!/[\\/]/.test(m) && !/^[A-Za-z]:/.test(m))
+        return m;
+    const base = m.split(/[\\/]/).pop() ?? '';
+    // Only real model-file extensions (final review, Task 9 I2): a version dot
+    // in a name such as qwen2.5 is part of the name.
+    return base.replace(/^[A-Za-z]:/, '').replace(/\.(?:gguf|bin|safetensors|pt|pth|onnx)$/i, '');
+}
+export function usageReportingState(cfg, now = new Date(), onFrom = USAGE_REPORTING_DEFAULT_ON_FROM, companyRequired = false) {
+    // Azure tenant mode, Task 8b (plan D11): the company's settings say usage
+    // counts are required — on, whatever the dated default or a stored "off".
+    if (companyRequired)
+        return { on: true, why: 'company-required' };
+    if (cfg.usage_reporting === 'on')
+        return { on: true, why: 'set-on' };
+    if (cfg.usage_reporting === 'off')
+        return { on: false, why: 'set-off' };
+    return now.getTime() >= Date.parse(onFrom) ? { on: true, why: 'default-on' } : { on: false, why: 'default-off-until', onFrom };
+}
+/**
+ * The one record shape POST /v1/usage takes — built field by field, so
+ * nothing else a caller passes can ride along. Null for managed calls (the
+ * proxy counts those) and for a call that never started. A started call
+ * with zero tokens (a local server that reports no usage) is still a turn
+ * and is recorded with zeros (F2).
+ */
+export function usageRecordFor(c) {
+    if (c.mode !== 'byok' && c.mode !== 'ai-hub' && c.mode !== 'local' && c.mode !== 'azure')
+        return null;
+    if (c.started === false)
+        return null;
+    const model = c.mode === 'local' && typeof c.model === 'string' ? localModelName(c.model) : c.model;
+    return {
+        request_id: typeof c.requestId === 'string' && REQUEST_ID_RE.test(c.requestId) ? c.requestId : randomUUID(),
+        mode: c.mode,
+        skill: label(c.skill, /[^A-Za-z0-9_-]/g, 64, 'none'),
+        model: label(model, /[^A-Za-z0-9._:/@-]/g, 100, 'unknown'),
+        input_tokens: count(c.input),
+        output_tokens: count(c.output),
+        cache_read_tokens: count(c.cacheRead),
+        cache_write_tokens: count(c.cacheWrite),
+        cli_version: normaliseCliVersion(CLI_VERSION),
+        session_id: label(c.sessionId, /[^A-Za-z0-9_-]/g, 64, 'none'),
+        at: (c.at ?? new Date()).toISOString(),
+    };
+}
+/**
+ * Azure tenant mode, Task 8b — why the company keeps usage counts on for this
+ * seat, or null when the developer's switch applies:
+ *  - 'required': the company's settings require usage counts;
+ *  - 'limit': this seat has a monthly limit (fix round 1, ruling 1), which
+ *    needs the counts even when the company made them optional.
+ * Only azure mode reads it; every other mode answers null with no I/O.
+ * Settings the company removed no longer keep anything on.
+ */
+export async function companyUsageRule(cfg) {
+    if (cfg.llm?.mode !== 'azure')
+        return null;
+    const { readConnectionCache } = await import('../connection/cache.js');
+    const c = await readConnectionCache().catch(() => null);
+    if (!c || c.removed)
+        return null;
+    if (c.connection.usage_counts === 'required')
+        return 'required';
+    return c.connection.limit ? 'limit' : null;
+}
+/** True when the company keeps usage counts on for this seat (required, or a monthly limit). */
+export async function companyRequiresUsageCounts(cfg) {
+    return (await companyUsageRule(cfg)) !== null;
+}
+/** Only azure asks the company; every other mode keeps today's switch exactly. */
+async function requiredFor(cfg, deps) {
+    if (cfg.llm?.mode !== 'azure')
+        return false;
+    return (deps.companyRequired ?? companyRequiresUsageCounts)(cfg).catch(() => false);
+}
+async function defaultGetKey() {
+    const { getStore } = await import('../auth/api-key.js');
+    return (await getStore()).get();
+}
+let flushTimer = null;
+function scheduleDefault(run) {
+    if (flushTimer)
+        return;
+    flushTimer = setTimeout(() => { flushTimer = null; run(); }, FLUSH_DELAY_MS);
+    flushTimer.unref?.();
+}
+/** After each non-managed model call. Never throws; never awaits the network. */
+export async function reportCallUsage(c, deps = {}) {
+    try {
+        const rec = usageRecordFor(c);
+        if (!rec)
+            return;
+        // Task 8b — the monthly limit counts every azure call on this laptop,
+        // whether or not the counts are reported (honest-developer control).
+        if (rec.mode === 'azure')
+            await (deps.addLocal ?? ((n) => addLocalUsage(n)))(countedTokens(rec)).catch(() => { });
+        const cfg = await (deps.loadConfig ?? loadConfig)();
+        if (!usageReportingState(cfg, (deps.now ?? (() => new Date()))(), undefined, await requiredFor(cfg, deps)).on) {
+            // Off: no queue file is written, and an existing one is deleted.
+            await deleteUsageQueue();
+            return;
+        }
+        // F10 — a record belongs to the seat that made the call; not signed in → no record.
+        const key = await (deps.getKey ?? defaultGetKey)();
+        if (!key)
+            return;
+        if (!(await enqueueUsage(rec, keyPrefixFor(key))))
+            return;
+        (deps.scheduleFlush ?? scheduleDefault)(() => {
+            try {
+                void flushUsageQueue(cfg.proxy_url, deps).catch(() => { });
+            }
+            catch { /* best effort */ }
+        });
+    }
+    catch { /* usage counts are best effort */ }
+}
+/**
+ * Send this seat's queued records in batches of at most 100 to the CSPeach
+ * proxy, with the seat's key. Re-checks first (F10): a managed seat, a seat
+ * with reporting off, or no key sends nothing. Each batch is leased (F1): it
+ * stays on disk until the proxy answered, then exactly those request ids are
+ * removed. 2xx → removed; 400 / 413 / 422 → removed (never accepted, F3);
+ * anything else or no answer → kept for later. Never logs the key.
+ */
+export async function flushUsageQueue(proxyUrl, deps = {}) {
+    const none = { sent: 0, kept: 0 };
+    let cfg;
+    try {
+        cfg = await (deps.loadConfig ?? loadConfig)();
+    }
+    catch {
+        return none;
+    }
+    if ((cfg.llm?.mode ?? 'managed') === 'managed')
+        return none;
+    if (!usageReportingState(cfg, (deps.now ?? (() => new Date()))(), undefined, await requiredFor(cfg, deps)).on)
+        return none;
+    let key;
+    try {
+        key = await (deps.getKey ?? defaultGetKey)();
+    }
+    catch {
+        key = null;
+    }
+    if (!key)
+        return none;
+    const seat = keyPrefixFor(key);
+    const ack = deps.ack ?? ackBatch;
+    let sent = 0;
+    for (let round = 0; round < MAX_ROUNDS; round++) {
+        const batch = await leaseBatch(BATCH_SIZE, seat);
+        if (batch.length === 0)
+            break;
+        const ids = batch.map((r) => r.request_id);
+        let r;
+        try {
+            r = await (deps.fetchImpl ?? fetch)(`${proxyUrl.replace(/\/$/, '')}/v1/usage`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${key}`, 'content-type': 'application/json', 'User-Agent': `cspeach/${CLI_VERSION}` },
+                body: JSON.stringify({ records: batch }),
+                signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
+            });
+        }
+        catch {
+            return { sent, kept: batch.length }; // offline: the lease simply lapses; nothing was removed
+        }
+        // F8 — always read the body (frees the socket); the rejected count is a
+        // debug line only, and never carries the key.
+        const text = await r.text().catch(() => '');
+        if (r.ok) {
+            sent += batch.length;
+            if (process.env.CSPEACH_DEBUG === '1') {
+                let rejected = 0;
+                try {
+                    rejected = Number(JSON.parse(text).rejected) || 0;
+                }
+                catch { /* not JSON */ }
+                if (rejected > 0)
+                    process.stderr.write(`[usage] the proxy rejected ${rejected} usage record(s)\n`);
+            }
+            // A failed removal keeps the batch for a resend (the proxy dedupes);
+            // stop here rather than lease the same batch again this flush.
+            if (!(await ack(ids)))
+                return { sent, kept: 0 };
+            continue;
+        }
+        if (DROP_STATUSES.has(r.status)) {
+            if (!(await ack(ids)))
+                return { sent, kept: 0 };
+            continue;
+        }
+        return { sent, kept: batch.length }; // 401 / 403 / 404 / 429 / 5xx: keep for later
+    }
+    return { sent, kept: 0 };
+}
+/**
+ * Controller ruling (Task 9 fix round 1) — at REPL / one-shot start, a
+ * non-managed seat with reporting on sends what is waiting. Fire-and-forget:
+ * returns at once (true when a flush was started), never throws, adds no
+ * start-up latency. Managed: returns false with no I/O at all.
+ */
+export function startUsageFlushAtStartup(cfg, deps = {}) {
+    try {
+        if ((cfg.llm?.mode ?? 'managed') === 'managed')
+            return false;
+        const flush = deps.flush ?? ((url) => flushUsageQueue(url));
+        if (cfg.llm?.mode === 'azure') {
+            // Task 8b — whether the company requires counts is read from disk, so
+            // the decision is async: fire-and-forget like the flush itself.
+            void (async () => {
+                if (!usageReportingState(cfg, (deps.now ?? (() => new Date()))(), undefined, await requiredFor(cfg, deps)).on)
+                    return;
+                await flush(cfg.proxy_url);
+            })().catch(() => { });
+            return true;
+        }
+        if (!usageReportingState(cfg, (deps.now ?? (() => new Date()))()).on)
+            return false;
+        void Promise.resolve(flush(cfg.proxy_url)).catch(() => { });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cspeach/cli",
-  "version": "1.1.33",
-  "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
+  "version": "1.1.34",
+  "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, signed skills, safety gates.",
   "keywords": [
     "abap",
     "sap",
@@ -52,6 +52,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.90.0",
+    "@azure/msal-node": "6.0.1",
     "@cspeach/register-core": "0.4.0",
     "@cspeach/sap-client": "0.1.18",
     "@iarna/toml": "^2.2.5",