@cspeach/cli 1.1.33 → 1.1.34

package/dist/commands/whoami.js

@@ -1,25 +1,127 @@
 /**
  * `cspeach whoami` — print the current account without booting the REPL.
- * Reads auth.json + calls /v1/me; falls back to a "not signed in via auth.json"
- * note when the file is absent. Does NOT inspect keytar (would require Inquirer
- * prompts to handle missing keychain on Windows; out of scope).
+ * Reads the CSPeach key through the one resolver (security batch item 6:
+ * this home's OS credential store entry, else auth.json) and calls /v1/me;
+ * a "not signed in" note when there is no key.
  */
-import { readAuthFile } from '../auth/auth-file.js';
+import { resolveApiKey } from '../auth/key-resolver.js';
 import { fetchMe } from '../auth/me.js';
+import { readLicenceCache, keyPrefixOf } from '../licence/licence-check.js';
 import { formatFailure, formatInfo } from '../renderer/notice-shape.js';
 import { panelHeading, panelRow } from '../renderer/panel-rows.js';
 import { paint } from '../renderer/theme.js';
 import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { queueStats } from '../usage/usage-queue.js';
 /** Server-supplied text (email, plan, trial fields) is one line with no control characters. */
 const serverText = (v) => sanitizeControlChars(String(v ?? '')).replace(/\s*\r?\n\s*/g, ' ').trim();
+async function defaultAzureWhoami() {
+    const { readConnectionCache } = await import('../connection/cache.js');
+    const c = await readConnectionCache();
+    if (!c)
+        return null;
+    const conn = c.connection;
+    if (conn.sign_in.includes('entra')) {
+        const { describeEntraSignIn } = await import('../auth/azure/token-provider.js');
+        const s = await describeEntraSignIn(conn);
+        if (s.state === 'signed-in' || !conn.sign_in.includes('key')) {
+            return { endpoint: conn.endpoint, tenant: conn.entra_tenant_id, method: 'Microsoft sign-in', account: s.username, expiresOn: s.expiresOn ?? null, state: s.state === 'signed-in' ? 'ok' : 'needs-sign-in' };
+        }
+    }
+    const { getAzureKey } = await import('../auth/azure/azure-key.js');
+    return { endpoint: conn.endpoint, tenant: conn.entra_tenant_id, method: 'Azure key', state: (await getAzureKey()) ? 'ok' : 'no-key' };
+}
+/** The portal's customer-facing words (viewer team.js INSTALL_MODE_LABEL).
+ *  Own key is not offered today: byok and ai-hub both read "Your AI service". */
+const MODE_LABEL = {
+    managed: 'CSPeach',
+    byok: 'Your AI service',
+    'ai-hub': 'Your AI service',
+    local: 'Local model',
+    azure: 'Your Azure',
+};
+/** A local read that must never hang whoami: settles to UNKNOWN after LOCAL_READ_MS. */
+const LOCAL_READ_MS = 2_000;
+const UNKNOWN = Symbol('unknown');
+function boundedRead(read) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => resolve(UNKNOWN), LOCAL_READ_MS);
+        timer.unref?.();
+        let p;
+        try {
+            p = read();
+        }
+        catch {
+            p = Promise.reject(new Error('read failed'));
+        }
+        p.then((v) => { clearTimeout(timer); resolve(v); }, () => { clearTimeout(timer); resolve(UNKNOWN); });
+    });
+}
+/** Security batch item 5 — what this machine knows about its own sign-in. Never the key itself. */
+async function printLocalFacts(deps, key) {
+    const mode = deps.mode ?? 'managed';
+    const prefix = keyPrefixOf(key);
+    // Final review (Task 11c): a key no longer than the prefix would print in
+    // full — no Key row then.
+    if (key.length > prefix.length)
+        deps.print(panelRow('Key', `${serverText(prefix)}…`, 8));
+    deps.print(panelRow('Mode', MODE_LABEL[mode] ?? 'unknown', 8));
+    let licence;
+    if (mode === 'managed') {
+        licence = 'checked by CSPeach on every request (managed)';
+    }
+    else {
+        const lic = await boundedRead(deps.readLicence ?? readLicenceCache);
+        if (lic === UNKNOWN)
+            licence = 'unknown';
+        else if (!lic)
+            licence = 'not checked on this machine yet';
+        else if (lic.keyPrefix !== prefix)
+            licence = 'not checked for this key on this machine yet';
+        else
+            licence = serverText(`${lic.status} · checked ${lic.checkedAt}`);
+    }
+    deps.print(panelRow('Licence', licence, 8));
+    const q = await boundedRead(deps.queue ?? queueStats);
+    const n = q === UNKNOWN ? NaN : Number(q.lines);
+    deps.print(panelRow('Queue', Number.isFinite(n) ? `${n} usage records waiting` : 'unknown', 8));
+    if (mode === 'azure')
+        await printAzureFacts(deps);
+}
+/** Azure tenant mode (Task 7): endpoint, tenant, sign-in method, account and token expiry. */
+async function printAzureFacts(deps) {
+    const a = await boundedRead(deps.azure ?? defaultAzureWhoami);
+    // A read that failed or ran past LOCAL_READ_MS (e.g. a slow silent token
+    // refresh) is not "no settings": say what is true.
+    if (a === UNKNOWN) {
+        deps.print(panelRow('Azure', 'Could not check your Azure sign-in in time · run cspeach doctor', 8));
+        return;
+    }
+    if (!a) {
+        deps.print(panelRow('Azure', 'settings not on this machine · cspeach login', 8));
+        return;
+    }
+    deps.print(panelRow('Azure', serverText(a.endpoint), 8));
+    deps.print(panelRow('Tenant', serverText(a.tenant), 8));
+    deps.print(panelRow('Sign-in', a.method, 8));
+    if (a.account)
+        deps.print(panelRow('Account', serverText(a.account), 8));
+    if (a.state === 'ok') {
+        if (a.expiresOn)
+            deps.print(panelRow('Token', `valid until ${a.expiresOn.toISOString()}`, 8));
+    }
+    else
+        deps.print(panelRow('Token', a.state === 'no-key' ? 'no Azure key on this machine · cspeach config set llm.azure_key -' : 'sign-in needed · cspeach login azure', 8));
+}
 export async function runWhoamiCommand(deps) {
-    const auth = await readAuthFile();
-    if (!auth) {
-        deps.print(formatInfo('Not signed in with cspeach login (no auth.json in your CSPeach home)').trimEnd());
-        deps.print(`  ${paint('dim', 'Next:')} cspeach login   (the REPL may still use a keychain key — run cspeach to check)`);
+    const { key } = await (deps.resolveKey ?? (() => resolveApiKey()))();
+    if (!key) {
+        deps.print(formatInfo('Not signed in (no CSPeach key in this CSPeach home)').trimEnd());
+        deps.print(`  ${paint('dim', 'Next:')} cspeach login`);
+        if (deps.mode === 'azure')
+            await printAzureFacts(deps);
         return 0;
     }
-    const me = await fetchMe({ proxyUrl: deps.proxyUrl, apiKey: auth.apiKey });
+    const me = await fetchMe({ proxyUrl: deps.proxyUrl, apiKey: key });
     if (!me.ok) {
         // Status 0 = the request never got an answer (network error or the /v1/me
         // timeout): signing in again would not help. Any HTTP answer keeps the
@@ -30,6 +132,7 @@ export async function runWhoamiCommand(deps) {
             detail: [unreachable ? `could not reach the server (${me.error})` : `the server answered ${me.status} (${me.error})`],
             next: unreachable ? 'check this machine can reach cspeach.dev (company network or proxy settings), then run cspeach whoami again' : 'cspeach login',
         }).trimEnd());
+        await printLocalFacts(deps, key);
         return 1;
     }
     const p = me.profile;
@@ -45,5 +148,6 @@ export async function runWhoamiCommand(deps) {
     if (p.entitlements.enabled_skills.length > 0) {
         deps.print(panelRow('Skills', serverText(p.entitlements.enabled_skills.join(', ')), 8));
     }
+    await printLocalFacts(deps, key);
     return 0;
 }

package/dist/config/loader.js

@@ -222,6 +222,9 @@ export async function loadConfig() {
             plan_audit: parsed.plan_audit === 'on' || parsed.plan_audit === 'off'
                 ? parsed.plan_audit
                 : undefined,
+            usage_reporting: parsed.usage_reporting === 'on' || parsed.usage_reporting === 'off'
+                ? parsed.usage_reporting
+                : undefined,
             approvals: parsed.approvals === 'plan' || parsed.approvals === 'per-write'
                 ? parsed.approvals
                 : undefined,
@@ -318,6 +321,8 @@ export async function loadConfig() {
         // callers see a genuine "absent" shape (treated as 'on').
         if (merged.plan_audit === undefined)
             delete merged.plan_audit;
+        if (merged.usage_reporting === undefined)
+            delete merged.usage_reporting;
         if (merged.approvals === undefined)
             delete merged.approvals;
         // Same for `audit_model`: absent-or-invalid must not serialise as

package/dist/connection/azure-auth.js

@@ -0,0 +1,135 @@
+/**
+ * Azure tenant mode — how a request authenticates to the company's Foundry
+ * endpoint. Entra: a bearer token from MSAL (Task 6). Key: the admin-issued
+ * key from the OS credential store. The CSPeach key never goes here, and the
+ * token or key never goes anywhere but the allow-listed host.
+ *
+ * Every Azure SDK client is built from azureSdkOptions, which also hands the
+ * SDK our guarded fetch: the host guard runs on the FINAL URL of every real
+ * request (not only on the saved endpoint), and redirects are refused —
+ * Node's fetch keeps api-key / x-api-key headers on a cross-origin redirect.
+ */
+import { getAzureKey } from '../auth/azure/azure-key.js';
+import { assertAllowedAzureUrl } from './guard.js';
+export class AzureSignInRequiredError extends Error {
+    method;
+    constructor(method) {
+        super(method === 'entra' ? 'Your Microsoft sign-in has ended.' : 'Your Azure key is not set on this machine.');
+        this.name = 'AzureSignInRequiredError';
+        this.method = method;
+    }
+}
+export async function selectAzureAuth(conn, deps = {}) {
+    // Task 6b — Entra through the token provider, loaded on demand (MSAL itself
+    // loads only inside auth/azure/msal-client.ts). Never interactive: a sign-in
+    // that ended throws AzureSignInRequiredError and the turn ends with
+    // `cspeach login azure`.
+    const entra = deps.entra ?? (async (c) => (await import('../auth/azure/token-provider.js')).entraForSelect(c, { getKey: deps.getKey }));
+    if (conn.sign_in.includes('entra')) {
+        const e = await entra(conn);
+        if (e)
+            return e;
+    }
+    if (conn.sign_in.includes('key')) {
+        return {
+            method: 'key',
+            async getAuth() {
+                const key = await (deps.getKey ?? getAzureKey)();
+                if (!key)
+                    throw new AzureSignInRequiredError('key');
+                return { kind: 'key', key };
+            },
+        };
+    }
+    return { method: 'entra', async getAuth() { throw new AzureSignInRequiredError('entra'); } };
+}
+/**
+ * The Azure endpoint answered with a redirect (3xx). Unlike
+ * AzureConnectionRefusedError this request DID reach Azure; CSPeach refuses to
+ * follow the answer. Plain message: the host only — never the key, the full
+ * URL or the redirect target.
+ */
+export class AzureRedirectRefusedError extends Error {
+    constructor(host) {
+        super(`Your Azure endpoint at ${host} answered with a redirect. CSPeach does not follow it.`);
+        this.name = 'AzureRedirectRefusedError';
+    }
+}
+function urlOf(input) {
+    if (typeof input === 'string')
+        return input;
+    if (input instanceof URL)
+        return input.href;
+    return input.url;
+}
+/** The SDK's attempt number for this request (0 = first try); the header it sets on every attempt. */
+function retryCountOf(input, init) {
+    try {
+        const h = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+        const n = Number(h.get('x-stainless-retry-count') ?? 0);
+        return Number.isFinite(n) ? n : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+/** Node's fetch with `redirect: 'error'` rejects a 3xx as TypeError("fetch failed", { cause: "unexpected redirect" }). */
+function isRedirectFailure(err) {
+    const cause = err?.cause;
+    return err instanceof TypeError && cause instanceof Error && /unexpected redirect/i.test(cause.message);
+}
+/**
+ * A fetch that checks every request URL against the Azure allow-list BEFORE
+ * any network call, always sends `redirect: 'error'`, and refuses a 3xx
+ * answer as well (belt and braces for a fetch that ignores the flag). `base`
+ * is read at call time, so a test's stubbed global fetch is the one used.
+ *
+ * Task 7, ruling 4 — a refusal can never succeed, so it is never retried:
+ * the SDK retries a failed fetch on its own, and its retries of a refused
+ * request (same URL, `x-stainless-retry-count` > 0) get the same refusal
+ * back without going to the network. A new request (count 0) always tries.
+ */
+export function createAzureFetch(base = () => globalThis.fetch) {
+    const refused = new Map();
+    const refuse = (url, err) => { refused.set(url, err); throw err; };
+    return async (input, init) => {
+        const url = urlOf(input);
+        const earlier = refused.get(url);
+        if (earlier && retryCountOf(input, init) > 0)
+            throw earlier;
+        refused.delete(url);
+        try {
+            assertAllowedAzureUrl(url);
+        }
+        catch (e) {
+            return refuse(url, e);
+        }
+        let res;
+        try {
+            res = await base()(input, { ...init, redirect: 'error' });
+        }
+        catch (e) {
+            if (isRedirectFailure(e))
+                return refuse(url, new AzureRedirectRefusedError(new URL(url).host));
+            throw e;
+        }
+        if (res.status >= 300 && res.status < 400) {
+            return refuse(url, new AzureRedirectRefusedError(new URL(url).host));
+        }
+        return res;
+    };
+}
+/** The one guarded fetch every Azure SDK client uses. */
+export const azureFetch = createAzureFetch();
+/**
+ * SDK options for an Azure client. Both auth fields are always set: the
+ * Anthropic SDK otherwise reads ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN from
+ * the environment and would send a developer's own key to Azure. Throws for
+ * a host outside the allow-list, before any client exists.
+ */
+export function azureSdkOptions(endpoint, auth) {
+    assertAllowedAzureUrl(`${endpoint}/v1/messages`);
+    return auth.kind === 'entra'
+        ? { baseURL: endpoint, authToken: auth.token, apiKey: null, fetch: azureFetch }
+        : { baseURL: endpoint, apiKey: auth.key, authToken: null, fetch: azureFetch };
+}

package/dist/connection/azure-errors.js

@@ -0,0 +1,103 @@
+/**
+ * Azure tenant mode — the spec's plain messages ("Request shaping and
+ * errors"), keyed on status and the Azure error body { error: { code,
+ * message } }. The 400 text pattern is data (AZURE_FACTS) and is confirmed by
+ * the live proof. Returns null for anything else (the generic turn-error block applies).
+ *
+ * Errors are matched by NAME, never instanceof, so this module (loaded by
+ * turn-error-ux.ts in every mode) never pulls in the credential store, MSAL
+ * or the Azure SDK client code.
+ */
+import { AZURE_FACTS } from './azure-facts.js';
+import { formatFailure } from '../renderer/notice-shape.js';
+import { getActiveConnection } from './cache.js';
+import { lastAzureDeployment, lastAzureMethod } from './azure-last-call.js';
+import { azureSignInTurnLine } from './azure-turn-error.js';
+const KEY_NEXT = 'ask IT for a current key, then cspeach config set llm.azure_key -';
+export function azureErrorContext() {
+    const c = getActiveConnection();
+    if (!c)
+        return null;
+    return { method: lastAzureMethod() ?? (c.connection.sign_in.includes('entra') ? 'entra' : 'key'), deployment: lastAzureDeployment() };
+}
+const REFUSALS = new Set(['AzureHostRefusedError', 'AzureRedirectRefusedError', 'AzureConnectionRefusedError']);
+/**
+ * Controller ruling 4 — a refusal from the guarded fetch reaches the caller
+ * wrapped by the SDK ("Connection error.", APIConnectionError) with the real
+ * reason in `cause`. Walk the cause chain (a few levels) for it.
+ */
+export function azureRefusalIn(err) {
+    let e = err;
+    for (let depth = 0; depth < 4 && e instanceof Error; depth++) {
+        if (REFUSALS.has(e.name))
+            return e;
+        e = e.cause;
+    }
+    return null;
+}
+function bodyText(err) {
+    const e = err;
+    const m = e?.error?.error?.message ?? e?.error?.message ?? e?.message;
+    return typeof m === 'string' ? m : '';
+}
+/** Final fix wave A — the line for our service's 403 azure_company (spec message table). */
+export const AZURE_COMPANY_LINE = 'Your company runs CSPeach on its own Azure. Run cspeach login to load its settings.';
+/**
+ * True for our service's `403 { error: 'azure_company' }`: the seat's company
+ * runs CSPeach on its own Azure, so the managed path refuses it. Read from the
+ * SDK's parsed body, else from the "403 {…}" message text.
+ */
+export function isAzureCompanyRefusal(err) {
+    const e = err;
+    if (!e || typeof e !== 'object')
+        return false;
+    if (e.status !== undefined && Number(e.status) !== 403)
+        return false;
+    const parsed = e.error;
+    if (parsed && typeof parsed === 'object' && parsed.error === 'azure_company')
+        return Number(e.status) === 403;
+    const msg = typeof e.message === 'string' ? e.message : '';
+    if (!/^403\b/.test(msg))
+        return false;
+    const brace = msg.indexOf('{');
+    if (brace < 0)
+        return false;
+    try {
+        return JSON.parse(msg.slice(brace, msg.lastIndexOf('}') + 1))?.error === 'azure_company';
+    }
+    catch {
+        return false;
+    }
+}
+export function azureErrorNotice(err, ctx) {
+    // Final fix wave A — our service refused this seat on the managed path
+    // because its company runs on its own Azure: one plain line, in any mode.
+    if (isAzureCompanyRefusal(err))
+        return { preformatted: formatFailure({ what: AZURE_COMPANY_LINE }) };
+    // Refusals and sign-in errors only ever come from the azure path, so they
+    // are shown even when no settings are active (e.g. settings missing).
+    const refused = azureRefusalIn(err);
+    if (refused) {
+        switch (refused.name) {
+            case 'AzureConnectionRefusedError': return { preformatted: refused.message };
+            case 'AzureHostRefusedError': return { what: refused.message, next: 'cspeach login (settings changed)' };
+            default: return { what: refused.message, next: 'ask IT to check the Azure endpoint in CSPeach settings' };
+        }
+    }
+    const signIn = azureSignInTurnLine(err);
+    if (signIn)
+        return signIn;
+    if (!ctx)
+        return null;
+    const status = Number(err?.status);
+    switch (status) {
+        case 401: return ctx.method === 'entra' ? { what: 'Your Microsoft sign-in has ended.', next: 'cspeach login azure' } : { what: 'Your Azure key was rejected.', next: KEY_NEXT };
+        case 403: return { what: "Your account is not allowed to use the company's AI models.", next: 'ask IT to add you to the CSPeach developers group' };
+        case 404: return { what: `Deployment "${ctx.deployment ?? 'unknown'}" was not found at your company's Azure endpoint.`, next: 'ask IT to check the deployment names in CSPeach settings; run cspeach doctor' };
+        case 429: return { what: "Your company's Azure limit was reached.", next: 'wait a minute, or ask IT to raise the quota' };
+        case 400: return AZURE_FACTS.unsupportedParamPattern.test(bodyText(err))
+            ? { what: 'CSPeach sent a setting your Azure model does not accept.', next: 'run cspeach doctor and send us the output' }
+            : null;
+        default: return null;
+    }
+}

package/dist/connection/azure-facts.js

@@ -0,0 +1,21 @@
+/**
+ * Azure tenant mode — the values the live test settles, in ONE place (plan
+ * D7). Each line names the live-proof item (spec "Live proof checklist") or
+ * owner action that sets it. Change them only in their own commit.
+ */
+export const NIL_CLIENT_ID = '00000000-0000-0000-0000-000000000000';
+export const AZURE_FACTS = Object.freeze({
+    /** Live proof 5 — 'v0' sends nothing unproven; 'v1' after the probe (azure-profile.ts). */
+    profileVersion: 'v0',
+    /** Live proof 4 — the Entra scope that returns a Foundry token for our public client. */
+    entraScope: 'https://ai.azure.com/.default',
+    /** Owner action 3 — our multi-tenant public client id (a public value). Recorded 2026-10-12 (app "CSPeach", multi-tenant, public client). */
+    clientId: '1b88e804-7801-43bb-9bf6-26c278472d82',
+    /** Live proof 5 — what a Foundry response's `model` holds: the deployment name or the model id. */
+    messageStartModel: 'unknown',
+    /** Live proof 7 / spec error table — the 400 text that means "a parameter this model does not accept". */
+    unsupportedParamPattern: /not supported|unsupported|unrecognized|unknown parameter|extra inputs are not permitted/i,
+});
+export function clientIdConfigured(id = AZURE_FACTS.clientId) {
+    return id !== NIL_CLIENT_ID;
+}

package/dist/connection/azure-gate.js

@@ -0,0 +1,40 @@
+/**
+ * Azure tenant mode — the per-turn check added to the licence gate (plan D8):
+ * refuse a turn while the settings are missing, removed, unconfirmed or point
+ * at a host outside the allow-list; then (Task 8b) the seat's monthly limit.
+ * Runs between turns only, so a running turn always finishes.
+ */
+import { getActiveConnection } from './cache.js';
+import { azureTurnVerdict } from './state.js';
+import { readLocalUsage } from './local-usage.js';
+import { limitVerdict } from './limit-gate.js';
+import { formatFailure } from '../renderer/notice-shape.js';
+/** The 80% line shows once per session (this process). */
+let warned80 = false;
+/** Test-only. */
+export function __resetLimitWarningForTests() { warned80 = false; }
+export async function azureGateCheck(get = getActiveConnection, deps = {}) {
+    const c = get();
+    const v = azureTurnVerdict(c);
+    if (!v.allow)
+        return { allow: false, message: v.message };
+    const limit = c.connection.limit;
+    if (!limit)
+        return { allow: true };
+    // A limit check that throws refuses this turn with a plain line (never a
+    // crash, never a silent allow); the next turn checks again.
+    let lv;
+    try {
+        lv = limitVerdict(limit, await (deps.readLocal ?? readLocalUsage)(), (deps.now ?? (() => new Date()))(), warned80);
+    }
+    catch {
+        return { allow: false, message: formatFailure({ what: "Could not check this month's CSPeach limit.", next: 'try again' }).trimEnd() };
+    }
+    if (!lv.allow)
+        return { allow: false, message: lv.message };
+    if (lv.warn) {
+        warned80 = true;
+        return { allow: true, line: lv.warn };
+    }
+    return { allow: true };
+}

package/dist/connection/azure-last-call.js

@@ -0,0 +1,5 @@
+let deployment = null;
+let method = null;
+export function noteAzureCall(d, m) { deployment = d; method = m; }
+export function lastAzureDeployment() { return deployment; }
+export function lastAzureMethod() { return method; }

package/dist/connection/azure-turn-error.js

@@ -0,0 +1,25 @@
+/**
+ * Azure tenant mode, Task 6b — a turn never opens a browser or asks. When the
+ * Microsoft sign-in (or the Azure key) is needed mid-turn, the token provider
+ * throws, and the turn ends with ONE plain line and the command that fixes
+ * it. "type continue" would only hit the same wall.
+ *
+ * Matched by error name, with no imports, so the error path (turn-error-ux.ts
+ * and one-shot, loaded in every mode) never pulls in MSAL, the credential
+ * store or the Azure SDK.
+ */
+const KEY_NEXT = 'ask IT for a current key, then cspeach config set llm.azure_key -';
+export function azureSignInTurnLine(err) {
+    if (!(err instanceof Error))
+        return null;
+    const method = err.method;
+    switch (err.name) {
+        case 'AzureSignInRequiredError':
+        case 'AzureSeveralAccountsError':
+            return { what: err.message, next: method === 'key' ? KEY_NEXT : 'cspeach login azure' };
+        case 'AzureWrongTenantError':
+            return { what: err.message, next: 'sign in with your work account: cspeach login azure' };
+        default:
+            return null;
+    }
+}

package/dist/connection/cache.js

@@ -0,0 +1,70 @@
+/**
+ * Azure tenant mode — <CSPEACH_HOME>/connection.json (one per home, no
+ * secret). Read at every start (fast, offline), refreshed with the licence
+ * check. A damaged or hand-edited file reads as "no cache".
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { cspeachRoot } from '../config/paths.js';
+import { setActiveDeployments } from '../models/model-identity.js';
+import { parseConnectionAnswer } from './guard.js';
+export function connectionCachePath() {
+    return path.join(cspeachRoot(), 'connection.json');
+}
+function asAzure(v) {
+    const a = parseConnectionAnswer(v);
+    return a && a.kind === 'azure' ? a : null;
+}
+export async function readConnectionCache() {
+    let raw;
+    try {
+        raw = JSON.parse(await fs.readFile(connectionCachePath(), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const connection = asAzure(raw.connection);
+    if (!connection)
+        return null;
+    const pending = raw.pending == null ? null : asAzure(raw.pending);
+    if (raw.pending != null && !pending)
+        return null;
+    const confirmed = raw.confirmed;
+    if (!confirmed || confirmed.endpoint !== connection.endpoint || confirmed.entra_tenant_id !== connection.entra_tenant_id)
+        return null;
+    return {
+        connection, pending, removed: raw.removed === true,
+        confirmed: { endpoint: connection.endpoint, entra_tenant_id: connection.entra_tenant_id },
+        fetchedAt: typeof raw.fetchedAt === 'string' ? raw.fetchedAt : '',
+    };
+}
+export async function writeConnectionCache(c) {
+    const file = connectionCachePath();
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(c, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
+    await fs.rename(tmp, file);
+}
+/** True when a file was removed, false when there was none; throws on any other error. */
+export async function deleteConnectionCache() {
+    try {
+        await fs.unlink(connectionCachePath());
+        return true;
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return false;
+        throw e;
+    }
+}
+let active = null;
+/** The settings this process runs on. Also sets the deployment table model identity reads. */
+export function setActiveConnection(c) {
+    active = c;
+    setActiveDeployments(c ? c.connection.deployments : null);
+}
+export function getActiveConnection() {
+    return active;
+}

package/dist/connection/fetch.js

@@ -0,0 +1,33 @@
+/** Azure tenant mode — GET {proxy}/v1/me/connection. Bearer only; never throws. */
+import { parseConnectionAnswer } from './guard.js';
+export async function fetchConnection(o) {
+    const timeoutMs = o.timeoutMs ?? 5000;
+    const signal = AbortSignal.timeout(timeoutMs);
+    const timedOut = new Promise((_, reject) => {
+        signal.addEventListener('abort', () => reject(new Error(`timed out after ${timeoutMs} ms`)), { once: true });
+    });
+    timedOut.catch(() => { });
+    try {
+        return await Promise.race([
+            (async () => {
+                const r = await (o.fetchImpl ?? fetch)(`${o.proxyUrl.replace(/\/$/, '')}/v1/me/connection`, {
+                    headers: { Authorization: `Bearer ${o.apiKey}` }, signal,
+                });
+                // An older service has no such route. Reported on its own: it is NEVER
+                // a "none" answer (only a real { kind: 'none' } body marks settings
+                // removed — a service rollback must not lock out every azure seat).
+                if (r.status === 404)
+                    return { ok: false, status: 404, error: 'no_route' };
+                const body = await r.json().catch(() => null);
+                if (!r.ok)
+                    return { ok: false, status: r.status, error: typeof body?.error === 'string' ? body.error : 'unknown' };
+                const answer = parseConnectionAnswer(body);
+                return answer ? { ok: true, answer } : { ok: false, status: r.status, error: 'unreadable_settings' };
+            })(),
+            timedOut,
+        ]);
+    }
+    catch (err) {
+        return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err) };
+    }
+}