@cspeach/cli 1.1.33 → 1.1.34

package/dist/repl/builtin-commands.js

@@ -8,22 +8,30 @@
  * read of the process-wide cost display mode (cost/credits.ts); no
  * inquirer, so the router can import it.
  */
-import { creditsActive } from '../cost/credits.js';
+import { creditsActive, tokensOnlyActive } from '../cost/credits.js';
 // Pure generated data (type-only import inside), so this file stays light.
 import { BUNDLED_RUNS } from '../runs/bundled-runs.js';
 export const COST_DESCRIPTION_USD = 'Show this session\'s spend so far ($ and tokens)';
 export const COST_DESCRIPTION_CREDITS = 'Show the credits this session has used so far';
+/** Azure tenant mode (Task 7, ruling 5): tokens only — never "$" or credits. */
+export const COST_DESCRIPTION_TOKENS = "Show this session's tokens so far";
 /** Piece 2 §10: managed customers see credits, never "$" (cost/display-mode.ts). */
 /** /usage (2026-10-09): this month in credits — see commands/usage.ts. */
 export const USAGE_DESCRIPTION = 'Show this month’s credits, your balance and the top skills';
+export const USAGE_DESCRIPTION_TOKENS = "Show where your usage is: your company's Azure invoice";
 export function costCommandDescription() {
+    if (tokensOnlyActive())
+        return COST_DESCRIPTION_TOKENS;
     return creditsActive() ? COST_DESCRIPTION_CREDITS : COST_DESCRIPTION_USD;
 }
+export function usageCommandDescription() {
+    return tokensOnlyActive() ? USAGE_DESCRIPTION_TOKENS : USAGE_DESCRIPTION;
+}
 export const BUILTIN_ENTRIES = [
     // Piece 2: /cancel is not listed — it exists only in the classic loop
     // (repl.tsx), and Esc / Ctrl+C already cancel under Ink.
     { name: '/cost', get description() { return costCommandDescription(); } },
-    { name: '/usage', description: USAGE_DESCRIPTION },
+    { name: '/usage', get description() { return usageCommandDescription(); } },
     { name: '/compact', description: 'Shrink a long session and keep the facts (later turns cost far less)' },
     { name: '/export', description: 'Export the signable session audit record — /export audit [filename]' },
     { name: '/context', description: 'Show what fills the model context window — a composition grid of bars' },

package/dist/repl/post-turn-status.js

@@ -21,7 +21,7 @@ import { computeCost } from '../cost/pricing.js';
 import { computeSessionCost } from '../cost/session-cost.js';
 import { globalStore } from '../ui/sap-state-store.js';
 import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
-import { globalCredits } from '../cost/credits.js';
+import { globalCredits, tokensOnlyActive } from '../cost/credits.js';
 import { printStatusFooter, formatStatusFooter } from '../renderer/status-footer.js';
 import { shouldUseInk } from '../renderer/tty.js';
 import { isUserPrompt } from '../session/user-prompt.js';
@@ -49,7 +49,8 @@ export function computeTurnFacts(session, snapshot, turnModel) {
     const userTurns = session.messages.filter(isUserPrompt).length;
     const lifetimeAfter = session.usage.input_tokens + session.usage.output_tokens;
     const turnTokens = Math.max(0, lifetimeAfter - (snapshot.input + snapshot.output));
-    const turnCost = computeCost(turnModel ?? session.model, {
+    // Azure: no price for the customer's deployment — never consult one.
+    const turnCost = tokensOnlyActive() ? 0 : computeCost(turnModel ?? session.model, {
         input: session.usage.input_tokens - snapshot.input,
         output: session.usage.output_tokens - snapshot.output,
         cacheRead: session.usage.cache_read_input_tokens - snapshot.cacheRead,

package/dist/repl/safety-confirm.js

@@ -29,6 +29,8 @@ const RULE_LABEL = {
     RULE_9_TRANSPORT_ISOLATION: 'RULE 9 — transport isolation',
     RULE_10_VERIFY_AFTER_WRITE: 'RULE 10 — verify after write',
     CREDENTIAL_HANDOVER: 'SAP login handed to a local process',
+    RISKY_COMMAND: 'risky command (known pattern)',
+    CREDENTIAL_FILE_READ: 'credential file read',
 };
 /** Piece 2 §5 — plain-words heading: what could go wrong. No rule codes, no tool names. */
 export const SAFETY_HEADING = {
@@ -39,6 +41,8 @@ export const SAFETY_HEADING = {
     RULE_9_TRANSPORT_ISOLATION: 'This change may land in a transport shared with other work',
     RULE_10_VERIFY_AFTER_WRITE: 'This change is not proven until it is checked',
     CREDENTIAL_HANDOVER: 'Your SAP login will be handed to a local program',
+    RISKY_COMMAND: 'This command matches a known risky pattern',
+    CREDENTIAL_FILE_READ: 'This reads a file that may hold passwords or keys',
 };
 /** Bottom-edge note: which rule is asking. */
 export const SAFETY_FOOTNOTE = {
@@ -49,6 +53,8 @@ export const SAFETY_FOOTNOTE = {
     RULE_9_TRANSPORT_ISOLATION: 'Forge Rule 9',
     RULE_10_VERIFY_AFTER_WRITE: 'Forge Rule 10',
     CREDENTIAL_HANDOVER: 'Credential handover',
+    RISKY_COMMAND: 'Risky command check',
+    CREDENTIAL_FILE_READ: 'Credential file check',
 };
 /** Rule 7 covers both overwrite and delete; the delete says so. */
 export function safetyHeading(a) {
@@ -103,8 +109,40 @@ function whatLabel(a) {
         return fallback;
     return toolActivityLabel(tool, args);
 }
+/** The risk gate's two rules — their subject is a model-written command or path. */
+function isRiskRule(a) {
+    return a.rule === 'RISKY_COMMAND' || a.rule === 'CREDENTIAL_FILE_READ';
+}
+/**
+ * Fix round 1 (F9) — the most of a risky command or path the card shows. A
+ * longer one shows its head and its tail with the hidden length between them
+ * (fix round 2, L2: a command padded past the cap cannot hide its target on
+ * the classic card, which has no scrollback copy). Ink also writes the whole
+ * text to scrollback first, like the Rule 8 summary. Never redacted.
+ */
+export const RISK_SUBJECT_MAX = 300;
+const RISK_SUBJECT_HEAD = 200;
+const RISK_SUBJECT_TAIL = 80;
+/** The subject as shown on a card: display-cleaned (F8), cut to head + tail past RISK_SUBJECT_MAX (F9, L2). */
+function riskSubject(name) {
+    const c = clean(name);
+    if (c.length <= RISK_SUBJECT_MAX)
+        return c;
+    const hidden = c.length - RISK_SUBJECT_HEAD - RISK_SUBJECT_TAIL;
+    return `${c.slice(0, RISK_SUBJECT_HEAD)} ${getGlyphs().more} (+${hidden} chars) ${c.slice(-RISK_SUBJECT_TAIL)}`;
+}
 /** What / Where / Undo rows (plain text; the card paints them dim). */
 export function safetyFacts(a) {
+    // Security batch item 4 — the risk gate's cards: the exact command or path,
+    // why it was flagged, and that it runs on this computer.
+    if (isRiskRule(a)) {
+        return [
+            `What   ${a.rule === 'RISKY_COMMAND' ? 'Run' : 'Read'} ${riskSubject(a.object.name)}`,
+            ...boundedWhatLines(whatLines(a)).map((t) => `       ${t}`),
+            'Where  this computer',
+            `Undo   ${a.rule === 'RISKY_COMMAND' ? 'Cannot be undone' : 'Once read, its text goes to the model'}`,
+        ];
+    }
     const what = a.rule === 'CREDENTIAL_HANDOVER'
         ? `Hand the SAP login for ${clean(a.object.name)} to a local program`
         : whatLabel(a);
@@ -162,6 +200,10 @@ async function confirmOnCards(action) {
         // The card keeps the header and the last lines; the whole text lands above it.
         emitTrace(what.join('\n'));
     }
+    if (isRiskRule(action) && clean(action.object.name).length > RISK_SUBJECT_MAX) {
+        // F9 — the card shows the cut; the whole (cleaned) command lands above it.
+        emitTrace(clean(action.object.name));
+    }
     const first = await askConfirm({
         id: 'safety-confirm',
         tag: release ? 'CANNOT BE UNDONE' : 'SAFETY CHECK',
@@ -260,14 +302,17 @@ function renderCard(action) {
     lines.push('');
     lines.push(`${chalk.yellow(getGlyphs().attention)}  ${chalk.yellow.bold(RULE_LABEL[action.rule])}`);
     lines.push(`   ${chalk.dim('op:       ')} ${action.op}`);
-    lines.push(`   ${chalk.dim('object:   ')} ${action.object.type} ${action.object.name}`);
+    // F8 — a risk card's subject is model-written: cleaned (no terminal escapes)
+    // and cut (F9). Other rules print exactly as before.
+    const risk = isRiskRule(action);
+    lines.push(`   ${chalk.dim('object:   ')} ${action.object.type} ${risk ? riskSubject(action.object.name) : action.object.name}`);
     lines.push(`   ${chalk.dim('transport:')} ${transport}`);
     if (action.rule === 'RULE_8_BATCH_PLAN' && typeof action.batch_count === 'number') {
         lines.push(`   ${chalk.dim('batch:    ')} ${action.batch_count} objects this turn`);
     }
     // what_will_happen may include embedded newlines (e.g. Rule 8 plan summary).
     // Indent the continuation lines so they align under the header field.
-    const whatLines = action.what_will_happen.split('\n');
+    const whatLines = risk ? action.what_will_happen.split('\n').map(clean) : action.what_will_happen.split('\n');
     if (whatLines.length === 1) {
         lines.push(`   ${chalk.dim('what:     ')} ${whatLines[0]}`);
     }

package/dist/repl/session-spend-line.js

@@ -6,9 +6,12 @@
  * credits existed: `  spend:     $1.37`.
  */
 import { formatCost } from '../cost/pricing.js';
-import { creditsActive, formatCredits, CREDITS_PENDING } from '../cost/credits.js';
+import { creditsActive, tokensOnlyActive, formatCredits, CREDITS_PENDING } from '../cost/credits.js';
+import { AZURE_INVOICE_LINE } from '../cost/display-mode.js';
 /** The spend VALUE in the current display mode (piece 2: goodbye block). */
 export function formatSessionSpendValue(sessionCostUsd, credits) {
+    if (tokensOnlyActive())
+        return AZURE_INVOICE_LINE;
     if (!creditsActive())
         return formatCost(sessionCostUsd);
     if (!credits)

package/dist/repl/startup-account.js

@@ -0,0 +1,51 @@
+import { formatFailure, formatInfo } from '../renderer/notice-shape.js';
+export async function runStartupAccount(deps, io) {
+    let licenceCheckedAtMs;
+    try {
+        const cfgEarly = await deps.loadConfig();
+        if (cfgEarly.llm.mode === 'managed') {
+            const authFile = await deps.readAuthFile();
+            const startupKey = authFile ? (await deps.resolveApiKey()).key : null;
+            if (authFile && startupKey) {
+                const meResult = await deps.fetchMe({ proxyUrl: cfgEarly.proxy_url, apiKey: startupKey });
+                if (!meResult.ok) {
+                    if (meResult.status === 401) {
+                        io.closeBrand();
+                        io.print(formatFailure({ what: 'Your CSPeach sign-in is no longer valid', next: 'cspeach login' }));
+                        return { exit: 1 };
+                    }
+                    io.notice(formatInfo(`Could not refresh your account (${meResult.error})`));
+                }
+                else {
+                    io.showProfile(meResult.profile);
+                }
+            }
+        }
+        else {
+            const { key: startupKey } = await deps.resolveApiKey();
+            if (startupKey) {
+                const licence = await deps.runLicenceCheck({ proxyUrl: cfgEarly.proxy_url, apiKey: startupKey }, { headers: await deps.licenceCheckHeaders(cfgEarly.llm.mode).catch(() => ({})) });
+                licenceCheckedAtMs = (deps.now ?? Date.now)();
+                if (!licence.allow) {
+                    io.closeBrand();
+                    io.print(licence.message);
+                    return { exit: 1 };
+                }
+                if (licence.verdict === 'unknown') {
+                    io.notice(formatInfo(licence.line));
+                }
+                else if (licence.profile) {
+                    io.showProfile(licence.profile);
+                }
+                if (licence.verdict === 'ok') {
+                    try {
+                        deps.startSkillsWarmup?.(cfgEarly, licence.verdict);
+                    }
+                    catch { /* never blocks start-up */ }
+                }
+            }
+        }
+    }
+    catch { /* banner is best-effort — never block REPL startup */ }
+    return licenceCheckedAtMs === undefined ? { exit: null } : { exit: null, licenceCheckedAtMs };
+}

package/dist/repl.js

@@ -27,7 +27,12 @@ import { applyResumedSkill, isShortFollowUp } from './router/resume-routing.js';
 import { readableInterruptReason, isUserStopReason } from './session/interrupt-reason.js';
 import { getStore } from './auth/api-key.js';
 import { readAuthFile } from './auth/auth-file.js';
+import { resolveApiKey } from './auth/key-resolver.js';
 import { fetchMe } from './auth/me.js';
+import { runLicenceCheck, licenceCheckHeaders } from './licence/licence-check.js';
+import { LicenceTurnGate } from './licence/turn-gate.js';
+import { runStartupAccount } from './repl/startup-account.js';
+import { startSkillsCacheWarmup } from './skills/source-authed.js';
 import { formatLoginBanner, signInFragment } from './ui/login-banner.js';
 import { printStartupBanner, printKeytarFallbackBanner, keychainFallbackNotice } from './renderer/banners.js';
 import { paint } from './renderer/theme.js';
@@ -39,15 +44,18 @@ import { AdtClient, snapshots } from '@cspeach/sap-client';
 import { makeSessionId, saveSession, sessionSaved } from './session/store.js';
 import { newSession } from './session/schema.js';
 import { resolveModelRole } from './models/resolve.js';
+import { familyOf, planTierModelFor, getActiveDeployments } from './models/model-identity.js';
 import { loadServerModelConfig, loadCustomerModelConfig, fetchToolLoadingMode } from './models/server-config.js';
 import { prefetchRouterPrompt } from './router/router-prompt.js';
+import { profileForMode } from './agent/connection-profile.js';
 import { repinResumedSessionModel } from './session/repin-model.js';
 import { computeCost } from './cost/pricing.js';
 import { formatSessionSpendValue } from './repl/session-spend-line.js';
 import { formatGoodbye } from './renderer/goodbye.js';
-import { globalCredits } from './cost/credits.js';
+import { globalCredits, tokensOnlyActive } from './cost/credits.js';
 import { initCredits } from './cost/credits-wire.js';
 import { createProviderForMode } from './agent/providers/factory.js';
+import { startUsageFlushAtStartup } from './usage/usage-reporter.js';
 import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
 import { IdleKeepalive } from './agent/cache-keepalive.js';
@@ -294,7 +302,8 @@ function existingStreamDir(sessionId) {
 }
 function printGoodbye(session) {
     const userTurns = session.messages.filter((m) => m.role === 'user' && typeof m.content === 'string').length;
-    const sessionCost = computeCost(session.model, {
+    // Azure: no price for the customer's deployment — never consult one.
+    const sessionCost = tokensOnlyActive() ? 0 : computeCost(session.model, {
         input: session.usage.input_tokens ?? 0,
         output: session.usage.output_tokens ?? 0,
         cacheRead: session.usage.cache_read_input_tokens ?? 0,
@@ -457,46 +466,51 @@ export async function runRepl(opts) {
         }
     }
     catch { /* startup banner is best-effort */ }
-    // Customer-onboarding (Task 9): if the new auth-file is present, hit /v1/me
-    // and render the verbose login banner. Falls through to the legacy keytar
-    // flow below when the file is absent (back-compat for pre-`cspeach login`
-    // users).
+    // Customer-onboarding (Task 9) + security batch item 1.
+    // Managed: today's call exactly — only when auth.json exists, the key is
+    // resolved only then, the same request, and a 401 exits. Falls through to the
+    // legacy keytar flow below when the file is absent (back-compat for
+    // pre-`cspeach login` users).
+    // byok / ai-hub / local: the shared licence check — server verdict, 72-hour
+    // offline grace, licence.json — whether or not auth.json exists. It IS this
+    // start-up /v1/me call (one request, the same 5 s budget), never a second one.
+    // The block lives in repl/startup-account.ts (behaviour-identical lift, driven
+    // by repl/__tests__/startup-account.test.ts).
     let signIn;
     let signedInAs;
-    try {
-        const authFile = await readAuthFile();
-        if (authFile) {
-            const cfgEarly = await loadConfig();
-            const meResult = await fetchMe({ proxyUrl: cfgEarly.proxy_url, apiKey: authFile.apiKey });
-            if (!meResult.ok) {
-                if (meResult.status === 401) {
-                    earlyBrand?.close();
-                    console.log(formatFailure({ what: 'Your CSPeach sign-in is no longer valid', next: 'cspeach login' }));
-                    return 1;
-                }
-                const note = formatInfo(`Could not refresh your account (${meResult.error})`);
-                if (getLook() === 'panels')
-                    startupNotices.push(note);
-                else
-                    console.log(note.trimEnd());
-            }
-            else {
-                signedInAs = meResult.profile.email;
-                const banner = formatLoginBanner(meResult.profile);
-                if (getLook() === 'panels') {
-                    signIn = signInFragment(meResult.profile);
-                    if (banner.warningLine)
-                        startupNotices.push(formatAttention({ text: banner.warningLine }));
-                }
-                else {
-                    console.log(banner.line);
-                    if (banner.warningLine)
-                        console.log(formatAttention({ text: banner.warningLine }).trimEnd());
-                }
-            }
+    const showProfile = (profile) => {
+        signedInAs = profile.email;
+        const banner = formatLoginBanner(profile);
+        if (getLook() === 'panels') {
+            signIn = signInFragment(profile);
+            if (banner.warningLine)
+                startupNotices.push(formatAttention({ text: banner.warningLine }));
         }
-    }
-    catch { /* banner is best-effort — never block REPL startup */ }
+        else {
+            console.log(banner.line);
+            if (banner.warningLine)
+                console.log(formatAttention({ text: banner.warningLine }).trimEnd());
+        }
+    };
+    const startupAccount = await runStartupAccount({
+        loadConfig, readAuthFile, resolveApiKey: () => resolveApiKey(), fetchMe, runLicenceCheck, licenceCheckHeaders,
+        // Final review finding 1 — fill the skills cache for offline use. Fire-and-forget.
+        startSkillsWarmup: (c, verdict) => { void startSkillsCacheWarmup(c, verdict); },
+    }, {
+        print: (line) => console.log(line),
+        notice: (note) => {
+            if (getLook() === 'panels')
+                startupNotices.push(note);
+            else
+                console.log(note.trimEnd());
+        },
+        showProfile,
+        closeBrand: () => earlyBrand?.close(),
+    });
+    if (startupAccount.exit === 1)
+        return 1;
+    // Read by the between-turns recheck (Task 6): the 4-hour clock starts here.
+    const licenceCheckedAtMs = startupAccount.licenceCheckedAtMs;
     earlyBrand?.finish(signIn);
     const store = await getStore();
     const keychainMissing = !(await store.isKeychainAvailable());
@@ -601,8 +615,55 @@ export async function runRepl(opts) {
         fetchToolLoadingMode(cfg, async () => apiKey ?? '', { timeoutMs: 1500 }),
         // 2026-10-02 — BYOK / ai-hub route on the laptop: prefetch the signed
         // router prompt (public manifest, no prompt data) under the same cap.
-        cfg.llm?.mode === 'byok' || cfg.llm?.mode === 'ai-hub' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
+        profileForMode(cfg.llm?.mode).router === 'direct' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
     ]);
+    // Azure tenant mode (Task 4) — the company's connection settings, before
+    // the session model is pinned (resolveModelRole reads the deployments).
+    // Cached connection.json, refreshed under the same 1.5 s cap; a changed
+    // endpoint is shown and asked about. A refusal is shown now and the gate
+    // refuses turns — never a fall-back to managed.
+    if (cfg.llm.mode === 'azure') {
+        const { refreshAzureConnection } = await import('./connection/startup.js');
+        const { confirm } = await import('./repl/themed-prompts.js');
+        const { askOrNo } = await import('./repl/ask-or-no.js');
+        const note = (line) => {
+            if (getLook() === 'panels')
+                startupNotices.push(line.endsWith('\n') ? line : `${line}\n`);
+            else
+                console.log(line.trimEnd());
+        };
+        // The "endpoint changed" rows must be on screen BEFORE the question, so
+        // they are held here and printed straight away when a question opens;
+        // anything left over joins the start-up notices.
+        const held = [];
+        const az = await refreshAzureConnection({
+            proxyUrl: cfg.proxy_url, apiKey: apiKey ?? null, interactive: true,
+            print: (line) => { held.push(line); },
+            confirm: async (message) => {
+                for (const line of held.splice(0))
+                    console.log(line.trimEnd());
+                // Ctrl+C here is a no (pending kept), never an unhandled ExitPromptError.
+                return askOrNo((m) => confirm({ message: m, default: false }))(message);
+            },
+        });
+        for (const line of held)
+            note(line);
+        if (!az.verdict.allow)
+            note(az.verdict.message);
+        else if (az.cached) {
+            // Task 6b — the Microsoft sign-in, before the first turn: asks first,
+            // then the browser. Esc / Ctrl+C during it stops it at once (the
+            // listener closes). Its own lines (the address to copy when no browser
+            // opens) print straight away, never held for after the sign-in.
+            const { azureSignInAtStart } = await import('./auth/azure/startup-sign-in.js');
+            const { loginOpener } = await import('./util/open-in-browser.js');
+            const s = await azureSignInAtStart(az.cached.connection, {
+                ask: askOrNo((message) => confirm({ message, default: true })), print: (line) => console.log(line.trimEnd()), open: loginOpener(),
+            });
+            if (!s.ok)
+                note(s.message);
+        }
+    }
     // Credits (2026-09-16) — resolve ONCE, before any cost figure can render.
     // A managed customer is billed in credits at a multiplier we do not
     // disclose, so the dollar figures (our Anthropic COGS) must never reach
@@ -815,6 +876,41 @@ export async function runRepl(opts) {
             throw new Error('No API key configured');
         return key;
     });
+    // Security batch item 1 — licence re-check between turns (byok / ai-hub /
+    // local, every 4 hours from the start-up check). Managed: never calls.
+    const licenceGate = new LicenceTurnGate({
+        mode: cfg.llm.mode,
+        proxyUrl: cfg.proxy_url,
+        getKey: async () => (await store.get()) ?? null,
+        // No start-up check ran (no key yet, e.g. pasted at the prompt below):
+        // non-managed checks on the very first turn. Managed never reads it.
+        lastCheckAtMs: licenceCheckedAtMs ?? (cfg.llm.mode === 'managed' ? Date.now() : -Infinity),
+        ...(cfg.llm.mode === 'azure' ? {
+            extra: async () => (await import('./connection/azure-gate.js')).azureGateCheck(),
+            // Plan D13 — never a prompt between turns (no inquirer inside the Ink
+            // UI): a changed endpoint or tenant is held as pending and the `extra`
+            // gate refuses with "…waiting for you to confirm it · start cspeach to
+            // review it". Nothing is printed here; the gate's refusal is the notice.
+            // So on this 4-hourly path the cache-write-failure line and the ignored
+            // env-override lines are dropped (they show again at the next start).
+            onRecheck: async () => {
+                const { refreshAzureConnection } = await import('./connection/startup.js');
+                await refreshAzureConnection({
+                    proxyUrl: cfg.proxy_url, apiKey: (await store.get()) ?? null, interactive: false,
+                    print: () => { }, confirm: async () => false,
+                });
+            },
+        } : {}),
+    });
+    // Security batch item 3 — send the usage counts still waiting from earlier
+    // runs. Non-managed only (a managed seat makes no call); fire-and-forget:
+    // never awaited, never throws into start-up.
+    if (cfg.llm.mode !== 'managed') {
+        try {
+            startUsageFlushAtStartup(cfg);
+        }
+        catch { /* best effort */ }
+    }
     // Task 15 — keep the prompt cache warm while the user is idle between
     // turns: armed after a turn, disarmed on the next submit and on exit;
     // `[keepalive] idle_pings` per idle period (managed / BYOK only).
@@ -1148,6 +1244,16 @@ export async function runRepl(opts) {
             // older turns via Haiku so subsequent turns ingest ~5k tokens of
             // context instead of 500k+. Saves \$3-8 per follow-up turn.
             if (trimmed === '/compact') {
+                // Security batch item 1 — /compact makes a model call: gated like a turn.
+                {
+                    const g = await licenceGate.beforeTurn();
+                    if (!g.allow) {
+                        chunkEmitter.emit('chunk', '\n' + g.message + '\n');
+                        return;
+                    }
+                    if (g.line)
+                        chunkEmitter.emit('chunk', formatInfo(g.line));
+                }
                 const { runCompact, formatCompactResult, buildSummarisationPrompt, serialiseForSummariser } = await import('./commands/compact.js');
                 const { summariseViaProvider } = await import('./agent/summarise-via-provider.js');
                 const { loadConfig } = await import('./config/loader.js');
@@ -1156,7 +1262,7 @@ export async function runRepl(opts) {
                     return await summariseViaProvider(provider, buildSummarisationPrompt(), serialiseForSummariser(toSummarise), 
                     // model-governance step 2d — compact model resolves env > local >
                     // server > built-in (== COMPACTION_MODEL when nothing set).
-                    { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' } });
+                    { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' }, sessionId: session.id });
                 };
                 try {
                     chunkEmitter.emit('chunk', '\n' + formatInfo('Compacting older turns into a summary…'));
@@ -1219,6 +1325,15 @@ export async function runRepl(opts) {
                 chunkEmitter.emit('chunk', '\n' + formatInfo(`Rerouting "${preview}" to /${rr.skill}`));
                 if (rr.warning)
                     chunkEmitter.emit('chunk', chalk.dim(`  (${rr.warning})\n`));
+                {
+                    const g = await licenceGate.beforeTurn();
+                    if (!g.allow) {
+                        chunkEmitter.emit('chunk', '\n' + g.message + '\n');
+                        return;
+                    }
+                    if (g.line)
+                        chunkEmitter.emit('chunk', formatInfo(g.line));
+                }
                 // Re-review 1 — its own AbortController, wired like the main path, so
                 // Ctrl+C and `/exit` stop a rerouted turn the same way.
                 const rerouteAbort = new AbortController();
@@ -1576,6 +1691,20 @@ export async function runRepl(opts) {
                 session.last_object = extractedObject ?? previousObject ?? null;
                 return;
             }
+            // Security batch item 1 — never mid-turn: checked here, before the turn
+            // and before any plan-resume work (run lease, object-list grant,
+            // re-audit, phase context, plan_in_flight). A plan step refused here
+            // never starts; the plan file keeps its state, so `/abap-plan --resume`
+            // continues later.
+            {
+                const g = await licenceGate.beforeTurn();
+                if (!g.allow) {
+                    chunkEmitter.emit('chunk', '\n' + g.message + '\n');
+                    return;
+                }
+                if (g.line)
+                    chunkEmitter.emit('chunk', formatInfo(g.line));
+            }
             // B3 (2026-06-06) — `/abap-plan --resume @plan-file`. Token-free
             // pre-work (load envelope, pick next eligible phase, print the
             // tracker board, inline the phase's rule files) happens in
@@ -1724,7 +1853,7 @@ export async function runRepl(opts) {
                     const { beginPlanPhaseContext, makePhaseBoundarySummariser } = await import('./commands/plan-boundary.js');
                     await beginPlanPhaseContext({
                         session,
-                        summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg)),
+                        summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg), session.id),
                         log: (line) => chunkEmitter.emit('chunk', line + '\n'),
                     });
                 }
@@ -1752,7 +1881,9 @@ export async function runRepl(opts) {
                         delegateTo: planResume.nextDelegateTo,
                         // model-governance step 2d — the session default now resolves
                         // env > local > server > built-in (== cfg.default_model when nothing set).
-                        defaultModel: resolveModelRole('session_default', cfg),
+                        defaultModel: familyOf(resolveModelRole('session_default', cfg), provider),
+                        // Azure tenant mode (Task 2) — undefined (today's Sonnet) with no connection table.
+                        tierModel: planTierModelFor(getActiveDeployments()),
                     });
                     if (choice.model) {
                         planModelOverride = choice.model;
@@ -2178,7 +2309,7 @@ export async function runRepl(opts) {
                         session,
                         config: { ...cfg.compact, auto_threshold_tokens: resolveAutoCompactThreshold(cfg) },
                         queued: pendingDispatchAccessor.get() !== null,
-                        summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg)),
+                        summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg), session.id),
                         emit: (line) => chunkEmitter.emit('chunk', line + '\n'),
                     });
                 }
@@ -3074,6 +3205,16 @@ export async function runRepl(opts) {
         // Summarises older turns via Haiku 4.5 so subsequent turns ingest ~5k
         // tokens of context instead of 500k+. Backs up session pre-mutation.
         if (trimmed === '/compact') {
+            // Security batch item 1 — /compact makes a model call: gated like a turn.
+            {
+                const g = await licenceGate.beforeTurn();
+                if (!g.allow) {
+                    console.log(g.message);
+                    continue;
+                }
+                if (g.line)
+                    console.log(formatInfo(g.line).trimEnd());
+            }
             const { runCompact, formatCompactResult, buildSummarisationPrompt, serialiseForSummariser } = await import('./commands/compact.js');
             const { summariseViaProvider } = await import('./agent/summarise-via-provider.js');
             const { loadConfig } = await import('./config/loader.js');
@@ -3082,7 +3223,7 @@ export async function runRepl(opts) {
                 return await summariseViaProvider(provider, buildSummarisationPrompt(), serialiseForSummariser(toSummarise), 
                 // model-governance step 2d — compact model resolves env > local >
                 // server > built-in (== COMPACTION_MODEL when nothing set).
-                { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' } });
+                { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' }, sessionId: session.id });
             };
             try {
                 console.log('\n' + formatInfo('Compacting older turns into a summary…').trimEnd());
@@ -3154,6 +3295,15 @@ export async function runRepl(opts) {
             console.log(formatInfo(`Rerouting "${preview}" to /${rr.skill}`).trimEnd());
             if (rr.warning)
                 console.log(chalk.dim(`  (${rr.warning})`));
+            {
+                const g = await licenceGate.beforeTurn();
+                if (!g.allow) {
+                    console.log(g.message);
+                    continue;
+                }
+                if (g.line)
+                    console.log(formatInfo(g.line).trimEnd());
+            }
             // A turn error prints the same stderr block as the normal turn path.
             await runRerouteTurn({
                 run: () => runTurn({
@@ -3574,6 +3724,17 @@ export async function runRepl(opts) {
             session.last_object = extractedObject ?? previousObject ?? null;
             continue;
         }
+        // Security batch item 1 — checked before the turn and before any
+        // plan-resume work (classic mirror of the Ink path).
+        {
+            const g = await licenceGate.beforeTurn();
+            if (!g.allow) {
+                console.log(g.message);
+                continue;
+            }
+            if (g.line)
+                console.log(formatInfo(g.line).trimEnd());
+        }
         // B3 (2026-06-06) — `/abap-plan --resume @plan-file` (classic-mode
         // mirror of the Ink path above; see that block for the full design
         // note). Token-free pre-work; terminal states end the turn with no
@@ -3700,7 +3861,7 @@ export async function runRepl(opts) {
                 const { beginPlanPhaseContext, makePhaseBoundarySummariser } = await import('./commands/plan-boundary.js');
                 await beginPlanPhaseContext({
                     session,
-                    summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg)),
+                    summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg), session.id),
                     log: (line) => console.log(line),
                 });
             }
@@ -3723,7 +3884,9 @@ export async function runRepl(opts) {
                     delegateTo: planResume.nextDelegateTo,
                     // model-governance step 2d — the session default now resolves
                     // env > local > server > built-in (== cfg.default_model when nothing set).
-                    defaultModel: resolveModelRole('session_default', cfg),
+                    defaultModel: familyOf(resolveModelRole('session_default', cfg), provider),
+                    // Azure tenant mode (Task 2) — undefined (today's Sonnet) with no connection table.
+                    tierModel: planTierModelFor(getActiveDeployments()),
                 });
                 if (choice.model) {
                     planModelOverride = choice.model;
@@ -4127,7 +4290,7 @@ export async function runRepl(opts) {
                     session,
                     config: { ...cfg.compact, auto_threshold_tokens: resolveAutoCompactThreshold(cfg) },
                     queued: pendingDispatchAccessor.get() !== null,
-                    summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg)),
+                    summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg), session.id),
                     emit: (line) => console.log(line),
                 });
             }