@cspeach/cli 1.1.33 → 1.1.35

package/dist/agent/anthropic-provider.js

@@ -10,6 +10,7 @@ import Anthropic from '@anthropic-ai/sdk';
 import { getDeviceFingerprint } from '../auth/device.js';
 import { createManagedSkillSource } from '../skills/source-managed.js';
 import { CLI_VERSION } from '../lib/version.js';
+import { MANAGED_PROFILE } from './connection-profile.js';
 export function createManagedProvider(cfg, getBearer) {
     const skillSource = createManagedSkillSource(cfg, getBearer);
     // Headers every managed request carries (the real call and the keepalive
@@ -28,6 +29,7 @@ export function createManagedProvider(cfg, getBearer) {
     return {
         name: 'anthropic-managed',
         mode: 'managed',
+        profile: MANAGED_PROFILE,
         skillSource,
         async createStream(params, options = {}) {
             const sdk = new Anthropic({

package/dist/agent/azure-profile.js

@@ -0,0 +1,7 @@
+export const AZURE_PROFILE_V0 = Object.freeze({
+    id: 'azure', shaping: 'direct', cacheMarkers: true, betas: Object.freeze([]), serverFallbacks: false,
+    blockBinding: 'off', toolChanges: false, deferredTools: 'static', effort: 'main-only',
+    structuredOutputs: true, keepalive: false, stripInternalHeaders: 'all', servedConfig: 'none', router: 'direct',
+    adoptServedModel: false, modelIdentity: 'deployment',
+});
+export const AZURE_PROFILE = AZURE_PROFILE_V0;

package/dist/agent/connection-profile.js

@@ -0,0 +1,49 @@
+import { AZURE_PROFILE } from './azure-profile.js';
+export const MANAGED_PROFILE = Object.freeze({
+    id: 'managed', shaping: 'proxy', cacheMarkers: false, betas: Object.freeze(['compact-2026-01-12']), serverFallbacks: false,
+    blockBinding: 'allow-list-when-proxy-serves', toolChanges: true, deferredTools: 'served', effort: 'all',
+    structuredOutputs: true, keepalive: true, stripInternalHeaders: 'none', servedConfig: 'full', router: 'proxy',
+    adoptServedModel: true, modelIdentity: 'model-id',
+});
+export const BYOK_PROFILE = Object.freeze({
+    id: 'byok', shaping: 'direct', cacheMarkers: true, betas: Object.freeze(['compact-2026-01-12']), serverFallbacks: true,
+    blockBinding: 'allow-list', toolChanges: true, deferredTools: 'served', effort: 'all',
+    structuredOutputs: true, keepalive: true, stripInternalHeaders: 'all', servedConfig: 'router-only', router: 'direct',
+    adoptServedModel: false, modelIdentity: 'model-id',
+});
+export const AI_HUB_PROFILE = Object.freeze({
+    id: 'ai-hub', shaping: 'legacy', cacheMarkers: false, betas: Object.freeze([]), serverFallbacks: false,
+    blockBinding: 'allow-list', toolChanges: false, deferredTools: 'static', effort: 'all',
+    structuredOutputs: false, keepalive: false, stripInternalHeaders: 'role-only', servedConfig: 'none', router: 'direct',
+    adoptServedModel: false, modelIdentity: 'model-id',
+});
+export const LOCAL_PROFILE = Object.freeze({
+    id: 'local', shaping: 'openai', cacheMarkers: false, betas: Object.freeze([]), serverFallbacks: false,
+    blockBinding: 'allow-list', toolChanges: false, deferredTools: 'static', effort: 'all',
+    structuredOutputs: false, keepalive: false, stripInternalHeaders: 'all', servedConfig: 'none', router: 'local-rules',
+    adoptServedModel: false, modelIdentity: 'model-id',
+});
+/** Test fakes and undefined modes: today's fall-through behaviour at every call site. */
+export const UNKNOWN_PROFILE = Object.freeze({
+    id: 'unknown', shaping: 'direct', cacheMarkers: false, betas: Object.freeze([]), serverFallbacks: false,
+    blockBinding: 'allow-list', toolChanges: false, deferredTools: 'env-only', effort: 'all',
+    structuredOutputs: false, keepalive: false, stripInternalHeaders: 'all', servedConfig: 'none', router: 'proxy',
+    adoptServedModel: false, modelIdentity: 'model-id',
+});
+const BY_MODE = new Map([
+    ['managed', MANAGED_PROFILE], ['byok', BYOK_PROFILE], ['ai-hub', AI_HUB_PROFILE], ['local', LOCAL_PROFILE],
+    ['azure', AZURE_PROFILE],
+]);
+export function profileForMode(mode) {
+    return (mode !== undefined && BY_MODE.get(mode)) || UNKNOWN_PROFILE;
+}
+/** The provider's own profile, else the one its mode names (plan D2). */
+export function profileOf(p) {
+    return p.profile ?? profileForMode(p.mode);
+}
+/** Whether the loop may send output_config.effort on a call with this role. */
+export function sendsEffortFor(profile, role) {
+    if (profile.effort === 'off')
+        return false;
+    return profile.effort === 'all' || (role ?? 'session_default') === 'session_default';
+}

package/dist/agent/loop.js

@@ -8,6 +8,7 @@ import { recordCompletedToolCall } from '../session/pending.js';
 import { loadConfig } from '../config/loader.js';
 import { resolveModelRole, resolveEffort, modelAcceptsEffort, resolveAutoCompactThreshold, callModelFor } from '../models/resolve.js';
 import { getCustomerModelConfig, managedProxyServesNewShapes, servedToolLoading } from '../models/server-config.js';
+import { familyOf, familyAcceptsEffort } from '../models/model-identity.js';
 import { buildToolList, buildSkillToolAddition, placeSystemMessagesInPlace, resolveToolLoading, } from '../tools/tool-loading.js';
 import { settleSessionToolLoading } from './tool-loading-pin.js';
 import { resolveSkillAlias } from '../skill-catalog.js';
@@ -29,8 +30,10 @@ import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
 // (progress-chatter import removed 2026-05-01 — superseded by CC-style
 //  two-line dispatch renderer; re-add if a future in-place spinner returns)
 import { buildRetryCapPausePayload, buildSkippedSiblingResults } from './retry-cap.js';
+import { reportCallUsage } from '../usage/usage-reporter.js';
 import { appendCostLine, buildEntry as buildCostEntry, perCallTokens, summariseInputTransformations } from '../cost/cost-log.js';
-import { modelAcceptsBinding, sessionMaxTokens, clampMaxTokens } from './provider-shape.js';
+import { sessionMaxTokens, clampMaxTokens, sendsBlockBinding } from './provider-shape.js';
+import { profileOf, sendsEffortFor } from './connection-profile.js';
 import { computeSessionCost } from '../cost/session-cost.js';
 import { refreshCreditsAfterTurn, creditsForCostLog, beginCreditsRequest } from '../cost/credits-wire.js';
 import { globalStore } from '../ui/sap-state-store.js';
@@ -224,50 +227,140 @@ export async function inkAwareConfirm(q, opts) {
     return 'n';
 }
 /**
- * Choices picker for an answer-blocker that carries `options`. Renders the
- * native Ink AskCard (the same CC-style picker the ask_question tool
- * uses) with the candidate answers plus "Write my own" and "Skip" escapes.
+ * The picker for one spec-gap blocker (Task 3, 2026-10-12). It asks through
+ * the normal question path: a one-question v2 form, the same shape the
+ * ask_question tool sends, drawn by AskCard.
  *
- * - headless  → skip (never blocks on stdin)
- * - classic (non-Ink) → 'write' so the caller falls back to the free-text box
- * - Ink → choice/multi modal; Esc or empty selection → skip
+ * - "Blocker 2 of 4" on the card frame's top edge (Task 4); the question is the bare text
+ * - Ctrl+C on the card → { kind: 'stop' }: the remaining blockers are not asked
+ * - options show in sentence case (the stored answer keeps the words as
+ *   written), then a plain "Skip for now" option; the card's own inline
+ *   "Type something else…" row takes a typed answer, so no second text card
+ * - a blocker with no options is a free-text form question (Esc skips)
+ * - asked under the card-slot focus claim; one scrollback line per answer
+ *   ("Blocker 2 of 4 → <answer>"), so answered blockers stay on screen
+ * - headless → skip (never blocks); classic (non-Ink) → 'write' (free text)
  *
- * The two sentinels are filtered out of any real picked answer; for multi-select
- * the modal returns comma-joined values, so Write/Skip win over any co-selected
- * options.
+ * Option values are index ids (o0, o1…) so an option with a comma survives a
+ * multi-select answer (comma-joined values).
  */
-const CHOOSE_WRITE = '__cspeach_write__';
 const CHOOSE_SKIP = '__cspeach_skip__';
+const SKIP_LABEL = 'Skip for now';
+const SKIP_DESCRIPTION = 'Stays open. Answer it later at cspeach.dev/edit.';
+const SKIPPED_TRACE = 'skipped for now';
+const STOPPED_TRACE = 'stopped';
+/**
+ * A first word that is a name, not prose (Task 4, m1): it holds _ / digits /
+ * a slash (zcl_foo, s4hk903359, zfin/pkg), is all capitals (ZTEST_LAS, ERDAT)
+ * or has a capital after its first letter (eTag). Such a word is never recased.
+ */
+const Z_Y_ENGLISH = new Set(['yes', 'you', 'your', 'yours', 'yet', 'year', 'years', 'yearly', 'yield', 'zero', 'zone', 'zones', 'zoom']);
+function looksLikeIdentifier(word) {
+    if (/[_\d/]/.test(word))
+        return true;
+    // A Z/Y customer-namespace name (zfin, ytools) unless it is a common English word.
+    if (/^[zy][a-z0-9_]{2,}$/i.test(word) && !Z_Y_ENGLISH.has(word.toLowerCase()))
+        return true;
+    if (/[A-Z]/.test(word.slice(1)))
+        return true;
+    return word.length > 1 && /[A-Z]/.test(word) && word === word.toUpperCase();
+}
+/** First letter upper case when it is a lower-case letter; the rest as written. Identifiers stay as written. */
+function sentenceCase(label) {
+    const first = label.charAt(0);
+    if (first === first.toUpperCase())
+        return label;
+    if (looksLikeIdentifier(label.split(/\s/, 1)[0] ?? ''))
+        return label;
+    return first.toUpperCase() + label.slice(1);
+}
 export async function inkAwareChoose(a) {
     const { shouldUseInk, isHeadless } = await import('../renderer/tty.js');
     if (isHeadless())
         return { kind: 'skip' };
     if (!shouldUseInk())
         return { kind: 'write' }; // classic REPL → free-text fallback
-    const choices = [
-        ...a.options.map((o) => ({ value: o, label: o })),
-        { value: CHOOSE_WRITE, label: '✏️  Write my own…' },
-        { value: CHOOSE_SKIP, label: '↷  Skip (leave for the viewer)' },
+    const header = `Blocker ${a.index + 1} of ${a.total}`;
+    const freeText = a.options.length === 0;
+    const options = freeText ? [] : [
+        ...a.options.map((o, i) => ({ value: `o${i}`, label: sentenceCase(o) })),
+        { value: CHOOSE_SKIP, label: SKIP_LABEL, description: SKIP_DESCRIPTION },
     ];
     const { askQuestionEmitter } = await import('../ui/ask-question-emitter.js');
-    const res = await askQuestionEmitter.request({
-        id: 'answer-blocker',
-        question: `Blocker ${a.index + 1}/${a.total}: ${a.question}`,
-        context: a.multiSelect ? 'Space to toggle one or more · Enter to submit' : undefined,
-        kind: a.multiSelect ? 'multi' : 'choice',
-        choices,
-    });
-    if (res.cancelled || res.answer == null)
+    const { withFocusClaim } = await import('../ui/card-slot.js');
+    const { emitTrace, formatAnswerTrace } = await import('../renderer/trace.js');
+    const { uiWidth } = await import('../renderer/ui-width.js');
+    let stopped = false;
+    const res = await withFocusClaim(() => askQuestionEmitter.requestForm({
+        formId: 'answer-blocker',
+        // Task 4 (m4): the counter sits on the frame's top edge.
+        frameHeader: header,
+        // Task 4 (m2): Ctrl+C stops the remaining blocker cards.
+        onInterrupt: () => { stopped = true; },
+        questions: [{
+                id: 'answer-blocker',
+                question: a.question,
+                ...(freeText ? { context: 'Esc skips it for now' } : {}),
+                header,
+                multiSelect: !freeText && a.multiSelect,
+                freeText,
+                options,
+            }],
+    }));
+    const skip = () => {
+        emitTrace(formatAnswerTrace(header, SKIPPED_TRACE, uiWidth()));
         return { kind: 'skip' };
-    const values = res.answer.split(',');
-    if (values.includes(CHOOSE_WRITE))
-        return { kind: 'write' };
-    if (values.includes(CHOOSE_SKIP))
-        return { kind: 'skip' };
-    const real = values.filter((v) => v !== CHOOSE_WRITE && v !== CHOOSE_SKIP);
-    if (real.length === 0)
-        return { kind: 'skip' };
-    return { kind: 'picked', answer: real.join(', ') };
+    };
+    if (stopped) {
+        emitTrace(formatAnswerTrace(header, STOPPED_TRACE, uiWidth()));
+        return { kind: 'stop' };
+    }
+    const ans = res.cancelled ? undefined : res.answers[0];
+    if (!ans || ans.answer == null)
+        return skip();
+    let answer;
+    let shown;
+    if (freeText) {
+        answer = ans.answer.trim();
+        shown = answer;
+    }
+    else if (ans.custom) {
+        // Task 4 (m3): a multi-select typed answer arrives as the ticked labels
+        // (in option order), then the typed words. The labels go back to the
+        // options as written; a ticked "Skip for now" gives way to the answer.
+        let rest = ans.answer.trim();
+        const parts = [];
+        const shownParts = [];
+        if (a.multiSelect) {
+            for (const o of options) {
+                if (!rest.startsWith(`${o.label}, `))
+                    continue;
+                rest = rest.slice(o.label.length + 2);
+                const i = /^o(\d+)$/.exec(o.value);
+                if (i) {
+                    parts.push(a.options[Number(i[1])]);
+                    shownParts.push(o.label);
+                }
+            }
+        }
+        answer = [...parts, rest].join(', ');
+        shown = [...shownParts, rest].join(', ');
+    }
+    else {
+        const values = ans.answer.split(',');
+        if (values.includes(CHOOSE_SKIP))
+            return skip();
+        const picked = values
+            .map((v) => /^o(\d+)$/.exec(v))
+            .map((m) => (m ? a.options[Number(m[1])] : undefined))
+            .filter((o) => o !== undefined);
+        answer = picked.join(', ');
+        shown = picked.map(sentenceCase).join(', ');
+    }
+    if (answer.length === 0)
+        return skip();
+    emitTrace(formatAnswerTrace(header, shown, uiWidth()));
+    return { kind: 'picked', answer };
 }
 export async function maybeOfferSave(p) {
     if (p.assistantText.trim().length === 0)
@@ -822,9 +915,12 @@ ${imageExpansion.error}`));
     // Standalone hides the SAP tools (toolsForContext); the agent_run
     // read-only filter (toolFilter) applies before the split, so a filtered-out
     // tool is neither loaded nor deferred (cannot be found by search either).
+    // Azure tenant mode (Task 1) — this connection's wire capabilities.
+    const profile = profileOf(params.provider);
     session.tool_set_skill ??= params.skill;
     const toolLoadingMode = resolveToolLoading({
         providerMode: params.provider.mode,
+        profile,
         env: process.env,
         served: servedToolLoading(),
     });
@@ -849,7 +945,7 @@ ${imageExpansion.error}`));
     // fetch, a model off the allow-list) has its deferred shapes stripped ONCE
     // (a deliberate rewrite like /compact) and is re-pinned static.
     const callToolMode = (model) => {
-        const settled = settleSessionToolLoading(session, { resolved: toolLoadingMode, model });
+        const settled = settleSessionToolLoading(session, { resolved: toolLoadingMode, model: familyOf(model, params.provider) });
         if (settled.stripped > 0) {
             emit(chalk.dim('(this session now sends the full tool list — earlier tool-search steps were removed from the conversation)'));
         }
@@ -1040,6 +1136,9 @@ ${imageExpansion.error}`));
                 // Final review C1/I2 + N1 (b) — the turn's mode, settled at turn
                 // start (any one-time deferred → static strip ran there).
                 const model = sentModel();
+                // Azure tenant mode (Task 2) — capability lookups take the FAMILY;
+                // `model` stays the wire name. Identity for every other connection.
+                const family = familyOf(model, params.provider);
                 const tools = turnTools;
                 // Bug 11a (proactive heal, 2026-06-07) — strip any residual
                 // `partial_json` from tool_use blocks on EVERY outgoing request.
@@ -1088,7 +1187,11 @@ ${imageExpansion.error}`));
                 // Task 4 — effort only from an explicit act (ruling F2); never to a
                 // model that rejects it (probe P1: claude-haiku-4-5* ⇒ 400).
                 const effort = params.effortOverride ?? resolveEffort(cfg);
-                const sendEffort = effort !== undefined && modelAcceptsEffort(model);
+                // Azure tenant mode (Task 5a) — deployment connections use the
+                // effort ALLOW-list: an unknown deployment name maps to itself and
+                // would pass the deny-list. Model-id connections are unchanged.
+                const familyTakesEffort = profile.modelIdentity === 'deployment' ? familyAcceptsEffort(family) : modelAcceptsEffort(family);
+                const sendEffort = effort !== undefined && familyTakesEffort && sendsEffortFor(profile, params.modelRole);
                 const streamParams = {
                     // A4 — per-turn override (plan model tiering) wins over the
                     // session model; absent on every non-plan turn. Task 3 (2026-09-27)
@@ -1116,7 +1219,7 @@ ${imageExpansion.error}`));
                     // I1 (2026-09-28) — clamped to the sent model's output ceiling:
                     // an agent_run child asks for 100000, which an enforced
                     // sonnet/haiku model rejects with a 400.
-                    max_tokens: clampMaxTokens(model, params.maxTokensOverride ?? sessionMaxTokens(model)),
+                    max_tokens: clampMaxTokens(family, params.maxTokensOverride ?? sessionMaxTokens(family)),
                     messages: session.messages,
                     tools,
                     // Task 7 — preserved thinking. Opus 5.5 binds each thinking block
@@ -1125,9 +1228,10 @@ ${imageExpansion.error}`));
                     // input_transformations) instead of rejecting the request. Only to
                     // the families probe P4 proved (allow-list, dated ids stripped).
                     // Task 21 fix round (controller ruling) — on the managed path only
-                    // when the proxy serves tool_loading (an old proxy adds no binding
+                    // when the proxy serves tool_loading — the managed profile's
+                    // 'allow-list-when-proxy-serves' rule (an old proxy adds no binding
                     // beta); BYOK adds its own beta; AI-hub/local strip the field.
-                    thinking: modelAcceptsBinding(model) && (params.provider.mode !== 'managed' || managedProxyServesNewShapes())
+                    thinking: sendsBlockBinding(profile, family, managedProxyServesNewShapes)
                         ? { type: 'adaptive', display: 'summarized', block_binding: { prefix_mismatch_behavior: 'drop_block' } }
                         : { type: 'adaptive', display: 'summarized' },
                     ...(sendEffort ? { output_config: { effort } } : {}),
@@ -1208,6 +1312,10 @@ ${imageExpansion.error}`));
         // reported in `message_start` (may differ from the requested id).
         const callIndex = roundIndex++;
         let lastServedModel;
+        // Security batch item 3 — this call's provider message id (usage request id).
+        let lastMessageId;
+        // F2 — a call that never saw message_start ran nothing: no usage record.
+        let sawMessageStart = false;
         // 2026-09-27 — blocks whose content_block_stop arrived. A thinking block
         // not in here was cut mid-stream and must never be persisted.
         const completedBlocks = new WeakSet();
@@ -1345,6 +1453,12 @@ ${imageExpansion.error}`));
                     const servedModel = event.message?.model;
                     if (typeof servedModel === 'string' && servedModel)
                         lastServedModel = servedModel;
+                    // Security batch item 3 — the provider's message id becomes the usage
+                    // record's request id (the server drops resends by it).
+                    sawMessageStart = true;
+                    const messageId = event.message?.id;
+                    if (typeof messageId === 'string' && messageId)
+                        lastMessageId = messageId;
                     // Task 7 — present only when the binding beta was sent; [] when
                     // nothing was dropped (summarised to undefined ⇒ no cost-line key).
                     inputTransformations = summariseInputTransformations(event.message?.input_transformations);
@@ -1471,7 +1585,7 @@ ${imageExpansion.error}`));
         // unpriced. Never on a per-turn override, and never on a message carrying
         // a `fallback` block (a refusal fallback must not pin the fallback model
         // for the rest of the session). Otherwise the served id is only logged.
-        if (params.provider.mode === 'managed'
+        if (profile.adoptServedModel
             && !params.modelOverride
             && typeof lastServedModel === 'string'
             && lastServedModel
@@ -1594,6 +1708,35 @@ ${imageExpansion.error}`));
             });
             readerCallsLogged = params.ctx.readerSpend?.calls ?? 0;
             void appendCostLine(session.id, entry);
+            // Security batch item 3 — usage counts for byok / ai-hub / local (the
+            // proxy counts managed, so a managed turn never reaches the reporter:
+            // no config read, no file, no network). Counts only; fire-and-forget;
+            // a sync throw or a rejection is swallowed so the turn never notices.
+            if (params.provider.mode !== 'managed') {
+                try {
+                    void reportCallUsage({
+                        mode: params.provider.mode,
+                        requestId: lastMessageId,
+                        skill: params.skill,
+                        // Azure tenant mode (Task 5a) — the usage `model` is the FAMILY of
+                        // the deployment this call was sent to (spec "Usage reporter and
+                        // licence"). Not the served id: Foundry's message_start model
+                        // string is unknown until the probe and may be a dated id, which
+                        // familyOf would return unchanged. Every other mode keeps today's
+                        // expression byte for byte.
+                        model: profile.modelIdentity === 'deployment'
+                            ? familyOf(params.modelOverride ?? session.model, params.provider)
+                            : (lastServedModel ?? params.modelOverride ?? session.model),
+                        input: callTokens.input,
+                        output: callTokens.output,
+                        cacheRead: callTokens.cacheRead,
+                        cacheWrite: callTokens.cacheCreate,
+                        sessionId: session.id,
+                        started: sawMessageStart,
+                    }).catch(() => { });
+                }
+                catch { /* usage counts are best effort */ }
+            }
         }
         // Close the stream-to-disk mirror with a footer (lightweight diagnostics).
         // Best-effort — failure here is invisible to the turn flow. Awaited
@@ -1779,7 +1922,7 @@ ${imageExpansion.error}`));
                         summarise: async (toSummarise) => summariseViaProvider(params.provider, buildSummarisationPrompt(), serialiseForSummariser(toSummarise), 
                         // model-governance step 2d — compact model resolves env > local >
                         // server > built-in (== COMPACTION_MODEL when nothing set).
-                        { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' } }),
+                        { model: resolveModelRole('compact', cfg), maxTokens: 4000, headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' }, sessionId: session.id }),
                     });
                 }
                 catch (err) {

package/dist/agent/provider-shape.js

@@ -36,6 +36,19 @@ export const BINDING_MODELS = new Set([
 export function modelAcceptsBinding(model) {
     return BINDING_MODELS.has(model.trim().toLowerCase().replace(/-\d{8}$/, ''));
 }
+/**
+ * Azure tenant mode, Task 1 — whether the loop adds thinking.block_binding,
+ * read from the connection profile. Managed: allow-list AND the proxy serves
+ * the new shapes (an old proxy adds no binding beta). The callback is only
+ * called for that rule.
+ */
+export function sendsBlockBinding(profile, model, proxyServesNewShapes) {
+    switch (profile.blockBinding) {
+        case 'off': return false;
+        case 'allow-list': return modelAcceptsBinding(model);
+        case 'allow-list-when-proxy-serves': return modelAcceptsBinding(model) && proxyServesNewShapes();
+    }
+}
 /**
  * Task 8 (ruling F5, spec D9) — ALLOW-list of the families probe P2 proved
  * accept `max_tokens: 65536` (claude-opus-5, claude-opus-5-5). Same matching
@@ -222,6 +235,21 @@ export function toLegacyShape(params) {
     }
     return out;
 }
+/**
+ * Azure tenant mode, Task 5a — for a connection whose profile says
+ * `toolChanges: false`: deferred tools load in full, the tool search entry
+ * and `role: 'system'` tool_addition messages (and server tool blocks) are
+ * removed. Unlike toLegacyShape it keeps every other field, so cache markers
+ * added afterwards (withSkillPrompt) still apply. Never mutates the input.
+ */
+export function withoutToolChanges(params) {
+    const out = { ...params };
+    if (Array.isArray(params.tools))
+        out.tools = legacyTools(params.tools);
+    if (Array.isArray(params.messages))
+        out.messages = legacyMessages(params.messages);
+    return out;
+}
 /**
  * Task 9 (Task 5 carry) — headers only our proxy understands. On a direct
  * path (BYOK talks to the public API) they would leak CSPeach plumbing to a
@@ -251,6 +279,14 @@ export function withoutRoleHeader(headers) {
     }
     return out;
 }
+/** Azure tenant mode, Task 5a — the headers a profile lets leave the laptop. */
+export function headersForProfile(profile, headers) {
+    switch (profile.stripInternalHeaders) {
+        case 'all': return withoutInternalHeaders(headers);
+        case 'role-only': return withoutRoleHeader(headers);
+        case 'none': return { ...(headers ?? {}) };
+    }
+}
 /** 2026-10-04 — the plan phase's delegate skill, when the loop sent one. */
 export function delegateSkillName(options) {
     const v = options.headers?.[DELEGATE_SKILL_HEADER];

package/dist/agent/providers/ai-hub-provider.js

@@ -1,21 +1,22 @@
 import Anthropic from '@anthropic-ai/sdk';
 import keychain from '../../auth/keychain.js';
-import { createManifestSkillSource } from '../../skills/source-manifest.js';
-import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
+import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, requireSkillName, toLegacyShape, withoutRoleHeader } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
+import { AI_HUB_PROFILE } from '../connection-profile.js';
 const KEYCHAIN_SERVICE = 'cspeach.ai-hub';
 const KEYCHAIN_ACCOUNT = 'token';
-export function createAiHubProvider(cfg) {
+export function createAiHubProvider(cfg, getBearer = defaultBearer) {
     if (!cfg.llm.ai_hub_base_url) {
         throw new Error('ai-hub mode requires llm.ai_hub_base_url — run: cspeach config set llm.ai_hub_base_url <url>');
     }
     const baseURL = cfg.llm.ai_hub_base_url;
     const modelAlias = cfg.llm.ai_hub_model_alias ?? 'anthropic--claude-opus-4-6';
-    const skillSource = createManifestSkillSource(DEFAULT_MANIFEST_URL);
+    const skillSource = createAuthedSkillSource(cfg, getBearer);
     return {
         name: 'sap-ai-hub',
         mode: 'ai-hub',
+        profile: AI_HUB_PROFILE,
         skillSource,
         async createStream(params, options = {}) {
             // Task 5 (ruling F3) — AI-hub keeps today's field set only (newer
@@ -25,7 +26,7 @@ export function createAiHubProvider(cfg) {
             const skillName = requireSkillName(options, 'AI Hub');
             const token = await getToken();
             // Task 18 — the `_reader` header uses the pinned reader prompt, no lookup.
-            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: false }, delegateSkillName(options));
+            const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: AI_HUB_PROFILE.cacheMarkers }, delegateSkillName(options));
             const request = {
                 ...toLegacyShape(params),
                 system,

package/dist/agent/providers/azure-provider.js

@@ -0,0 +1,125 @@
+/**
+ * Azure tenant mode — the customer's own Microsoft Foundry resource. The
+ * request goes straight from the laptop to
+ * https://<resource>.services.ai.azure.com/anthropic/v1/messages with an
+ * Entra token or the company's Azure key; our service never sees it.
+ *
+ * Every wire choice is read from the connection profile (v0 until the probe,
+ * azure-profile.ts): cache markers, betas, block binding, tool changes,
+ * effort (main role only, and only for a family on the effort allow-list),
+ * keepalive and which internal headers are stripped. Fallbacks are always
+ * dropped (Foundry has none). The host guard runs before any client exists
+ * and again on every request URL (the guarded fetch in azure-auth.ts).
+ */
+import Anthropic from '@anthropic-ai/sdk';
+import { sendsEffortFor } from '../connection-profile.js';
+import { AZURE_PROFILE } from '../azure-profile.js';
+import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
+import { delegateSkillName, headersForProfile, requireSkillName, withoutToolChanges, withSkillPrompt } from '../provider-shape.js';
+import { systemPromptForSkill } from '../system-prompt.js';
+import { familyAcceptsEffort, familyFromTable } from '../../models/model-identity.js';
+import { getActiveConnection } from '../../connection/cache.js';
+import { azureTurnVerdict, AzureConnectionRefusedError } from '../../connection/state.js';
+import { azureSdkOptions, selectAzureAuth } from '../../connection/azure-auth.js';
+import { noteAzureCall } from '../../connection/azure-last-call.js';
+const ROLE_HEADER = 'x-cspeach-model-role';
+/** The role header, whatever its case (the same rule as withoutRoleHeader in provider-shape.ts). */
+function roleOf(headers) {
+    for (const [k, v] of Object.entries(headers ?? {}))
+        if (k.toLowerCase() === ROLE_HEADER)
+            return v;
+    return undefined;
+}
+export function shapeForAzure(p, profile) {
+    const out = { ...p };
+    delete out.fallbacks;
+    if (profile.blockBinding === 'off' && out.thinking?.block_binding) {
+        const { block_binding: _drop, ...thinking } = out.thinking;
+        out.thinking = thinking;
+    }
+    return out;
+}
+/** Effort only on the roles the profile allows, and only to a family known to accept it (never an unknown deployment). */
+function withAzureEffort(p, profile, role, family) {
+    if (p.output_config === undefined)
+        return p;
+    if (sendsEffortFor(profile, role) && familyAcceptsEffort(family))
+        return p;
+    // Drop only effort; any other output_config field (e.g. format) stays.
+    const { output_config, ...rest } = p;
+    const { effort: _drop, ...others } = output_config;
+    return Object.keys(others).length > 0 ? { ...rest, output_config: others } : rest;
+}
+export function createAzureProvider(cfg, getBearer = defaultBearer, deps = {}) {
+    const profile = deps.profile ?? AZURE_PROFILE;
+    if (profile.shaping !== 'direct')
+        throw new Error(`The azure provider shapes requests itself (direct); profile says ${profile.shaping}.`);
+    const skillSource = createAuthedSkillSource(cfg, getBearer);
+    const current = () => (deps.connection ?? getActiveConnection)();
+    const authFor = deps.auth ?? ((c) => selectAzureAuth(c));
+    async function shapeRequest(params, options) {
+        const cached = current();
+        const v = azureTurnVerdict(cached);
+        if (!v.allow)
+            throw new AzureConnectionRefusedError(v.message);
+        const conn = cached.connection;
+        const skillName = requireSkillName(options, 'Azure');
+        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: profile.cacheMarkers }, delegateSkillName(options));
+        const base = profile.toolChanges ? params : withoutToolChanges(params);
+        const family = familyFromTable(params.model, conn.deployments);
+        const body = withAzureEffort(shapeForAzure(withSkillPrompt(base, system, { cacheMarkers: profile.cacheMarkers }), profile), profile, roleOf(options.headers), family);
+        // The guard runs inside azureSdkOptions, before any client exists, and
+        // its fetch re-checks every real request URL.
+        const authProvider = await authFor(conn);
+        const auth = await authProvider.getAuth();
+        const sdk = new Anthropic({ ...azureSdkOptions(conn.endpoint, auth), defaultHeaders: headersForProfile(profile, options.headers) });
+        noteAzureCall(params.model, authProvider.method);
+        return { sdk, body };
+    }
+    const withBetas = (body) => (profile.betas.length > 0 ? { ...body, betas: [...profile.betas] } : body);
+    const provider = {
+        name: 'azure-foundry',
+        mode: 'azure',
+        profile,
+        skillSource,
+        modelFamily: (wire) => familyFromTable(wire, current()?.connection.deployments ?? null),
+        async createStream(params, options = {}) {
+            const { sdk, body } = await shapeRequest(params, options);
+            const opts = options.signal ? { signal: options.signal } : undefined;
+            return profile.betas.length > 0
+                ? sdk.beta.messages.stream(withBetas(body), opts)
+                : sdk.messages.stream(body, opts);
+        },
+        async healthCheck() {
+            const cached = current();
+            if (!azureTurnVerdict(cached).allow)
+                return { ok: false, message: "Your company's Azure settings are not ready on this machine", hint: 'cspeach login' };
+            try {
+                await (await authFor(cached.connection)).getAuth();
+            }
+            catch (e) {
+                return { ok: false, message: e?.message ?? 'Azure sign-in failed', hint: cached.connection.sign_in.includes('entra') ? 'cspeach login azure' : 'cspeach config set llm.azure_key -' };
+            }
+            try {
+                await skillSource.listAvailableSkills();
+            }
+            catch (e) {
+                return { ok: false, message: `Azure sign-in ok, but skills could not be loaded: ${e.message}`, hint: 'cspeach login' };
+            }
+            return { ok: true, message: `Azure settings ok (${cached.connection.endpoint}) · deployments are checked below` };
+        },
+    };
+    if (profile.keepalive) {
+        // Same shaped body as createStream, max_tokens 0, no stream, no retries.
+        provider.keepalive = async (params, options = {}) => {
+            const { sdk, body } = await shapeRequest(params, options);
+            const ping = { ...withBetas(body), max_tokens: 0 };
+            const opts = { maxRetries: 0, timeout: 20_000 };
+            if (profile.betas.length > 0)
+                await sdk.beta.messages.create(ping, opts);
+            else
+                await sdk.messages.create(ping, opts);
+        };
+    }
+    return provider;
+}