@cspeach/cli 1.1.33 → 1.1.35

package/dist/agent/providers/byok-provider.js

@@ -1,15 +1,15 @@
 import Anthropic from '@anthropic-ai/sdk';
 import keychain from '../../auth/keychain.js';
-import { createManifestSkillSource } from '../../skills/source-manifest.js';
-import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
+import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, modelAcceptsFallbacks, requiredBetas, requireSkillName, withoutInternalHeaders, withSkillPrompt } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
+import { BYOK_PROFILE } from '../connection-profile.js';
 const KEYCHAIN_SERVICE = 'cspeach.anthropic';
 const KEYCHAIN_ACCOUNT = 'api-key';
 // Cheapest Anthropic model available at doctor-probe time.
 const HEALTH_PROBE_MODEL = 'claude-haiku-4-6-latest';
-export function createByokProvider(_cfg) {
-    const skillSource = createManifestSkillSource(DEFAULT_MANIFEST_URL);
+export function createByokProvider(cfg, getBearer = defaultBearer) {
+    const skillSource = createAuthedSkillSource(cfg, getBearer);
     // Task 5 (ruling F3) — the loop's request is provider-neutral; BYOK talks to
     // the model directly, so it adds what the proxy adds for managed: preamble +
     // skill body as `system`, cache markers, and the betas matching the fields
@@ -19,11 +19,11 @@ export function createByokProvider(_cfg) {
         const skillName = requireSkillName(options, 'BYOK');
         const key = await getKey();
         // Task 18 — the `_reader` header uses the pinned reader prompt, no lookup.
-        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: true }, delegateSkillName(options));
+        const system = await systemPromptForSkill(skillName, skillSource, { cacheMarkers: BYOK_PROFILE.cacheMarkers }, delegateSkillName(options));
         // Task 6 — opt into server-side fallback, only for the families probe
         // P3 proved (allow-list); requiredBetas adds its beta.
-        const prompted = withSkillPrompt(params, system, { cacheMarkers: true });
-        const shaped = modelAcceptsFallbacks(params.model)
+        const prompted = withSkillPrompt(params, system, { cacheMarkers: BYOK_PROFILE.cacheMarkers });
+        const shaped = BYOK_PROFILE.serverFallbacks && modelAcceptsFallbacks(params.model)
             ? { ...prompted, fallbacks: 'default' }
             : prompted;
         const betas = requiredBetas(shaped);
@@ -34,6 +34,7 @@ export function createByokProvider(_cfg) {
     return {
         name: 'anthropic-byok',
         mode: 'byok',
+        profile: BYOK_PROFILE,
         skillSource,
         async createStream(params, options = {}) {
             const { sdk, body } = await shapeRequest(params, options);

package/dist/agent/providers/factory.js

@@ -2,12 +2,17 @@ import { createManagedProvider } from '../anthropic-provider.js';
 import { createByokProvider } from './byok-provider.js';
 import { createAiHubProvider } from './ai-hub-provider.js';
 import { createLocalProvider } from './local-provider.js';
+import { createAzureProvider } from './azure-provider.js';
 export function createProviderForMode(cfg, getBearer) {
     switch (cfg.llm.mode) {
         case 'managed': return createManagedProvider(cfg, getBearer);
-        case 'byok': return createByokProvider(cfg);
-        case 'ai-hub': return createAiHubProvider(cfg);
-        case 'local': return createLocalProvider(cfg);
+        // Security batch item 2 — the CSPeach bearer now reaches every mode: skill
+        // bodies come from the signed-in route.
+        case 'byok': return createByokProvider(cfg, getBearer);
+        case 'ai-hub': return createAiHubProvider(cfg, getBearer);
+        case 'local': return createLocalProvider(cfg, getBearer);
+        // Azure tenant mode — the company's own Foundry resource (Task 5a).
+        case 'azure': return createAzureProvider(cfg, getBearer);
         default: throw new Error(`unknown llm.mode: ${cfg.llm.mode}`);
     }
 }

package/dist/agent/providers/local-provider.js

@@ -1,28 +1,29 @@
 // Loaded on use (fix round 3, item 11e): only local mode needs the OpenAI SDK.
 const loadOpenAI = async () => (await import('openai')).default;
 import crypto from 'node:crypto';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex } from '@noble/hashes/utils';
-import { createBundledSkillSource } from '../../skills/source-bundled.js';
-import { BUNDLED_SKILLS } from '../../skills/bundled-skills.js';
+import { createAuthedSkillSource, defaultBearer } from '../../skills/source-authed.js';
 import { delegateSkillName, requireSkillName } from '../provider-shape.js';
 import { systemPromptForSkill } from '../system-prompt.js';
-export function createLocalProvider(cfg) {
+import { LOCAL_PROFILE } from '../connection-profile.js';
+export function createLocalProvider(cfg, getBearer = defaultBearer) {
     if (!cfg.llm.local_base_url) {
         throw new Error('local mode requires llm.local_base_url — run: cspeach config set llm.local_base_url http://localhost:11434/v1');
     }
     const baseURL = cfg.llm.local_base_url;
     const model = cfg.llm.local_model ?? 'llama3.1:70b';
-    const skillSource = createBundledSkillSource();
+    // Security batch item 2 — local follows the same rule as byok / ai-hub:
+    // sign in once, skills cached on disk, then offline within the 72-hour grace.
+    const skillSource = createAuthedSkillSource(cfg, getBearer);
     return {
         name: 'local-openai-compat',
         mode: 'local',
+        profile: LOCAL_PROFILE,
         skillSource,
         async createStream(params, options = {}) {
             if (params.tools && params.tools.length > 0) {
                 throw new Error('Tool calling not supported in local mode (Plan A). Switch to managed/byok/ai-hub, or wait for the local-mode tool-calling follow-up PR.');
             }
-            // Task 5 (ruling F3) — preamble + bundled skill body as the system
+            // Task 5 (ruling F3) — preamble + skill body as the system
             // message (no cache markers). anthropicParamsToOpenAI copies only
             // max_tokens / messages / system, so newer fields never reach the endpoint.
             const skillName = requireSkillName(options, 'Local');
@@ -49,24 +50,19 @@ export function createLocalProvider(cfg) {
             catch (e) {
                 return { ok: false, message: `Local endpoint unreachable: ${e.message}`, hint: `Is Ollama/vLLM running at ${baseURL}? Is ${model} loaded?` };
             }
-            const bundled = Object.entries(BUNDLED_SKILLS);
-            if (bundled.length === 0) {
-                return { ok: false, message: 'No skills bundled in this CLI build', hint: 'This CLI was built without running `npm run prebuild`. Rebuild from source or install the published CLI.' };
+            // Key presence only (no network): a signed-out seat cannot load skills.
+            const key = await getBearer().catch(() => '');
+            if (typeof key !== 'string' || key.trim() === '') {
+                return { ok: false, message: 'Local endpoint responding, but CSPeach is not signed in, so skills cannot be loaded.', hint: 'Run cspeach login once while online; skills are then kept on disk for offline use.' };
             }
-            const mismatches = [];
-            for (const [name, body] of bundled) {
-                const actual = bytesToHex(sha256(new TextEncoder().encode(body.body)));
-                if (actual !== body.sha256)
-                    mismatches.push(`${name} (manifest=${body.sha256}, actual=${actual})`);
+            let names;
+            try {
+                names = await skillSource.listAvailableSkills();
             }
-            if (mismatches.length > 0) {
-                return {
-                    ok: false,
-                    message: `bundled skill(s) sha256 mismatch: ${mismatches.join('; ')}`,
-                    hint: 'CLI binary may have been tampered with; reinstall from a trusted source.',
-                };
+            catch (e) {
+                return { ok: false, message: `Local endpoint responding, but skills could not be loaded: ${e.message}`, hint: 'Run cspeach login once while online; skills are then kept on disk for offline use.' };
             }
-            return { ok: true, message: `Local model ${model} at ${baseURL} responding; ${bundled.length} skills bundled (sha256 verified)` };
+            return { ok: true, message: `Local model ${model} at ${baseURL} responding; ${names.length} skills available to this signed-in seat` };
         },
     };
 }

package/dist/agent/risk-gate.js

@@ -0,0 +1,202 @@
+/**
+ * Security batch item 4 — a risk gate of its own, in tool-dispatch.ts. Plan
+ * approval, batch approval and auto-approve never skip it: it does not read
+ * any of them. Headless runs (one-shot, CI) decline, and say so (via
+ * presentSafetyConfirmation).
+ *
+ * Ruling F16: network tools (curl, wget, Invoke-WebRequest, nc …) get the card
+ * whether or not they are on the shell allow-list. The gate runs before the
+ * tool's own allow-list check, so a network tool a user has added asks first,
+ * and one that is not on the list asks first and is then refused by the tool.
+ *
+ * Fix round 1: background_run is gated like shell_exec (F1); npm/pnpm
+ * run-anything subcommands and npx are flagged as wrappers (F3); node's
+ * `--import data:` (F4) and git's command-running subcommands (F5) are
+ * flagged; git is left out of the deploy/publish word rule (F6); node's
+ * options end at the script (F7). grep and glob skip credential files
+ * instead of asking (F2) — stricter than a card, a deliberate choice.
+ *
+ * Fix round 2: the npm/pnpm subcommand is found cautiously, past any word
+ * that could be an option's value (N1); git's long-option prefixes and short
+ * bundles (`--exe`, `-ix`) are read (N2); a git subcommand named deploy or
+ * publish is flagged again (L1).
+ *
+ * Honest limit: these are argv rules. `npm run <script>`, `npx` and
+ * `node <file>` running model-written code can get past them. Site copy says
+ * "known risky patterns".
+ */
+import path from 'node:path';
+import { BLOCKED_BASENAME_RE } from '../tools/_filesystem-shared.js';
+const NETWORK_TOOLS = new Set(['curl', 'wget', 'invoke-webrequest', 'iwr', 'nc', 'ncat', 'netcat']);
+const NODE_EVAL_FLAGS = new Set(['-e', '--eval', '-p', '--print']);
+/** git global options that take a separate value (skipped when finding the subcommand). */
+const GIT_VALUE_OPTIONS = new Set(['-C', '--git-dir', '--work-tree', '--namespace']);
+/** npm / pnpm subcommands that run any program, or download and run a package (F3). */
+const RUN_ANY_SUBCOMMANDS = new Set(['exec', 'x', 'dlx', 'explore']);
+const CREDENTIAL_BASENAMES = new Set(['.git-credentials', '.npmrc']);
+const CREDENTIAL_EXTS = new Set(['.pem', '.key']);
+export const FILE_READ_TOOLS = new Set(['file_read', 'read_document']);
+/**
+ * The bare program name, as Windows would resolve it: surrounding whitespace
+ * and quotes dropped, any folder dropped (either slash), lower-cased, and a
+ * Windows program extension dropped. Display uses the command as given.
+ */
+const commandName = (cmd) => path.basename(cmd.trim().replace(/^["']+|["']+$/g, '').trim().replace(/\\/g, '/'))
+    .toLowerCase()
+    .replace(/\.(exe|cmd|bat|ps1)$/, '');
+/** Show an arg with whitespace (or an empty arg) quoted, so the card reads as the argv it is (fix round 1, F9). Never redacted. */
+const showArg = (a) => (a.length === 0 || /\s/.test(a) ? JSON.stringify(a) : a);
+/**
+ * node runs inline code: `-e`/`--eval`/`-p`/`--print` (any spelling), or an
+ * `--import`/`--loader`/`--experimental-loader` whose value is a `data:` URL.
+ * Only node's own options count: scanning stops at `--` and at the script
+ * (the first positional that cannot be the value of the option before it),
+ * so the script's own args (`node build.js -prod`) are not read (F7, F4).
+ */
+function nodeRunsInlineCode(args) {
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === '--')
+            return false;
+        if (!a.startsWith('-') || a === '-') {
+            const prev = i > 0 ? args[i - 1] : undefined;
+            // The script — unless it may be the value of a dash option before it.
+            if (prev === undefined || !prev.startsWith('-') || prev.includes('='))
+                return false;
+            continue;
+        }
+        if (NODE_EVAL_FLAGS.has(a) || /^--(eval|print)=/.test(a) || /^-[a-z]*[ep][a-z]*$/i.test(a))
+            return true;
+        const m = /^--(import|loader|experimental-loader)(?:=(.*))?$/.exec(a);
+        if (m) {
+            const v = m[2] ?? args[i + 1];
+            if (typeof v === 'string' && /^\s*data:/i.test(v))
+                return true;
+        }
+    }
+    return false;
+}
+/** git subcommands (after the global options) that run a command string (F5). */
+function gitRunsCommand(sub, rest) {
+    switch (sub) {
+        // Fix round 2 (N2): git takes any unambiguous prefix of a long option
+        // (`--ex`, `--exe`) and bundled short options (`-ix`). A lowercase x in a
+        // short bundle is --exec; capital -X is the merge-strategy option.
+        case 'rebase':
+            return rest.some((a) => /^-[a-z]*x/.test(a) || /^--ex(e(c)?)?(=|$)/.test(a));
+        case 'bisect':
+            return rest[0] === 'run';
+        case 'submodule':
+            return rest.includes('foreach');
+        case 'filter-branch':
+            return true;
+        case 'difftool':
+        case 'mergetool':
+            // difftool has no other long option starting with `e`, so `--e` is enough.
+            return rest.some((a) => /^-[a-z]*x/.test(a) || /^--e(x(t(c(m(d)?)?)?)?)?(=|$)/.test(a));
+        default:
+            return false;
+    }
+}
+/**
+ * Fix round 2 (N1) — npm / pnpm's subcommand, read cautiously. Any option
+ * that is not a boolean takes the next word as its value (`--loglevel
+ * silent`, `--cache c`, `--reporter silent` …), and no hand-kept list can
+ * name them all. So every positional that could be the value of the dash
+ * option before it is a candidate, and the walk stops at the first positional
+ * that cannot be a value: the definite subcommand. Returns every candidate up
+ * to and including it (and the word after `--`). Extra card, never a miss:
+ * a value literally named `exec`/`x`/`dlx`/`explore` is flagged too.
+ */
+function packageManagerSubcommands(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === '--') {
+            if (args[i + 1] !== undefined)
+                out.push(args[i + 1]);
+            break;
+        }
+        if (a.startsWith('-'))
+            continue;
+        out.push(a);
+        const prev = i > 0 ? args[i - 1] : undefined;
+        if (prev === undefined || !prev.startsWith('-') || prev.includes('='))
+            break;
+    }
+    return out.map((s) => s.toLowerCase());
+}
+export function shellRisk(command, args) {
+    const cmd = commandName(command);
+    const subject = [command, ...args].map(showArg).join(' ');
+    const flag = (reason) => ({ kind: 'command', subject, reason });
+    if (cmd === 'node' && nodeRunsInlineCode(args)) {
+        return flag('runs code given on the command line');
+    }
+    if (cmd === 'git') {
+        let i = 0;
+        for (; i < args.length && args[i].startsWith('-'); i++) {
+            const a = args[i];
+            if (a === '-c' || /^-c./.test(a) || a.startsWith('--config-env'))
+                return flag('overrides git settings for this command');
+            if (GIT_VALUE_OPTIONS.has(a))
+                i++;
+        }
+        if (args[i] === 'config')
+            return flag('changes git settings');
+        if (gitRunsCommand(args[i], args.slice(i + 1)))
+            return flag('runs a command through git');
+        // Fix round 2 (L1) — a git subcommand named deploy / publish (a user's
+        // alias or a git-publish program). Only the subcommand position: file
+        // names, messages and branch names stay quiet (F6).
+        if (/deploy|publish/i.test(args[i] ?? ''))
+            return flag('deploys or publishes');
+    }
+    // F3 — the wrapper itself is flagged; the wrapped command is not parsed
+    // (`npm exec -c "<shell string>"` cannot be read reliably).
+    if (cmd === 'npx' || ((cmd === 'npm' || cmd === 'pnpm') && packageManagerSubcommands(args).some((s) => RUN_ANY_SUBCOMMANDS.has(s)))) {
+        return flag('runs a program through npm/pnpm');
+    }
+    if (NETWORK_TOOLS.has(cmd))
+        return flag('can send data to or fetch from the network');
+    // F6 — not git: `git add ui5-deploy.yaml` or a branch named for a publish
+    // cannot deploy anything (git's upload is `push`, an honest limit).
+    if (cmd !== 'git' && [command, ...args].some((a) => /deploy|publish/i.test(a)))
+        return flag('deploys or publishes');
+    return null;
+}
+export function credentialFileRisk(p) {
+    if (typeof p !== 'string' || p.length === 0)
+        return null;
+    // Windows spellings that open the same file: `.npmrc.`, `.npmrc `, `.npmrc::$DATA`.
+    const base = path.posix.basename(p.replace(/\\/g, '/')).split(':')[0].replace(/[. ]+$/, '').toLowerCase();
+    const flag = (reason) => ({ kind: 'credential-file', subject: p, reason });
+    if (CREDENTIAL_BASENAMES.has(base))
+        return flag('this file usually holds a password or token');
+    if (base.startsWith('.env') && !BLOCKED_BASENAME_RE.test(base))
+        return flag('environment files often hold passwords or keys');
+    if (CREDENTIAL_EXTS.has(path.posix.extname(base)))
+        return flag('certificate and key files can hold private keys');
+    return null;
+}
+/**
+ * grep and glob skip credential files (fix round 1, F2): a card cannot be
+ * shown mid-walk for a file the model did not name, so they are left out and
+ * this one line says so. file_read still reads one, with the card.
+ */
+export function credentialSkipNote(n) {
+    return `... (${n} credential file${n === 1 ? '' : 's'} skipped: .npmrc, .git-credentials, .env*, *.pem, *.key — use file_read, which asks the user first)`;
+}
+export function riskOf(tool, args) {
+    // background_run (category 'subagent') runs the same allow-listed commands
+    // with the same {command, args} — fix round 1, F1.
+    if (tool.category === 'shell' || tool.name === 'background_run') {
+        if (typeof args?.command !== 'string')
+            return null;
+        const argv = Array.isArray(args?.args) ? args.args.filter((a) => typeof a === 'string') : [];
+        return shellRisk(args.command, argv);
+    }
+    if (FILE_READ_TOOLS.has(tool.name))
+        return credentialFileRisk(args?.path);
+    return null;
+}

package/dist/agent/summarise-via-provider.js

@@ -13,6 +13,8 @@
  * NOT for tool-using calls. NOT for thinking-enabled calls. Pure text-in /
  * text-out.
  */
+import { profileOf } from './connection-profile.js';
+import { familyOf } from '../models/model-identity.js';
 /**
  * Run a single non-streaming summarisation call.
  *
@@ -37,20 +39,65 @@ export async function summariseViaProvider(provider, system, user, opts) {
             : opts.headers,
         signal: opts.signal,
     });
+    // Final fix wave B — in azure mode a compaction call is counted like any
+    // other azure call (usage record + local limit count). Every other mode
+    // reports nothing from here, as before.
+    const azure = profileOf(provider).modelIdentity === 'deployment';
+    const usage = { started: false, id: undefined, input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+    const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
     let accumulated = '';
-    for await (const event of stream) {
-        const type = event?.type;
-        if (type === 'content_block_delta') {
-            const delta = event.delta;
-            if (delta?.type === 'text_delta' && typeof delta.text === 'string') {
-                accumulated += delta.text;
+    try {
+        for await (const event of stream) {
+            const type = event?.type;
+            if (type === 'content_block_delta') {
+                const delta = event.delta;
+                if (delta?.type === 'text_delta' && typeof delta.text === 'string') {
+                    accumulated += delta.text;
+                }
             }
+            else if (azure && type === 'message_start') {
+                const u = event.message?.usage ?? {};
+                usage.started = true;
+                if (typeof event.message?.id === 'string' && event.message.id)
+                    usage.id = event.message.id;
+                usage.input = num(u.input_tokens);
+                usage.cacheRead = num(u.cache_read_input_tokens);
+                usage.cacheWrite = num(u.cache_creation_input_tokens);
+                usage.output = num(u.output_tokens);
+            }
+            else if (azure && type === 'message_delta') {
+                // output_tokens on message_delta is the running total for the message.
+                usage.output = Math.max(usage.output, num(event.usage?.output_tokens));
+            }
+            // Ignore everything else — message_stop etc.
         }
-        // Ignore everything else — message_start/stop, usage events, etc.
-        // For one-shot text summarisation only content_block_delta matters.
+    }
+    finally {
+        if (azure && usage.started)
+            await reportCompactionUsage(provider, opts, usage);
     }
     if (!accumulated || accumulated.trim().length === 0) {
         throw new Error('Summariser returned empty output.');
     }
     return accumulated;
 }
+/** Fire-and-forget, never throws: usage counts are best effort. */
+async function reportCompactionUsage(provider, opts, u) {
+    try {
+        const { reportCallUsage } = await import('../usage/usage-reporter.js');
+        void reportCallUsage({
+            mode: 'azure',
+            requestId: u.id,
+            skill: opts.headers?.['X-CSForge-Skill'] ?? 'compact',
+            // The family of the deployment the call went to (the small one for compaction).
+            model: familyOf(opts.model, provider),
+            input: u.input,
+            output: u.output,
+            cacheRead: u.cacheRead,
+            cacheWrite: u.cacheWrite,
+            sessionId: opts.sessionId ?? '',
+            started: true,
+        }).catch(() => { });
+    }
+    catch { /* best effort */ }
+}

package/dist/agent/tool-dispatch.js

@@ -8,6 +8,7 @@ import { presentSafetyConfirmation } from '../repl/safety-confirm.js';
 import { shouldGateRule8, recordWriteOp, renderPlanSummary, getWriteOpsThisTurn, } from '../repl/rule8-detector.js';
 import { isCredentialHandoverApproved, markCredentialHandoverApproved, } from '../repl/credential-handover-gate.js';
 import { READER_TOOLS } from '../tools/subagent/reader-prompt.js';
+import { riskOf } from './risk-gate.js';
 const READER_TOOL_SET = new Set(READER_TOOLS);
 export async function dispatchTool(name, args, ctx) {
     const tool = getTool(name);
@@ -68,6 +69,24 @@ export async function dispatchTool(name, args, ctx) {
             return declined(r);
         markCredentialHandoverApproved(sessionId, handover.alias, handover.scope);
     }
+    // Security batch item 4 — the risk gate. Its own check, on every call:
+    // plan approval, batch approval and auto-approve do not skip it. Known risky
+    // shell patterns and reads of credential files ask every time; headless runs
+    // decline (presentSafetyConfirmation) and the refusal goes back to the model.
+    const risk = riskOf(tool, args);
+    if (risk) {
+        const r = await presentSafetyConfirmation({
+            rule: risk.kind === 'command' ? 'RISKY_COMMAND' : 'CREDENTIAL_FILE_READ',
+            op: tool.name,
+            object: { type: risk.kind === 'command' ? 'command' : 'file', name: risk.subject },
+            what_will_happen: `Flagged: ${risk.reason}`,
+            rollback_available: false,
+            transport: '',
+            args,
+        });
+        if (!r.confirmed)
+            return declined(r);
+    }
     // Rule 8 — no batch without plan. 2nd+ mutating call this turn requires
     // explicit confirmation. Fires regardless of /safety-mode toggle (batch
     // detection is unconditional per Plan 3 §6.6).

package/dist/agent/turn-error-ux.js

@@ -21,6 +21,8 @@ import { promises as fs } from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { TurnStreamWriter } from './turn-stream.js';
+import { azureSignInTurnLine } from '../connection/azure-turn-error.js';
+import { azureErrorNotice, azureErrorContext } from '../connection/azure-errors.js';
 export function logsRoot() {
     return path.join(os.homedir(), '.cspeach', 'logs');
 }
@@ -204,6 +206,26 @@ export async function renderTurnError(input) {
         print('');
         return;
     }
+    // Azure tenant mode (Task 6b) — the Microsoft sign-in ended (or the key is
+    // gone) mid-turn: the plain line and the command that fixes it, never a
+    // browser or a question here.
+    const azure = azureSignInTurnLine(input.err);
+    if (azure) {
+        printBlock(print, formatFailure(azure));
+        print('');
+        return;
+    }
+    // Azure tenant mode (Task 7) — the plain messages for the customer's own
+    // Azure (null unless azure settings are active or the error is an azure
+    // refusal, so every other mode is unchanged). A refusal the SDK wrapped as
+    // "Connection error." is unwrapped here (ruling 4).
+    const az = azureErrorNotice(input.err, azureErrorContext());
+    if (az) {
+        await writeErrorLog(id, input.err);
+        printBlock(print, 'preformatted' in az ? az.preformatted : formatFailure({ what: az.what, detail: [`Session: ${id}`], next: az.next }));
+        print('');
+        return;
+    }
     const reason = describeError(input.err);
     const logPath = await writeErrorLog(id, input.err);
     const detail = [reason, `Session: ${id}`];

package/dist/auth/api-key.js

@@ -1,12 +1,16 @@
 import keychain, { newProbeAccount } from './keychain.js';
+import { resolveApiKey, keychainAccountForHome, recordStoreWrite } from './key-resolver.js';
 const SERVICE = 'cspeach';
-const ACCOUNT = 'api-key';
 class KeychainStore {
     /** One probe per store: repeat checks (repl.tsx) reuse the first answer. */
     available;
-    async get() { return keychain.getPassword(SERVICE, ACCOUNT); }
-    async set(key) { await keychain.setPassword(SERVICE, ACCOUNT, key); }
-    async delete() { await keychain.deletePassword(SERVICE, ACCOUNT); }
+    /** Security batch item 6 — the one resolver: this home's account first, then auth.json. */
+    async get() { return (await resolveApiKey()).key; }
+    async set(key) {
+        await keychain.setPassword(SERVICE, keychainAccountForHome(), key);
+        await recordStoreWrite().catch(() => { });
+    }
+    async delete() { await keychain.deletePassword(SERVICE, keychainAccountForHome()); }
     isKeychainAvailable() {
         this.available ??= this.probe();
         return this.available;
@@ -32,7 +36,8 @@ class KeychainStore {
 }
 class EphemeralStore {
     cached = null;
-    async get() { return this.cached; }
+    /** No credential store: a key typed this session, else auth.json (the fallback). */
+    async get() { return this.cached ?? (await resolveApiKey()).key; }
     async set(key) { this.cached = key; }
     async delete() { this.cached = null; }
     async isKeychainAvailable() { return false; }

package/dist/auth/auth-file.js

@@ -19,6 +19,7 @@
  */
 import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
+import { randomBytes } from 'node:crypto';
 import { cspeachRoot } from '../config/paths.js';
 let pathOverride = null;
 /** Test-only override; pass null to reset. */
@@ -32,9 +33,14 @@ export async function readAuthFile() {
     try {
         const raw = await fs.readFile(authFilePath(), 'utf-8');
         const parsed = JSON.parse(raw);
-        if (typeof parsed.apiKey !== 'string' || typeof parsed.customerId !== 'string')
+        if (typeof parsed.customerId !== 'string')
             return null;
-        return { apiKey: parsed.apiKey, customerId: parsed.customerId };
+        const out = { customerId: parsed.customerId };
+        if (typeof parsed.apiKey === 'string' && parsed.apiKey.trim() !== '')
+            out.apiKey = parsed.apiKey;
+        if (typeof parsed.savedAt === 'string')
+            out.savedAt = parsed.savedAt;
+        return out;
     }
     catch {
         return null;
@@ -43,10 +49,27 @@ export async function readAuthFile() {
 export async function writeAuthFile(auth) {
     const p = authFilePath();
     await fs.mkdir(path.dirname(p), { recursive: true });
-    // Only the two known fields — never a secret a caller passes along by mistake.
-    const body = { apiKey: auth.apiKey, customerId: auth.customerId };
+    // Only the known fields — never a secret a caller passes along by mistake.
+    const body = {
+        ...(auth.apiKey !== undefined ? { apiKey: auth.apiKey } : {}),
+        customerId: auth.customerId,
+        ...(auth.savedAt !== undefined ? { savedAt: auth.savedAt } : {}),
+    };
     await writeAtomic0600(p, JSON.stringify(body, null, 2));
 }
+/** auth.json's modification time, or null when there is no file. */
+export async function authFileMtimeMs() {
+    try {
+        return (await fs.stat(authFilePath())).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+/** The folder auth.json lives in (the CSPeach home, or a test override's folder). */
+export function authFileDir() {
+    return path.dirname(authFilePath());
+}
 /** Rename errors that mean "the target is open elsewhere" (Windows), worth retrying. */
 const LOCK_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
 /** Backoff between rename attempts (5 tries in all). */
@@ -63,7 +86,9 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
  * The temp file holds the API key, so it is always removed.
  */
 async function writeAtomic0600(p, text) {
-    const tmp = `${p}.${process.pid}.tmp`;
+    // Unique per write (security batch fix round 1): two writes in one process
+    // never share a temp file. Still matches cleanStaleAuthTemps' auth.json.*.tmp.
+    const tmp = `${p}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
     try {
         await fs.writeFile(tmp, text, { encoding: 'utf-8', mode: 0o600 });
         // Defensive: re-chmod in case the create-time mode was ignored (e.g., umask 022).
@@ -129,11 +154,15 @@ export async function cleanStaleAuthTemps() {
     }
     catch { /* no ~/.cspeach yet */ }
 }
+/** Remove auth.json. True when it is gone (or was never there); false when the unlink failed. */
 export async function deleteAuthFile() {
     try {
         await fs.unlink(authFilePath());
+        return true;
+    }
+    catch (err) {
+        return err.code === 'ENOENT';
     }
-    catch { /* ignore */ }
 }
 /** The BYOK key's keychain entry — the same one byok-provider.ts reads and login writes. */
 const BYOK_KEYCHAIN_SERVICE = 'cspeach.anthropic';

package/dist/auth/azure/azure-key.js

@@ -0,0 +1,21 @@
+/**
+ * Azure tenant mode — the admin-issued Azure key fallback, in the OS
+ * credential store: service cspeach.azure, account api-key[:<home hash>]
+ * (the same per-home rule as the CSPeach key, key-resolver.ts). Allowed only
+ * when the company's settings list `key` as a sign-in method.
+ */
+import keychain from '../keychain.js';
+import { keychainAccountForHome } from '../key-resolver.js';
+export const AZURE_SERVICE = 'cspeach.azure';
+export function azureAccountForHome(prefix, home, defaultHome) {
+    return keychainAccountForHome(home, defaultHome).replace(/^api-key/, prefix);
+}
+export async function getAzureKey() {
+    return keychain.getPassword(AZURE_SERVICE, azureAccountForHome('api-key'));
+}
+export async function setAzureKey(key) {
+    await keychain.setPassword(AZURE_SERVICE, azureAccountForHome('api-key'), key);
+}
+export async function deleteAzureKey() {
+    return keychain.deletePassword(AZURE_SERVICE, azureAccountForHome('api-key'));
+}