@cspeach/cli 1.1.33 → 1.1.35

package/dist/auth/me.js

@@ -18,20 +18,26 @@ export async function fetchMe(opts) {
     try {
         return await Promise.race([
             (async () => {
-                const r = await fetch(url, { headers: { Authorization: `Bearer ${opts.apiKey}` }, signal });
+                // No extra headers → exactly `{ Authorization }`, as before the batch.
+                const r = await fetch(url, { headers: { ...(opts.headers ?? {}), Authorization: `Bearer ${opts.apiKey}` }, signal });
+                const serverDate = r.headers.get('date');
                 if (!r.ok) {
                     const body = await r.json().catch(() => ({}));
-                    return { ok: false, status: r.status, error: body.error ?? 'unknown' };
+                    return {
+                        ok: false, status: r.status, error: body?.error ?? 'unknown',
+                        ...(typeof body?.reason === 'string' ? { reason: body.reason } : {}),
+                        serverDate,
+                    };
                 }
                 const profile = await r.json();
-                return { ok: true, profile };
+                return { ok: true, profile, serverDate };
             })(),
             timedOut,
         ]);
     }
     catch (err) {
         if (signal.aborted)
-            return { ok: false, status: 0, error: `timed out after ${timeoutMs} ms` };
-        return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err) };
+            return { ok: false, status: 0, error: `timed out after ${timeoutMs} ms`, serverDate: null };
+        return { ok: false, status: 0, error: err instanceof Error ? err.message : String(err), serverDate: null };
     }
 }

package/dist/cli.js

@@ -27,6 +27,15 @@ export async function main(argv) {
     const legacyNotice = legacyByokKeyNotice(await migrateLegacyByokKey().catch(() => 'failed'));
     if (legacyNotice)
         console.error(legacyNotice);
+    // Security batch item 6 — move the CSPeach key from auth.json into this
+    // home's OS credential store entry (copy → read back → only then remove).
+    // Once; idempotent; one notice when it cannot.
+    {
+        const { migrateSignIn, signInMigrationNotice } = await import('./auth/key-resolver.js');
+        const notice = signInMigrationNotice(await migrateSignIn().catch(() => 'failed'));
+        if (notice)
+            console.error(notice);
+    }
     let args = argv.slice(2);
     // Standalone mode (2026-09-16) — `--no-sap` is accepted ANYWHERE in the args
     // for both the REPL and one-shot, and stripped like `--sap-alias` below.
@@ -162,6 +171,14 @@ export async function main(argv) {
         const { runDoctor } = await import('./doctor/run.js');
         return runDoctor();
     }
+    // Azure tenant mode (Task 6b) — the Microsoft sign-in alone, with the
+    // company settings already on this machine. Same opener as `cspeach login`:
+    // no shell, the authorize URL (full of &) as one argument.
+    if (args[0] === 'login' && args[1] === 'azure') {
+        const { runLoginAzureCommand } = await import('./commands/login-azure.js');
+        const { loginOpener } = await import('./util/open-in-browser.js');
+        return runLoginAzureCommand({ deviceCode: args.includes('--device-code'), print: (s) => console.log(s), open: loginOpener() });
+    }
     if (args[0] === 'login') {
         const { runLoginCommand } = await import('./commands/login.js');
         const { input } = await import('@inquirer/prompts');
@@ -176,6 +193,7 @@ export async function main(argv) {
             open,
             print: (s) => console.log(s),
             prompt: (q) => input({ message: q }),
+            deviceCode: args.includes('--device-code'),
         });
     }
     if (args[0] === 'logout') {
@@ -186,7 +204,7 @@ export async function main(argv) {
         const { runWhoamiCommand } = await import('./commands/whoami.js');
         const { loadConfig } = await import('./config/loader.js');
         const cfg = await loadConfig();
-        return runWhoamiCommand({ proxyUrl: cfg.proxy_url, print: (s) => console.log(s) });
+        return runWhoamiCommand({ proxyUrl: cfg.proxy_url, print: (s) => console.log(s), mode: cfg.llm.mode });
     }
     // A team project — many laptops, one picture (spec 2026-09-18).
     if (args[0] === 'team') {
@@ -297,7 +315,8 @@ Usage:
   cspeach sap link [alias] [--project dir]  Let a local CAP app reach its S/4 services (Ctrl+C stops)
   cspeach doctor                    Diagnose install + connectivity
   cspeach login                     Sign in via device-code flow
-  cspeach logout                    Sign out (keep keychain key, if any)
+  cspeach login azure               Sign in to Microsoft for your company's Azure (--device-code: use a code instead of the browser)
+  cspeach logout                    Sign out (removes the CSPeach key from this home)
   cspeach whoami                    Print current account info
   cspeach team discover            Read the whole estate from SAP into this folder (read only)
   cspeach team start <packages>     Start a team project in this folder: object list, first check, you own it all

package/dist/commands/compact.js

@@ -33,6 +33,7 @@ import { paint } from '../renderer/theme.js';
 import { getGlyphs } from '../renderer/glyphs.js';
 import { saveSession } from '../session/store.js';
 import { isUserPrompt } from '../session/user-prompt.js';
+import { getActiveDeployments } from '../models/model-identity.js';
 /** Keep this many recent user-prompt anchored turns verbatim. */
 export const KEEP_RECENT_TURNS = 5;
 /** Don't bother compacting if there's only a handful of older turns. */
@@ -200,6 +201,16 @@ export function renderTodoSection(todos) {
  * turns are where the list was built, and Haiku isn't trusted to
  * reproduce it verbatim.
  */
+/**
+ * Azure tenant mode, Task 5a — the model the summary line names. With a
+ * company deployment table (azure only) compaction runs on the small
+ * deployment, so the line names it and its family; every other mode keeps
+ * the COMPACTION_MODEL text byte for byte.
+ */
+function compactionModelLabel() {
+    const table = getActiveDeployments();
+    return table ? `${table.small.name} (${table.small.model})` : COMPACTION_MODEL;
+}
 export function buildSummaryMessage(summary, droppedTurns, todos) {
     const ts = new Date().toISOString();
     const todoSection = renderTodoSection(todos);
@@ -207,7 +218,7 @@ export function buildSummaryMessage(summary, droppedTurns, todos) {
         role: 'user',
         content: [
             `[Context summary auto-generated by /compact at ${ts}.`,
-            `Original turns (${droppedTurns}) were summarised by ${COMPACTION_MODEL} to`,
+            `Original turns (${droppedTurns}) were summarised by ${compactionModelLabel()} to`,
             `reduce cache cost on subsequent turns. The original session is backed up`,
             `to ~/.cspeach/sessions/${'<session-id>'}.pre-compact-<timestamp>.json]`,
             '',

package/dist/commands/config-set.js

@@ -20,6 +20,7 @@ const MUTABLE_KEYS = new Set([
     'write_mode',
     'plan_mode',
     'plan_audit',
+    'usage_reporting',
     'approvals',
     'no_sap',
     'llm.mode',
@@ -31,6 +32,7 @@ const MUTABLE_KEYS = new Set([
     // Virtual keys that route to keychain (not saved to config.toml):
     'llm.byok_key',
     'llm.ai_hub_token',
+    'llm.azure_key',
 ]);
 // SAP-scoped key pattern: sap.<alias>.auto_approve
 const SAP_AUTO_APPROVE_RE = /^sap\.([A-Z0-9_-]{2,32})\.auto_approve$/;
@@ -70,9 +72,10 @@ const EFFORT_VALUES = ['low', 'medium', 'high', 'xhigh', 'max'];
 const TELEMETRY_VALUES = ['minimal', 'full'];
 const AUTO_APPROVE_VALUES = ['never', 'low', 'medium'];
 const SYSTEM_ROLE_VALUES = ['dev', 'qas', 'prd'];
-const LLM_MODE_VALUES = ['managed', 'byok', 'ai-hub', 'local'];
+const LLM_MODE_VALUES = ['managed', 'byok', 'ai-hub', 'local', 'azure'];
 const PLAN_MODE_VALUES = ['step', 'guarded'];
 const PLAN_AUDIT_VALUES = ['on', 'off'];
+const USAGE_REPORTING_VALUES = ['on', 'off'];
 const APPROVALS_VALUES = ['plan', 'per-write'];
 /**
  * Thrown on validation failure. The outer CLI dispatcher converts to
@@ -105,7 +108,7 @@ const INTERNAL_KEYS = new Set(['default_model_set', 'effort_set', 'file_keys']);
  * unset` cannot remove them — that is a keychain operation — so they are
  * rejected with a pointer rather than silently no-op'd.
  */
-const VIRTUAL_KEYCHAIN_KEYS = new Set(['llm.byok_key', 'llm.ai_hub_token']);
+const VIRTUAL_KEYCHAIN_KEYS = new Set(['llm.byok_key', 'llm.ai_hub_token', 'llm.azure_key']);
 /**
  * MUTABLE_KEYS that `config unset` can act on (excludes keychain virtuals and
  * the deprecated `local_files` alias — the canonical name is `local_build`).
@@ -392,6 +395,38 @@ export async function runConfigSet(args) {
         console.log(chalk.green(`Set ${key} = ${value}`));
         return;
     }
+    // Azure tenant mode (Task 5a) — the admin-issued Azure key, only when the
+    // company allows keys. Stored in the OS credential store per CSPEACH_HOME.
+    if (key === 'llm.azure_key') {
+        const { readConnectionCache } = await import('../connection/cache.js');
+        const company = await readConnectionCache();
+        if (!company || company.removed)
+            err('Your company has no Azure settings in CSPeach. Run cspeach login first.');
+        if (!company.connection.sign_in.includes('key'))
+            err('Your company does not allow Azure keys in CSPeach. Use cspeach login azure.');
+        let secret = value;
+        if (secret === '-') {
+            if (process.stdin.isTTY) {
+                const { password } = await import('@inquirer/prompts');
+                secret = await password({ message: 'Azure key (input masked):', mask: '*' });
+            }
+            else {
+                const chunks = [];
+                for await (const c of process.stdin)
+                    chunks.push(c);
+                secret = Buffer.concat(chunks).toString('utf8').trim();
+            }
+        }
+        else {
+            console.log(chalk.yellow('WARN: the key was passed as a shell argument and is now in your shell history. Prefer: cspeach config set llm.azure_key -'));
+        }
+        if (!secret || !secret.trim())
+            err('No key was given.');
+        const { setAzureKey } = await import('../auth/azure/azure-key.js');
+        await setAzureKey(secret.trim());
+        console.log(chalk.green('✓ Azure key stored in your OS credential store'));
+        return;
+    }
     // Virtual keys that store secrets in the OS keychain instead of config.toml.
     if (key === 'llm.byok_key' || key === 'llm.ai_hub_token') {
         // Support stdin piping for secrets: `echo "key" | cspeach config set llm.byok_key -`
@@ -557,6 +592,25 @@ export async function runConfigSet(args) {
             }
             cfg.plan_audit = value;
             break;
+        case 'usage_reporting':
+            // Security batch item 3 — usage counts from non-managed turns.
+            if (!USAGE_REPORTING_VALUES.includes(value)) {
+                err(`Invalid usage_reporting "${value}". Allowed: ${USAGE_REPORTING_VALUES.join(', ')}`);
+            }
+            // Azure tenant mode, Task 8b (plan D11) — the company decides: when its
+            // settings require usage counts, or this seat has a monthly limit (which
+            // needs the counts; fix round 1, ruling 1), "off" is refused and nothing
+            // changes. Every other mode keeps today's switch exactly.
+            if (value === 'off' && cfg.llm?.mode === 'azure') {
+                const { companyUsageRule } = await import('../usage/usage-reporter.js');
+                const rule = await companyUsageRule(cfg);
+                if (rule === 'required')
+                    err('Your company requires usage counts for CSPeach on Azure');
+                if (rule === 'limit')
+                    err('Your company sets a monthly CSPeach limit for you, so usage counts stay on.');
+            }
+            cfg.usage_reporting = value;
+            break;
         case 'approvals':
             // 'plan' = the plan's one approval covers its listed objects (default);
             // 'per-write' = a card before every write.
@@ -565,12 +619,21 @@ export async function runConfigSet(args) {
             }
             cfg.approvals = value;
             break;
-        case 'llm.mode':
+        case 'llm.mode': {
             if (!LLM_MODE_VALUES.includes(value)) {
                 err(`Invalid llm.mode "${value}". Allowed: ${LLM_MODE_VALUES.join(', ')}`);
             }
+            // Azure tenant mode — the org setting wins (spec "How settings reach the
+            // CLI"). The cache is this CSPeach home's connection.json.
+            const { readConnectionCache } = await import('../connection/cache.js');
+            const company = await readConnectionCache();
+            if (value !== 'azure' && company && !company.removed)
+                err('Your company set CSPeach to use your Azure. Run cspeach logout to leave it.');
+            if (value === 'azure' && !company)
+                err('Your company has no Azure settings on this machine. Run cspeach login to load them.');
             cfg.llm.mode = value;
             break;
+        }
         case 'llm.ai_hub_base_url':
             try {
                 new URL(value);
@@ -613,6 +676,11 @@ export async function runConfigSet(args) {
     // value-diff can't see — e.g. `config set default_model claude-opus-4-8`).
     markExplicit(cfg, key);
     await saveConfig(cfg);
+    // F15 — off means off: the counts already waiting are deleted too.
+    if (key === 'usage_reporting' && value === 'off') {
+        const { deleteUsageQueue } = await import('../usage/usage-queue.js');
+        await deleteUsageQueue().catch(() => { });
+    }
     console.log(chalk.green(`Set ${key} = ${value}`));
 }
 /**
@@ -689,6 +757,8 @@ export function validateValue(key, value) {
             return PLAN_MODE_VALUES.includes(value);
         case 'plan_audit':
             return PLAN_AUDIT_VALUES.includes(value);
+        case 'usage_reporting':
+            return USAGE_REPORTING_VALUES.includes(value);
         case 'approvals':
             return APPROVALS_VALUES.includes(value);
         case 'no_sap':
@@ -711,6 +781,7 @@ export function validateValue(key, value) {
             return isModelAlias(value);
         case 'llm.byok_key':
         case 'llm.ai_hub_token':
+        case 'llm.azure_key':
             return value.length > 0; // Secrets pass through if non-empty; no format check
         default:
             return false;

package/dist/commands/config-show.js

@@ -51,6 +51,7 @@ const LLM_REQUIRED_KEYS_BY_MODE = {
     byok: [],
     'ai-hub': ['ai_hub_base_url', 'ai_hub_model_alias'],
     local: ['local_base_url', 'local_model'],
+    azure: [],
 };
 function printLlmMissingHints(llm) {
     if (typeof llm !== 'object' || llm === null)
@@ -134,6 +135,24 @@ function resolveDottedKey(cfg, keyPath) {
     }
     return current;
 }
+/** Azure tenant mode (Task 7) — the company's settings, read-only, never a secret. */
+export function formatAzureBlock(c) {
+    const d = c.connection.deployments;
+    const entry = (e) => (e ? `${e.name} (${e.model})` : '<none: plan reviews run on main>');
+    return [
+        '',
+        `${chalk.bold('[azure]')} ${chalk.gray('# set by your company · read-only · change it through your CSPeach admin')}`,
+        `endpoint = "${c.connection.endpoint}"`,
+        `tenant = "${c.connection.entra_tenant_id}"`,
+        `main = "${entry(d.main)}"`,
+        `small = "${entry(d.small)}"`,
+        `review = "${entry(d.review)}"`,
+        `sign_in = "${c.connection.sign_in.join(', ')}"`,
+        `usage_counts = "${c.connection.usage_counts}"`,
+        ...(c.pending ? [chalk.yellow(`# a changed endpoint is waiting for you: ${c.pending.endpoint} (start cspeach to review it)`)] : []),
+        ...(c.removed ? [chalk.yellow('# your company removed these settings: run cspeach login')] : []),
+    ];
+}
 /**
  * Executes `cspeach config show [key]`.
  * Without argument: prints full config as TOML (secrets redacted).
@@ -153,6 +172,12 @@ export async function runConfigShow(args) {
         if (customer?.model && customer.enforced) {
             console.log(chalk.gray(`# model set by your account admin: ${customer.model} (enforced)`));
         }
+        if (cfg.llm.mode === 'azure') {
+            const { readConnectionCache } = await import('../connection/cache.js');
+            const c = await readConnectionCache();
+            for (const l of c ? formatAzureBlock(c) : ['', chalk.yellow("# [azure] your company's settings are not on this machine: run cspeach login")])
+                console.log(l);
+        }
         return;
     }
     const keyPath = args[0];

package/dist/commands/cost.js

@@ -11,7 +11,7 @@
 import chalk from 'chalk';
 import { readCostLog, summarise, turnRows } from '../cost/cost-log.js';
 import { formatCost } from '../cost/pricing.js';
-import { creditsActive, formatCredits, globalCredits, CREDITS_PENDING, } from '../cost/credits.js';
+import { creditsActive, tokensOnlyActive, formatCredits, globalCredits, CREDITS_PENDING, } from '../cost/credits.js';
 import { panelHeading, panelRow } from '../renderer/panel-rows.js';
 import { formatInfo } from '../renderer/notice-shape.js';
 import { countLabel } from '../renderer/checklist-format.js';
@@ -54,6 +54,9 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     // 2026-10-02 (owner): tokens go too. Not a COGS leak on their own, but beside
     // credits they invite "credits per token" maths — credits only for managed.
     const inCredits = creditsActive();
+    // Azure (Task 5b): tokens only — CSPeach has no price for the customer's
+    // deployments, so no formatCost() figure is printed anywhere below.
+    const tokensOnly = tokensOnlyActive();
     const perTurn = summariseCredits(entries);
     const turnsNote = `${s.turns} turn${s.turns === 1 ? '' : 's'}`;
     emit('');
@@ -66,6 +69,9 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
         if (credits?.balance != null)
             emit(panelRow('Balance', formatCredits(credits.balance, unit)));
     }
+    else if (tokensOnly) {
+        emit(panelHeading('Session tokens so far', turnsNote));
+    }
     else {
         emit(panelHeading(`Session cost so far: ${formatCost(s.totalCost)}`, turnsNote));
     }
@@ -75,13 +81,19 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
         emit(panelRow('input', s.totalTokens.input.toLocaleString().padStart(12)));
         emit(panelRow('output', s.totalTokens.output.toLocaleString().padStart(12)));
         emit(panelRow('cache read', s.totalTokens.cacheRead.toLocaleString().padStart(12)));
-        emit(panelRow('cache create', s.totalTokens.cacheCreate.toLocaleString().padStart(12)));
+        // Azure (Task 7, ruling 7): the spec's wording; other modes unchanged.
+        emit(panelRow(tokensOnly ? 'cache write' : 'cache create', s.totalTokens.cacheCreate.toLocaleString().padStart(12)));
+    }
+    if (tokensOnly) {
+        emit('');
+        emit(panelRow('Cost', 'billed on your Azure invoice · CSPeach has no price for your deployments'));
     }
     // Task 18 fix M3 — reader subagent spend (already inside the total above).
     // USD only: in credits mode the balance delta already carries it.
     if (s.readerCalls > 0 && !inCredits) {
         emit('');
-        emit(panelRow('Readers', `${s.readerCalls} run${s.readerCalls === 1 ? '' : 's'}   ${formatCost(s.readerCost)}`));
+        const readerTail = tokensOnly ? '' : `   ${formatCost(s.readerCost)}`;
+        emit(panelRow('Readers', `${s.readerCalls} run${s.readerCalls === 1 ? '' : 's'}${readerTail}`));
     }
     if (s.byModel.length > 1 && !inCredits) {
         emit('');
@@ -89,7 +101,7 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
         for (const m of s.byModel) {
             // Credits mode: turn counts only. A per-model dollar split is a direct
             // read on our per-model COGS.
-            const tail = inCredits ? '' : `   ${formatCost(m.cost)}`;
+            const tail = inCredits || tokensOnly ? '' : `   ${formatCost(m.cost)}`;
             emit(panelRow(modelText(m.model), `${m.turns} turn${m.turns === 1 ? '' : 's'}${tail}`, 24));
         }
     }
@@ -117,8 +129,9 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
             ? (typeof e.credits === 'number'
                 ? formatCredits(e.credits, credits?.unitLabel ?? 'credits')
                 : CREDITS_PENDING)
-            : formatCost(e.cost);
-        emit(panelRow(`turn ${String(e.turn).padStart(3)}`, inCredits ? tail : `${tok.padStart(10)} tok   ${tail}`, 8));
+            : tokensOnly ? '' : formatCost(e.cost);
+        const row = inCredits ? tail : tokensOnly ? `${tok.padStart(10)} tok` : `${tok.padStart(10)} tok   ${tail}`;
+        emit(panelRow(`turn ${String(e.turn).padStart(3)}`, row, 8));
     }
     if (inCredits && perTurn.unknown > 0) {
         emit('');

package/dist/commands/help.js

@@ -1,6 +1,6 @@
 import chalk from 'chalk';
 import { SKILL_CATALOG } from '../skill-catalog.js';
-import { costCommandDescription, USAGE_DESCRIPTION } from '../repl/builtin-commands.js';
+import { costCommandDescription, usageCommandDescription } from '../repl/builtin-commands.js';
 import { panelHeading } from '../renderer/panel-rows.js';
 import { paint } from '../renderer/theme.js';
 import { uiWidth, truncateToWidth } from '../renderer/ui-width.js';
@@ -52,7 +52,7 @@ export const HELP_GROUPS = [
             { name: '/new', description: fixed('Next prompt picks a skill afresh (also /reset)') },
             { name: '/recap', description: fixed('Show the recap (last session, open tasks, plan)') },
             { name: '/cost', description: costCommandDescription },
-            { name: '/usage', description: fixed(USAGE_DESCRIPTION) },
+            { name: '/usage', description: usageCommandDescription },
             { name: '/context', description: fixed("Show what fills the model's context window") },
             { name: '/compact', description: fixed('Shrink a long session and keep the facts') },
             { name: '/help', description: fixed('This screen (also /skills)') },

package/dist/commands/login-azure.js

@@ -0,0 +1,33 @@
+/**
+ * `cspeach login azure [--device-code]` — the Microsoft sign-in alone (token
+ * expired, password changed, a new policy). Uses the company settings already
+ * on this machine; `cspeach login` fetches them.
+ */
+import { formatFailure } from '../renderer/notice-shape.js';
+import { paint } from '../renderer/theme.js';
+import { getGlyphs } from '../renderer/glyphs.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { readConnectionCache } from '../connection/cache.js';
+import { signInAzure } from '../auth/azure/sign-in.js';
+export async function runLoginAzureCommand(deps) {
+    const cached = await (deps.read ?? readConnectionCache)();
+    if (!cached || cached.removed) {
+        deps.print(formatFailure({ what: "Your company's Azure settings are not on this machine.", next: 'cspeach login' }).trimEnd());
+        return 2;
+    }
+    const conn = cached.connection;
+    if (!conn.sign_in.includes('entra')) {
+        deps.print(formatFailure({ what: 'Your company uses Azure keys, not Microsoft sign-in.', next: 'ask IT for your key, then cspeach config set llm.azure_key -' }).trimEnd());
+        return 2;
+    }
+    const r = await (deps.signIn ?? signInAzure)(conn, { deviceCode: deps.deviceCode }, { open: deps.open, print: deps.print });
+    if (!r.ok) {
+        deps.print(formatFailure({ what: r.what, next: r.next }).trimEnd());
+        return 2;
+    }
+    const until = r.expiresOn ? ` · token valid until ${r.expiresOn.toISOString()}` : '';
+    // The account name comes from Microsoft: one line, no control characters.
+    const who = sanitizeControlChars(r.username).replace(/\s+/g, ' ').trim();
+    deps.print(`${paint('ok', getGlyphs().done)} Signed in to Microsoft as ${who}${until}`);
+    return 0;
+}

package/dist/commands/login.js

@@ -6,23 +6,30 @@
  *   2) Open the browser to verification_url_complete (or print URL if open fails)
  *   3) Print user_code prominently so customer can read it
  *   4) Poll /v1/auth/device/poll every interval until verified or maxAttempts
- *   5) Save api_key + customer_id to ~/.cspeach/auth.json
+ *   5) Save api_key to the OS credential store (this CSPeach home's account);
+ *      auth.json keeps customer_id + savedAt (the key only without a store)
  *   6) Call GET /v1/me — if trial_mode === 'byok', pull the org's Anthropic key,
  *      or prompt for the user's own
  *   7) Store that key in the OS keychain (cspeach.anthropic/api-key) — never
  *      in auth.json (2026-10-02)
+ *   8) GET /v1/me/connection — Azure tenant mode: the company's Azure
+ *      settings are shown and saved only on a yes (a no exits 6)
+ *   9) Azure with Entra: the Microsoft sign-in (browser, or a device code
+ *      with --device-code); a failure exits 7 and keeps the CSPeach sign-in
  *
  * Dependencies (open, print, prompt) are injected so the command is
  * unit-testable without stubbing platform globals.
  */
 import keychain from '../auth/keychain.js';
-import { writeAuthFile } from '../auth/auth-file.js';
+import { saveSignIn } from '../auth/key-resolver.js';
 import { fetchOrgAnthropicKey } from '../auth/org-anthropic-key.js';
 import { formatFailure, formatAttention, formatInfo } from '../renderer/notice-shape.js';
 import { panelRow } from '../renderer/panel-rows.js';
 import { paint } from '../renderer/theme.js';
 import { getGlyphs } from '../renderer/glyphs.js';
 import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { runConnectionStep } from '../connection/login-step.js';
+import { clientIdConfigured } from '../connection/azure-facts.js';
 const ANTHROPIC_KEYCHAIN_SERVICE = 'cspeach.anthropic';
 const ANTHROPIC_KEYCHAIN_ACCOUNT = 'api-key';
 /** Server-supplied text (user code, URL, email, plan) is one line with no control characters. */
@@ -92,12 +99,13 @@ export async function runLoginCommand(deps) {
         deps.print(formatFailure({ what: 'Timed out waiting for the browser sign-in', next: 'cspeach login' }).trimEnd());
         return 5;
     }
-    // 5) Save (non-BYOK part).
-    await writeAuthFile({
-        apiKey: polled.api_key,
-        customerId: polled.customer_id,
-    });
-    deps.print(done('Saved your CSPeach key to auth.json in your CSPeach home'));
+    // 5) Save (non-BYOK part). Security batch item 6 — the OS credential store
+    // first; auth.json keeps customerId + savedAt, and the key only when no
+    // credential store works on this machine.
+    const savedTo = await (deps.saveSignIn ?? saveSignIn)({ apiKey: polled.api_key, customerId: polled.customer_id });
+    deps.print(done(savedTo === 'store'
+        ? 'Saved your CSPeach key to your OS credential store'
+        : 'Saved your CSPeach key to auth.json in your CSPeach home (no OS credential store is available)'));
     // 6) /v1/me — figure out if BYOK is required.
     try {
         const r = await fetch(`${proxy}/v1/me`, { headers: { Authorization: `Bearer ${polled.api_key}` } });
@@ -138,6 +146,46 @@ export async function runLoginCommand(deps) {
     catch (err) {
         deps.print(formatInfo(`Could not read your account details (${err instanceof Error ? err.message : String(err)}) · sign-in still worked`).trimEnd());
     }
+    // 8) Azure tenant mode — the company's connection settings (no secrets).
+    // { kind: 'none' } changes nothing; an Azure answer is confirmed on screen.
+    const step = await (deps.connectionStep ?? runConnectionStep)({
+        proxyUrl: proxy, apiKey: polled.api_key, print: deps.print,
+        confirm: async (q) => /^y(es)?$/i.test((await deps.prompt(`${q} [y/n] `)).trim()),
+    });
+    if (step.result === 'declined')
+        return 6;
+    // Azure tenant mode (Task 6b) — with Entra the Microsoft sign-in follows
+    // the settings. A failed one keeps the CSPeach sign-in (exit 7).
+    if (step.result === 'azure') {
+        if (step.connection.sign_in.includes('entra')) {
+            // Only when this build can sign in to Microsoft at all; otherwise the
+            // sign-in's own refusal is the one line.
+            if (clientIdConfigured())
+                deps.print(formatInfo("Now sign in to Microsoft for your company's Azure").trimEnd());
+            const signIn = deps.azureSignIn ?? (await import('../auth/azure/sign-in.js')).signInAzure;
+            const r = await signIn(step.connection, { deviceCode: deps.deviceCode === true }, { open: deps.open, print: deps.print });
+            if (!r.ok) {
+                deps.print(formatFailure({ what: r.what, next: r.next }).trimEnd());
+                deps.print(formatInfo('Your CSPeach sign-in worked · when the Microsoft sign-in is sorted out, run cspeach login azure').trimEnd());
+                return 7;
+            }
+            deps.print(done(`Signed in to Microsoft as ${serverText(r.username)}`));
+        }
+        else {
+            deps.print(formatInfo('Your company uses Azure keys · ask IT for yours, then run cspeach config set llm.azure_key -').trimEnd());
+        }
+    }
+    // Fix round 1 (I3): still set to azure (e.g. after cspeach logout) but the
+    // company has no settings. Never suggest managed: that would move prompts
+    // to our service without the company's say.
+    // Ruling 1 (Task 7): only a real { kind: 'none' } answer says so; a service
+    // without the settings route ('no_route') stays silent.
+    if (step.result === 'none') {
+        const { loadConfig } = await import('../config/loader.js');
+        const mode = await loadConfig().then((c) => c.llm?.mode).catch(() => undefined);
+        if (mode === 'azure')
+            deps.print(formatInfo('Your company has no Azure settings in CSPeach · ask your CSPeach admin which setup to use').trimEnd());
+    }
     deps.print(`  ${paint('dim', 'Next:')} run cspeach to start`);
     return 0;
 }

package/dist/commands/logout.js

@@ -1,21 +1,45 @@
 /**
- * `cspeach logout` — delete the device-code-flow auth file. The REPL
- * will fall back to the keytar-stored API key if one is present.
+ * `cspeach logout` — security batch item 6: delete this home's credential
+ * store entry, auth.json and licence.json; Azure tenant mode adds the
+ * company's Azure entries in this home (clearAzureSignIn). Other CSPeach
+ * homes are untouched.
  */
-import { deleteAuthFile, readAuthFile } from '../auth/auth-file.js';
-import { formatInfo } from '../renderer/notice-shape.js';
+import { clearSignIn } from '../auth/key-resolver.js';
+import { clearAzureSignIn } from '../auth/azure/clear.js';
+import { formatFailure, formatInfo } from '../renderer/notice-shape.js';
 import { paint } from '../renderer/theme.js';
 import { getGlyphs } from '../renderer/glyphs.js';
 export async function runLogoutCommand(deps) {
-    const before = await readAuthFile();
-    await deleteAuthFile();
-    if (before) {
-        deps.print(`${paint('ok', getGlyphs().done)} Signed out · removed auth.json from your CSPeach home`);
-        deps.print(`  ${paint('dim', 'The REPL uses the keychain-stored key if you have one.')}`);
+    const { hadSignIn, cleared } = await (deps.clear ?? (() => clearSignIn()))();
+    // Fix round 1 (F2): never say "removed" while a key is still in this home.
+    if (cleared === false) {
+        deps.print(formatFailure({
+            what: 'Could not sign out completely',
+            detail: ['a CSPeach key is still in this CSPeach home (OS credential store or auth.json)'],
+            next: 'close other cspeach windows, then run cspeach logout again',
+        }).trimEnd());
+        return 1;
+    }
+    const az = await (deps.clearAzure ?? (() => clearAzureSignIn()))()
+        .catch(() => ({ removed: [], failed: ['your Azure sign-in details'] }));
+    if (hadSignIn) {
+        deps.print(`${paint('ok', getGlyphs().done)} Signed out · removed your CSPeach key from this CSPeach home`);
         deps.print(`  ${paint('dim', 'Next:')} cspeach login   (to sign in again)`);
     }
     else {
-        deps.print(formatInfo('Already signed out · no auth.json present').trimEnd());
+        deps.print(formatInfo('Already signed out · no CSPeach key in this CSPeach home').trimEnd());
+    }
+    for (const what of az.removed)
+        deps.print(`${paint('ok', getGlyphs().done)} Removed ${what} from this CSPeach home`);
+    // Fix round 1: outside azure mode an Azure clean-up error (e.g. EPERM on a
+    // stale connection.json) neither prints nor changes the exit code.
+    const mode = az.failed.length > 0
+        ? await (deps.mode ?? (async () => (await (await import('../config/loader.js')).loadConfig()).llm?.mode))().catch(() => undefined)
+        : undefined;
+    // An unreadable mode still reports the failure.
+    if (az.failed.length > 0 && (mode === undefined || mode === 'azure')) {
+        deps.print(formatFailure({ what: `Could not remove ${az.failed.join(', ')}`, next: 'close other cspeach windows, then run cspeach logout again' }).trimEnd());
+        return 1;
     }
     return 0;
 }

package/dist/commands/plan-boundary.js

@@ -67,12 +67,12 @@ const COMPACT_CALL = {
     maxTokens: 4000,
     headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' },
 };
-export function makePhaseBoundarySummariser(provider, model) {
-    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), buildPhaseBoundaryPrompt() + '\n\n' + serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers } });
+export function makePhaseBoundarySummariser(provider, model, sessionId) {
+    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), buildPhaseBoundaryPrompt() + '\n\n' + serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers }, ...(sessionId ? { sessionId } : {}) });
 }
 /** The standard /compact summarisation (the compact skill carries the instructions). */
-export function makeAutoCompactSummariser(provider, model) {
-    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers } });
+export function makeAutoCompactSummariser(provider, model, sessionId) {
+    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers }, ...(sessionId ? { sessionId } : {}) });
 }
 /** Auto-compact after a plan turn whose revision is already saved and that queued no next step. */
 export async function maybeAutoCompactAfterPlanTurn(a) {