@cspeach/cli 1.1.33 → 1.1.35

package/dist/doctor/run.js

@@ -13,6 +13,8 @@ import { checkCredits } from './checks/credits.js';
 import { checkForgeRules } from './checks/forge-rules.js';
 import { checkSystemRoles } from './checks/system-roles.js';
 import { checkStandards } from './checks/standards.js';
+import { checkUsageReporting } from './checks/usage-reporting.js';
+import { checkAzure, activateAzureForDoctor } from './checks/azure.js';
 import { paint } from '../renderer/theme.js';
 import { getGlyphs } from '../renderer/glyphs.js';
 import { isNoColor } from '../renderer/color-mode.js';
@@ -104,7 +106,12 @@ export async function collectChecks() {
     const checks = [];
     checks.push(await checkProxy());
     checks.push(await checkAuth());
+    // Azure tenant mode (Task 7): the saved settings, then the azure rows right
+    // after the llm-mode row. Every other mode: no read, no rows.
+    await activateAzureForDoctor(cfg);
     checks.push(await checkLlmMode(cfg));
+    checks.push(...(await checkAzure(cfg)));
+    checks.push(await checkUsageReporting(cfg));
     checks.push(await checkCredits(cfg));
     checks.push(await checkWriteMode(cfg));
     checks.push(await checkSystemRoles(cfg));

package/dist/lib/graceful-exit.js

@@ -31,6 +31,20 @@ function call(fn, self) {
         return Promise.reject(e);
     }
 }
+/**
+ * 2026-10-13 — async work that must run on the way out, before the sockets
+ * close (ending the stateful SAP session, so its locks leave SM12). Capped as
+ * a whole; a task that throws or hangs never blocks the exit.
+ */
+const exitTasks = new Set();
+/** Register an async exit task. Returns an unregister. */
+export function registerExitTask(task) {
+    exitTasks.add(task);
+    return () => { exitTasks.delete(task); };
+}
+export function __resetExitTasksForTests() {
+    exitTasks.clear();
+}
 export async function gracefulExit(code, opts = {}) {
     const exit = opts.exit ?? ((c) => process.exit(c));
     const graceMs = opts.graceMs ?? 250;
@@ -38,6 +52,9 @@ export async function gracefulExit(code, opts = {}) {
     const guard = () => { };
     process.on('unhandledRejection', guard);
     try {
+        if (exitTasks.size > 0) {
+            await capped(Promise.allSettled([...exitTasks].map((t) => call(t, {}))), opts.exitTaskMs ?? 3_500);
+        }
         const dispatcher = globalThis[UNDICI_DISPATCHER];
         if (dispatcher) {
             let done = false;

package/dist/licence/licence-check.js

@@ -0,0 +1,205 @@
+/**
+ * Security batch item 1 — the shared licence check. It IS the start-up
+ * GET /v1/me (no second call), plus a cache in licence.json
+ * ({ checkedAt, serverDate, status, keyPrefix }, atomic, no secret).
+ *
+ *   401 invalid_api_key / malformed_api_key / reason 'revoked' → revoked: refuse.
+ *   401 missing_authorization                                  → missing: "run cspeach login".
+ *   network error, timeout, 5xx, 429, 404 customer_not_found…  → unknown: the grace clock.
+ *
+ * Grace: 72 hours from the last `ok`. With no usable cache (fresh or wiped
+ * profile, unreadable file, rotated key) the clock starts at this failed
+ * check — only a server verdict refuses straight away. A clock earlier than
+ * the cached server Date gives "unknown" and never rewrites the cache: a
+ * deterrent, not tamper-proof.
+ */
+import crypto from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { getDeviceFingerprint } from '../auth/device.js';
+import { fetchMe } from '../auth/me.js';
+import { formatFailure } from '../renderer/notice-shape.js';
+import { licenceCachePath } from './paths.js';
+export const LICENCE_GRACE_MS = 72 * 60 * 60 * 1000;
+export const LICENCE_RECHECK_MS = 4 * 60 * 60 * 1000;
+export const CLOCK_SKEW_TOLERANCE_MS = 5 * 60 * 1000;
+export function keyPrefixOf(key) { return key.slice(0, 12); }
+export function verdictFromMe(r) {
+    if (r.ok)
+        return 'ok';
+    if (r.status === 401) {
+        if (r.error === 'missing_authorization')
+            return 'missing';
+        if (r.reason === 'revoked' || r.error === 'invalid_api_key' || r.error === 'malformed_api_key')
+            return 'revoked';
+    }
+    return 'unknown';
+}
+const when = (d) => d.toLocaleString(undefined, { dateStyle: 'medium', timeStyle: 'short' });
+const offlineLine = (graceUntil) => `Could not reach CSPeach to check your licence; working offline until ${when(graceUntil)}`;
+export function revokedMessage() {
+    return formatFailure({
+        what: 'Your CSPeach licence for this key has ended',
+        detail: [
+            'Your SAP work, sessions and snapshots are untouched.',
+            'If a plan was running, it stopped before its next step; resume it later with /abap-plan --resume.',
+        ],
+        next: 'run cspeach login, or contact your admin',
+    }).trimEnd();
+}
+/** A 401 invalid key without the server's 'revoked' reason (e.g. mistyped or
+ *  unknown key): same refusal, but nothing "ended". */
+export function invalidKeyMessage() {
+    return formatFailure({
+        what: 'This CSPeach key is not valid',
+        detail: ['Your SAP work, sessions and snapshots are untouched.'],
+        next: 'run cspeach login, or contact your admin',
+    }).trimEnd();
+}
+const refusalMessage = (reason) => (reason === 'revoked' ? revokedMessage() : invalidKeyMessage());
+function expiredMessage(lastOk) {
+    return formatFailure({
+        what: 'CSPeach could not check your licence for 72 hours',
+        detail: [
+            lastOk ? `last successful check: ${when(lastOk)}` : 'no successful check on this machine yet',
+            'Your SAP work, sessions and snapshots are untouched.',
+        ],
+        next: 'connect to the network and run cspeach again, or contact your admin',
+    }).trimEnd();
+}
+export function missingMessage() {
+    return formatFailure({ what: 'You are not signed in to CSPeach', next: 'cspeach login' }).trimEnd();
+}
+export function decide(a) {
+    const nowIso = a.now.toISOString();
+    if (a.verdict === 'ok') {
+        return { decision: { allow: true, verdict: 'ok', profile: a.profile }, write: { checkedAt: nowIso, serverDate: a.serverDate, status: 'ok', keyPrefix: a.keyPrefix } };
+    }
+    if (a.verdict === 'revoked') {
+        return {
+            decision: { allow: false, verdict: 'revoked', message: refusalMessage(a.reason) },
+            write: { checkedAt: nowIso, serverDate: a.serverDate, status: 'revoked', keyPrefix: a.keyPrefix, ...(a.reason === 'revoked' ? { reason: 'revoked' } : {}) },
+        };
+    }
+    if (a.verdict === 'missing')
+        return { decision: { allow: false, verdict: 'missing', message: missingMessage() }, write: null };
+    // A rotated key's cache, or one whose checkedAt is not a real time, is no
+    // cache: the clock starts now. It can never produce 'expired'.
+    const cache = a.cache && a.cache.keyPrefix === a.keyPrefix && Number.isFinite(Date.parse(a.cache.checkedAt)) ? a.cache : null;
+    if (!cache) {
+        const graceUntil = new Date(a.now.getTime() + LICENCE_GRACE_MS);
+        return {
+            decision: { allow: true, verdict: 'unknown', graceUntil, line: offlineLine(graceUntil), clockBehind: false },
+            write: { checkedAt: nowIso, serverDate: null, status: 'unknown', keyPrefix: a.keyPrefix },
+        };
+    }
+    if (cache.status === 'revoked')
+        return { decision: { allow: false, verdict: 'revoked', message: refusalMessage(cache.reason) }, write: null };
+    const start = Date.parse(cache.checkedAt);
+    const anchor = Math.max(start, cache.serverDate ? Date.parse(cache.serverDate) || -Infinity : -Infinity);
+    const graceUntil = new Date(start + LICENCE_GRACE_MS);
+    const clockBehind = a.now.getTime() < anchor - CLOCK_SKEW_TOLERANCE_MS;
+    if (clockBehind || a.now.getTime() <= graceUntil.getTime()) {
+        return { decision: { allow: true, verdict: 'unknown', graceUntil, line: offlineLine(graceUntil), clockBehind }, write: null };
+    }
+    return { decision: { allow: false, verdict: 'expired', message: expiredMessage(cache.status === 'ok' ? new Date(start) : null) }, write: null };
+}
+export async function readLicenceCache() {
+    try {
+        const c = JSON.parse(await fs.readFile(licenceCachePath(), 'utf-8'));
+        if (typeof c.checkedAt !== 'string' || !Number.isFinite(Date.parse(c.checkedAt)))
+            return null;
+        if (c.status !== 'ok' && c.status !== 'revoked' && c.status !== 'unknown')
+            return null;
+        if (typeof c.keyPrefix !== 'string')
+            return null;
+        return {
+            checkedAt: c.checkedAt, serverDate: typeof c.serverDate === 'string' ? c.serverDate : null, status: c.status, keyPrefix: c.keyPrefix,
+            ...(c.reason === 'revoked' ? { reason: 'revoked' } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeLicenceCache(c) {
+    const p = licenceCachePath();
+    await fs.mkdir(path.dirname(p), { recursive: true });
+    // Random suffix, as key-resolver writeMeta: two writes in one process
+    // (start-up check + Task 6 recheck) can never share a temp file.
+    const tmp = `${p}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    try {
+        await fs.writeFile(tmp, JSON.stringify(c, null, 2), 'utf-8');
+        await fs.rename(tmp, p);
+    }
+    finally {
+        await fs.rm(tmp, { force: true }).catch(() => { });
+    }
+}
+/** One check. Never throws: anything unexpected is "unknown". */
+export async function runLicenceCheck(a, deps = {}) {
+    let now;
+    try {
+        now = (deps.now ?? (() => new Date()))();
+    }
+    catch {
+        now = new Date();
+    }
+    let me;
+    try {
+        me = await (deps.fetchMe ?? fetchMe)({ proxyUrl: a.proxyUrl, apiKey: a.apiKey, headers: deps.headers });
+    }
+    catch (err) {
+        me = { ok: false, status: 0, error: err instanceof Error ? err.message : String(err), serverDate: null };
+    }
+    let cache = null;
+    try {
+        cache = await (deps.readCache ?? readLicenceCache)();
+    }
+    catch {
+        cache = null; // unreadable counts as missing — never a refusal
+    }
+    let verdict = 'unknown';
+    try {
+        verdict = verdictFromMe(me);
+    }
+    catch {
+        verdict = 'unknown'; // a malformed answer is never a refusal
+    }
+    const reason = me && !me.ok ? me.reason : undefined;
+    let result;
+    try {
+        result = decide({
+            verdict, now, cache, keyPrefix: keyPrefixOf(a.apiKey),
+            serverDate: me.serverDate ?? null, profile: me.ok ? me.profile : undefined, reason,
+        });
+    }
+    catch {
+        // Defensive only. A clear server verdict already in hand is honoured;
+        // anything else must never lock a working user out.
+        if (verdict === 'revoked')
+            return { allow: false, verdict: 'revoked', message: refusalMessage(reason) };
+        if (verdict === 'missing')
+            return { allow: false, verdict: 'missing', message: missingMessage() };
+        const graceUntil = new Date(Date.now() + LICENCE_GRACE_MS);
+        return { allow: true, verdict: 'unknown', graceUntil, line: offlineLine(graceUntil), clockBehind: false };
+    }
+    if (result.write) {
+        try {
+            await (deps.writeCache ?? writeLicenceCache)(result.write);
+        }
+        catch { /* a cache we cannot write only means the next check starts fresh */ }
+    }
+    return result.decision;
+}
+/**
+ * Device headers on the licence check (spec item 1), byok / ai-hub / local
+ * only — the managed /v1/me request stays byte-identical (plan deviation D2).
+ * `x-cspeach-mode` lets the proxy record the install's mode (Task 11a).
+ */
+export async function licenceCheckHeaders(mode, device = getDeviceFingerprint) {
+    if (mode === 'managed')
+        return {};
+    const d = await device();
+    return { 'x-device-machine-id': d.machineId, 'x-device-hostname': d.hostname, 'x-cspeach-mode': mode };
+}

package/dist/licence/paths.js

@@ -0,0 +1,6 @@
+import path from 'node:path';
+import { cspeachRoot } from '../config/paths.js';
+/** <CSPeach home>/licence.json — the licence check's cache. Holds no secret. */
+export function licenceCachePath() {
+    return path.join(cspeachRoot(), 'licence.json');
+}

package/dist/licence/turn-gate.js

@@ -0,0 +1,66 @@
+import { runLicenceCheck, licenceCheckHeaders, missingMessage, LICENCE_RECHECK_MS, } from './licence-check.js';
+import { formatFailure } from '../renderer/notice-shape.js';
+export class LicenceTurnGate {
+    o;
+    lastCheckAtMs;
+    revokedMessage = null;
+    constructor(o) {
+        this.o = o;
+        this.lastCheckAtMs = o.lastCheckAtMs ?? (o.now ?? Date.now)();
+    }
+    async beforeTurn() {
+        const lic = await this.licenceBeforeTurn();
+        if (this.o.mode === 'managed' || !lic.allow || !this.o.extra)
+            return lic;
+        let ex;
+        // Fix round 1 (I1): a throwing extra gate fails CLOSED. With removed
+        // settings the cache still holds the old connection, so allowing would
+        // send the prompt and token where the gate refuses. Not sticky: the next
+        // turn runs the gate again.
+        try {
+            ex = await this.o.extra();
+        }
+        catch {
+            return { allow: false, message: formatFailure({ what: "Could not check your company's Azure settings.", next: 'start cspeach again' }).trimEnd() };
+        }
+        if (!ex.allow)
+            return ex;
+        const line = [lic.line, ex.line].filter(Boolean).join(' · ');
+        return line ? { allow: true, line } : { allow: true };
+    }
+    async licenceBeforeTurn() {
+        if (this.o.mode === 'managed')
+            return { allow: true };
+        if (this.revokedMessage)
+            return { allow: false, message: this.revokedMessage };
+        const now = (this.o.now ?? Date.now)();
+        if (now - this.lastCheckAtMs < (this.o.intervalMs ?? LICENCE_RECHECK_MS))
+            return { allow: true };
+        this.lastCheckAtMs = now;
+        await this.o.onRecheck?.().catch(() => { });
+        const key = await this.o.getKey().catch(() => null);
+        if (!key) {
+            this.lastCheckAtMs = -Infinity;
+            return { allow: false, message: missingMessage() };
+        }
+        const headers = await (this.o.headers ?? licenceCheckHeaders)(this.o.mode).catch(() => ({}));
+        let d;
+        try {
+            d = await (this.o.check ?? runLicenceCheck)({ proxyUrl: this.o.proxyUrl, apiKey: key }, { headers });
+        }
+        catch {
+            // runLicenceCheck never throws; any other check that does must never
+            // block or crash the REPL. Allow, and check again on the next turn.
+            this.lastCheckAtMs = -Infinity;
+            return { allow: true };
+        }
+        if (!d.allow) {
+            if (d.verdict === 'revoked')
+                this.revokedMessage = d.message;
+            else
+                this.lastCheckAtMs = -Infinity;
+            return { allow: false, message: d.message };
+        }
+        return d.verdict === 'unknown' ? { allow: true, line: d.line } : { allow: true };
+    }
+}

package/dist/models/model-identity.js

@@ -0,0 +1,65 @@
+let active = null;
+export function setActiveDeployments(t) { active = t; }
+export function getActiveDeployments() { return active; }
+export function familyFromTable(wire, table) {
+    if (!table)
+        return wire;
+    for (const e of [table.main, table.small, table.review]) {
+        if (e && e.name === wire)
+            return e.model;
+    }
+    return wire;
+}
+export function familyOf(wire, provider) {
+    if (!provider || provider.profile?.modelIdentity !== 'deployment')
+        return wire;
+    return provider.modelFamily ? provider.modelFamily(wire) : familyFromTable(wire, active);
+}
+/**
+ * Azure tenant mode, Task 5a — families known to accept output_config.effort
+ * (an ALLOW-list, exact match after lowercasing and stripping a trailing
+ * -YYYYMMDD). Deployment connections send effort only to these; an unknown
+ * deployment name or an unprobed family (claude-haiku-*, claude-sonnet-5-5
+ * until Task 5c's probe) gets none. Model-id connections keep the
+ * modelAcceptsEffort deny-list unchanged.
+ */
+export const EFFORT_FAMILIES = new Set(['claude-opus-5-5', 'claude-opus-5', 'claude-sonnet-4-6']);
+export function familyAcceptsEffort(family) {
+    return EFFORT_FAMILIES.has(family.trim().toLowerCase().replace(/-\d{8}$/, ''));
+}
+/** The deployment each CLI role runs on (spec "Model roles"). */
+export function connectionRoleModel(role, table) {
+    switch (role) {
+        case 'session_default': return table.main.name;
+        case 'audit': return (table.review ?? table.main).name;
+        case 'compact': return table.small.name;
+    }
+}
+/** Skill routing runs on the small deployment. */
+export function routerDeployment(table) { return table.small; }
+/**
+ * Plan tiering target: undefined = no connection (today's Sonnet constant);
+ * the review deployment's name; null = azure without review (tiering off).
+ */
+export function planTierModelFor(table) {
+    if (!table)
+        return undefined;
+    return table.review?.name ?? null;
+}
+/** The deployments `cspeach doctor` sends a 1-token call to (Task 7). */
+export function probeTargets(table) {
+    const out = [
+        { role: 'main', name: table.main.name, family: table.main.model, required: true },
+        { role: 'small', name: table.small.name, family: table.small.model, required: true },
+    ];
+    if (table.review)
+        out.push({ role: 'review', name: table.review.name, family: table.review.model, required: false });
+    return out;
+}
+export const ROLE_ENV_VARS = ['CSPEACH_DEFAULT_MODEL', 'CSPEACH_AUDIT_MODEL', 'CSPEACH_COMPACT_MODEL'];
+/** Env role overrides that are set but ignored because the company's connection chooses the models. */
+export function ignoredEnvOverrides(env) {
+    if (!active)
+        return [];
+    return ROLE_ENV_VARS.filter((v) => (env[v] ?? '').trim().length > 0);
+}

package/dist/models/resolve.js

@@ -19,6 +19,8 @@
 // snapshot) every role resolves to today's constant — byte-identical to before
 // this feature.
 //
+// Azure tenant mode: when a connection table is active it replaces every layer.
+//
 // Pure in the resolveAuditModel sense: no async I/O, no fetch. The only external
 // read is getServerModelConfig(), a synchronous in-memory snapshot the caller
 // (or the startup fetch) has already populated. `router` is proxy-side only and
@@ -28,6 +30,7 @@ import { DEFAULT_SESSION_MODEL } from '../config/model-defaults.js';
 import { PLAN_TIER_SONNET_MODEL } from '../commands/plan-model-tier.js';
 import { COMPACTION_MODEL } from '../commands/compact.js';
 import { getCustomerModelConfig, getServerModelConfig, isEffort } from './server-config.js';
+import { getActiveDeployments, connectionRoleModel } from './model-identity.js';
 /** First non-empty (trimmed) candidate in precedence order, else the built-in. */
 function firstSet(candidates, builtin) {
     for (const c of candidates) {
@@ -49,6 +52,11 @@ function firstSet(candidates, builtin) {
  * explicit user choice (even one equal to the built-in) still wins.
  */
 export function resolveModelRole(role, cfg, env = process.env) {
+    // Azure tenant mode (Task 2) — the company's deployments are the ONLY role
+    // source in azure mode (org setting wins); null for every other mode.
+    const table = getActiveDeployments();
+    if (table)
+        return connectionRoleModel(role, table);
     const server = getServerModelConfig();
     switch (role) {
         case 'session_default':

package/dist/models/server-config.js

@@ -27,6 +27,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { cspeachRoot } from '../config/paths.js';
+import { profileForMode } from '../agent/connection-profile.js';
 export const EFFORT_VALUES = ['low', 'medium', 'high', 'xhigh', 'max'];
 const EFFORT_ROLE_KEYS = ['session_default', 'audit', 'compact'];
 export function isEffort(v) {
@@ -152,7 +153,7 @@ async function readFreshDiskCache() {
  */
 export async function loadServerModelConfig(cfg, opts) {
     // Non-managed modes bypass the proxy for inference and must never fetch.
-    if (cfg.llm?.mode !== 'managed')
+    if (profileForMode(cfg.llm?.mode).servedConfig !== 'full')
         return;
     try {
         // URL construction lives INSIDE the try: a degenerate config (e.g. a
@@ -297,7 +298,7 @@ export function byokRouterModel() {
 export async function fetchToolLoadingMode(cfg, getBearer, opts) {
     byokToolLoading = undefined;
     byokRouter = undefined;
-    if (cfg.llm?.mode !== 'byok')
+    if (profileForMode(cfg.llm?.mode).servedConfig !== 'router-only')
         return undefined;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), opts?.timeoutMs ?? FETCH_TIMEOUT_MS);

package/dist/one-shot.js

@@ -1,7 +1,8 @@
 import chalk from 'chalk';
 import { loadConfig, resolveLocalBuild, resolveStandalone } from './config/loader.js';
 import { applyColorMode } from './renderer/color-mode.js';
-import { formatAttention, formatInfo } from './renderer/notice-shape.js';
+import { formatAttention, formatFailure, formatInfo } from './renderer/notice-shape.js';
+import { azureErrorNotice, azureErrorContext } from './connection/azure-errors.js';
 import { formatRoutingLine } from './renderer/routing-line.js';
 import { createOfflineAdtClient } from './sap/offline-adt-client.js';
 import { STANDALONE_ALIAS } from './tools/index.js';
@@ -14,9 +15,11 @@ import { newSession } from './session/schema.js';
 import { resolveModelRole } from './models/resolve.js';
 import { loadServerModelConfig, loadCustomerModelConfig, fetchToolLoadingMode } from './models/server-config.js';
 import { prefetchRouterPrompt } from './router/router-prompt.js';
+import { profileForMode } from './agent/connection-profile.js';
 import { createProviderForMode } from './agent/providers/factory.js';
 import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
+import { runLicenceCheck, licenceCheckHeaders } from './licence/licence-check.js';
 import { classifyPrompt, parseShortcut, rejectUnknownSkill } from './router/classifier.js';
 import { routingFailureFromResult, routingFailureOneShotLine, routingFallbackFromError } from './router/routing-failure.js';
 import { startThinkingHeartbeat, ROUTING_HEARTBEAT_THRESHOLDS } from './renderer/thinking-heartbeat.js';
@@ -32,6 +35,8 @@ import { todoEmitter } from './ui/todo-emitter.js';
 import { applyLocalBuildConfig, applyStandaloneFileTools } from './tools/local-build.js';
 import { getEffectiveWriteMode } from './repl/mode-cycle.js';
 import { initCredits } from './cost/credits-wire.js';
+import { startUsageFlushAtStartup } from './usage/usage-reporter.js';
+import { startSkillsCacheWarmup } from './skills/source-authed.js';
 import { formatTurnReceipt, turnSpendText } from './renderer/footer-line.js';
 import { snapshotTurnStart, computeTurnFacts } from './repl/post-turn-status.js';
 import { globalCredits } from './cost/credits.js';
@@ -105,7 +110,7 @@ export async function runOneShot(prompt, opts) {
         fetchToolLoadingMode(cfg, async () => (await (await getStore()).get()) ?? '', { timeoutMs: 1500 }),
         // 2026-10-02 — BYOK / ai-hub route on the laptop: prefetch the signed
         // router prompt (public manifest, no prompt data) under the same cap.
-        cfg.llm?.mode === 'byok' || cfg.llm?.mode === 'ai-hub' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
+        profileForMode(cfg.llm?.mode).router === 'direct' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
     ]);
     // B5 (2026-06-11) — one-shot is headless by design: a single turn, no
     // REPL, often piped (CI / battery). Any stdin prompt would hang forever
@@ -150,6 +155,74 @@ export async function runOneShot(prompt, opts) {
         console.error('No API key configured. Run `cspeach` (interactive) first to set one.');
         return 1;
     }
+    // Security batch item 1 — licence check at one-shot start, byok / ai-hub /
+    // local only. Managed makes no new call: the proxy checks every request.
+    if (cfg.llm.mode !== 'managed') {
+        const licence = await runLicenceCheck({ proxyUrl: cfg.proxy_url, apiKey: (await store.get()) ?? '' }, { headers: await licenceCheckHeaders(cfg.llm.mode).catch(() => ({})) });
+        if (!licence.allow) {
+            console.error(licence.message);
+            return 1;
+        }
+        if (licence.verdict === 'unknown')
+            console.error(formatInfo(licence.line).trimEnd());
+        // Azure tenant mode — one-shot never asks: a changed endpoint, removed
+        // settings or no settings refuse until a person runs cspeach interactively.
+        if (cfg.llm.mode === 'azure') {
+            const { refreshAzureConnection } = await import('./connection/startup.js');
+            const az = await refreshAzureConnection({
+                proxyUrl: cfg.proxy_url, apiKey: (await store.get()) ?? null, interactive: false,
+                print: (l) => console.error(l.trimEnd()), confirm: async () => false,
+            });
+            if (!az.verdict.allow) {
+                console.error(az.verdict.message.trimEnd());
+                return 1;
+            }
+            // Task 6b — the Microsoft sign-in, silently: one-shot never asks and
+            // never opens a browser; a sign-in that ended refuses with the line.
+            if (az.cached) {
+                const { ensureAzureSignIn } = await import('./auth/azure/sign-in.js');
+                const s = await ensureAzureSignIn(az.cached.connection, {
+                    interactive: false, ask: async () => false, print: (l) => console.error(l.trimEnd()),
+                    open: async () => { throw new Error('no browser in one-shot'); },
+                });
+                if (!s.ok) {
+                    console.error(s.message.trimEnd());
+                    return 1;
+                }
+                // Task 8b — the monthly limit, the same check as the REPL's per-turn
+                // gate, on the settings just loaded. A check that throws refuses with
+                // a plain line, never a crash.
+                const cached = az.cached;
+                let g;
+                try {
+                    g = await (await import('./connection/azure-gate.js')).azureGateCheck(() => cached);
+                }
+                catch {
+                    g = { allow: false, message: formatFailure({ what: "Could not check this month's CSPeach limit.", next: 'try again' }) };
+                }
+                if (!g.allow) {
+                    console.error(g.message.trimEnd());
+                    return 1;
+                }
+                if (g.line)
+                    console.error(formatInfo(g.line).trimEnd());
+            }
+        }
+        // Final review finding 1 — fill the skills cache for offline use after an
+        // ok verdict. Fire-and-forget: never awaited, never throws into start-up.
+        if (licence.verdict === 'ok') {
+            try {
+                void startSkillsCacheWarmup(cfg, licence.verdict);
+            }
+            catch { /* best effort */ }
+        }
+        // Security batch item 3 — send the usage counts still waiting from earlier
+        // runs. Fire-and-forget: never awaited, never throws into start-up.
+        try {
+            startUsageFlushAtStartup(cfg);
+        }
+        catch { /* best effort */ }
+    }
     // Credits (2026-09-16) — resolve the display mode before the turn runs, so
     // the per-turn cost JSONL records the ledger charge and nothing downstream
     // can print a dollar to a managed customer — including the one-line stderr
@@ -347,6 +420,17 @@ export async function runOneShot(prompt, opts) {
             ctx: { adt, sapAlias: alias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: alwaysDeclinePreviewHook, chunkEmitter: noticeEmitter, todoEmitter },
         });
     }
+    catch (err) {
+        // Azure tenant mode (Task 6b) — the sign-in ended mid-turn: never a
+        // browser or a question; the plain line and the fix, exit 1. Task 7: the
+        // rest of the azure message table too, and a refusal the SDK wrapped as
+        // "Connection error." is unwrapped (ruling 4). Null in every other mode.
+        const azure = azureErrorNotice(err, azureErrorContext());
+        if (!azure)
+            throw err;
+        console.error(('preformatted' in azure ? azure.preformatted : formatFailure(azure)).trimEnd());
+        return 1;
+    }
     finally {
         // Review M2 — even when the turn throws, the answer so far ends with its
         // newline (and any held colour reset) instead of being cut mid-line.