@cspeach/cli 1.1.24 → 1.1.26

package/dist/router/router-prompt.js

@@ -0,0 +1,121 @@
+/**
+ * Where BYOK (and ai-hub) get the skill router's instructions (2026-10-02,
+ * local routing).
+ *
+ * In BYOK the CLI classifies prompts on the laptop (router/byok-classifier.ts)
+ * — the prompt never goes to a CSPeach host. The instructions it classifies
+ * with must not drift from the proxy's and must be tamper-evident, so they
+ * come from:
+ *   1. the `router` entry of the SIGNED skill manifest
+ *      (manifest.cspeach.dev/v1.json), verified with the same ed25519 check as
+ *      skill bodies — the proxy publishes it from the same source
+ *      /v1/classify runs on (cspeach-proxy/src/classifier/router-core.ts) —
+ *      used only when its revision is the same or NEWER than the bundled copy
+ *      (review item 2: a stale published manifest never rolls back routing);
+ *   2. otherwise (older server without the entry, older revision, unknown
+ *      schema version, bad signature, manifest unreachable or slow) the copy
+ *      compiled into this CLI from that same source (router-core.ts) — never
+ *      the proxy.
+ * The manifest is public and carries no prompt data.
+ *
+ * Latency (review items 1 + N2): the manifest is prefetched at startup
+ * (capped, alongside the model-config fetch). Only the session's FIRST prompt
+ * waits for the read, at most `waitMs`; every later prompt uses the verified
+ * entry if the read has landed, else the bundled copy at once — even while a
+ * slow read is still in flight. After a failed read, a refresh runs in the
+ * background once the cool-down has passed; no prompt waits on it. Ctrl+C
+ * ends a wait at once.
+ */
+import { ManifestClient, DEFAULT_MANIFEST_URL } from '../skills/manifest-client.js';
+import { ROUTER_PROMPT, asRouterPrompt } from './router-core.js';
+/** After a failed manifest read, refresh in the background no sooner than this. */
+const RETRY_AFTER_MS = 5 * 60 * 1000;
+/** Longest a prompt waits for the session's first manifest read. */
+export const PROMPT_WAIT_MS = 1500;
+let cached = null;
+let failedAt = null;
+let inflight = null;
+/** True once a prompt has waited on the manifest this session (review N2). */
+let promptWaited = false;
+/** Test-only reset of the session cache. */
+export function __resetRouterPromptForTests() {
+    cached = null;
+    failedAt = null;
+    inflight = null;
+    promptWaited = false;
+}
+const bundled = () => ({ prompt: ROUTER_PROMPT, source: 'bundled' });
+function cancelled() {
+    const e = new Error('routing cancelled');
+    e.name = 'AbortError';
+    return e;
+}
+/** Start (or join) the one manifest read. Resolves, never rejects. */
+function startFetch(manifestUrl, now) {
+    if (!inflight) {
+        inflight = (async () => {
+            try {
+                const m = await new ManifestClient(manifestUrl).fetchAndVerifyManifest();
+                const entry = asRouterPrompt(m.router);
+                // Same-or-newer than the bundled copy, else the bundled copy (a
+                // definite answer for this manifest: cached, no refetch).
+                cached = entry && entry.revision >= ROUTER_PROMPT.revision ? { prompt: entry, source: 'manifest' } : bundled();
+                failedAt = null;
+                return cached;
+            }
+            catch {
+                // Unreachable, not yet published, or a signature failure (tampered).
+                failedAt = now();
+                return bundled();
+            }
+            finally {
+                inflight = null;
+            }
+        })();
+    }
+    return inflight;
+}
+/** Wait for `p` at most `ms`, or until `signal` aborts (rejects AbortError). */
+function waitFor(p, ms, signal) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => { cleanup(); resolve(bundled()); }, Math.max(0, ms));
+        timer.unref?.();
+        const onAbort = () => { cleanup(); reject(cancelled()); };
+        const cleanup = () => { clearTimeout(timer); signal?.removeEventListener('abort', onAbort); };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        p.then((v) => { cleanup(); resolve(v); }, () => { cleanup(); resolve(bundled()); });
+    });
+}
+/**
+ * Startup prefetch (byok / ai-hub). Waits at most `timeoutMs`; the read keeps
+ * going in the background if slower. Never throws.
+ */
+export async function prefetchRouterPrompt(opts) {
+    if (cached || failedAt !== null)
+        return;
+    await waitFor(startFetch(opts.manifestUrl ?? DEFAULT_MANIFEST_URL, Date.now), opts.timeoutMs);
+}
+/**
+ * The router instructions for one classification. Never throws, except an
+ * AbortError when `signal` aborts while waiting.
+ */
+export async function loadRouterPrompt(opts = {}) {
+    if (cached)
+        return cached;
+    if (opts.signal?.aborted)
+        throw cancelled();
+    const now = opts.now ?? Date.now;
+    const url = opts.manifestUrl ?? DEFAULT_MANIFEST_URL;
+    if (failedAt !== null) {
+        // A read already failed this session: never make a prompt wait again.
+        if (now() - failedAt >= RETRY_AFTER_MS)
+            void startFetch(url, now);
+        return bundled();
+    }
+    const read = startFetch(url, now);
+    // Only the first prompt of the session waits; later ones never do.
+    if (promptWaited)
+        return bundled();
+    promptWaited = true;
+    return waitFor(read, opts.waitMs ?? PROMPT_WAIT_MS, opts.signal);
+}

package/dist/router/routing-failure.js

@@ -1,17 +1,69 @@
+/**
+ * Skill-routing failure: what happened, in true words (live fix 2026-09-26).
+ *
+ * Fix 9: the REPL used to print "Skill routing is offline · CSPeach service
+ * unreachable: This operation was aborted" when the classify call merely
+ * timed out (the proxy was healthy). The wording now comes from the
+ * classifier's machine-readable kind — never "offline"/"unreachable" for a
+ * timeout. Used by the Ink REPL, the classic REPL and one-shot.
+ */
+import { localRulesResult } from './classifier.js';
 /** The failure behind an offline (fallback) classify result, or null when routing worked. */
 export function routingFailureFromResult(c) {
     if (!c.offline)
         return null;
-    return c.transport_kind === 'timeout' ? { kind: 'timeout' } : { kind: 'network' };
+    if (c.transport_kind === 'timeout')
+        return { kind: 'timeout' };
+    if (c.transport_kind === 'http' && typeof c.http_status === 'number')
+        return { kind: 'http', status: c.http_status };
+    if (c.transport_kind === 'failed')
+        return { kind: 'failed' };
+    return { kind: 'network' };
 }
-/** The failure behind a thrown classify error (HTTP), or null for any other error. */
+/** The failure behind a thrown classify error (HTTP / unreadable body), or null for any other error. */
 export function routingFailureFromError(err) {
     // Duck-typed (not instanceof) so a re-loaded module instance still matches.
     const e = err;
-    if (e && e.transport_kind === 'http' && typeof e.status === 'number')
+    if (e && e.transport_kind === 'http' && typeof e.status === 'number') {
         return { kind: 'http', status: e.status };
+    }
+    if (e && e.transport_kind === 'failed')
+        return { kind: 'failed' };
     return null;
 }
+/**
+ * Live fix 2026-10-02 — a classify failure (the proxy answered HTTP 500 for a
+ * prompt its router answered in prose; an unreadable body; anything else
+ * classifyPrompt throws) no longer ends the turn or escapes one-shot as
+ * "unhandled error". Every routing path (Ink REPL, classic REPL, one-shot)
+ * takes this result instead: the bundled local-rules pick at low confidence,
+ * marked offline with the failure kind, so the existing offline handling
+ * runs — the low-confidence path (picker / one-shot top-1), one notice, and
+ * fix 10's "stay in the active skill" mid-skill.
+ *
+ * Returns null (caller keeps its own handling) for a missing API key, a user
+ * cancel (AbortError), and the slash-guard CLI bug, which must stay loud.
+ */
+export function routingFallbackFromError(err, prompt) {
+    const e = err;
+    if (e?.message === 'no_api_key')
+        return null;
+    if (e?.name === 'AbortError')
+        return null;
+    if (typeof e?.message === 'string' && e.message.startsWith('slash command reached the classifier'))
+        return null;
+    const f = routingFailureFromError(err) ?? { kind: 'failed' };
+    return {
+        ...localRulesResult(prompt),
+        offline: true,
+        transport_kind: f.kind === 'http' ? 'http' : 'failed',
+        ...(f.kind === 'http' ? { http_status: f.status } : {}),
+    };
+}
+/** "Couldn't pick a skill automatically (HTTP 500)" — the 2026-10-02 fallback headline. */
+function couldNotPick(f) {
+    return `Couldn't pick a skill automatically${f.kind === 'http' ? ` (HTTP ${f.status})` : ''}`;
+}
 /** Headline for the notice: "Skill routing timed out" etc. */
 export function routingFailureText(f) {
     switch (f.kind) {
@@ -20,15 +72,24 @@ export function routingFailureText(f) {
         case 'timeout': return 'Skill routing timed out';
         case 'network': return "Skill routing couldn't reach the CSPeach service";
         case 'http': return `Skill routing failed (HTTP ${f.status})`;
+        case 'failed': return 'Skill routing failed';
     }
 }
 /** The attention notice: headline, plus the real cause for network failures. */
 export function routingFailureNotice(f, transportError) {
+    // 2026-10-02: an HTTP / other classify failure now continues on local
+    // rules (routingFallbackFromError) — say so, and how to choose.
+    if (f.kind === 'http' || f.kind === 'failed') {
+        return { text: couldNotPick(f), fact: 'routed by local rules — start with /skill to choose' };
+    }
     const text = routingFailureText(f);
     return f.kind === 'network' && transportError ? { text, fact: transportError } : { text };
 }
 /** One-shot's dim stderr line (the turn continues on the bundled local rules). */
 export function routingFailureOneShotLine(f, transportError) {
+    if (f.kind === 'http' || f.kind === 'failed') {
+        return `[${couldNotPick(f)} — routed by local rules. Start with /skill to choose.]`;
+    }
     const n = routingFailureNotice(f, transportError);
     return `[${n.text}${n.fact ? `: ${n.fact}` : ''} — routed by local rules]`;
 }
@@ -38,6 +99,7 @@ function routingFailureShort(f) {
         case 'timeout': return 'Routing timed out';
         case 'network': return "Routing couldn't reach the CSPeach service";
         case 'http': return `Routing failed (HTTP ${f.status})`;
+        case 'failed': return 'Routing failed';
     }
 }
 /**