@cspeach/cli 1.1.25 → 1.1.26

package/dist/one-shot.js

@@ -13,11 +13,12 @@ import { makeSessionId, saveSession } from './session/store.js';
 import { newSession } from './session/schema.js';
 import { resolveModelRole } from './models/resolve.js';
 import { loadServerModelConfig, loadCustomerModelConfig, fetchToolLoadingMode } from './models/server-config.js';
+import { prefetchRouterPrompt } from './router/router-prompt.js';
 import { createProviderForMode } from './agent/providers/factory.js';
 import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
 import { classifyPrompt, parseShortcut, rejectUnknownSkill } from './router/classifier.js';
-import { routingFailureFromResult, routingFailureOneShotLine } from './router/routing-failure.js';
+import { routingFailureFromResult, routingFailureOneShotLine, routingFallbackFromError } from './router/routing-failure.js';
 import { startThinkingHeartbeat, ROUTING_HEARTBEAT_THRESHOLDS } from './renderer/thinking-heartbeat.js';
 import { setRenderingOverride, setHeadlessOverride, setOneShotOverride } from './renderer/tty.js';
 import { resolveRenderingMode } from './renderer/rendering-mode.js';
@@ -96,6 +97,9 @@ export async function runOneShot(prompt, opts) {
         loadCustomerModelConfig(cfg, async () => (await (await getStore()).get()) ?? '', { timeoutMs: 1500 }),
         // Task 16 (F13) — BYOK reads only the served tool_loading (signed in only).
         fetchToolLoadingMode(cfg, async () => (await (await getStore()).get()) ?? '', { timeoutMs: 1500 }),
+        // 2026-10-02 — BYOK / ai-hub route on the laptop: prefetch the signed
+        // router prompt (public manifest, no prompt data) under the same cap.
+        cfg.llm?.mode === 'byok' || cfg.llm?.mode === 'ai-hub' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
     ]);
     // B5 (2026-06-11) — one-shot is headless by design: a single turn, no
     // REPL, often piped (CI / battery). Any stdin prompt would hang forever
@@ -224,7 +228,13 @@ export async function runOneShot(prompt, opts) {
                 console.error('No API key configured. Run `cspeach` (interactive) first to set one.');
                 return 1;
             }
-            throw err;
+            // Live fix 2026-10-02 — a classify failure (proxy HTTP 500, an
+            // unreadable body) escaped as "cspeach: unhandled error". Continue on
+            // the bundled local rules instead; the offline line below says so.
+            const fallback = routingFallbackFromError(err, body);
+            if (!fallback)
+                throw err;
+            c = fallback;
         }
         finally {
             routingBeat.stop();

package/dist/projects/plan-lane.js

@@ -108,6 +108,53 @@ export function checkLaneConsistency(content, rec) {
     }
     return null;
 }
+/* ── deploy is a required step of a UI lane (owner, 2026-10-02) ─────────── */
+/**
+ * A rap lane with a UI, and the `none` lane (a UI on an already published
+ * service), build an app that runs on SAP — its plan must deploy it. cap is
+ * out (the BTP deploy is not built); abap-report has no UI.
+ */
+export function laneRequiresDeploy(rec) {
+    const { backend, ui } = rec.final;
+    return (backend === 'rap' && ui !== 'none') || backend === 'none';
+}
+/** The deploy phase of a UI: ui layer, /abap-fiori-build, id `ui.deploy` (or `<app>.deploy`). */
+export function isDeployPhase(p) {
+    return p.layer === 'ui' && p.delegateTo === 'abap-fiori-build' && /(^|\.)deploy$/.test(p.id);
+}
+/** The developer's recorded reason for not deploying (phases[ui.build].ui.deployOptOut), if any. */
+export function deployOptOutOf(phases) {
+    for (const p of phases) {
+        const why = p.ui?.deployOptOut?.trim();
+        if (why)
+            return why;
+    }
+    return undefined;
+}
+/**
+ * Refuse a UI-lane plan with no deploy phase (and no recorded opt-out), or
+ * whose deploy phase does not wait for a UI build phase. Returns a plain
+ * refusal or null. Checked at save; a phase write-back may not remove it.
+ */
+export function checkRequiredDeploy(content, rec) {
+    if (!laneRequiresDeploy(rec))
+        return null;
+    const deploys = content.phases.filter(isDeployPhase);
+    if (deploys.length === 0) {
+        if (deployOptOutOf(content.phases))
+            return null;
+        return ('This lane builds an app that runs on SAP, so the plan needs a ui.deploy phase (deploy the app to the ABAP ' +
+            'repository, delegateTo abap-fiori-build, layer ui) after ui.build. If the developer does not want it deployed, ' +
+            'record their words in phases[ui.build].ui.deployOptOut. Re-run /abap-plan.');
+    }
+    const builds = new Set(content.phases.filter((p) => p.layer === 'ui' && !isDeployPhase(p)).map((p) => p.id));
+    for (const d of deploys) {
+        if (!d.entryCriteria.some((id) => builds.has(id))) {
+            return `Phase ${cardLine(d.id)} must run after ui.build — list the UI build phase in its entryCriteria. Re-run /abap-plan.`;
+        }
+    }
+    return null;
+}
 /**
  * Resume / continuation gate: read the plan's lane with its recorded sha,
  * re-validate it and check the stored phases against it. Lane-less plans pass

package/dist/projects/plan-run.js

@@ -372,6 +372,14 @@ g = getGlyphs()) {
     if (deployed?.work?.deployedUrl) {
         lines.push(`App deployed: ${deployed.work.deployedUrl}`);
     }
+    else if (phases.some((p) => p.layer === 'ui' && p.delegateTo === 'abap-fiori-build' && p.ui !== undefined)) {
+        // 2026-10-02 — deploy is a chained step of a UI plan: finishing without a
+        // deployed app is said out loud, never left to silence.
+        const optOut = phases.map((p) => p.ui?.deployOptOut?.trim()).find((w) => !!w);
+        lines.push(optOut
+            ? `${g.info} Deploy skipped by the developer: ${sanitizeControlChars(optOut)}`
+            : `${g.attention} The app was not deployed to SAP — it runs only in local preview. Deploy it with /abap-fiori-build (Step 10, fiori_deploy) or record why not.`);
+    }
     lines.push('Consider /abap-preflight on the produced transport(s) before release.');
     return lines;
 }

package/dist/projects/plan-schema.js

@@ -78,6 +78,8 @@ const planPhaseUiSchema = z.object({
     floorplan: z.enum(PLAN_UI_FLOORPLANS).optional(),
     appId: z.string().min(1).optional(),
     appTitle: z.string().min(1).optional(),
+    // The developer's own words for not deploying (checkRequiredDeploy, plan-lane.ts).
+    deployOptOut: z.string().min(1).optional(),
 });
 /** Keep in sync with PlanAuditState in types.ts. 'warn' is the non-blocking
  * tier (confidence-tiered redesign, 2026-07-08) — persisted literally so a

package/dist/projects/save-command.js

@@ -18,7 +18,7 @@ import { renderEmailTemplate } from './email-template.js';
 import { writePlanHandover } from './handover-md.js';
 import { ensureWorkspace, resolveWorkspacePath } from './workspace.js';
 import { askYesNo, isYes } from './yes-no.js';
-import { checkLaneConsistency, LANE_CHANGED_AT_CREATE, readPlanLane } from './plan-lane.js';
+import { checkLaneConsistency, checkRequiredDeploy, LANE_CHANGED_AT_CREATE, readPlanLane } from './plan-lane.js';
 const SKILL_REGISTRY = {
     'abap-spec-gap': {
         artefactType: 'spec-gap',
@@ -343,7 +343,8 @@ export async function runSaveCommand(args) {
             args.log('[save] The plan was not saved.');
             return null;
         }
-        const conflict = checkLaneConsistency(planExtract.content, lr.rec);
+        // 2026-10-02 — a UI lane must deploy (or record the developer's opt-out).
+        const conflict = checkLaneConsistency(planExtract.content, lr.rec) ?? checkRequiredDeploy(planExtract.content, lr.rec);
         if (conflict) {
             args.log('');
             args.log(`[save] ${conflict}`);

package/dist/renderer/footer-line.js

@@ -80,18 +80,24 @@ export function formatFooterLine(s, width) {
 export function turnSpendText(p) {
     if (creditsActive()) {
         const c = p.credits;
-        if (!c || c.chargedThisTurn === null)
+        // 2026-10-02: the whole user request (every model round), not its last round.
+        if (!c || c.chargedThisRequest === null)
             return CREDITS_PENDING;
-        return formatCredits(c.chargedThisTurn, c.unitLabel);
+        return formatCredits(c.chargedThisRequest, c.unitLabel);
     }
     return p.costThisTurn != null ? formatCost(p.costThisTurn) : '';
 }
-/** `/<skill> · <tokens> tokens · <this-turn spend> · <time>` — one dim line, no newline. */
+/**
+ * `/<skill> · <tokens> tokens · <this-turn spend> · <time>` — one dim line, no newline.
+ * 2026-10-02 (owner): in credits mode (a managed customer) the token count is
+ * dropped — credits only, so nobody works out "credits per token".
+ */
 export function formatTurnReceipt(p) {
     const parts = [];
     if (p.skill && p.skill !== '(none)')
         parts.push(p.skill.startsWith('/') ? p.skill : `/${p.skill}`);
-    parts.push(`${p.tokens.toLocaleString('en-US')} tokens`);
+    if (!creditsActive())
+        parts.push(`${p.tokens.toLocaleString('en-US')} tokens`);
     if (p.spend)
         parts.push(p.spend);
     if (p.ms > 0)

package/dist/renderer/status-footer.js

@@ -71,13 +71,14 @@ export function formatStatusFooter(params) {
     const shortSession = sessionId.slice(0, 8);
     const skillDisplay = skill.startsWith('/') ? skill : `/${skill}`;
     const turns = `${turnCount} turn${turnCount === 1 ? '' : 's'}`;
-    const tokStr = tokens.toLocaleString() + ' tok this turn';
-    const cachedStr = cachedTokens > 0 ? `${cachedTokens.toLocaleString()} cached` : '';
-    const elapsed = elapsedMs > 0 ? `${(elapsedMs / 1000).toFixed(1)}s` : '';
     // Credits mode: the whole spend story collapses into ONE customer-facing
     // segment (turn · session · balance) in place of the two dollar segments.
     // (Classic receipt only — the Ink 'turn' variant returned above.)
+    // 2026-10-02 (owner): and no token/cached counts — credits only.
     const inCredits = creditsActive();
+    const tokStr = inCredits ? '' : tokens.toLocaleString() + ' tok this turn';
+    const cachedStr = !inCredits && cachedTokens > 0 ? `${cachedTokens.toLocaleString()} cached` : '';
+    const elapsed = elapsedMs > 0 ? `${(elapsedMs / 1000).toFixed(1)}s` : '';
     const costTurnStr = inCredits
         ? (credits ? formatCreditsLine(credits) : CREDITS_PENDING)
         : (costThisTurn != null ? formatCost(costThisTurn) : '');
@@ -92,7 +93,7 @@ export function formatStatusFooter(params) {
         sapAlias,
         skillDisplay,
         turns,
-        tokStr,
+        ...(tokStr ? [tokStr] : []),
         ...(costTurnStr ? [costTurnStr] : []),
         ...(cachedStr ? [cachedStr] : []),
         ...(costSessStr ? [costSessStr] : []),

package/dist/renderer/tool-labels.js

@@ -192,6 +192,7 @@ const RULES = {
     fiori_scaffold: (a) => ({ verb: 'Scaffolded app', object: shortLeft(str(a['basePath']) ?? '') }),
     fiori_apply: (a) => ({ verb: 'Applied', object: shortRight([str(a['entry']), str(a['appDir'])].filter(Boolean).join(' · ')) }),
     fiori_list: () => ({ verb: 'Listed patterns', object: '' }),
+    fiori_deploy: (a) => ({ verb: str(a['mode']) === 'deploy' ? 'Deploy app' : 'Deploy test', object: shortRight(str(a['appDir']) ?? '') }),
     fiori_deploy_config: (a) => ({ verb: 'Deploy config', object: shortRight(str(a['name']) ?? str(a['appDir']) ?? '') }),
     fiori_fe_extend: (a) => ({ verb: 'Extended app', object: shortRight([str(a['op']), str(a['basePath'])].filter(Boolean).join(' · ')) }),
     fiori_preview: (a) => ({ verb: 'Preview', object: shortRight([str(a['action']) ?? 'start', str(a['appDir'])].filter(Boolean).join(' ')) }),
@@ -258,7 +259,7 @@ const PRESENT = {
     'Read playbook': 'Reading playbook', 'Read convention': 'Reading convention', 'Merged CCA': 'Merging CCA',
     'Merged progress': 'Merging progress', 'Checked background': 'Checking background',
     Subagent: 'Running subagent', Reader: 'Running reader', 'Drafted schedule': 'Drafting schedule', Applied: 'Applying',
-    'Listed patterns': 'Listing patterns', 'Deploy config': 'Writing deploy config', 'Extended app': 'Extending app',
+    'Listed patterns': 'Listing patterns', 'Deploy config': 'Writing deploy config', 'Deploy app': 'Deploying app', 'Deploy test': 'Test-deploying app', 'Extended app': 'Extending app',
     Preview: 'Preview', 'Searched samples': 'Searching samples', 'Read sample': 'Reading sample',
     'Audited metadata': 'Auditing metadata', 'Extended model': 'Extending model',
     'Checked capability': 'Checking capability',

package/dist/repl.js

@@ -38,6 +38,7 @@ import { makeSessionId, saveSession, sessionSaved } from './session/store.js';
 import { newSession } from './session/schema.js';
 import { resolveModelRole } from './models/resolve.js';
 import { loadServerModelConfig, loadCustomerModelConfig, fetchToolLoadingMode } from './models/server-config.js';
+import { prefetchRouterPrompt } from './router/router-prompt.js';
 import { repinResumedSessionModel } from './session/repin-model.js';
 import { computeCost } from './cost/pricing.js';
 import { formatSessionSpendValue } from './repl/session-spend-line.js';
@@ -60,7 +61,7 @@ import { enqueueSteering } from './agent/steering-queue.js';
 import { classifyPrompt, parseShortcut, rejectUnknownSkill } from './router/classifier.js';
 import { pipedRoutingPick } from './router/piped-routing.js';
 import { decideRouting } from './router/routing-decision.js';
-import { routingFailureFromError, routingFailureFromResult, routingFailureNotice, routingFailureOutcome, routingFailureText } from './router/routing-failure.js';
+import { routingFailureFromError, routingFailureFromResult, routingFailureNotice, routingFailureOutcome, routingFailureText, routingFallbackFromError } from './router/routing-failure.js';
 import { coachingPickerClassic } from './ui/coaching-picker-classic.js';
 import { coachingPickerEmitter } from './ui/coaching-picker-emitter.js';
 import { globalStore as sapStateStore } from './ui/sap-state-store.js';
@@ -553,6 +554,9 @@ export async function runRepl(opts) {
         loadCustomerModelConfig(cfg, async () => apiKey ?? '', { timeoutMs: 1500 }),
         // Task 16 (F13) — BYOK reads only the served tool_loading (signed in only).
         fetchToolLoadingMode(cfg, async () => apiKey ?? '', { timeoutMs: 1500 }),
+        // 2026-10-02 — BYOK / ai-hub route on the laptop: prefetch the signed
+        // router prompt (public manifest, no prompt data) under the same cap.
+        cfg.llm?.mode === 'byok' || cfg.llm?.mode === 'ai-hub' ? prefetchRouterPrompt({ timeoutMs: 1500 }) : Promise.resolve(),
     ]);
     // Credits (2026-09-16) — resolve ONCE, before any cost figure can render.
     // A managed customer is billed in credits at a multiplier we do not
@@ -1318,8 +1322,16 @@ export async function runRepl(opts) {
                             }, { signal: routingCtl.signal });
                         }
                         catch (err) {
-                            if (!routingCtl.signal.aborted)
-                                throw err;
+                            if (!routingCtl.signal.aborted) {
+                                // Live fix 2026-10-02 — a classify failure (proxy HTTP 500,
+                                // an unreadable body) dropped the turn. Continue on the
+                                // bundled local rules: the offline handling below prints one
+                                // notice, then the low-confidence picker (or fix 10's stay).
+                                const fallback = routingFallbackFromError(err, prompt);
+                                if (!fallback)
+                                    throw err;
+                                c = fallback;
+                            }
                         }
                         finally {
                             routingAbort = null;
@@ -1467,6 +1479,8 @@ export async function runRepl(opts) {
                         // Task 9 — run-lease identity + takeover prompt (concurrent
                         // resume guard; inkAwarePrompt answers '' in headless = decline).
                         sessionId: session.id,
+                        // 2026-10-02 — deploy card on a direct resume into ui.deploy.
+                        sapAlias: session.sap_system ?? undefined,
                         prompt: inkAwarePrompt,
                         confirm: inkAwareConfirm,
                         log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
@@ -1494,6 +1508,7 @@ export async function runRepl(opts) {
                             phaseIds: planResume.reauditPhaseIds ?? [planResume.reauditPhaseId],
                             sessionId: session.id,
                             cwd: process.cwd(),
+                            sapAlias: session.sap_system ?? undefined,
                             mode: planResume.effectiveMode ?? 'step',
                             modeFlag: planResume.mode,
                             // Off-switch (I3) — footer honesty on re-audit boards; (I2) the
@@ -1833,6 +1848,7 @@ export async function runRepl(opts) {
                         executedPhaseId: planResume.nextPhaseId,
                         sessionId: session.id,
                         cwd: process.cwd(),
+                        sapAlias: session.sap_system ?? undefined,
                         mode: planResume.effectiveMode ?? 'step',
                         modeFlag: planResume.mode,
                         // Off-switch — skips the normal post-phase audit when 'off'; the
@@ -1903,6 +1919,7 @@ export async function runRepl(opts) {
                         outcome: planOutcome,
                         sessionId: session.id,
                         cwd: process.cwd(),
+                        sapAlias: session.sap_system ?? undefined,
                         subagentDispatches: planSubagentDispatches,
                         prompt: inkAwarePrompt,
                         confirm: inkAwareConfirm,
@@ -3077,11 +3094,22 @@ export async function runRepl(opts) {
             }
             else {
                 try {
-                    const c = await classifyPrompt(prompt, {
-                        sap_system: selectedAlias,
-                        last_skill: session.last_skill ?? null,
-                        last_object: extractedObject ?? session.last_object ?? null,
-                    });
+                    let c;
+                    try {
+                        c = await classifyPrompt(prompt, {
+                            sap_system: selectedAlias,
+                            last_skill: session.last_skill ?? null,
+                            last_object: extractedObject ?? session.last_object ?? null,
+                        });
+                    }
+                    catch (err) {
+                        // Live fix 2026-10-02 — same as the Ink path: a classify failure
+                        // continues on the bundled local rules instead of ending the turn.
+                        const fallback = routingFallbackFromError(err, prompt);
+                        if (!fallback)
+                            throw err;
+                        c = fallback;
+                    }
                     if (c.screenshot)
                         console.log(formatInfo(`Screenshot: ${c.screenshot}`).trimEnd());
                     // Fix 10 (2026-09-26): routing failed mid-skill → stay in the
@@ -3214,6 +3242,8 @@ export async function runRepl(opts) {
                     configAudit: cfg.plan_audit,
                     // Task 9 — run-lease identity + takeover prompt (classic mirror).
                     sessionId: session.id,
+                    // 2026-10-02 — deploy card on a direct resume into ui.deploy.
+                    sapAlias: session.sap_system ?? undefined,
                     prompt: inkAwarePrompt,
                     confirm: inkAwareConfirm,
                     log: (...lines) => lines.forEach((l) => console.log(l)),
@@ -3240,6 +3270,7 @@ export async function runRepl(opts) {
                         phaseIds: planResume.reauditPhaseIds ?? [planResume.reauditPhaseId],
                         sessionId: session.id,
                         cwd: process.cwd(),
+                        sapAlias: session.sap_system ?? undefined,
                         mode: planResume.effectiveMode ?? 'step',
                         modeFlag: planResume.mode,
                         // Off-switch (I3/I2) — classic mirror; see the Ink re-audit site.
@@ -3551,6 +3582,7 @@ export async function runRepl(opts) {
                     executedPhaseId: planResume.nextPhaseId,
                     sessionId: session.id,
                     cwd: process.cwd(),
+                    sapAlias: session.sap_system ?? undefined,
                     mode: planResume.effectiveMode ?? 'step',
                     modeFlag: planResume.mode,
                     // Off-switch (I3/I2) — classic mirror of the Ink chain call: skip
@@ -3620,6 +3652,7 @@ export async function runRepl(opts) {
                     outcome: planOutcome,
                     sessionId: session.id,
                     cwd: process.cwd(),
+                    sapAlias: session.sap_system ?? undefined,
                     subagentDispatches: planSubagentDispatches,
                     prompt: inkAwarePrompt,
                     confirm: inkAwareConfirm,

package/dist/router/byok-classifier.js

@@ -0,0 +1,159 @@
+/**
+ * Skill routing without our server (2026-10-02): BYOK and ai-hub.
+ *
+ * The site promises that in BYOK (the customer's own Anthropic key) prompts
+ * never touch CSPeach servers, and that in ai-hub they stay in the customer's
+ * SAP BTP landscape. Until today classifyPrompt POSTed every free-text prompt
+ * — plus pasted screenshots, the SAP alias and the last skill — to
+ * {proxy}/v1/classify in every mode, and the proxy classified it on CSPeach's
+ * key. Now:
+ *   - BYOK: one Messages API call, direct to the model API, with the
+ *     customer's keychain key; router model = the one CSPeach serves
+ *     (roles.router from the public /v1/model-config), with a default.
+ *   - ai-hub (review item 3): the same call through the customer's own hub
+ *     (llm.ai_hub_base_url, their token, their model alias), with today's
+ *     field set only — no output_config, like the ai-hub provider.
+ *
+ * Same quality as managed: the request and its handling come from
+ * router-core.ts, a verbatim copy of the proxy's router core (system prompt
+ * from the signed manifest or the bundled copy — router-prompt.ts; JSON
+ * schema via structured outputs; thinking off; max_tokens 600; self-heal
+ * without output_config on a 400; one retry on an unparseable answer; then the
+ * low-confidence fallback).
+ *
+ * Latency (review item 1): ONE overall deadline covers every call (self-heal
+ * and retry included); past it the caller routes by local rules with the
+ * timeout notice. Ctrl+C aborts the in-flight call at once.
+ *
+ * Nothing in here talks to a CSPeach host. The only other network read on
+ * this path is the public signed manifest (router-prompt.ts), which carries
+ * no prompt data.
+ */
+import Anthropic from '@anthropic-ai/sdk';
+import keychain from '../auth/keychain.js';
+import { byokRouterModel } from '../models/server-config.js';
+import { addRouterSpend } from '../cost/router-spend.js';
+import { loadRouterPrompt } from './router-prompt.js';
+import { ROUTER_UNPARSEABLE_RESULT, buildRouterRequest, runRouterCalls, } from './router-core.js';
+/** Same keychain entry the BYOK provider reads (byok-provider.ts) and login writes. */
+export const BYOK_KEYCHAIN_SERVICE = 'cspeach.anthropic';
+export const BYOK_KEYCHAIN_ACCOUNT = 'api-key';
+/** Same keychain entry the ai-hub provider reads. */
+const AI_HUB_KEYCHAIN_SERVICE = 'cspeach.ai-hub';
+const AI_HUB_KEYCHAIN_ACCOUNT = 'token';
+/** The ai-hub provider's default alias (ai-hub-provider.ts). */
+const AI_HUB_DEFAULT_MODEL = 'anthropic--claude-opus-4-6';
+/** Per model call; the SDK retries a timeout / dropped connection once (maxRetries 1). */
+const ROUTER_CALL_TIMEOUT_MS = 8000;
+/** One deadline for the whole routing step (every call, self-heal and retry included). */
+const ROUTER_DEADLINE_MS = 10_000;
+let deadlineOverride;
+/** Test-only: shorten the overall routing deadline (undefined = default). */
+export function __setRouterDeadlineForTests(ms) {
+    deadlineOverride = ms;
+}
+let selfHealWarned = false;
+/** Test-only: re-arm the once-per-session self-heal warning. */
+export function __resetRouterWarnForTests() {
+    selfHealWarned = false;
+}
+export class ByokRouterFailure extends Error {
+    failure;
+    constructor(failure) {
+        super(`router call failed (${failure.kind})`);
+        this.failure = failure;
+        this.name = 'ByokRouterFailure';
+    }
+}
+function causeOf(err) {
+    const e = err;
+    if (e?.cause)
+        return `${e.cause.code ?? e.cause.errno ?? 'unknown'}${e.cause.message ? `: ${e.cause.message}` : ''}`;
+    return e?.message ?? String(err);
+}
+function cancelled() {
+    const e = new Error('routing cancelled');
+    e.name = 'AbortError';
+    return e;
+}
+/**
+ * Classify one prompt on the laptop. Returns the router's answer (or the
+ * low-confidence fallback when it gave no parseable answer twice). Throws:
+ * AbortError on a user cancel; ByokRouterFailure for a model-API failure or
+ * the overall deadline; an Error when no key / token is configured.
+ */
+export async function classifyByok(prompt, context, images, opts = {}) {
+    const target = opts.target ?? { mode: 'byok' };
+    if (opts.signal?.aborted)
+        throw cancelled();
+    const key = target.mode === 'byok'
+        ? await keychain.getPassword(BYOK_KEYCHAIN_SERVICE, BYOK_KEYCHAIN_ACCOUNT)
+        : await keychain.getPassword(AI_HUB_KEYCHAIN_SERVICE, AI_HUB_KEYCHAIN_ACCOUNT);
+    if (!key) {
+        throw new Error(target.mode === 'byok'
+            ? 'BYOK Anthropic API key not configured — run: cspeach config set llm.byok_key <key>'
+            : 'AI Hub token not configured — run: cspeach config set llm.ai_hub_token <token>');
+    }
+    // One controller for the whole step: the user's cancel OR the deadline.
+    const ctrl = new AbortController();
+    let deadlineHit = false;
+    const timer = setTimeout(() => { deadlineHit = true; ctrl.abort(); }, deadlineOverride ?? ROUTER_DEADLINE_MS);
+    timer.unref?.();
+    const onUserAbort = () => ctrl.abort();
+    opts.signal?.addEventListener('abort', onUserAbort, { once: true });
+    const userCancelled = () => opts.signal?.aborted === true;
+    try {
+        const { prompt: routerPrompt } = await loadRouterPrompt({ signal: ctrl.signal });
+        const model = target.mode === 'byok' ? byokRouterModel() : (target.modelAlias ?? AI_HUB_DEFAULT_MODEL);
+        const full = buildRouterRequest(model, prompt, context, images, routerPrompt);
+        // ai-hub: today's field set only (the hub has no flag for newer fields).
+        const request = target.mode === 'byok'
+            ? full
+            : (({ output_config: _dropped, ...rest }) => rest)(full);
+        const sdk = new Anthropic({
+            apiKey: key,
+            maxRetries: 1,
+            timeout: ROUTER_CALL_TIMEOUT_MS,
+            ...(target.mode === 'ai-hub' ? { baseURL: target.baseURL } : {}),
+        });
+        const { result } = await runRouterCalls((req) => sdk.messages.create(req, { signal: ctrl.signal }), request, {
+            // Once per session — a model that rejects structured outputs would
+            // otherwise print this on every prompt.
+            warn: (message, detail) => {
+                if (selfHealWarned)
+                    return;
+                selfHealWarned = true;
+                console.warn(message, detail);
+            },
+            // The customer's own bill (BYOK) — counted in the USD meter as each
+            // call finishes, so a deadline / cancel after call 1 keeps call 1
+            // (review S1). ai-hub is billed by their BTP account at rates we
+            // don't know: not priced here.
+            onCall: (c) => { if (target.mode === 'byok')
+                addRouterSpend(model, c.usage); },
+        });
+        return result ?? { ...ROUTER_UNPARSEABLE_RESULT, alternates: [] };
+    }
+    catch (err) {
+        if (userCancelled())
+            throw cancelled();
+        if (deadlineHit)
+            throw new ByokRouterFailure({ kind: 'timeout', detail: 'routing deadline' });
+        if (err instanceof Anthropic.APIUserAbortError)
+            throw cancelled();
+        if (err instanceof Anthropic.APIConnectionTimeoutError) {
+            throw new ByokRouterFailure({ kind: 'timeout', detail: causeOf(err) });
+        }
+        if (err instanceof Anthropic.APIConnectionError) {
+            throw new ByokRouterFailure({ kind: 'connection', detail: causeOf(err) });
+        }
+        if (err instanceof Anthropic.APIError && typeof err.status === 'number') {
+            throw new ByokRouterFailure({ kind: 'http', status: err.status });
+        }
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+        opts.signal?.removeEventListener('abort', onUserAbort);
+    }
+}