@cspeach/cli 1.1.25 → 1.1.27

package/dist/router/router-core.js

@@ -0,0 +1,307 @@
+// GENERATED COPY — do not edit here. Edit cspeach-proxy/src/classifier/router-core.ts,
+// then run `npx tsx scripts/sync-router-core.ts` (prebuild runs it too).
+// src/router/__tests__/router-core-pin.test.ts fails when this copy drifts.
+// ---- verbatim copy of cspeach-proxy/src/classifier/router-core.ts below ----
+// ROUTER CORE — the single source of the skill router's instructions and call
+// behaviour (2026-10-02, BYOK local routing).
+//
+// Why this file exists: in BYOK mode the customer's prompt must never reach a
+// CSPeach server, so the CLI classifies on the laptop, direct to the model
+// with the customer's own key. To keep that routing exactly as good as the
+// managed /v1/classify route, both sides run THIS code:
+//   - the proxy imports it (classifier/haiku.ts, and skills/skill-manifest.ts,
+//     which publishes ROUTER_PROMPT inside the signed skill manifest);
+//   - the CLI carries a byte-identical copy at
+//     cspeach-cli/src/router/router-core.ts (scripts/sync-router-core.ts
+//     writes it; a CLI test fails on any drift).
+//
+// RULES for this file: NO imports (it must compile, unchanged, in both
+// packages); keep it plain TypeScript that passes both tsconfigs. Editing the
+// skill list or routing notes here changes managed routing (after a proxy
+// deploy), the signed manifest (after publish-skill-manifest) and the CLI's
+// bundled fallback (after sync-router-core + a CLI release).
+/**
+ * Version of the router entry's SHAPE in the signed manifest
+ * ({ schema_version, system, screenshot_note }). A CLI uses a manifest router
+ * entry only when it knows this version; otherwise it keeps its bundled copy.
+ * Bump it only when the shape or the request contract changes — not for text
+ * edits.
+ */
+export const ROUTER_SCHEMA_VERSION = 1;
+/**
+ * Revision of the router TEXT and request (2026-10-02, review item 2). Bump
+ * it on EVERY change to SKILL_DESCRIPTIONS, the routing notes, ROUTER_SYSTEM,
+ * SCREENSHOT_NOTE or buildRouterRequest. A BYOK CLI prefers the signed
+ * manifest's router entry only when its revision is the same or newer than
+ * its own bundled copy — so a stale published manifest never rolls a newer
+ * CLI back to older routing. router-revision-pin.test.ts fails until bumped.
+ */
+export const ROUTER_REVISION = 1;
+// 2026-06-12: keep in lockstep with .claude/skills (35 abap skills).
+// abap-dump replaced abap-dump-analyze + abap-dump-triage (portfolio merge);
+// added previously-missing abap-plan, abap-fiori-build, abap-cca-merge, abap-upgrade-merge.
+// 2026-06-28 (M1-M4 portfolio merges): removed 4 donor skills — abap-radar → abap-explain
+// (technical orientation mode); abap-document → abap-handover (object scope); abap-performance
+// → abap-review (performance lens); abap-cloud-check → abap-review (cloud lens). Skill count
+// drops from 35 to 31. abap-preflight is NOT removed (chained by abap-transport-analysis).
+// 2026-06-15 (Bug #1): pair every skill with a one-line description. Haiku was
+// routing on bare NAMES — "color the lines on a custom Z report" matched the word
+// "enhance" (82%) when it should have been abap-refactor; Haiku never saw that
+// abap-enhance = extend SAP STANDARD only. The one-liners + routing notes below
+// encode the key disambiguations directly. These keys ARE the skill list — there
+// is no separate name array to drift out of sync.
+// 2026-09-25: added abap-cap (CAP phase 1) — "build a CAP app" had no home and
+// fell back to abap-generate at low confidence.
+// 2026-10-01: added abap-app (app lane routing slice 1) — one entry from a spec
+// document to a running app; the CAP routing note below is unchanged.
+export const SKILL_DESCRIPTIONS = {
+    'abap-app': 'Build an app FROM a spec or requirements document (Word, PDF, Excel or text) — finds the spec gaps, picks the app lane (backend + UI) and confirms it with the developer, then plans and builds the app.',
+    'abap-atc-fix': 'Run ATC checks on an object and auto-fix findings where safe.',
+    'abap-cap': 'Build a CAP (SAP Cloud Application Programming Model, Node.js / CDS) app on the laptop — domain model, service, handlers, Fiori Elements app — run it locally and prove it with the Fiori checks. Side-by-side (BTP) extensions, not the ABAP core.',
+    'abap-cca': 'Custom Code Analysis — inventory + classify a whole custom-code estate (Keep/Fix/Retire) for S/4HANA migration / Clean Core.',
+    'abap-cca-merge': 'Merge multiple parallel CCA assessment files into one consolidated assessment.',
+    'abap-data-model': 'Design and create DDIC objects — domains, data elements, tables, structures.',
+    'abap-design': 'Design solution architecture — object list, dependency sequence, pattern selection. After spec-gap, before coding.',
+    'abap-dump': 'Diagnose ABAP short dumps (ST22 runtime errors) and fix them.',
+    'abap-eml': 'Write and test EML (Entity Manipulation Language) for RAP business objects.',
+    'abap-enhance': 'Extend SAP-delivered STANDARD objects via BAdI / enhancement spots / exits. ONLY for standard objects — never for editing your own custom Z/Y code.',
+    'abap-estimate': 'Effort estimation for ABAP tickets — component breakdown, hour ranges, risk.',
+    'abap-explain': 'Understand an existing object — plain-language explanation (default) or a `technical` developer orientation (deps, tables, risks, modernization notes).',
+    'abap-fiori-build': 'Build a freestyle SAPUI5 app on the laptop from already-published OData services.',
+    'abap-generate': 'Create NEW ABAP code/objects from a requirement (greenfield).',
+    'abap-handover': 'Documentation for an object (`object` scope) or a whole package (`package` scope) — purpose, interfaces, deps, catalog, architecture, config.',
+    'abap-impact': 'Analyze the impact of changing an object before touching it — where-used, dependents, risk.',
+    'abap-incident': 'End-to-end incident pipeline — from short dump to fix deployed and documented.',
+    'abap-migrate': 'ECC→S/4HANA migration assessment for custom objects — API analysis, successor lookup, per-object effort.',
+    'abap-modernize': 'Transform a CLASSIC program into a modern architecture (e.g. report → Fiori Elements / RAP) for the release level.',
+    'abap-plan': 'Plan and run a multi-session SAP project — phase envelope carries state across sessions, one phase per session.',
+    'abap-preflight': 'Pre-release checklist for a change set — dependencies, tests, rollback, readiness.',
+    'abap-rap': 'Scaffold a complete RAP stack from scratch — table, CDS interface+projection, BDEF, behavior class, service definition+binding.',
+    'abap-refactor': 'Modify / improve / add a feature to EXISTING custom ABAP code in place — restructure, clean up, or change a Z/Y program/class (incl. small feature changes like adding output coloring).',
+    'abap-review': 'Read-only code review across lenses: `quality` (default, 7 criteria), `performance` (N+1/SELECT*/indexes), `cloud` (clean-core / ABAP Cloud readiness).',
+    'abap-segw': 'Implement SEGW OData service methods (MPC/DPC) for an existing gateway project.',
+    'abap-spec-gap': "Find what's missing before coding — business questions, technical gaps, edge cases, test scenarios.",
+    'abap-test': 'Generate ABAP Unit test classes for existing code.',
+    'abap-transport': 'Transport management — create requests, validate object lists, release transports.',
+    'abap-transport-analysis': 'Pre-release transport analysis — list objects, ATC each, cross-dependency + conflict checks.',
+    'abap-upgrade-fix': 'Interactive upgrade remediation — fix ATC findings object-by-object with successor-API lookup and approval.',
+    'abap-upgrade-merge': 'Merge multiple parallel upgrade-fix progress files into one consolidated progress.',
+    'abap-upgrade-scan': 'Scan custom code for S/4HANA upgrade findings — ATC readiness variant, categorize, remediation plan.',
+    'abap-upgrade-verify': 'Verify upgrade remediation — re-run ATC, compare against baseline, flag regressions.',
+};
+export const SKILL_LIST = Object.keys(SKILL_DESCRIPTIONS);
+// Screenshot-aware routing (2026-09-23) — appended ONLY when images are sent,
+// so text-only routing keeps the exact pre-feature instructions.
+export const SCREENSHOT_NOTE = `
+
+A screenshot is attached. Read it (error text, transaction code such as ST22/ATC/SE80, object names) and classify on the prompt AND the screenshot together — a vague prompt ("can you see this?") with an ST22 dump is abap-dump. Also add "screenshot": a one-line reading of it (e.g. "ST22 dump: CX_SY_ZERODIVIDE in ZCL_X, method CALC").`;
+export const ROUTER_SYSTEM = `You classify user prompts into ABAP-development skills. Given a prompt and context, return JSON: {"skill": "<name>", "confidence": 0-1, "alternates": ["<name>"], "reasoning": "..."}.
+
+Skills (name — what it is for):
+${SKILL_LIST.map((n) => `- ${n} — ${SKILL_DESCRIPTIONS[n]}`).join('\n')}
+
+Routing notes:
+- Editing, changing, or adding a feature to an EXISTING custom (Z*/Y*) object → abap-refactor (in-place change) or abap-generate (new objects). abap-enhance is ONLY for SAP-delivered STANDARD objects — never for custom code.
+- "Make a classic report modern / turn it into Fiori" → abap-modernize. "Build a full RAP stack from scratch" → abap-rap.
+- CAP / cds / Node.js / a side-by-side BTP app or extension → abap-cap. On-stack RAP inside the ABAP system → abap-rap. A UI on an already-published OData service → abap-fiori-build.
+- Building an app FROM a spec or requirements document (Word / PDF / Excel, 'build the app in this spec') → abap-app. A direct request without a spec document keeps its own skill.
+- Quick cold-read / orientation of an object → abap-explain (technical audience).
+- Performance issues / N+1 / SELECT * → abap-review (performance lens). Clean-core / ABAP Cloud readiness of one object → abap-review (cloud lens); estate-wide clean-core → abap-cca.
+- Developer documentation of an object → abap-handover (object scope).
+
+Pick the single best skill. Confidence is 0.75+ if the intent clearly matches one skill, 0.6-0.75 if two skills are plausible, <0.6 if none are clearly right.`;
+export const ROUTER_PROMPT = {
+    schema_version: ROUTER_SCHEMA_VERSION,
+    revision: ROUTER_REVISION,
+    system: ROUTER_SYSTEM,
+    screenshot_note: SCREENSHOT_NOTE,
+};
+/**
+ * A router entry read from outside (the signed manifest), or null when it is
+ * not one this code can use — unknown schema version, missing revision,
+ * missing or empty text.
+ * Callers then keep ROUTER_PROMPT. Never throws.
+ */
+export function asRouterPrompt(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const r = raw;
+    if (r.schema_version !== ROUTER_SCHEMA_VERSION)
+        return null;
+    if (typeof r.revision !== 'number' || !Number.isInteger(r.revision) || r.revision < 0)
+        return null;
+    if (typeof r.system !== 'string' || r.system.trim() === '')
+        return null;
+    if (typeof r.screenshot_note !== 'string')
+        return null;
+    return { schema_version: ROUTER_SCHEMA_VERSION, revision: r.revision, system: r.system, screenshot_note: r.screenshot_note };
+}
+const tok = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+// Live fix 2026-10-02: some prompts made the router answer in prose instead of
+// JSON (e.g. a read-only question ending "Answer in a short list." — the router
+// followed the user's format request). classifyWithUsage threw 'Classifier
+// produced non-JSON output' and /v1/classify returned HTTP 500, which the CLI
+// one-shot surfaced as "unhandled error". Three layers now:
+//   1. Structured outputs (output_config.format, json_schema) ask the API for
+//      JSON. Chosen over an assistant prefill of "{" — the router role is
+//      admin-tunable and prefill is rejected (400) on every 4.6+ model — and
+//      over forced tool use — tool_choice "tool" is rejected on Opus 5.5 /
+//      Sonnet 5.5 / Fable 5.1. Structured outputs run on the default router
+//      (claude-haiku-4-5) and the current 5.x models. SYSTEM is unchanged, so
+//      routing for normal prompts is the same.
+//   2. A strict parse; an unparseable answer is retried ONCE.
+//   3. Still unparseable → ROUTER_UNPARSEABLE_RESULT (confidence 0 ⇒ the CLI's
+//      low-confidence path: picker in the REPL, top-1 + notice in one-shot),
+//      flagged `unparseable` so the route does not cache it. Never a throw.
+// Upstream API errors (network / 4xx / 5xx from the provider) still throw; the
+// route turns them into a JSON 502 and the CLI degrades to local rules.
+/** abap-explain: read-only and generic — the safest default when the router gave no answer. */
+export const ROUTER_UNPARSEABLE_RESULT = Object.freeze({
+    skill: 'abap-explain',
+    confidence: 0,
+    alternates: [],
+    reasoning: 'router_unparseable',
+});
+/** JSON schema for the router answer — the same fields SYSTEM asks for. */
+export function resultSchema(withScreenshot) {
+    return {
+        type: 'object',
+        properties: {
+            skill: { type: 'string' },
+            confidence: { type: 'number' },
+            alternates: { type: 'array', items: { type: 'string' } },
+            reasoning: { type: 'string' },
+            // Only offered when a screenshot was sent (SCREENSHOT_NOTE asks for it).
+            ...(withScreenshot ? { screenshot: { type: 'string' } } : {}),
+        },
+        required: ['skill', 'confidence', 'alternates', 'reasoning'],
+        additionalProperties: false,
+    };
+}
+/** The router's text → a RouterResult, or null when it is not one. Never throws. */
+export function parseRouterText(text) {
+    const candidates = [text.trim()];
+    const m = text.match(/\{[\s\S]*\}/);
+    if (m && m[0] !== candidates[0])
+        candidates.push(m[0]);
+    for (const c of candidates) {
+        let v;
+        try {
+            v = JSON.parse(c);
+        }
+        catch {
+            continue;
+        }
+        if (!v || typeof v !== 'object' || Array.isArray(v))
+            continue;
+        const r = v;
+        if (typeof r.skill !== 'string' || r.skill.trim() === '')
+            continue;
+        return {
+            ...r,
+            confidence: typeof r.confidence === 'number' && Number.isFinite(r.confidence) ? r.confidence : 0,
+            alternates: Array.isArray(r.alternates) ? r.alternates.filter((a) => typeof a === 'string') : [],
+        };
+    }
+    return null;
+}
+/** The user turn the router sees: the prompt plus the routing context. */
+export function routerUserMessage(prompt, context) {
+    return `Prompt: ${prompt}\n\nContext: sap_system=${context.sap_system ?? 'unknown'}, last_skill=${context.last_skill ?? 'none'}`;
+}
+/** The router request body (Messages API), exactly as the proxy has sent it since 2026-10-02. */
+export function buildRouterRequest(model, prompt, context, images = [], routerPrompt = ROUTER_PROMPT) {
+    const userMsg = routerUserMessage(prompt, context);
+    return {
+        model,
+        // Root cause found live 2026-10-02 (v54): the router model (claude-sonnet-5)
+        // thinks by default and, on harder prompts, spent all 300 tokens on a
+        // thinking block — stop_reason max_tokens, no text, unparseable. Routing is
+        // a quick pick: thinking off, and headroom for the JSON answer.
+        max_tokens: 600,
+        thinking: { type: 'disabled' },
+        system: images.length === 0 ? routerPrompt.system : routerPrompt.system + routerPrompt.screenshot_note,
+        // 2026-10-02: JSON via structured outputs (see the note above).
+        output_config: { format: { type: 'json_schema', schema: resultSchema(images.length > 0) } },
+        // Screenshot-aware routing (2026-09-23): images ride ahead of the text in
+        // the same message; with none, the plain string is sent as before.
+        messages: [{
+                role: 'user',
+                content: images.length === 0
+                    ? userMsg
+                    : [
+                        ...images.map((im) => ({
+                            type: 'image',
+                            source: { type: 'base64', media_type: im.media_type, data: im.data },
+                        })),
+                        { type: 'text', text: userMsg },
+                    ],
+            }],
+    };
+}
+/**
+ * Send the router request: the self-heal, parse, one retry. `create` is the
+ * caller's Messages API call (the proxy's org-key client, or the CLI's BYOK
+ * client) — injected so this file stays import-free. Provider errors other
+ * than the self-heal case are rethrown for the caller to map.
+ */
+export async function runRouterCalls(create, request, opts = {}) {
+    const now = opts.now ?? Date.now;
+    // 2026-10-02 (self-healing): the router role is admin-tunable, and not every
+    // model accepts structured outputs (e.g. Sonnet 4.6 / Opus 4.6–4.7 are not on
+    // the supported list). Sending output_config to one of those is a 400 on
+    // EVERY classify — all customers would drop to the CLI's local rules. So a
+    // 400 while output_config is sent re-sends the same call ONCE without it;
+    // the parse / retry / fallback below then works as before (SYSTEM still
+    // asks for JSON). A 400 without output_config, and any non-400, surface.
+    let req = request;
+    const send = async () => {
+        try {
+            return await create(req);
+        }
+        catch (err) {
+            if ('output_config' in req && err?.status === 400) {
+                opts.warn?.(`[classify] router model ${request.model} rejected output_config (400) — retrying without structured outputs:`, err instanceof Error ? err.message : String(err));
+                const { output_config: _dropped, ...rest } = request;
+                req = rest;
+                return await create(req);
+            }
+            throw err;
+        }
+    };
+    const calls = [];
+    let result = null;
+    // At most two parsed answers: the first, and ONE retry when it is unparseable.
+    for (let attempt = 0; attempt < 2 && result === null; attempt++) {
+        const startedAt = now();
+        const res = await send();
+        const u = res?.usage ?? {};
+        const call = {
+            usage: {
+                input: tok(u.input_tokens),
+                output: tok(u.output_tokens),
+                cacheRead: tok(u.cache_read_input_tokens),
+                cacheCreate: tok(u.cache_creation_input_tokens),
+            },
+            latencyMs: now() - startedAt,
+        };
+        calls.push(call);
+        opts.onCall?.(call);
+        const content = Array.isArray(res?.content) ? res.content : [];
+        const text = content
+            .filter((b) => b.type === 'text')
+            .map((b) => b.text)
+            .join('\n');
+        result = parseRouterText(text);
+    }
+    return { result, calls };
+}
+/** Token counts summed over every call made. */
+export function sumRouterUsage(calls) {
+    return calls.reduce((s, c) => ({
+        input: s.input + c.usage.input,
+        output: s.output + c.usage.output,
+        cacheRead: s.cacheRead + c.usage.cacheRead,
+        cacheCreate: s.cacheCreate + c.usage.cacheCreate,
+    }), { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 });
+}

package/dist/router/router-prompt.js

@@ -0,0 +1,121 @@
+/**
+ * Where BYOK (and ai-hub) get the skill router's instructions (2026-10-02,
+ * local routing).
+ *
+ * In BYOK the CLI classifies prompts on the laptop (router/byok-classifier.ts)
+ * — the prompt never goes to a CSPeach host. The instructions it classifies
+ * with must not drift from the proxy's and must be tamper-evident, so they
+ * come from:
+ *   1. the `router` entry of the SIGNED skill manifest
+ *      (manifest.cspeach.dev/v1.json), verified with the same ed25519 check as
+ *      skill bodies — the proxy publishes it from the same source
+ *      /v1/classify runs on (cspeach-proxy/src/classifier/router-core.ts) —
+ *      used only when its revision is the same or NEWER than the bundled copy
+ *      (review item 2: a stale published manifest never rolls back routing);
+ *   2. otherwise (older server without the entry, older revision, unknown
+ *      schema version, bad signature, manifest unreachable or slow) the copy
+ *      compiled into this CLI from that same source (router-core.ts) — never
+ *      the proxy.
+ * The manifest is public and carries no prompt data.
+ *
+ * Latency (review items 1 + N2): the manifest is prefetched at startup
+ * (capped, alongside the model-config fetch). Only the session's FIRST prompt
+ * waits for the read, at most `waitMs`; every later prompt uses the verified
+ * entry if the read has landed, else the bundled copy at once — even while a
+ * slow read is still in flight. After a failed read, a refresh runs in the
+ * background once the cool-down has passed; no prompt waits on it. Ctrl+C
+ * ends a wait at once.
+ */
+import { ManifestClient, DEFAULT_MANIFEST_URL } from '../skills/manifest-client.js';
+import { ROUTER_PROMPT, asRouterPrompt } from './router-core.js';
+/** After a failed manifest read, refresh in the background no sooner than this. */
+const RETRY_AFTER_MS = 5 * 60 * 1000;
+/** Longest a prompt waits for the session's first manifest read. */
+export const PROMPT_WAIT_MS = 1500;
+let cached = null;
+let failedAt = null;
+let inflight = null;
+/** True once a prompt has waited on the manifest this session (review N2). */
+let promptWaited = false;
+/** Test-only reset of the session cache. */
+export function __resetRouterPromptForTests() {
+    cached = null;
+    failedAt = null;
+    inflight = null;
+    promptWaited = false;
+}
+const bundled = () => ({ prompt: ROUTER_PROMPT, source: 'bundled' });
+function cancelled() {
+    const e = new Error('routing cancelled');
+    e.name = 'AbortError';
+    return e;
+}
+/** Start (or join) the one manifest read. Resolves, never rejects. */
+function startFetch(manifestUrl, now) {
+    if (!inflight) {
+        inflight = (async () => {
+            try {
+                const m = await new ManifestClient(manifestUrl).fetchAndVerifyManifest();
+                const entry = asRouterPrompt(m.router);
+                // Same-or-newer than the bundled copy, else the bundled copy (a
+                // definite answer for this manifest: cached, no refetch).
+                cached = entry && entry.revision >= ROUTER_PROMPT.revision ? { prompt: entry, source: 'manifest' } : bundled();
+                failedAt = null;
+                return cached;
+            }
+            catch {
+                // Unreachable, not yet published, or a signature failure (tampered).
+                failedAt = now();
+                return bundled();
+            }
+            finally {
+                inflight = null;
+            }
+        })();
+    }
+    return inflight;
+}
+/** Wait for `p` at most `ms`, or until `signal` aborts (rejects AbortError). */
+function waitFor(p, ms, signal) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => { cleanup(); resolve(bundled()); }, Math.max(0, ms));
+        timer.unref?.();
+        const onAbort = () => { cleanup(); reject(cancelled()); };
+        const cleanup = () => { clearTimeout(timer); signal?.removeEventListener('abort', onAbort); };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        p.then((v) => { cleanup(); resolve(v); }, () => { cleanup(); resolve(bundled()); });
+    });
+}
+/**
+ * Startup prefetch (byok / ai-hub). Waits at most `timeoutMs`; the read keeps
+ * going in the background if slower. Never throws.
+ */
+export async function prefetchRouterPrompt(opts) {
+    if (cached || failedAt !== null)
+        return;
+    await waitFor(startFetch(opts.manifestUrl ?? DEFAULT_MANIFEST_URL, Date.now), opts.timeoutMs);
+}
+/**
+ * The router instructions for one classification. Never throws, except an
+ * AbortError when `signal` aborts while waiting.
+ */
+export async function loadRouterPrompt(opts = {}) {
+    if (cached)
+        return cached;
+    if (opts.signal?.aborted)
+        throw cancelled();
+    const now = opts.now ?? Date.now;
+    const url = opts.manifestUrl ?? DEFAULT_MANIFEST_URL;
+    if (failedAt !== null) {
+        // A read already failed this session: never make a prompt wait again.
+        if (now() - failedAt >= RETRY_AFTER_MS)
+            void startFetch(url, now);
+        return bundled();
+    }
+    const read = startFetch(url, now);
+    // Only the first prompt of the session waits; later ones never do.
+    if (promptWaited)
+        return bundled();
+    promptWaited = true;
+    return waitFor(read, opts.waitMs ?? PROMPT_WAIT_MS, opts.signal);
+}

package/dist/router/routing-failure.js

@@ -1,17 +1,69 @@
+/**
+ * Skill-routing failure: what happened, in true words (live fix 2026-09-26).
+ *
+ * Fix 9: the REPL used to print "Skill routing is offline · CSPeach service
+ * unreachable: This operation was aborted" when the classify call merely
+ * timed out (the proxy was healthy). The wording now comes from the
+ * classifier's machine-readable kind — never "offline"/"unreachable" for a
+ * timeout. Used by the Ink REPL, the classic REPL and one-shot.
+ */
+import { localRulesResult } from './classifier.js';
 /** The failure behind an offline (fallback) classify result, or null when routing worked. */
 export function routingFailureFromResult(c) {
     if (!c.offline)
         return null;
-    return c.transport_kind === 'timeout' ? { kind: 'timeout' } : { kind: 'network' };
+    if (c.transport_kind === 'timeout')
+        return { kind: 'timeout' };
+    if (c.transport_kind === 'http' && typeof c.http_status === 'number')
+        return { kind: 'http', status: c.http_status };
+    if (c.transport_kind === 'failed')
+        return { kind: 'failed' };
+    return { kind: 'network' };
 }
-/** The failure behind a thrown classify error (HTTP), or null for any other error. */
+/** The failure behind a thrown classify error (HTTP / unreadable body), or null for any other error. */
 export function routingFailureFromError(err) {
     // Duck-typed (not instanceof) so a re-loaded module instance still matches.
     const e = err;
-    if (e && e.transport_kind === 'http' && typeof e.status === 'number')
+    if (e && e.transport_kind === 'http' && typeof e.status === 'number') {
         return { kind: 'http', status: e.status };
+    }
+    if (e && e.transport_kind === 'failed')
+        return { kind: 'failed' };
     return null;
 }
+/**
+ * Live fix 2026-10-02 — a classify failure (the proxy answered HTTP 500 for a
+ * prompt its router answered in prose; an unreadable body; anything else
+ * classifyPrompt throws) no longer ends the turn or escapes one-shot as
+ * "unhandled error". Every routing path (Ink REPL, classic REPL, one-shot)
+ * takes this result instead: the bundled local-rules pick at low confidence,
+ * marked offline with the failure kind, so the existing offline handling
+ * runs — the low-confidence path (picker / one-shot top-1), one notice, and
+ * fix 10's "stay in the active skill" mid-skill.
+ *
+ * Returns null (caller keeps its own handling) for a missing API key, a user
+ * cancel (AbortError), and the slash-guard CLI bug, which must stay loud.
+ */
+export function routingFallbackFromError(err, prompt) {
+    const e = err;
+    if (e?.message === 'no_api_key')
+        return null;
+    if (e?.name === 'AbortError')
+        return null;
+    if (typeof e?.message === 'string' && e.message.startsWith('slash command reached the classifier'))
+        return null;
+    const f = routingFailureFromError(err) ?? { kind: 'failed' };
+    return {
+        ...localRulesResult(prompt),
+        offline: true,
+        transport_kind: f.kind === 'http' ? 'http' : 'failed',
+        ...(f.kind === 'http' ? { http_status: f.status } : {}),
+    };
+}
+/** "Couldn't pick a skill automatically (HTTP 500)" — the 2026-10-02 fallback headline. */
+function couldNotPick(f) {
+    return `Couldn't pick a skill automatically${f.kind === 'http' ? ` (HTTP ${f.status})` : ''}`;
+}
 /** Headline for the notice: "Skill routing timed out" etc. */
 export function routingFailureText(f) {
     switch (f.kind) {
@@ -20,15 +72,24 @@ export function routingFailureText(f) {
         case 'timeout': return 'Skill routing timed out';
         case 'network': return "Skill routing couldn't reach the CSPeach service";
         case 'http': return `Skill routing failed (HTTP ${f.status})`;
+        case 'failed': return 'Skill routing failed';
     }
 }
 /** The attention notice: headline, plus the real cause for network failures. */
 export function routingFailureNotice(f, transportError) {
+    // 2026-10-02: an HTTP / other classify failure now continues on local
+    // rules (routingFallbackFromError) — say so, and how to choose.
+    if (f.kind === 'http' || f.kind === 'failed') {
+        return { text: couldNotPick(f), fact: 'routed by local rules — start with /skill to choose' };
+    }
     const text = routingFailureText(f);
     return f.kind === 'network' && transportError ? { text, fact: transportError } : { text };
 }
 /** One-shot's dim stderr line (the turn continues on the bundled local rules). */
 export function routingFailureOneShotLine(f, transportError) {
+    if (f.kind === 'http' || f.kind === 'failed') {
+        return `[${couldNotPick(f)} — routed by local rules. Start with /skill to choose.]`;
+    }
     const n = routingFailureNotice(f, transportError);
     return `[${n.text}${n.fact ? `: ${n.fact}` : ''} — routed by local rules]`;
 }
@@ -38,6 +99,7 @@ function routingFailureShort(f) {
         case 'timeout': return 'Routing timed out';
         case 'network': return "Routing couldn't reach the CSPeach service";
         case 'http': return `Routing failed (HTTP ${f.status})`;
+        case 'failed': return 'Routing failed';
     }
 }
 /**

package/dist/sap/unreachable.js

@@ -23,6 +23,9 @@ export function unreachableCode(err) {
     return undefined;
 }
 export function unreachableMessage(alias, host, port, code) {
-    return (`Can't reach SAP system ${alias} (${host}:${port}) — ${code}. Check the VPN / network, ` +
+    return (
+    // 2026-10-04: never assume a VPN — many users sit on the company network.
+    `Can't reach SAP system ${alias} (${host}:${port}) from this machine — ${code}. ` +
+        'Check network access to the SAP system (company network or VPN), ' +
         'or run with --no-sap for work that does not need SAP.');
 }