@cspeach/cli 1.1.33 → 1.1.34

package/dist/router/byok-classifier.js

@@ -33,7 +33,9 @@ import Anthropic from '@anthropic-ai/sdk';
 import keychain from '../auth/keychain.js';
 import { byokRouterModel } from '../models/server-config.js';
 import { addRouterSpend } from '../cost/router-spend.js';
+import { reportCallUsage } from '../usage/usage-reporter.js';
 import { loadRouterPrompt } from './router-prompt.js';
+import { azureSdkOptions } from '../connection/azure-auth.js';
 import { ROUTER_UNPARSEABLE_RESULT, buildRouterRequest, runRouterCalls, } from './router-core.js';
 /** Same keychain entry the BYOK provider reads (byok-provider.ts) and login writes. */
 export const BYOK_KEYCHAIN_SERVICE = 'cspeach.anthropic';
@@ -65,6 +67,17 @@ export class ByokRouterFailure extends Error {
         this.name = 'ByokRouterFailure';
     }
 }
+/** Final fix wave B — fire-and-forget, never throws: usage counts are best effort. */
+function reportAzureRouterCall(family, u) {
+    try {
+        void reportCallUsage({
+            mode: 'azure', skill: '_router', model: family,
+            input: u.input, output: u.output, cacheRead: u.cacheRead, cacheWrite: u.cacheCreate,
+            sessionId: '', started: true,
+        }).catch(() => { });
+    }
+    catch { /* best effort */ }
+}
 function causeOf(err) {
     const e = err;
     if (e?.cause)
@@ -86,10 +99,13 @@ export async function classifyByok(prompt, context, images, opts = {}) {
     const target = opts.target ?? { mode: 'byok' };
     if (opts.signal?.aborted)
         throw cancelled();
-    const key = target.mode === 'byok'
-        ? await keychain.getPassword(BYOK_KEYCHAIN_SERVICE, BYOK_KEYCHAIN_ACCOUNT)
-        : await keychain.getPassword(AI_HUB_KEYCHAIN_SERVICE, AI_HUB_KEYCHAIN_ACCOUNT);
-    if (!key) {
+    // Azure signs in through target.auth() (Entra token or Azure key), never the keychain entries here.
+    const key = target.mode === 'azure'
+        ? null
+        : target.mode === 'byok'
+            ? await keychain.getPassword(BYOK_KEYCHAIN_SERVICE, BYOK_KEYCHAIN_ACCOUNT)
+            : await keychain.getPassword(AI_HUB_KEYCHAIN_SERVICE, AI_HUB_KEYCHAIN_ACCOUNT);
+    if (target.mode !== 'azure' && !key) {
         throw new Error(target.mode === 'byok'
             ? 'BYOK Anthropic API key not configured — run: cspeach config set llm.byok_key <key>'
             : 'AI Hub token not configured — run: cspeach config set llm.ai_hub_token <token>');
@@ -104,18 +120,23 @@ export async function classifyByok(prompt, context, images, opts = {}) {
     const userCancelled = () => opts.signal?.aborted === true;
     try {
         const { prompt: routerPrompt } = await loadRouterPrompt({ signal: ctrl.signal });
-        const model = target.mode === 'byok' ? byokRouterModel() : (target.modelAlias ?? AI_HUB_DEFAULT_MODEL);
+        const model = target.mode === 'byok' ? byokRouterModel() : target.mode === 'azure' ? target.model : (target.modelAlias ?? AI_HUB_DEFAULT_MODEL);
         const full = buildRouterRequest(model, prompt, context, images, routerPrompt);
         // ai-hub: today's field set only (the hub has no flag for newer fields).
-        const request = target.mode === 'byok'
+        // azure: output_config only when the profile allows structured outputs.
+        const request = target.mode === 'byok' || (target.mode === 'azure' && target.structuredOutputs)
             ? full
             : (({ output_config: _dropped, ...rest }) => rest)(full);
-        const sdk = new Anthropic({
-            apiKey: key,
-            maxRetries: 1,
-            timeout: ROUTER_CALL_TIMEOUT_MS,
-            ...(target.mode === 'ai-hub' ? { baseURL: target.baseURL } : {}),
-        });
+        // Azure: the guarded options (host allow-list on every request URL, no
+        // redirects, the other auth field null so no ANTHROPIC_* env var leaks).
+        const sdk = target.mode === 'azure'
+            ? new Anthropic({ ...azureSdkOptions(target.baseURL, await target.auth()), maxRetries: 1, timeout: ROUTER_CALL_TIMEOUT_MS })
+            : new Anthropic({
+                apiKey: key,
+                maxRetries: 1,
+                timeout: ROUTER_CALL_TIMEOUT_MS,
+                ...(target.mode === 'ai-hub' ? { baseURL: target.baseURL } : {}),
+            });
         const { result } = await runRouterCalls((req) => sdk.messages.create(req, { signal: ctrl.signal }), request, {
             // Once per session — a model that rejects structured outputs would
             // otherwise print this on every prompt.
@@ -129,8 +150,14 @@ export async function classifyByok(prompt, context, images, opts = {}) {
             // call finishes, so a deadline / cancel after call 1 keeps call 1
             // (review S1). ai-hub is billed by their BTP account at rates we
             // don't know: not priced here.
-            onCall: (c) => { if (target.mode === 'byok')
-                addRouterSpend(model, c.usage); },
+            // Azure (final fix wave B): each router call is counted like any other
+            // azure call — a usage record and the local limit count.
+            onCall: (c) => {
+                if (target.mode === 'byok')
+                    addRouterSpend(model, c.usage);
+                else if (target.mode === 'azure')
+                    reportAzureRouterCall(target.family, c.usage);
+            },
         });
         return result ?? { ...ROUTER_UNPARSEABLE_RESULT, alternates: [] };
     }

package/dist/router/classifier.js

@@ -6,6 +6,7 @@ import { isBuiltinCommandHead } from '../repl/builtin-commands.js';
 import { expandImageAttachments } from '../projects/image-attachments.js';
 import { expandImageChips } from '../ui/clipboard-image.js';
 import { classifyByok, ByokRouterFailure } from './byok-classifier.js';
+import { routerRouteFor } from './router-target.js';
 /** A non-2xx answer from the classify endpoint (fix 9: carries the kind). */
 export class ClassifyHttpError extends Error {
     status;
@@ -165,26 +166,14 @@ export async function classifyPrompt(prompt, context, opts = {}) {
     // with the customer's own key; ai-hub through the customer's own hub;
     // local by the bundled rules (byok-classifier.ts / localModeResult).
     // Managed keeps /v1/classify below, byte-identical.
-    const mode = cfg.llm?.mode;
-    if (mode === 'local') {
+    const route = routerRouteFor(cfg);
+    if (route.kind === 'local-rules') {
         if (opts.signal?.aborted)
             throw routingCancelled();
         return localModeResult(prompt);
     }
-    if (mode === 'byok')
-        return classifyPromptByok(prompt, context, opts, { mode: 'byok' });
-    if (mode === 'ai-hub') {
-        const baseURL = cfg.llm.ai_hub_base_url;
-        if (!baseURL)
-            throw new Error('ai-hub mode requires llm.ai_hub_base_url — run: cspeach config set llm.ai_hub_base_url <url>');
-        // llm.ai_hub_router_model (optional, 2026-10-02) routes on a cheaper /
-        // faster deployment; unset ⇒ the session alias.
-        return classifyPromptByok(prompt, context, opts, {
-            mode: 'ai-hub',
-            baseURL,
-            modelAlias: cfg.llm.ai_hub_router_model ?? cfg.llm.ai_hub_model_alias,
-        });
-    }
+    if (route.kind === 'direct')
+        return classifyPromptByok(prompt, context, opts, route.target);
     const store = await getStore();
     const key = await store.get();
     if (!key)

package/dist/router/router-target.js

@@ -0,0 +1,41 @@
+import { profileForMode } from '../agent/connection-profile.js';
+import { getActiveConnection } from '../connection/cache.js';
+import { azureTurnVerdict, AzureConnectionRefusedError } from '../connection/state.js';
+import { selectAzureAuth } from '../connection/azure-auth.js';
+import { routerDeployment } from '../models/model-identity.js';
+export function routerRouteFor(cfg, profileFor = profileForMode) {
+    const mode = cfg.llm?.mode;
+    const p = profileFor(mode);
+    if (p.router === 'local-rules')
+        return { kind: 'local-rules' };
+    if (p.router === 'proxy')
+        return { kind: 'proxy' };
+    switch (mode) {
+        case 'byok':
+            return { kind: 'direct', target: { mode: 'byok' } };
+        case 'ai-hub': {
+            const baseURL = cfg.llm.ai_hub_base_url;
+            if (!baseURL)
+                throw new Error('ai-hub mode requires llm.ai_hub_base_url — run: cspeach config set llm.ai_hub_base_url <url>');
+            // llm.ai_hub_router_model (optional, 2026-10-02) routes on a cheaper /
+            // faster deployment; unset ⇒ the session alias.
+            return { kind: 'direct', target: { mode: 'ai-hub', baseURL, modelAlias: cfg.llm.ai_hub_router_model ?? cfg.llm.ai_hub_model_alias } };
+        }
+        case 'azure': {
+            const cached = getActiveConnection();
+            const v = azureTurnVerdict(cached);
+            if (!v.allow)
+                throw new AzureConnectionRefusedError(v.message);
+            const c = cached.connection;
+            return {
+                kind: 'direct',
+                target: {
+                    mode: 'azure', baseURL: c.endpoint, model: routerDeployment(c.deployments).name, family: routerDeployment(c.deployments).model,
+                    auth: async () => (await selectAzureAuth(c)).getAuth(), structuredOutputs: p.structuredOutputs,
+                },
+            };
+        }
+        default:
+            throw new Error(`no direct router for llm.mode ${String(mode)}`);
+    }
+}

package/dist/sap/onboarding.js

@@ -126,73 +126,79 @@ export async function runAddSapWizard() {
             default: 'approval-gated',
         });
         cfg.write_mode = write_mode;
-        const llm_mode = await select({
-            message: 'How should CSPeach reach the AI model?',
-            choices: [
-                {
-                    name: 'managed (recommended) — we handle the Anthropic account',
-                    value: 'managed',
-                    description: 'Your prompts route through api.cspeach.dev. We bill, we ratelimit, we sign skills. Simplest setup.',
-                },
-                {
-                    name: 'byok — your own Anthropic account',
-                    value: 'byok',
-                    description: 'Your prompts go direct to Anthropic with your API key. You own the contract. Skills signed + fetched from our public manifest.',
-                },
-                {
-                    name: 'ai-hub — your SAP AI Core tenant (endorsed architecture)',
-                    value: 'ai-hub',
-                    description: 'Your prompts route through your SAP BTP AI Core proxy. Data stays in your SAP landscape. Strongest compliance posture (short of SAP Partner Edge).',
-                },
-                {
-                    name: 'local — your own Ollama / vLLM endpoint (air-gap)',
-                    value: 'local',
-                    description: 'No external AI. Skills bundled with the CLI binary. Tool-calling quality depends on the local model.',
-                },
-            ],
-            default: 'managed',
-        });
-        cfg.llm = { mode: llm_mode };
-        if (llm_mode === 'ai-hub') {
-            cfg.llm.ai_hub_base_url = await input({
-                message: 'AI Core proxy URL (e.g. https://proxy.yourcorp.com/v1):',
-                validate: v => v.startsWith('https://') || v.startsWith('http://') ? true : 'Must be a URL',
-            });
-            cfg.llm.ai_hub_model_alias = await input({
-                message: 'AI Core model alias (default: anthropic--claude-opus-4-6):',
-                default: 'anthropic--claude-opus-4-6',
-            });
-            const aiHubToken = await password({
-                message: 'AI Core API token (input masked):',
-                mask: '*',
-            });
-            try {
-                await keychain.setPassword('cspeach.ai-hub', 'token', aiHubToken);
-            }
-            catch {
-                console.log(chalk.yellow('Warning: keychain unavailable; AI Hub token will be prompted per session.'));
-            }
+        if (cfg.llm?.mode === 'azure') {
+            // Azure tenant mode — the company chose the models; the wizard never changes it.
+            console.log(chalk.dim("AI models: your company's Azure (set by your company)."));
         }
-        if (llm_mode === 'local') {
-            cfg.llm.local_base_url = await input({
-                message: 'Local endpoint base URL (default: http://localhost:11434/v1 for Ollama):',
-                default: 'http://localhost:11434/v1',
-            });
-            cfg.llm.local_model = await input({
-                message: 'Model name (e.g. llama3.1:70b):',
-                default: 'llama3.1:70b',
+        else {
+            const llm_mode = await select({
+                message: 'How should CSPeach reach the AI model?',
+                choices: [
+                    {
+                        name: 'managed (recommended) — we handle the Anthropic account',
+                        value: 'managed',
+                        description: 'Your prompts route through api.cspeach.dev. We bill, we ratelimit, we sign skills. Simplest setup.',
+                    },
+                    {
+                        name: 'byok — your own Anthropic account',
+                        value: 'byok',
+                        description: 'Your prompts go direct to Anthropic with your API key. You own the contract. Skills signed + fetched from our public manifest.',
+                    },
+                    {
+                        name: 'ai-hub — your SAP AI Core tenant (endorsed architecture)',
+                        value: 'ai-hub',
+                        description: 'Your prompts route through your SAP BTP AI Core proxy. Data stays in your SAP landscape. Strongest compliance posture (short of SAP Partner Edge).',
+                    },
+                    {
+                        name: 'local — your own Ollama / vLLM endpoint (air-gap)',
+                        value: 'local',
+                        description: 'No external AI. Skills bundled with the CLI binary. Tool-calling quality depends on the local model.',
+                    },
+                ],
+                default: 'managed',
             });
-        }
-        if (llm_mode === 'byok') {
-            const byokKey = await password({
-                message: 'Anthropic API key sk-ant-... (input masked):',
-                mask: '*',
-            });
-            try {
-                await keychain.setPassword('cspeach.anthropic', 'api-key', byokKey);
+            cfg.llm = { mode: llm_mode };
+            if (llm_mode === 'ai-hub') {
+                cfg.llm.ai_hub_base_url = await input({
+                    message: 'AI Core proxy URL (e.g. https://proxy.yourcorp.com/v1):',
+                    validate: v => v.startsWith('https://') || v.startsWith('http://') ? true : 'Must be a URL',
+                });
+                cfg.llm.ai_hub_model_alias = await input({
+                    message: 'AI Core model alias (default: anthropic--claude-opus-4-6):',
+                    default: 'anthropic--claude-opus-4-6',
+                });
+                const aiHubToken = await password({
+                    message: 'AI Core API token (input masked):',
+                    mask: '*',
+                });
+                try {
+                    await keychain.setPassword('cspeach.ai-hub', 'token', aiHubToken);
+                }
+                catch {
+                    console.log(chalk.yellow('Warning: keychain unavailable; AI Hub token will be prompted per session.'));
+                }
+            }
+            if (llm_mode === 'local') {
+                cfg.llm.local_base_url = await input({
+                    message: 'Local endpoint base URL (default: http://localhost:11434/v1 for Ollama):',
+                    default: 'http://localhost:11434/v1',
+                });
+                cfg.llm.local_model = await input({
+                    message: 'Model name (e.g. llama3.1:70b):',
+                    default: 'llama3.1:70b',
+                });
             }
-            catch {
-                console.log(chalk.yellow('Warning: keychain unavailable; Anthropic key will be prompted per session.'));
+            if (llm_mode === 'byok') {
+                const byokKey = await password({
+                    message: 'Anthropic API key sk-ant-... (input masked):',
+                    mask: '*',
+                });
+                try {
+                    await keychain.setPassword('cspeach.anthropic', 'api-key', byokKey);
+                }
+                catch {
+                    console.log(chalk.yellow('Warning: keychain unavailable; Anthropic key will be prompted per session.'));
+                }
             }
         }
     }

package/dist/session/audit-export.js

@@ -31,7 +31,8 @@
 // never an invented approval.
 import { summarise } from '../cost/cost-log.js';
 import { CLI_VERSION } from '../lib/version.js';
-import { creditsActive, formatCredits } from '../cost/credits.js';
+import { creditsActive, tokensOnlyActive, formatCredits } from '../cost/credits.js';
+import { AZURE_INVOICE_LINE } from '../cost/display-mode.js';
 /**
  * Object-mutating tools — one row per completed call in the Writes table.
  * Kept as a literal name set (not the tool registry) so this pure builder
@@ -433,7 +434,13 @@ export function buildAuditReport(input) {
     const auditEntries = costEntries.filter((e) => e.label);
     const auditCost = Math.round(auditEntries.reduce((s, e) => s + e.cost, 0) * 10000) / 10000;
     const inCredits = creditsActive();
-    if (inCredits) {
+    // Azure (Task 5b): tokens only — no price of ours for the customer's deployments.
+    const tokensOnly = tokensOnlyActive();
+    const noPrice = inCredits || tokensOnly;
+    if (tokensOnly) {
+        L(`- **Total:** ${AZURE_INVOICE_LINE} · ${cost.turns} turn${cost.turns === 1 ? '' : 's'}`);
+    }
+    else if (inCredits) {
         const unit = credits?.unitLabel ?? 'credits';
         const logged = costEntries.reduce((s, e) => s + (typeof e.credits_charged === 'number' ? e.credits_charged : 0), 0);
         const total = credits && credits.sessionTotal > 0 ? credits.sessionTotal : logged;
@@ -449,14 +456,14 @@ export function buildAuditReport(input) {
     if (auditEntries.length > 0) {
         // Credits mode: the labelled-audit turn COUNT is still useful provenance;
         // its USD cost is not ours to publish to a customer.
-        L(inCredits
+        L(noPrice
             ? `- **Includes** ${auditEntries.length} labelled audit turn${auditEntries.length === 1 ? '' : 's'}`
             : `- **Includes** ${auditEntries.length} labelled audit turn${auditEntries.length === 1 ? '' : 's'}: $${auditCost.toFixed(4)}`);
     }
     if (cost.byModel.length > 1) {
         L('- **By model:**');
         for (const m of cost.byModel) {
-            L(inCredits
+            L(noPrice
                 ? `  - ${m.model}: ${m.turns} turn${m.turns === 1 ? '' : 's'}`
                 : `  - ${m.model}: ${m.turns} turn${m.turns === 1 ? '' : 's'} · $${m.cost.toFixed(4)}`);
         }

package/dist/skills/manifest-client.js

@@ -6,6 +6,31 @@ import { MANIFEST_PUBLIC_KEYS } from './signing-public-key.js';
 import { canonicalise } from './canonical.js';
 // @noble/ed25519 v2 requires an ed25519 sha512 hook.
 ed.etc.sha512Sync = (...m) => sha512(concatBytes(...m));
+/**
+ * A body that does not match its signed manifest entry. Fail closed: never
+ * loaded, never cached, and deliberately NOT a "skills unavailable" error, so
+ * it can never open the public fallback or the disk cache. Hashes stay out of
+ * the user message (they go to `debug`, written only to the debug log).
+ */
+export class SkillIntegrityError extends Error {
+    debug;
+    constructor(debug) {
+        super('This skill failed its integrity check and was not loaded. Update CSPeach or contact support.');
+        this.name = 'SkillIntegrityError';
+        this.debug = debug;
+    }
+}
+/**
+ * The manifest could not be fetched: a network failure or a 5xx (incl. 503
+ * "not yet published"). Task 8 — the ONLY manifest failure the on-disk skills
+ * cache may cover. A bad signature, a 4xx or bad JSON never is.
+ */
+export class ManifestUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ManifestUnavailableError';
+    }
+}
 export class ManifestClient {
     manifestUrl;
     constructor(manifestUrl) {
@@ -17,21 +42,29 @@ export class ManifestClient {
             r = await fetch(this.manifestUrl, { signal: AbortSignal.timeout(10_000) });
         }
         catch (e) {
-            throw new Error(`manifest fetch failed (${this.manifestUrl}): ${e.message}`);
+            throw new ManifestUnavailableError(`manifest fetch failed (${this.manifestUrl}): ${e.message}`);
         }
         if (r.status === 503) {
             const body = await r.json().catch(() => ({}));
             const raw = String(body.error ?? 'server says not ready');
             // Cap length — an untrusted server could flood the error message.
             const safe = raw.length > 200 ? raw.slice(0, 200) + '…' : raw;
-            throw new Error(`manifest not yet published (HTTP 503): ${safe}`);
+            throw new ManifestUnavailableError(`manifest not yet published (HTTP 503): ${safe}`);
         }
+        if (r.status >= 500)
+            throw new ManifestUnavailableError(`manifest fetch: HTTP ${r.status} from ${this.manifestUrl}`);
         if (!r.ok)
             throw new Error(`manifest fetch: HTTP ${r.status} from ${this.manifestUrl}`);
         return await r.json();
     }
     async fetchAndVerifyManifest() {
-        const m = await this.fetchManifest();
+        return this.verifyManifest(await this.fetchManifest());
+    }
+    /**
+     * Verify a manifest's ed25519 signature — fetched just now or read from the
+     * on-disk skills cache (Task 8). Works offline.
+     */
+    async verifyManifest(m) {
         const { signature, ...payload } = m;
         const canonical = canonicalise(payload);
         const canonicalBytes = new TextEncoder().encode(canonical);
@@ -82,7 +115,7 @@ export class ManifestClient {
         // the manifest-anchored expected value, constitutes an integrity check.
         const actualSha = bytesToHex(sha256(new TextEncoder().encode(j.body)));
         if (opts.expectedSha256 !== actualSha) {
-            throw new Error(`skill ${name}: sha256 mismatch with manifest (manifest=${opts.expectedSha256}, computed=${actualSha}) — body may have been tampered in transit`);
+            throw new SkillIntegrityError(`skill ${name}: sha256 mismatch with manifest (manifest=${opts.expectedSha256}, computed=${actualSha}) — body may have been tampered in transit`);
         }
         return { name, body: j.body, sha256: actualSha, signature: '', signedAt: j.updated_at };
     }

package/dist/skills/skills-cache.js

@@ -0,0 +1,115 @@
+/**
+ * Security batch item 2 — <CSPeach home>/skills-cache/ for byok, ai-hub and
+ * local. manifest.json (re-verified with its ed25519 signature on every load)
+ * plus one <skill>.json per body. A body loads only when its sha256 AND
+ * updated_at match the signed manifest entry; anything else is refetched.
+ * Offline use works from here within the licence check's 72-hour grace.
+ *
+ * The cache is never a trust anchor: a stored hash is never read back (the
+ * body is re-hashed every load), a corrupt or edited file loads nothing, and
+ * a name that is not a plain skill name never becomes a path.
+ *
+ * No TTL by design: the licence turn-gate (72-hour grace) bounds offline use.
+ */
+import { promises as fs } from 'node:fs';
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+import { cspeachRoot } from '../config/paths.js';
+const SAFE_NAME = /^[a-z0-9_-]{1,64}$/;
+const MANIFEST_FILE = 'manifest.json';
+/** A *.tmp older than this is a crash leftover (a live write renames within ms). */
+const STALE_TMP_MS = 60_000;
+/** A plain skill name, and never the manifest's own file name. */
+function safeName(name) {
+    return typeof name === 'string' && SAFE_NAME.test(name) && `${name}.json` !== MANIFEST_FILE;
+}
+export function skillsCacheDir() {
+    return path.join(cspeachRoot(), 'skills-cache');
+}
+const manifestFile = () => path.join(skillsCacheDir(), MANIFEST_FILE);
+const bodyFile = (name) => path.join(skillsCacheDir(), `${name}.json`);
+async function writeAtomic(p, text) {
+    await fs.mkdir(path.dirname(p), { recursive: true });
+    // Unique per write (as key-resolver writeMeta): two writes in one process
+    // must never share a temp file.
+    const tmp = `${p}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    try {
+        await fs.writeFile(tmp, text, { encoding: 'utf-8', mode: 0o600 });
+        await fs.rename(tmp, p);
+    }
+    finally {
+        await fs.rm(tmp, { force: true }).catch(() => { });
+    }
+}
+export const fileSkillsCache = {
+    async saveManifest(m) {
+        await writeAtomic(manifestFile(), JSON.stringify(m)).catch(() => { });
+    },
+    async loadManifest(verify) {
+        let parsed;
+        try {
+            parsed = JSON.parse(await fs.readFile(manifestFile(), 'utf-8'));
+        }
+        catch {
+            return null;
+        }
+        if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.skills))
+            return null;
+        try {
+            return await verify(parsed);
+        }
+        catch {
+            return null;
+        }
+    },
+    async loadBody(entry) {
+        if (!safeName(entry.name))
+            return null;
+        try {
+            const c = JSON.parse(await fs.readFile(bodyFile(entry.name), 'utf-8'));
+            if (c.name !== entry.name || typeof c.body !== 'string' || c.updated_at !== entry.updated_at)
+                return null;
+            const actual = bytesToHex(sha256(new TextEncoder().encode(c.body)));
+            if (actual !== entry.sha256)
+                return null;
+            return { name: entry.name, body: c.body, sha256: actual, signature: '', signedAt: typeof c.signedAt === 'string' ? c.signedAt : '' };
+        }
+        catch {
+            return null;
+        }
+    },
+    async saveBody(entry, body) {
+        if (!safeName(entry.name))
+            return;
+        await writeAtomic(bodyFile(entry.name), JSON.stringify({ name: entry.name, body: body.body, updated_at: entry.updated_at, signedAt: body.signedAt })).catch(() => { });
+    },
+    async removeBody(name) {
+        if (!safeName(name))
+            return;
+        await fs.rm(bodyFile(name), { force: true }).catch(() => { });
+    },
+    async prune(m) {
+        const keep = new Set([MANIFEST_FILE, ...m.skills.filter((s) => safeName(s.name)).map((s) => `${s.name}.json`)]);
+        let removed = 0;
+        try {
+            for (const f of await fs.readdir(skillsCacheDir())) {
+                const p = path.join(skillsCacheDir(), f);
+                if (f.endsWith('.json') && !keep.has(f)) {
+                    await fs.rm(p, { force: true });
+                    removed++;
+                }
+                else if (f.endsWith('.tmp')) {
+                    const st = await fs.stat(p).catch(() => null);
+                    if (st && Date.now() - st.mtimeMs > STALE_TMP_MS) {
+                        await fs.rm(p, { force: true });
+                        removed++;
+                    }
+                }
+            }
+        }
+        catch { /* no cache yet */ }
+        return removed;
+    },
+};