fix: improve skill routing for Claude 4.5 and reduce test cost

plugin/skills/azure-deploy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: azure-deploy
-description: "Deploy already-prepared applications to Azure by running azd up, azd deploy, or infrastructure provisioning commands. Supports Bicep and Terraform projects. WHEN: \"run azd up\", \"run azd deploy\", \"execute deployment\", \"provision infrastructure\", \"push to production\", \"push to cloud\", \"go live\", \"ship it\", \"bicep deploy\", \"terraform apply\", \"publish to Azure\", \"launch on Azure\"."
+description: "Execute Azure deployments for already-prepared applications. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery, retry logic, and deployment verification. Requires .azure/plan.md from azure-prepare and validated status from azure-validate. WHEN: \"run azd up\", \"run azd deploy\", \"execute deployment\", \"provision infrastructure\", \"push to production\", \"push to cloud\", \"go live\", \"ship it\", \"bicep deploy\", \"terraform apply\", \"publish to Azure\", \"launch on Azure\"."
 ---
 
 # Azure Deploy
@@ -30,14 +30,14 @@ description: "Deploy already-prepared applications to Azure by running azd up, a
 ## Triggers
 
 Activate this skill when user wants to:
-- Deploy their application to Azure
-- Publish, host, or launch their app
-- Push updates to existing deployment
-- Run `azd up` or `az deployment`
-- Ship code to production
-- Deploy Azure Functions to the cloud
+- Execute deployment of an already-prepared application (azure.yaml and infra/ exist)
+- Push updates to an existing Azure deployment
+- Run `azd up`, `azd deploy`, or `az deployment` on a prepared project
+- Ship already-built code to production
 - Deploy an application that already includes API Management (APIM) gateway infrastructure
 
+> **Scope**: This skill executes deployments. It does not create applications, generate infrastructure code, or scaffold projects. For those tasks, use **azure-prepare**.
+
 > **APIM / AI Gateway**: Use this skill to deploy applications whose APIM/AI gateway infrastructure was already created during **azure-prepare**. For creating or changing APIM resources, see [APIM deployment guide](https://learn.microsoft.com/azure/api-management/get-started-create-service-instance). For AI governance policies, invoke **azure-aigateway** skill.
 
 ## Rules
@@ -46,6 +46,7 @@ Activate this skill when user wants to:
 2. `.azure/plan.md` must exist with status `Validated`
 3. **Pre-deploy checklist required** — [Pre-Deploy Checklist](references/pre-deploy-checklist.md)
 4. ⛔ **Destructive actions require `ask_user`** — [global-rules](references/global-rules.md)
+5. **Scope: deployment execution only** — This skill owns execution of `azd up`, `azd deploy`, `terraform apply`, and `az deployment` commands. These commands are run through this skill's error recovery and verification pipeline.
 
 ---
 

plugin/skills/azure-prepare/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: azure-prepare
-description: "Default entry point for Azure application development. Analyzes your project and prepares it for Azure deployment by generating infrastructure code (Bicep/Terraform), azure.yaml, and Dockerfiles. WHEN: \"create an app\", \"build a web app\", \"create API\", \"create frontend\", \"create backend\", \"add a feature\", \"build a service\", \"develop a project\", \"migrate my app\", \"modernize my code\", \"update my application\", \"add database\", \"add authentication\", \"add caching\", \"deploy to Azure\", \"host on Azure\", \"Azure with terraform\", \"Azure with azd\", \"generate azure.yaml\", \"generate Bicep\", \"generate Terraform\", \"create Azure Functions app\", \"create serverless HTTP API\", \"create function app\", \"create event-driven function\", \"create and deploy to Azure\", \"create Azure Functions and deploy\", \"create function app and deploy\"."
+description: "Default entry point for Azure application development. Analyzes your project and prepares it for Azure deployment by generating infrastructure code (Bicep/Terraform), azure.yaml, and Dockerfiles. Preparation ONLY — does not execute deployments. After preparation, hand off to azure-validate then azure-deploy for execution. WHEN: \"create an app\", \"build a web app\", \"create API\", \"create frontend\", \"create backend\", \"add a feature\", \"build a service\", \"develop a project\", \"migrate my app\", \"modernize my code\", \"update my application\", \"add database\", \"add authentication\", \"add caching\", \"deploy to Azure\", \"host on Azure\", \"Azure with terraform\", \"Azure with azd\", \"generate azure.yaml\", \"generate Bicep\", \"generate Terraform\", \"create Azure Functions app\", \"create serverless HTTP API\", \"create function app\", \"create event-driven function\", \"create and deploy to Azure\", \"create Azure Functions and deploy\", \"create function app and deploy\"."
 ---
 
 # Azure Prepare
@@ -30,6 +30,7 @@ Activate this skill when user wants to:
 5. **Validate before deploy** — Invoke azure-validate before azure-deploy
 6. **Confirm Azure context** — Use `ask_user` for subscription and location per [Azure Context](references/azure-context.md)
 7. ⛔ **Destructive actions require `ask_user`** — [Global Rules](references/global-rules.md)
+8. **Scope: preparation only** — This skill generates infrastructure code and configuration files. Deployment execution (`azd up`, `azd deploy`, `terraform apply`) is handled by the **azure-deploy** skill, which provides built-in error recovery and deployment verification.
 
 ---
 
@@ -96,7 +97,7 @@ Execute the approved plan. Update `.azure/plan.md` status after each step.
 | 3 | **Generate Artifacts** — Create infrastructure and configuration files | [generate.md](references/generate.md) |
 | 4 | **Harden Security** — Apply security best practices | [security.md](references/security.md) |
 | 5 | **Update Plan** — Mark steps complete, set status to `Ready for Validation` | `.azure/plan.md` |
-| 6 | **Validate** — Invoke **azure-validate** skill | — |
+| 6 | **⛔ Hand Off** — Invoke **azure-validate** skill. Your preparation work is done. Deployment execution is handled by azure-deploy. | — |
 
 ---
 

plugin/skills/azure-validate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: azure-validate
-description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment."
+description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), permissions, and prerequisites before deploying. After all checks pass, hand off to azure-deploy skill which executes the actual deployment commands with error recovery and verification. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment."
 ---
 
 # Azure Validate

tests/azure-deploy/__snapshots__/triggers.test.ts.snap

@@ -2,37 +2,50 @@
 
 exports[`azure-deploy - Trigger Tests Trigger Keywords Snapshot skill description triggers match snapshot 1`] = `
 {
-  "description": "Deploy already-prepared applications to Azure by running azd up, azd deploy, or infrastructure provisioning commands. Supports Bicep and Terraform projects. WHEN: "run azd up", "run azd deploy", "execute deployment", "provision infrastructure", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure".",
+  "description": "Execute Azure deployments for already-prepared applications. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery, retry logic, and deployment verification. Requires .azure/plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "provision infrastructure", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure".",
   "extractedKeywords": [
     "already-prepared",
     "applications",
     "apply",
     "azure",
+    "azure-prepare",
+    "azure-validate",
     "bicep",
+    "built-in",
     "cli",
     "cloud",
     "commands",
     "deploy",
     "deployment",
+    "deployments",
+    "error",
     "execute",
-    "function",
+    "from",
     "identity",
     "infrastructure",
     "launch",
     "live",
+    "logic",
     "mcp",
+    "plan",
     "production",
-    "projects",
     "provision",
-    "provisioning",
     "publish",
     "push",
-    "running",
+    "recovery",
+    "requires",
+    "retry",
+    "runs",
     "ship",
-    "supports",
+    "skill",
+    "status",
     "terraform",
+    "this",
+    "validated",
     "validation",
+    "verification",
     "when",
+    "with",
   ],
   "name": "azure-deploy",
 }
@@ -44,30 +57,43 @@ exports[`azure-deploy - Trigger Tests Trigger Keywords Snapshot skill keywords m
   "applications",
   "apply",
   "azure",
+  "azure-prepare",
+  "azure-validate",
   "bicep",
+  "built-in",
   "cli",
   "cloud",
   "commands",
   "deploy",
   "deployment",
+  "deployments",
+  "error",
   "execute",
-  "function",
+  "from",
   "identity",
   "infrastructure",
   "launch",
   "live",
+  "logic",
   "mcp",
+  "plan",
   "production",
-  "projects",
   "provision",
-  "provisioning",
   "publish",
   "push",
-  "running",
+  "recovery",
+  "requires",
+  "retry",
+  "runs",
   "ship",
-  "supports",
+  "skill",
+  "status",
   "terraform",
+  "this",
+  "validated",
   "validation",
+  "verification",
   "when",
+  "with",
 ]
 `;

tests/azure-deploy/integration.test.ts

@@ -19,7 +19,7 @@ import { cloneRepo } from "../utils/git-clone";
 import { expectFiles, softCheckSkill } from "../utils/evaluate";
 
 const SKILL_NAME = "azure-deploy";
-const RUNS_PER_PROMPT = 5;
+const RUNS_PER_PROMPT = 1;
 const ASPIRE_SAMPLES_REPO = "https://github.com/dotnet/aspire-samples.git";
 
 // Check if integration tests should be skipped at module level
@@ -60,7 +60,7 @@ describeIntegration(`${SKILL_NAME}_ - Integration Tests`, () => {
       for (let i = 0; i < RUNS_PER_PROMPT; i++) {
         try {
           const agentMetadata = await agent.run({
-            prompt: "Publish my web app to Azure and configure the environment"
+            prompt: "My app already has azure.yaml and infra/ configured. Publish it to Azure now."
           });
 
           softCheckSkill(agentMetadata, SKILL_NAME);
@@ -78,7 +78,7 @@ describeIntegration(`${SKILL_NAME}_ - Integration Tests`, () => {
       for (let i = 0; i < RUNS_PER_PROMPT; i++) {
         try {
           const agentMetadata = await agent.run({
-            prompt: "Deploy my Azure Functions app to the cloud using azd"
+            prompt: "Deploy my existing Azure Functions project to the cloud. The infrastructure and azure.yaml are already set up."
           });
 
           softCheckSkill(agentMetadata, SKILL_NAME);

tests/azure-prepare/__snapshots__/triggers.test.ts.snap

@@ -2,12 +2,15 @@
 
 exports[`azure-prepare - Trigger Tests Trigger Keywords Snapshot skill description triggers match snapshot 1`] = `
 {
-  "description": "Default entry point for Azure application development. Analyzes your project and prepares it for Azure deployment by generating infrastructure code (Bicep/Terraform), azure.yaml, and Dockerfiles. WHEN: "create an app", "build a web app", "create API", "create frontend", "create backend", "add a feature", "build a service", "develop a project", "migrate my app", "modernize my code", "update my application", "add database", "add authentication", "add caching", "deploy to Azure", "host on Azure", "Azure with terraform", "Azure with azd", "generate azure.yaml", "generate Bicep", "generate Terraform", "create Azure Functions app", "create serverless HTTP API", "create function app", "create event-driven function", "create and deploy to Azure", "create Azure Functions and deploy", "create function app and deploy".",
+  "description": "Default entry point for Azure application development. Analyzes your project and prepares it for Azure deployment by generating infrastructure code (Bicep/Terraform), azure.yaml, and Dockerfiles. Preparation ONLY — does not execute deployments. After preparation, hand off to azure-validate then azure-deploy for execution. WHEN: "create an app", "build a web app", "create API", "create frontend", "create backend", "add a feature", "build a service", "develop a project", "migrate my app", "modernize my code", "update my application", "add database", "add authentication", "add caching", "deploy to Azure", "host on Azure", "Azure with terraform", "Azure with azd", "generate azure.yaml", "generate Bicep", "generate Terraform", "create Azure Functions app", "create serverless HTTP API", "create function app", "create event-driven function", "create and deploy to Azure", "create Azure Functions and deploy", "create function app and deploy".",
   "extractedKeywords": [
+    "after",
     "analyzes",
     "application",
     "authentication",
     "azure",
+    "azure-deploy",
+    "azure-validate",
     "backend",
     "bicep",
     "build",
@@ -19,31 +22,39 @@ exports[`azure-prepare - Trigger Tests Trigger Keywords Snapshot skill descripti
     "default",
     "deploy",
     "deployment",
+    "deployments",
     "develop",
     "development",
     "dockerfiles",
+    "does",
     "entry",
     "event-driven",
+    "execute",
+    "execution",
     "feature",
     "frontend",
     "function",
     "functions",
     "generate",
     "generating",
+    "hand",
     "host",
     "http",
     "identity",
     "infrastructure",
     "migrate",
     "modernize",
+    "only",
     "point",
+    "preparation",
     "prepare",
     "prepares",
     "project",
     "security",
     "serverless",
     "service",
     "terraform",
+    "then",
     "update",
     "validation",
     "when",
@@ -57,10 +68,13 @@ exports[`azure-prepare - Trigger Tests Trigger Keywords Snapshot skill descripti
 
 exports[`azure-prepare - Trigger Tests Trigger Keywords Snapshot skill keywords match snapshot 1`] = `
 [
+  "after",
   "analyzes",
   "application",
   "authentication",
   "azure",
+  "azure-deploy",
+  "azure-validate",
   "backend",
   "bicep",
   "build",
@@ -72,31 +86,39 @@ exports[`azure-prepare - Trigger Tests Trigger Keywords Snapshot skill keywords
   "default",
   "deploy",
   "deployment",
+  "deployments",
   "develop",
   "development",
   "dockerfiles",
+  "does",
   "entry",
   "event-driven",
+  "execute",
+  "execution",
   "feature",
   "frontend",
   "function",
   "functions",
   "generate",
   "generating",
+  "hand",
   "host",
   "http",
   "identity",
   "infrastructure",
   "migrate",
   "modernize",
+  "only",
   "point",
+  "preparation",
   "prepare",
   "prepares",
   "project",
   "security",
   "serverless",
   "service",
   "terraform",
+  "then",
   "update",
   "validation",
   "when",

tests/azure-prepare/integration.test.ts

@@ -21,7 +21,7 @@ import { expectFiles, getToolCalls, softCheckSkill } from "../utils/evaluate";
 import { isSkillInvoked } from "../utils/evaluate";
 
 const SKILL_NAME = "azure-prepare";
-const RUNS_PER_PROMPT = 5;
+const RUNS_PER_PROMPT = 1;
 const FOLLOW_UP_PROMPT = ["Go with recommended options."];
 
 // Check if integration tests should be skipped at module level