@fml-inc/fml 0.1.3 → 0.3.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fml",
-  "version": "0.1.3",
+  "version": "0.3.0",
   "description": "FML agent tools for Claude Code",
   "mcpServers": {
     "fml": {

package/dist/{chunk-I5BHNW37.js → chunk-BOREGHA6.js}

@@ -130,6 +130,42 @@ function createApiClient(token) {
         return { ok: false, error: msg };
       }
     },
+    // ── Tool catalog ─────────────────────────────────────────────────────
+    async listTools(pluginVersion) {
+      try {
+        if (isServiceToken) {
+          const url = new URL(`${getSiteUrl()}/api/tools/list`);
+          if (pluginVersion) url.searchParams.set("pluginVersion", pluginVersion);
+          const res = await fetch(url.toString(), {
+            headers: { Authorization: `Bearer ${token}` }
+          });
+          const text = await res.text();
+          let data;
+          try {
+            data = JSON.parse(text);
+          } catch {
+            throw new Error(`HTTP ${res.status}: ${text.slice(0, 200)}`);
+          }
+          if (!data.ok || !data.descriptors) {
+            throw new Error(data.error ?? `HTTP ${res.status}`);
+          }
+          return data.descriptors;
+        }
+        const client = await getClient();
+        return await client.query(
+          ref("user/plugin_tools:listTools"),
+          pluginVersion ? { pluginVersion } : {}
+        );
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes("Unauthorized") || msg.includes("not authenticated")) {
+          throw new Error(
+            "Authentication expired. Run `fml login` to sign in again, then restart Claude Code."
+          );
+        }
+        throw err;
+      }
+    },
     // ── Repo resolution ──────────────────────────────────────────────────
     async resolveRepo(orgSlug, repoFullName) {
       const client = await getClient();
@@ -182,4 +218,4 @@ export {
   createApiClient,
   getAuthenticatedClient
 };
-//# sourceMappingURL=chunk-I5BHNW37.js.map
+//# sourceMappingURL=chunk-BOREGHA6.js.map

package/dist/chunk-BOREGHA6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/native-check.ts","../src/convex-client.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport { execSync } from \"node:child_process\";\nimport { rmSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * Verify that better-sqlite3's native addon matches the running Node version.\n * If mismatched (e.g. user upgraded Node), attempt an automatic rebuild.\n * Call this before any code that imports better-sqlite3.\n */\nexport function ensureNativeModules(): void {\n  const require = createRequire(import.meta.url);\n  try {\n    require(\"better-sqlite3\");\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : \"\";\n    if (!msg.includes(\"NODE_MODULE_VERSION\")) {\n      throw err;\n    }\n\n    console.error(\n      \"[fml] better-sqlite3 was compiled for a different Node.js version, rebuilding...\",\n    );\n\n    const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), \"..\");\n\n    // Remove stale build directory to avoid EEXIST errors from node-gyp\n    const sqlitePath = dirname(require.resolve(\"better-sqlite3/package.json\"));\n    rmSync(join(sqlitePath, \"build\"), { recursive: true, force: true });\n\n    try {\n      execSync(\"npm rebuild better-sqlite3\", {\n        cwd: pkgRoot,\n        stdio: \"inherit\",\n        timeout: 60_000,\n      });\n      console.error(\"[fml] Rebuild complete.\");\n    } catch {\n      console.error(\n        \"[fml] Automatic rebuild failed. Please run manually:\\n\" +\n          `  cd ${pkgRoot} && rm -rf node_modules/better-sqlite3/build && npm rebuild better-sqlite3`,\n      );\n      process.exit(1);\n    }\n  }\n}\n","import type { FunctionReference } from \"convex/server\";\nimport { resolveRepoFromCwd } from \"@fml-inc/panopticon/repo\";\nimport { getSelectedOrg, getValidToken } from \"./auth/token-store.js\";\nimport { CONVEX_URL } from \"./config.js\";\nimport type {\n  RepoConfigSnapshotDetail,\n  RepoConfigSnapshotSummary,\n  ResolvedRepo,\n  UserConfigSnapshotDetail,\n  UserConfigSnapshotSummary,\n} from \"./types.js\";\n\n// ── Shared plumbing ─────────────────────────────────────────────────────────\n\nexport type ToolCategory =\n  | \"messages\"\n  | \"slack\"\n  | \"skills\"\n  | \"analysis\"\n  | \"integrations\"\n  | \"engineering\"\n  | \"memory\"\n  | \"automations\"\n  | \"amplitude\"\n  | \"posthog\"\n  | \"meta-ads\";\n\nexport interface PublicToolDescriptor {\n  name: string;\n  description: string;\n  inputSchema: Record<string, unknown>;\n  category?: ToolCategory;\n  experimental?: boolean;\n}\n\nexport interface ToolResult {\n  ok: boolean;\n  result?: unknown;\n  error?: string;\n}\n\nexport interface OrgInfo {\n  _id: string;\n  name: string;\n  slug?: string;\n  repos?: Array<{\n    _id: string;\n    fullName: string;\n    owner: string;\n    name: string;\n    private: boolean;\n  }>;\n}\n\nfunction ref<T extends \"query\" | \"mutation\" | \"action\">(\n  path: string,\n): FunctionReference<T> {\n  return path as unknown as FunctionReference<T>;\n}\n\n// ── API client factory ──────────────────────────────────────────────────────\n\nexport function createApiClient(token: string) {\n  const isServiceToken = token.startsWith(\"fml_st_\");\n\n  let clientPromise: Promise<{\n    query: <T>(\n      ref: FunctionReference<\"query\">,\n      args: Record<string, unknown>,\n    ) => Promise<T>;\n    mutation: <T>(\n      ref: FunctionReference<\"mutation\">,\n      args: Record<string, unknown>,\n    ) => Promise<T>;\n    action: <T>(\n      ref: FunctionReference<\"action\">,\n      args: Record<string, unknown>,\n    ) => Promise<T>;\n  }> | null = null;\n\n  function getClient() {\n    if (!clientPromise) {\n      clientPromise = import(\"convex/browser\").then(({ ConvexHttpClient }) => {\n        const client = new ConvexHttpClient(CONVEX_URL);\n        client.setAuth(token);\n        return client;\n      });\n    }\n    return clientPromise;\n  }\n\n  /**\n   * Derive the Convex site URL (HTTP actions) from the cloud URL.\n   * Convex uses paired domains: *.convex.cloud for client APIs,\n   * *.convex.site for HTTP actions. This is a stable Convex convention.\n   */\n  function getSiteUrl(): string {\n    return CONVEX_URL.replace(\".convex.cloud\", \".convex.site\").replace(\n      /\\/$/,\n      \"\",\n    );\n  }\n\n  return {\n    // ── Orgs ──────────────────────────────────────────────────────────────\n\n    async queryOrgs(): Promise<OrgInfo[]> {\n      if (isServiceToken) {\n        // Service tokens can't call Convex actions directly — org is embedded in the token\n        return [];\n      }\n      const client = await getClient();\n      return await client.query(ref(\"user/plugin:getMyOrgsAndRepos\"), {});\n    },\n\n    // ── Tool gateway ─────────────────────────────────────────────────────\n\n    async callBackend(\n      toolName: string,\n      args: Record<string, unknown>,\n      opts?: { org?: string },\n    ): Promise<ToolResult> {\n      try {\n        if (isServiceToken) {\n          // Service token path: POST to HTTP endpoint (Convex can't validate non-JWT tokens)\n          // Thread user identity: sandbox agents set FML_USER_EXTERNAL_ID;\n          // device-flow logins fall back to the id stashed on the stored token\n          // so tools can execute with the real user context even though the\n          // token's actAsExternalId is the namespaced system:cli:* string.\n          const { readTokens } = await import(\"./auth/token-store.js\");\n          const userExternalId =\n            process.env.FML_USER_EXTERNAL_ID ?? readTokens()?.user.id;\n          const res = await fetch(`${getSiteUrl()}/api/tools/execute`, {\n            method: \"POST\",\n            headers: {\n              \"Content-Type\": \"application/json\",\n              Authorization: `Bearer ${token}`,\n            },\n            body: JSON.stringify({\n              toolName,\n              args,\n              ...(userExternalId && { userExternalId }),\n            }),\n          });\n          const text = await res.text();\n          let data: ToolResult;\n          try {\n            data = JSON.parse(text) as ToolResult;\n          } catch {\n            return {\n              ok: false,\n              error: `HTTP ${res.status}: ${text.slice(0, 200)}`,\n            };\n          }\n          if (!res.ok && !data.error) {\n            return { ok: false, error: `HTTP ${res.status}` };\n          }\n          return data;\n        }\n\n        // JWT path: standard Convex action\n        const client = await getClient();\n        const actionArgs: Record<string, unknown> = { toolName, args };\n        // Explicit org > stored org selection > repo-based inference\n        const org = opts?.org ?? getSelectedOrg();\n        if (org) actionArgs.org = org;\n        const repo = resolveRepoFromCwd(process.cwd());\n        if (repo) actionArgs.repo = repo.repo;\n\n        const result = await client.action(\n          ref<\"action\">(\"user/tool_gateway:executeTool\"),\n          actionArgs,\n        );\n        return { ok: true, result };\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        if (msg.includes(\"Unauthorized\") || msg.includes(\"not authenticated\")) {\n          return {\n            ok: false,\n            error:\n              \"Authentication expired. Run `fml login` to sign in again, then restart Claude Code.\",\n          };\n        }\n        return { ok: false, error: msg };\n      }\n    },\n\n    // ── Tool catalog ─────────────────────────────────────────────────────\n\n    async listTools(pluginVersion?: string): Promise<PublicToolDescriptor[]> {\n      try {\n        if (isServiceToken) {\n          const url = new URL(`${getSiteUrl()}/api/tools/list`);\n          if (pluginVersion) url.searchParams.set(\"pluginVersion\", pluginVersion);\n          const res = await fetch(url.toString(), {\n            headers: { Authorization: `Bearer ${token}` },\n          });\n          const text = await res.text();\n          let data: { ok: boolean; descriptors?: PublicToolDescriptor[]; error?: string };\n          try {\n            data = JSON.parse(text) as typeof data;\n          } catch {\n            throw new Error(`HTTP ${res.status}: ${text.slice(0, 200)}`);\n          }\n          if (!data.ok || !data.descriptors) {\n            throw new Error(data.error ?? `HTTP ${res.status}`);\n          }\n          return data.descriptors;\n        }\n\n        const client = await getClient();\n        return await client.query<PublicToolDescriptor[]>(\n          ref<\"query\">(\"user/plugin_tools:listTools\"),\n          pluginVersion ? { pluginVersion } : {},\n        );\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        if (msg.includes(\"Unauthorized\") || msg.includes(\"not authenticated\")) {\n          throw new Error(\n            \"Authentication expired. Run `fml login` to sign in again, then restart Claude Code.\",\n          );\n        }\n        throw err;\n      }\n    },\n\n    // ── Repo resolution ──────────────────────────────────────────────────\n\n    async resolveRepo(\n      orgSlug: string,\n      repoFullName: string,\n    ): Promise<ResolvedRepo | null> {\n      const client = await getClient();\n      return await client.query(ref(\"user/cli:resolveRepo\"), {\n        orgSlug,\n        repoFullName,\n      });\n    },\n\n    // ── Config snapshots ─────────────────────────────────────────────────\n\n    async listUserConfigSnapshots(\n      orgSlug: string,\n    ): Promise<UserConfigSnapshotSummary[]> {\n      const client = await getClient();\n      const result = await client.query<UserConfigSnapshotSummary[] | null>(\n        ref(\"user/config_snapshots:listUserSnapshots\"),\n        { orgSlug },\n      );\n      return result ?? [];\n    },\n\n    async getUserConfigDetail(\n      orgSlug: string,\n      githubUsername: string,\n    ): Promise<UserConfigSnapshotDetail | null> {\n      const client = await getClient();\n      return await client.query(ref(\"user/config_snapshots:getUserDetail\"), {\n        orgSlug,\n        githubUsername,\n      });\n    },\n\n    async listRepoConfigSnapshots(\n      orgSlug: string,\n      repository?: string,\n    ): Promise<RepoConfigSnapshotSummary[]> {\n      const client = await getClient();\n      const result = await client.query<RepoConfigSnapshotSummary[] | null>(\n        ref(\"user/config_snapshots:listRepoSnapshots\"),\n        { orgSlug, repository },\n      );\n      return result ?? [];\n    },\n\n    async getRepoConfigDetail(\n      orgSlug: string,\n      repository: string,\n    ): Promise<RepoConfigSnapshotDetail | null> {\n      const client = await getClient();\n      return await client.query(ref(\"user/config_snapshots:getRepoDetail\"), {\n        orgSlug,\n        repository,\n      });\n    },\n  };\n}\n\n// ── Convenience: auto-authenticated client ──────────────────────────────────\n\n/**\n * Create an API client using the stored auth token.\n * Returns null if not authenticated.\n */\nexport async function getAuthenticatedClient() {\n  const token = await getValidToken();\n  if (!token) return null;\n  return createApiClient(token);\n}\n"],"mappings":";;;;;;;AAAA,SAAS,qBAAqB;AAC9B,SAAS,gBAAgB;AACzB,SAAS,cAAc;AACvB,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAOvB,SAAS,sBAA4B;AAC1C,QAAMA,WAAU,cAAc,YAAY,GAAG;AAC7C,MAAI;AACF,IAAAA,SAAQ,gBAAgB;AAAA,EAC1B,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU;AACjD,QAAI,CAAC,IAAI,SAAS,qBAAqB,GAAG;AACxC,YAAM;AAAA,IACR;AAEA,YAAQ;AAAA,MACN;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,IAAI;AAGlE,UAAM,aAAa,QAAQA,SAAQ,QAAQ,6BAA6B,CAAC;AACzE,WAAO,KAAK,YAAY,OAAO,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAElE,QAAI;AACF,eAAS,8BAA8B;AAAA,QACrC,KAAK;AAAA,QACL,OAAO;AAAA,QACP,SAAS;AAAA,MACX,CAAC;AACD,cAAQ,MAAM,yBAAyB;AAAA,IACzC,QAAQ;AACN,cAAQ;AAAA,QACN;AAAA,OACU,OAAO;AAAA,MACnB;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AACF;;;AC7CA,SAAS,0BAA0B;AAqDnC,SAAS,IACP,MACsB;AACtB,SAAO;AACT;AAIO,SAAS,gBAAgB,OAAe;AAC7C,QAAM,iBAAiB,MAAM,WAAW,SAAS;AAEjD,MAAI,gBAaQ;AAEZ,WAAS,YAAY;AACnB,QAAI,CAAC,eAAe;AAClB,sBAAgB,OAAO,gBAAgB,EAAE,KAAK,CAAC,EAAE,iBAAiB,MAAM;AACtE,cAAM,SAAS,IAAI,iBAAiB,UAAU;AAC9C,eAAO,QAAQ,KAAK;AACpB,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAOA,WAAS,aAAqB;AAC5B,WAAO,WAAW,QAAQ,iBAAiB,cAAc,EAAE;AAAA,MACzD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA;AAAA,IAGL,MAAM,YAAgC;AACpC,UAAI,gBAAgB;AAElB,eAAO,CAAC;AAAA,MACV;AACA,YAAM,SAAS,MAAM,UAAU;AAC/B,aAAO,MAAM,OAAO,MAAM,IAAI,+BAA+B,GAAG,CAAC,CAAC;AAAA,IACpE;AAAA;AAAA,IAIA,MAAM,YACJ,UACA,MACA,MACqB;AACrB,UAAI;AACF,YAAI,gBAAgB;AAMlB,gBAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2BAAuB;AAC3D,gBAAM,iBACJ,QAAQ,IAAI,wBAAwB,WAAW,GAAG,KAAK;AACzD,gBAAM,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,sBAAsB;AAAA,YAC3D,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,gBAAgB;AAAA,cAChB,eAAe,UAAU,KAAK;AAAA,YAChC;AAAA,YACA,MAAM,KAAK,UAAU;AAAA,cACnB;AAAA,cACA;AAAA,cACA,GAAI,kBAAkB,EAAE,eAAe;AAAA,YACzC,CAAC;AAAA,UACH,CAAC;AACD,gBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,cAAI;AACJ,cAAI;AACF,mBAAO,KAAK,MAAM,IAAI;AAAA,UACxB,QAAQ;AACN,mBAAO;AAAA,cACL,IAAI;AAAA,cACJ,OAAO,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,YAClD;AAAA,UACF;AACA,cAAI,CAAC,IAAI,MAAM,CAAC,KAAK,OAAO;AAC1B,mBAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,IAAI,MAAM,GAAG;AAAA,UAClD;AACA,iBAAO;AAAA,QACT;AAGA,cAAM,SAAS,MAAM,UAAU;AAC/B,cAAM,aAAsC,EAAE,UAAU,KAAK;AAE7D,cAAM,MAAM,MAAM,OAAO,eAAe;AACxC,YAAI,IAAK,YAAW,MAAM;AAC1B,cAAM,OAAO,mBAAmB,QAAQ,IAAI,CAAC;AAC7C,YAAI,KAAM,YAAW,OAAO,KAAK;AAEjC,cAAM,SAAS,MAAM,OAAO;AAAA,UAC1B,IAAc,+BAA+B;AAAA,UAC7C;AAAA,QACF;AACA,eAAO,EAAE,IAAI,MAAM,OAAO;AAAA,MAC5B,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,mBAAmB,GAAG;AACrE,iBAAO;AAAA,YACL,IAAI;AAAA,YACJ,OACE;AAAA,UACJ;AAAA,QACF;AACA,eAAO,EAAE,IAAI,OAAO,OAAO,IAAI;AAAA,MACjC;AAAA,IACF;AAAA;AAAA,IAIA,MAAM,UAAU,eAAyD;AACvE,UAAI;AACF,YAAI,gBAAgB;AAClB,gBAAM,MAAM,IAAI,IAAI,GAAG,WAAW,CAAC,iBAAiB;AACpD,cAAI,cAAe,KAAI,aAAa,IAAI,iBAAiB,aAAa;AACtE,gBAAM,MAAM,MAAM,MAAM,IAAI,SAAS,GAAG;AAAA,YACtC,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,UAC9C,CAAC;AACD,gBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,cAAI;AACJ,cAAI;AACF,mBAAO,KAAK,MAAM,IAAI;AAAA,UACxB,QAAQ;AACN,kBAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,EAAE;AAAA,UAC7D;AACA,cAAI,CAAC,KAAK,MAAM,CAAC,KAAK,aAAa;AACjC,kBAAM,IAAI,MAAM,KAAK,SAAS,QAAQ,IAAI,MAAM,EAAE;AAAA,UACpD;AACA,iBAAO,KAAK;AAAA,QACd;AAEA,cAAM,SAAS,MAAM,UAAU;AAC/B,eAAO,MAAM,OAAO;AAAA,UAClB,IAAa,6BAA6B;AAAA,UAC1C,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,QACvC;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAI,IAAI,SAAS,cAAc,KAAK,IAAI,SAAS,mBAAmB,GAAG;AACrE,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA;AAAA,IAIA,MAAM,YACJ,SACA,cAC8B;AAC9B,YAAM,SAAS,MAAM,UAAU;AAC/B,aAAO,MAAM,OAAO,MAAM,IAAI,sBAAsB,GAAG;AAAA,QACrD;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA;AAAA,IAIA,MAAM,wBACJ,SACsC;AACtC,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B,IAAI,yCAAyC;AAAA,QAC7C,EAAE,QAAQ;AAAA,MACZ;AACA,aAAO,UAAU,CAAC;AAAA,IACpB;AAAA,IAEA,MAAM,oBACJ,SACA,gBAC0C;AAC1C,YAAM,SAAS,MAAM,UAAU;AAC/B,aAAO,MAAM,OAAO,MAAM,IAAI,qCAAqC,GAAG;AAAA,QACpE;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,wBACJ,SACA,YACsC;AACtC,YAAM,SAAS,MAAM,UAAU;AAC/B,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B,IAAI,yCAAyC;AAAA,QAC7C,EAAE,SAAS,WAAW;AAAA,MACxB;AACA,aAAO,UAAU,CAAC;AAAA,IACpB;AAAA,IAEA,MAAM,oBACJ,SACA,YAC0C;AAC1C,YAAM,SAAS,MAAM,UAAU;AAC/B,aAAO,MAAM,OAAO,MAAM,IAAI,qCAAqC,GAAG;AAAA,QACpE;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAQA,eAAsB,yBAAyB;AAC7C,QAAM,QAAQ,MAAM,cAAc;AAClC,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,gBAAgB,KAAK;AAC9B;","names":["require"]}

package/dist/{chunk-YIWT7BWN.js → chunk-CFPXJT5Q.js}

@@ -2,7 +2,7 @@ import {
   SYNC_PID_FILE,
   isDaemonRunning,
   panopticonExec
-} from "./chunk-ZA4RG25C.js";
+} from "./chunk-MUKYS4IB.js";
 
 // src/commands/daemon.ts
 function parsePanopticonRunning() {
@@ -30,4 +30,4 @@ export {
   handleStart,
   handleStop
 };
-//# sourceMappingURL=chunk-YIWT7BWN.js.map
+//# sourceMappingURL=chunk-CFPXJT5Q.js.map

package/dist/chunk-MUKYS4IB.js

@@ -0,0 +1,93 @@
+import {
+  FML_DATA_DIR,
+  FML_LOG_DIR
+} from "./chunk-4YEAQJPF.js";
+
+// src/daemon-utils.ts
+import fs2 from "fs";
+import path2 from "path";
+
+// src/bin-utils.ts
+import fs from "fs";
+import path from "path";
+import { execFileSync, execSync } from "child_process";
+var IS_WIN = process.platform === "win32";
+var DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+function resolveBin(name) {
+  const pathDirs = (process.env.PATH ?? "").split(path.delimiter).filter(Boolean);
+  const hasExt = path.extname(name) !== "";
+  const exts = !IS_WIN || hasExt ? [""] : (process.env.PATHEXT ?? DEFAULT_PATHEXT).split(";").filter(Boolean);
+  for (const dir of pathDirs) {
+    for (const ext of exts) {
+      const candidate = path.join(dir, name + ext);
+      try {
+        if (fs.statSync(candidate).isFile()) return candidate;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function isWinShim(bin) {
+  return IS_WIN && /\.(cmd|bat)$/i.test(bin);
+}
+function quoteWinArg(arg) {
+  if (arg.length === 0) return '""';
+  if (/^[A-Za-z0-9@\-_+=:/.,]+$/.test(arg)) return arg;
+  const crt = arg.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, "$1$1");
+  const quoted = `"${crt}"`;
+  return quoted.replace(/([()%!^<>&|"])/g, "^$1");
+}
+function execBinSync(bin, args, opts = {}) {
+  const { timeout = 1e4, encoding = "utf-8", stdio = "pipe" } = opts;
+  if (isWinShim(bin)) {
+    const command = [bin, ...args].map(quoteWinArg).join(" ");
+    return execSync(command, { timeout, encoding, stdio });
+  }
+  return execFileSync(bin, args, { timeout, encoding, stdio });
+}
+
+// src/daemon-utils.ts
+var SYNC_PID_FILE = path2.join(FML_DATA_DIR, "sync.pid");
+var SYNC_LOG_FILE = path2.join(FML_LOG_DIR, "sync.log");
+function isDaemonRunning(pidFile) {
+  if (!fs2.existsSync(pidFile)) return { running: false, pid: null };
+  const pid = parseInt(fs2.readFileSync(pidFile, "utf-8").trim(), 10);
+  try {
+    process.kill(pid, 0);
+    return { running: true, pid };
+  } catch {
+    return { running: false, pid };
+  }
+}
+function resolvePanopticonBin() {
+  return resolveBin("panopticon");
+}
+function panopticonExec(...argsAndOpts) {
+  let timeout = 1e4;
+  const args = [];
+  for (const a of argsAndOpts) {
+    if (typeof a === "string") args.push(a);
+    else timeout = a.timeout ?? timeout;
+  }
+  const bin = resolvePanopticonBin();
+  if (!bin) return { ok: false, stdout: "panopticon binary not found" };
+  try {
+    const stdout = execBinSync(bin, args, { timeout });
+    return { ok: true, stdout };
+  } catch (err) {
+    const e = err;
+    return { ok: false, stdout: (e.stdout ?? "") + (e.stderr ?? "") };
+  }
+}
+
+export {
+  resolveBin,
+  execBinSync,
+  SYNC_PID_FILE,
+  SYNC_LOG_FILE,
+  isDaemonRunning,
+  resolvePanopticonBin,
+  panopticonExec
+};
+//# sourceMappingURL=chunk-MUKYS4IB.js.map

package/dist/chunk-MUKYS4IB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/daemon-utils.ts","../src/bin-utils.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { execBinSync, resolveBin } from \"./bin-utils.js\";\nimport { FML_DATA_DIR, FML_LOG_DIR } from \"./dirs.js\";\n\nexport const SYNC_PID_FILE = path.join(FML_DATA_DIR, \"sync.pid\");\nexport const SYNC_LOG_FILE = path.join(FML_LOG_DIR, \"sync.log\");\n\nexport function isDaemonRunning(pidFile: string): {\n  running: boolean;\n  pid: number | null;\n} {\n  if (!fs.existsSync(pidFile)) return { running: false, pid: null };\n  const pid = parseInt(fs.readFileSync(pidFile, \"utf-8\").trim(), 10);\n  try {\n    process.kill(pid, 0);\n    return { running: true, pid };\n  } catch {\n    return { running: false, pid };\n  }\n}\n\n/** Resolve the panopticon CLI binary from PATH (globally installed). */\nexport function resolvePanopticonBin(): string | null {\n  return resolveBin(\"panopticon\");\n}\n\n/** Run a panopticon CLI command and return stdout. */\nexport function panopticonExec(...args: string[]): {\n  ok: boolean;\n  stdout: string;\n};\nexport function panopticonExec(\n  ...argsAndOpts: [...string[], { timeout?: number }]\n): { ok: boolean; stdout: string };\nexport function panopticonExec(\n  ...argsAndOpts: Array<string | { timeout?: number }>\n): {\n  ok: boolean;\n  stdout: string;\n} {\n  let timeout = 10_000;\n  const args: string[] = [];\n  for (const a of argsAndOpts) {\n    if (typeof a === \"string\") args.push(a);\n    else timeout = a.timeout ?? timeout;\n  }\n  const bin = resolvePanopticonBin();\n  if (!bin) return { ok: false, stdout: \"panopticon binary not found\" };\n  try {\n    const stdout = execBinSync(bin, args, { timeout });\n    return { ok: true, stdout };\n  } catch (err: unknown) {\n    const e = err as { stdout?: string; stderr?: string; status?: number };\n    return { ok: false, stdout: (e.stdout ?? \"\") + (e.stderr ?? \"\") };\n  }\n}\n","import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { execFileSync, execSync } from \"node:child_process\";\n\nconst IS_WIN = process.platform === \"win32\";\nconst DEFAULT_PATHEXT = \".COM;.EXE;.BAT;.CMD\";\n\n/**\n * Resolve a CLI binary by walking process.env.PATH. On Windows, probe each\n * process.env.PATHEXT extension. Returns an absolute path or null.\n *\n * Pass the bare command name (e.g. \"npm\", not \"npm.cmd\"); the extension is\n * applied via PATHEXT on Windows. If the caller does include an extension,\n * it's used as-is.\n *\n * Replaces `which`/`where`: avoids spawning a child process and works the\n * same on macOS, Linux, and Windows.\n */\nexport function resolveBin(name: string): string | null {\n  const pathDirs = (process.env.PATH ?? \"\").split(path.delimiter).filter(Boolean);\n  const hasExt = path.extname(name) !== \"\";\n  const exts = !IS_WIN || hasExt\n    ? [\"\"]\n    : (process.env.PATHEXT ?? DEFAULT_PATHEXT).split(\";\").filter(Boolean);\n\n  for (const dir of pathDirs) {\n    for (const ext of exts) {\n      const candidate = path.join(dir, name + ext);\n      try {\n        if (fs.statSync(candidate).isFile()) return candidate;\n      } catch {}\n    }\n  }\n  return null;\n}\n\n/** True for Windows shell shims that execFile cannot run directly. */\nfunction isWinShim(bin: string): boolean {\n  return IS_WIN && /\\.(cmd|bat)$/i.test(bin);\n}\n\n/**\n * Quote a single argument for safe inclusion in a Windows command line that\n * will be parsed by cmd.exe and then re-parsed by a CRT program.\n *\n * Two layers:\n *   1. CRT (CommandLineToArgvW): wrap in `\"`, escape internal `\"` as `\\\"`,\n *      double any backslashes that precede a quote.\n *   2. cmd.exe: escape its metacharacters with `^` so they aren't expanded\n *      before the CRT layer sees them. `%` and `!` (delayed expansion) are\n *      the dangerous ones inside quotes; the rest are safest belt-and-braces.\n */\nexport function quoteWinArg(arg: string): string {\n  if (arg.length === 0) return '\"\"';\n\n  // Fast path: bare-word args that need no quoting at all.\n  // Backslash is intentionally excluded so `path\\` and similar still go\n  // through the trailing-backslash doubling logic below.\n  if (/^[A-Za-z0-9@\\-_+=:/.,]+$/.test(arg)) return arg;\n\n  // CRT layer: double backslashes before quotes, escape quotes, double trailing backslashes.\n  const crt = arg\n    .replace(/(\\\\*)\"/g, '$1$1\\\\\"')\n    .replace(/(\\\\+)$/, \"$1$1\");\n  const quoted = `\"${crt}\"`;\n\n  // cmd.exe layer: escape metacharacters (including the surrounding quotes)\n  // so cmd's first pass passes them through verbatim.\n  return quoted.replace(/([()%!^<>&|\"])/g, \"^$1\");\n}\n\nexport interface ExecBinOptions {\n  timeout?: number;\n  encoding?: BufferEncoding;\n  stdio?: \"pipe\" | \"inherit\" | \"ignore\";\n}\n\n/**\n * Run a resolved binary path with the given args, handling Windows .cmd/.bat\n * shims correctly. Throws on non-zero exit (matching execFileSync).\n */\nexport function execBinSync(\n  bin: string,\n  args: string[],\n  opts: ExecBinOptions = {},\n): string {\n  const { timeout = 10_000, encoding = \"utf-8\", stdio = \"pipe\" } = opts;\n\n  if (isWinShim(bin)) {\n    // CVE-2024-27980: Node refuses to spawn .cmd/.bat without shell: true.\n    // Build the command string ourselves so we control the quoting.\n    const command = [bin, ...args].map(quoteWinArg).join(\" \");\n    return execSync(command, { timeout, encoding, stdio });\n  }\n\n  return execFileSync(bin, args, { timeout, encoding, stdio });\n}\n"],"mappings":";;;;;;AAAA,OAAOA,SAAQ;AACf,OAAOC,WAAU;;;ACDjB,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,cAAc,gBAAgB;AAEvC,IAAM,SAAS,QAAQ,aAAa;AACpC,IAAM,kBAAkB;AAajB,SAAS,WAAW,MAA6B;AACtD,QAAM,YAAY,QAAQ,IAAI,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,OAAO;AAC9E,QAAM,SAAS,KAAK,QAAQ,IAAI,MAAM;AACtC,QAAM,OAAO,CAAC,UAAU,SACpB,CAAC,EAAE,KACF,QAAQ,IAAI,WAAW,iBAAiB,MAAM,GAAG,EAAE,OAAO,OAAO;AAEtE,aAAW,OAAO,UAAU;AAC1B,eAAW,OAAO,MAAM;AACtB,YAAM,YAAY,KAAK,KAAK,KAAK,OAAO,GAAG;AAC3C,UAAI;AACF,YAAI,GAAG,SAAS,SAAS,EAAE,OAAO,EAAG,QAAO;AAAA,MAC9C,QAAQ;AAAA,MAAC;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,UAAU,KAAsB;AACvC,SAAO,UAAU,gBAAgB,KAAK,GAAG;AAC3C;AAaO,SAAS,YAAY,KAAqB;AAC/C,MAAI,IAAI,WAAW,EAAG,QAAO;AAK7B,MAAI,2BAA2B,KAAK,GAAG,EAAG,QAAO;AAGjD,QAAM,MAAM,IACT,QAAQ,WAAW,SAAS,EAC5B,QAAQ,UAAU,MAAM;AAC3B,QAAM,SAAS,IAAI,GAAG;AAItB,SAAO,OAAO,QAAQ,mBAAmB,KAAK;AAChD;AAYO,SAAS,YACd,KACA,MACA,OAAuB,CAAC,GAChB;AACR,QAAM,EAAE,UAAU,KAAQ,WAAW,SAAS,QAAQ,OAAO,IAAI;AAEjE,MAAI,UAAU,GAAG,GAAG;AAGlB,UAAM,UAAU,CAAC,KAAK,GAAG,IAAI,EAAE,IAAI,WAAW,EAAE,KAAK,GAAG;AACxD,WAAO,SAAS,SAAS,EAAE,SAAS,UAAU,MAAM,CAAC;AAAA,EACvD;AAEA,SAAO,aAAa,KAAK,MAAM,EAAE,SAAS,UAAU,MAAM,CAAC;AAC7D;;;AD3FO,IAAM,gBAAgBC,MAAK,KAAK,cAAc,UAAU;AACxD,IAAM,gBAAgBA,MAAK,KAAK,aAAa,UAAU;AAEvD,SAAS,gBAAgB,SAG9B;AACA,MAAI,CAACC,IAAG,WAAW,OAAO,EAAG,QAAO,EAAE,SAAS,OAAO,KAAK,KAAK;AAChE,QAAM,MAAM,SAASA,IAAG,aAAa,SAAS,OAAO,EAAE,KAAK,GAAG,EAAE;AACjE,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AACnB,WAAO,EAAE,SAAS,MAAM,IAAI;AAAA,EAC9B,QAAQ;AACN,WAAO,EAAE,SAAS,OAAO,IAAI;AAAA,EAC/B;AACF;AAGO,SAAS,uBAAsC;AACpD,SAAO,WAAW,YAAY;AAChC;AAUO,SAAS,kBACX,aAIH;AACA,MAAI,UAAU;AACd,QAAM,OAAiB,CAAC;AACxB,aAAW,KAAK,aAAa;AAC3B,QAAI,OAAO,MAAM,SAAU,MAAK,KAAK,CAAC;AAAA,QACjC,WAAU,EAAE,WAAW;AAAA,EAC9B;AACA,QAAM,MAAM,qBAAqB;AACjC,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,8BAA8B;AACpE,MAAI;AACF,UAAM,SAAS,YAAY,KAAK,MAAM,EAAE,QAAQ,CAAC;AACjD,WAAO,EAAE,IAAI,MAAM,OAAO;AAAA,EAC5B,SAAS,KAAc;AACrB,UAAM,IAAI;AACV,WAAO,EAAE,IAAI,OAAO,SAAS,EAAE,UAAU,OAAO,EAAE,UAAU,IAAI;AAAA,EAClE;AACF;","names":["fs","path","path","fs"]}

package/dist/cli.js

@@ -3,7 +3,7 @@ import {
   createApiClient,
   ensureNativeModules,
   getAuthenticatedClient
-} from "./chunk-I5BHNW37.js";
+} from "./chunk-BOREGHA6.js";
 import {
   CONVEX_URL,
   DEFAULT_SYNC_URL,
@@ -27,10 +27,12 @@ import {
   handleStart,
   handleStop,
   parsePanopticonRunning
-} from "./chunk-YIWT7BWN.js";
+} from "./chunk-CFPXJT5Q.js";
 import {
-  panopticonExec
-} from "./chunk-ZA4RG25C.js";
+  execBinSync,
+  panopticonExec,
+  resolveBin
+} from "./chunk-MUKYS4IB.js";
 import {
   FML_DATA_DIR,
   FML_LOG_DIR
@@ -273,7 +275,6 @@ async function handleDoctor(opts) {
 }
 
 // src/commands/install.ts
-import { execFileSync } from "child_process";
 import fs from "fs";
 import os from "os";
 import path from "path";
@@ -369,7 +370,7 @@ async function handleInstall() {
   const pluginRoot = getPluginRoot();
   console.log("Installing fml...\n");
   console.log("[1/5] Setting up panopticon...");
-  const { resolvePanopticonBin } = await import("./daemon-utils-LIG6K2MK.js");
+  const { resolvePanopticonBin } = await import("./daemon-utils-CJO4XVJQ.js");
   let freshInstall = false;
   const bin = resolvePanopticonBin();
   let needsInstall = !bin;
@@ -386,18 +387,22 @@ async function handleInstall() {
     console.log(
       bin ? "      Upgrading @fml-inc/panopticon..." : "      Installing @fml-inc/panopticon globally..."
     );
-    try {
-      execFileSync("npm", ["install", "-g", "@fml-inc/panopticon@latest"], {
-        encoding: "utf-8",
-        timeout: 12e4,
-        stdio: "pipe"
-      });
-      freshInstall = true;
-      console.log("      Installed @fml-inc/panopticon");
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(`      Failed to install panopticon: ${msg}`);
+    const npmBin = resolveBin("npm");
+    if (!npmBin) {
+      console.error("      Failed to install panopticon: npm not found on PATH");
       console.error("      Install manually: npm install -g @fml-inc/panopticon@latest");
+    } else {
+      try {
+        execBinSync(npmBin, ["install", "-g", "@fml-inc/panopticon@latest"], {
+          timeout: 12e4
+        });
+        freshInstall = true;
+        console.log("      Installed @fml-inc/panopticon");
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`      Failed to install panopticon: ${msg}`);
+        console.error("      Install manually: npm install -g @fml-inc/panopticon@latest");
+      }
     }
   }
   if (!freshInstall) {
@@ -481,21 +486,26 @@ async function handleInstall() {
   settings.enabledPlugins["fml@local-plugins"] = true;
   writeJsonFile(CLAUDE_SETTINGS_PATH, settings);
   console.log(`      Claude settings: ${CLAUDE_SETTINGS_PATH}`);
-  try {
+  const claudeBin = resolveBin("claude");
+  if (!claudeBin) {
+    console.log("      warn: claude CLI not found, run 'claude plugin install fml@local-plugins' manually");
+  } else {
     try {
-      execFileSync("claude", ["plugin", "install", "fml@local-plugins"], {
-        stdio: "pipe",
-        timeout: 15e3
-      });
-    } catch {
-      execFileSync("claude", ["plugin", "update", "fml@local-plugins"], {
-        stdio: "pipe",
-        timeout: 15e3
-      });
+      try {
+        execBinSync(claudeBin, ["plugin", "install", "fml@local-plugins"], {
+          timeout: 15e3
+        });
+      } catch {
+        execBinSync(claudeBin, ["plugin", "update", "fml@local-plugins"], {
+          timeout: 15e3
+        });
+      }
+      console.log("      Plugin registered via Claude Code CLI");
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.log(`      warn: claude plugin install/update failed: ${msg}`);
+      console.log("      Run 'claude plugin install fml@local-plugins' manually");
     }
-    console.log("      Plugin registered via Claude Code CLI");
-  } catch {
-    console.log("      warn: claude CLI not found, run 'claude plugin install fml@local-plugins' manually");
   }
   console.log();
   console.log("[5/5] Configuring sync target...");
@@ -531,7 +541,6 @@ async function handleInstall() {
 }
 
 // src/commands/uninstall.ts
-import { execFileSync as execFileSync2 } from "child_process";
 import fs2 from "fs";
 import os2 from "os";
 import path2 from "path";
@@ -568,14 +577,17 @@ function handleUninstall(opts) {
     console.log("[1/5] Skipping plugin uninstall (target-specific uninstall)");
   } else {
     console.log("[1/5] Uninstalling MCP plugin...");
-    try {
-      execFileSync2(
-        "claude",
-        ["plugin", "uninstall", "fml@local-plugins", "--scope", "user"],
-        { stdio: "pipe", timeout: 1e4 }
-      );
-      console.log("      Uninstalled (user scope)");
-    } catch {
+    const claudeBin = resolveBin("claude");
+    if (claudeBin) {
+      try {
+        execBinSync(
+          claudeBin,
+          ["plugin", "uninstall", "fml@local-plugins", "--scope", "user"],
+          { timeout: 1e4 }
+        );
+        console.log("      Uninstalled (user scope)");
+      } catch {
+      }
     }
     const installedPluginsPath = path2.join(
       CLAUDE_DIR2,
@@ -689,7 +701,7 @@ function handleUninstall(opts) {
 // src/commands/update.ts
 import { execSync as execSync2 } from "child_process";
 async function handleUpdate() {
-  const currentVersion = true ? "0.1.3+6d86365" : "unknown";
+  const currentVersion = true ? "0.3.0+3bdd3b3" : "unknown";
   console.log(`Current: ${currentVersion}`);
   console.log("Updating via npm...\n");
   try {
@@ -1931,6 +1943,134 @@ async function handleConfigDetail(opts) {
   }
 }
 
+// src/commands/tools.ts
+import { readFileSync } from "fs";
+import path3 from "path";
+var pluginVersion = true ? "0.3.0+3bdd3b3" : void 0;
+async function getApi() {
+  const api = await getAuthenticatedClient();
+  if (!api) {
+    console.error("Not authenticated. Run `fml login`.");
+    process.exit(1);
+  }
+  return api;
+}
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  if (a.length === 0) return b.length;
+  if (b.length === 0) return a.length;
+  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 0; i < a.length; i++) {
+    const curr = [i + 1];
+    for (let j = 0; j < b.length; j++) {
+      const cost = a[i] === b[j] ? 0 : 1;
+      curr.push(Math.min(curr[j] + 1, prev[j + 1] + 1, prev[j] + cost));
+    }
+    prev = curr;
+  }
+  return prev[b.length];
+}
+function closestMatches(name, descriptors) {
+  const threshold = Math.max(2, Math.ceil(name.length * 0.4));
+  return descriptors.map((d) => ({
+    name: d.name,
+    // Substring match always beats fuzzy match.
+    score: d.name.includes(name) ? 0 : levenshtein(name, d.name)
+  })).filter((m) => m.score <= threshold).sort((a, b) => a.score - b.score).slice(0, 3).map((m) => m.name);
+}
+function findOrSuggestExit(name, descriptors) {
+  const descriptor = descriptors.find((d) => d.name === name);
+  if (descriptor) return descriptor;
+  console.error(`Unknown tool: ${name}`);
+  const suggestions = closestMatches(name, descriptors);
+  if (suggestions.length > 0) {
+    console.error(`Did you mean: ${suggestions.join(", ")}?`);
+  }
+  process.exit(1);
+}
+async function handleToolsList(opts) {
+  const api = await getApi();
+  let descriptors = await api.listTools(pluginVersion);
+  if (opts.category) {
+    descriptors = descriptors.filter((d) => d.category === opts.category);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(descriptors, null, 2));
+    return;
+  }
+  if (descriptors.length === 0) {
+    console.log("No tools found.");
+    return;
+  }
+  const nameW = Math.min(
+    40,
+    Math.max(...descriptors.map((d) => d.name.length), 4)
+  );
+  const catW = 14;
+  const header = "name".padEnd(nameW) + "  " + "category".padEnd(catW) + "  description";
+  const divider = "-".repeat(header.length);
+  console.log(header);
+  console.log(divider);
+  for (const d of descriptors) {
+    const cat = d.category ?? "";
+    const suffix = d.experimental ? " (experimental)" : "";
+    const desc = (d.description + suffix).slice(0, 80);
+    console.log(d.name.padEnd(nameW) + "  " + cat.padEnd(catW) + "  " + desc);
+  }
+}
+async function handleToolsDescribe(name, opts) {
+  const api = await getApi();
+  const descriptors = await api.listTools(pluginVersion);
+  const descriptor = findOrSuggestExit(name, descriptors);
+  if (opts.json) {
+    console.log(JSON.stringify(descriptor, null, 2));
+    return;
+  }
+  console.log(`Name:        ${descriptor.name}`);
+  if (descriptor.category) console.log(`Category:    ${descriptor.category}`);
+  if (descriptor.experimental) console.log(`Experimental: true`);
+  console.log(`
+Description:
+  ${descriptor.description}`);
+  console.log(`
+Input schema:
+${JSON.stringify(descriptor.inputSchema, null, 2)}`);
+}
+async function handleToolsCall(name, opts) {
+  if (opts.args !== void 0 && opts.file !== void 0) {
+    console.error("Error: --args and --file are mutually exclusive.");
+    process.exit(1);
+  }
+  const raw = opts.file ? (() => {
+    try {
+      return readFileSync(path3.resolve(opts.file), "utf8");
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`Could not read args file: ${msg}`);
+      process.exit(1);
+    }
+  })() : opts.args ?? "{}";
+  let parsedArgs;
+  try {
+    parsedArgs = JSON.parse(raw);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(
+      `Invalid JSON in ${opts.file ? "--file" : "--args"}: ${msg}`
+    );
+    process.exit(1);
+  }
+  const api = await getApi();
+  const descriptors = await api.listTools(pluginVersion);
+  findOrSuggestExit(name, descriptors);
+  const result = await api.callBackend(name, parsedArgs);
+  if (!result.ok) {
+    console.error(result.error || "Request failed");
+    process.exit(1);
+  }
+  console.log(JSON.stringify(result.result, null, 2));
+}
+
 // src/cli.ts
 ensureNativeModules();
 await initSentry();
@@ -1938,9 +2078,9 @@ if (process.argv.length <= 2 || process.argv.includes("--help") || process.argv.
   printBanner();
 }
 var program = new Command().name("fml").description("FML agent tools for Claude Code").version(
-  true ? "0.1.3+6d86365" : "dev"
+  true ? "0.3.0+3bdd3b3" : "dev"
 );
-program.command("tools", { hidden: true }).description("List all available CLI commands (including hidden agent tools)").action(() => {
+var tools = program.command("tools", { hidden: true }).description("List all available CLI commands (including hidden agent tools)").action(() => {
   function formatCmd(cmd, prefix = "") {
     const name = prefix ? `${prefix} ${cmd.name()}` : cmd.name();
     const args = cmd.registeredArguments.map((a) => a.required ? `<${a.name()}>` : `[${a.name()}]`).join(" ");
@@ -1959,6 +2099,9 @@ program.command("tools", { hidden: true }).description("List all available CLI c
   });
   console.log(lines.join("\n\n"));
 });
+tools.command("list").description("List backend tools available via the dynamic catalog").option("--category <category>", "Filter by category").option("--json", "Output as JSON").action((opts) => handleToolsList(opts));
+tools.command("describe").description("Show description and input schema for a backend tool").argument("<name>", "Tool name (e.g. integration-github)").option("--json", "Output as JSON").action((name, opts) => handleToolsDescribe(name, opts));
+tools.command("call").description("Invoke a backend tool by name with JSON args").argument("<name>", "Tool name").option("--args <json>", "Args as a JSON string (defaults to {})").option("--file <path>", "Path to a JSON file containing args").action((name, opts) => handleToolsCall(name, opts));
 program.command("install").description("Register plugin, hooks, and daemons").action(() => handleInstall());
 program.command("uninstall").description("Remove fml plugin, hooks, and optionally all data").option(
   "--target <target>",