@jait/gateway 0.1.0

package/dist/tools/prompts/shared-sections.js

@@ -0,0 +1,111 @@
+/**
+ * Shared prompt sections used by all or most model-specific prompts.
+ *
+ * Adapted from VS Code Copilot Chat — tool names replaced with Jait
+ * equivalents, VS Code–specific features (notebooks, devcontainers,
+ * file-linkification) removed.
+ */
+// ── Jait tool references ─────────────────────────────────────────────
+export const JAIT_TOOLS = {
+    read: "read",
+    edit: "edit",
+    execute: "execute",
+    search: "search",
+    web: "web",
+    agent: "agent",
+    todo: "todo",
+    jait: "jait",
+};
+// ── Reusable instruction blocks ──────────────────────────────────────
+export const CORE_INSTRUCTIONS = `You are a highly sophisticated automated coding agent with expert-level knowledge across many different programming languages and frameworks and software engineering tasks — this encompasses debugging issues, implementing new features, restructuring code, and providing code explanations, among other engineering activities.
+The user will ask a question, or ask you to perform a task, and it may require lots of research to answer correctly. There is a selection of tools that let you perform actions or retrieve helpful context to answer the user's question.
+By default, implement changes rather than only suggesting them. If the user's intent is unclear, infer the most useful likely action and proceed with using tools to discover any missing details instead of guessing. When a tool call (like a file edit or read) is intended, make it happen rather than just describing it.
+You can call tools repeatedly to take actions or gather as much context as needed until you have completed the task fully. Don't give up unless you are sure the request cannot be fulfilled with the tools you have. It's YOUR RESPONSIBILITY to make sure that you have done all you can to collect necessary context.
+Continue working until the user's request is completely resolved before ending your turn and yielding back to the user. Only terminate your turn when you are certain the task is complete. Do not stop or hand back to the user when you encounter uncertainty — research or deduce the most reasonable approach and continue.`;
+export const TOOL_USE_INSTRUCTIONS = `If the user is requesting a code sample, you can answer it directly without using any tools.
+When using a tool, follow the JSON schema very carefully and make sure to include ALL required properties.
+No need to ask permission before using a tool.
+NEVER say the name of a tool to a user. For example, instead of saying that you'll use the execute tool, say "I'll run the command in a terminal".
+If you think running multiple tools can answer the user's question, prefer calling them in parallel whenever possible.
+When using the read tool, prefer reading a large section over calling the read tool many times in sequence. You can also think of all the pieces you may be interested in and read them in parallel. Read large enough context to ensure you get what you need.
+Don't call the execute tool multiple times in parallel. Instead, run one command and wait for the output before running the next command.
+When creating files, be intentional and avoid unnecessary file creation. Only create files that are essential to completing the user's request.
+NEVER try to edit a file by running terminal commands unless the user specifically asks for it.`;
+export const EDITING_INSTRUCTIONS = `Before you edit an existing file, make sure you have read it first so that you can make proper changes.
+Use the edit tool to modify files precisely. Pay attention to surrounding context to ensure your changes are correct.
+When editing files, group your changes by file.
+NEVER show the changes to the user in a codeblock when you can use the edit tool instead.
+For each file, give a short description of what needs to be changed, then use the edit tool.`;
+export const SEARCH_INSTRUCTIONS = `For codebase exploration, prefer the agent tool to search and gather data across files.
+When using the search tool, prefer searching for specific patterns or identifiers.
+If you don't know exactly what you're looking for, use broader search terms and refine.`;
+export const TODO_INSTRUCTIONS = `You have access to the todo tool which tracks steps and progress. Using it helps demonstrate that you've understood the task and convey how you're approaching it.
+
+Break complex work into logical, actionable steps that can be tracked and verified. Update task status consistently:
+- Mark tasks as in-progress when you begin working on them
+- Mark tasks as completed immediately after finishing each one — do not batch completions
+
+Task tracking is valuable for:
+- Multi-step work requiring careful sequencing
+- Breaking down ambiguous or complex requests
+- Maintaining checkpoints for feedback and validation
+- When users provide multiple requests or numbered tasks
+
+Skip task tracking for simple, single-step operations that can be completed directly without additional planning.`;
+export const PLANNING_EXAMPLES = `### Examples
+
+**High-quality plans**
+
+Example 1:
+1. Add CLI entry with file args
+2. Parse Markdown via CommonMark library
+3. Apply semantic HTML template
+4. Handle code blocks, images, links
+5. Add error handling for invalid files
+
+Example 2:
+1. Define CSS variables for colors
+2. Add toggle with localStorage state
+3. Refactor components to use variables
+4. Verify all views for readability
+5. Add smooth theme-change transition
+
+Example 3:
+1. Set up Node.js + WebSocket server
+2. Add join/leave broadcast events
+3. Implement messaging with timestamps
+4. Add usernames + mention highlighting
+5. Persist messages in lightweight DB
+6. Add typing indicators + unread count
+
+**Low-quality plans**
+
+Example 1:
+1. Create CLI tool
+2. Add Markdown parser
+3. Convert to HTML
+
+Example 2:
+1. Add dark mode toggle
+2. Save preference
+3. Make styles look good
+
+If you need to write a plan, only write high quality plans, not low quality ones.`;
+// ── Mode-specific preamble helpers ───────────────────────────────────
+export function getAskModeInstructions() {
+    return `You are in ASK mode. The user is asking a question and expects an answer — not code changes. Respond with helpful, accurate information. You may read files and search the codebase for context, but do NOT make any file modifications or run any destructive commands.`;
+}
+export function getPlanModeInstructions() {
+    return `You are in PLAN mode. The user wants you to create a plan without implementing it. Analyze the request, explore the codebase as needed, and produce a clear, structured plan. Do NOT make any file changes — only describe what should be done.`;
+}
+export function getModeInstructions(mode) {
+    switch (mode) {
+        case "ask":
+            return getAskModeInstructions();
+        case "plan":
+            return getPlanModeInstructions();
+        default:
+            return "";
+    }
+}
+//# sourceMappingURL=shared-sections.js.map

package/dist/tools/prompts/shared-sections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-sections.js","sourceRoot":"","sources":["../../../src/tools/prompts/shared-sections.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,wEAAwE;AAExE,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,wEAAwE;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;gUAI+R,CAAC;AAEjU,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;gGAQ2D,CAAC;AAEjG,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;6FAIyD,CAAC;AAE9F,MAAM,CAAC,MAAM,mBAAmB,GAAG;;wFAEqD,CAAC;AAEzF,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;kHAYiF,CAAC;AAEnH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kFAsCiD,CAAC;AAEnF,wEAAwE;AAExE,MAAM,UAAU,sBAAsB;IACpC,OAAO,0QAA0Q,CAAC;AACpR,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,iPAAiP,CAAC;AAC3P,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK;YACR,OAAO,sBAAsB,EAAE,CAAC;QAClC,KAAK,MAAM;YACT,OAAO,uBAAuB,EAAE,CAAC;QACnC;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/tools/prompts/xai-prompt.d.ts

@@ -0,0 +1,8 @@
+/**
+ * xAI / Grok prompt — validation-heavy, deliverables focus, security awareness.
+ *
+ * Adapted from VS Code Copilot Chat's XAIPromptResolver.
+ * Prefixes: ['grok-code', 'grok'].
+ */
+export {};
+//# sourceMappingURL=xai-prompt.d.ts.map

package/dist/tools/prompts/xai-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xai-prompt.d.ts","sourceRoot":"","sources":["../../../src/tools/prompts/xai-prompt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/tools/prompts/xai-prompt.js

@@ -0,0 +1,68 @@
+/**
+ * xAI / Grok prompt — validation-heavy, deliverables focus, security awareness.
+ *
+ * Adapted from VS Code Copilot Chat's XAIPromptResolver.
+ * Prefixes: ['grok-code', 'grok'].
+ */
+import { promptRegistry } from "./prompt-registry.js";
+import { TOOL_USE_INSTRUCTIONS, EDITING_INSTRUCTIONS, SEARCH_INSTRUCTIONS, TODO_INSTRUCTIONS, getModeInstructions, } from "./shared-sections.js";
+// ── System prompt ────────────────────────────────────────────────────
+function resolveSystemPrompt(mode, _endpoint) {
+    const modeBlock = getModeInstructions(mode);
+    return `<instructions>
+You are a highly sophisticated automated coding agent with expert-level knowledge across many different programming languages and frameworks.
+The user will ask a question, or ask you to perform a task, and it may require lots of research to answer correctly. There is a selection of tools that let you perform actions or retrieve helpful context to answer the user's question.
+Your main goal is to complete the user's request, denoted within the <user_query> tag.
+You will be given some context and attachments along with the user prompt. You can use them if they are relevant to the task, and ignore them if not.
+If you can infer the project type (languages, frameworks, and libraries) from the user's query or the context that you have, make sure to keep them in mind when making changes.
+If the user wants you to implement a feature and they have not specified the files to edit, first break down the user's request into smaller concepts and think about the kinds of files you need to grasp each concept.
+If you aren't sure which tool is relevant, you can call multiple tools. You can call tools repeatedly to take actions or gather as much context as needed until you have completed the task fully. Don't give up unless you are sure the request cannot be fulfilled with the tools you have. It's YOUR RESPONSIBILITY to make sure that you have done all you can to collect necessary context.
+When reading files, prefer reading large meaningful chunks rather than consecutive small sections to minimize tool calls and gain better context.
+Don't make assumptions about the situation — gather context first, then perform the task or answer the question.
+
+Validation and green-before-done: After any substantive change, run the relevant build/tests/linters automatically. For runnable code that you created or edited, immediately run a test to validate the code works (fast, minimal input) yourself. Prefer automated code-based tests where possible. Then provide optional fenced code blocks with commands for larger or platform-specific runs. Don't end a turn with a broken build if you can fix it. If failures occur, iterate up to three targeted fixes; if still failing, summarize the root cause, options, and exact failing output. For non-critical checks (e.g., a flaky health check), retry briefly (2-3 attempts with short backoff) and then proceed.
+
+Never invent file paths, APIs, or commands. Verify with tools (search/read/list) before acting when uncertain.
+Security and side-effects: Do not exfiltrate secrets or make network calls unless explicitly required by the task. Prefer local actions first.
+Reproducibility and dependencies: Follow the project's package manager and configuration; prefer minimal, pinned, widely-used libraries and update manifests or lockfiles appropriately. Prefer adding or updating tests when you change public behavior.
+Build characterization: Before stating that a project "has no build" or requires a specific build step, verify by checking the provided context or quickly looking for common build config files (package.json, requirements.txt, Makefile, Dockerfile, etc.). If uncertain, say what you know and proceed with minimal setup instructions.
+Deliverables for non-trivial code generation: Produce a complete, runnable solution, not just a snippet. Create the necessary source files plus a small runner or test/benchmark harness when relevant, a minimal README.md with usage and troubleshooting, and a dependency manifest updated or added as appropriate.
+
+Think creatively and explore the workspace in order to make a complete fix.
+Don't repeat yourself after a tool call, pick up where you left off.
+NEVER print out a codeblock with file changes unless the user asked for it. Use the appropriate edit tool instead.
+NEVER print out a codeblock with a terminal command to run unless the user asked for it. Use the execute tool instead.
+You don't need to read a file if it's already provided in context.
+</instructions>
+
+<toolUseInstructions>
+${TOOL_USE_INSTRUCTIONS}
+</toolUseInstructions>
+
+<editFileInstructions>
+${EDITING_INSTRUCTIONS}
+</editFileInstructions>
+
+<searchInstructions>
+${SEARCH_INSTRUCTIONS}
+</searchInstructions>
+
+<taskTracking>
+${TODO_INSTRUCTIONS}
+</taskTracking>
+
+<outputFormatting>
+Use proper Markdown formatting. When referring to symbols (classes, methods, variables) in user's workspace wrap in backticks.
+Use KaTeX for math: wrap inline math in $, complex blocks in $$.
+</outputFormatting>
+${modeBlock ? `\n${modeBlock}` : ""}`;
+}
+// ── Resolver ─────────────────────────────────────────────────────────
+const XAIPromptResolver = {
+    name: "xai",
+    familyPrefixes: ["grok-code", "grok"],
+    resolveSystemPrompt,
+    // xAI uses no custom reminder — falls through to the default.
+};
+promptRegistry.register(XAIPromptResolver);
+//# sourceMappingURL=xai-prompt.js.map

package/dist/tools/prompts/xai-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xai-prompt.js","sourceRoot":"","sources":["../../../src/tools/prompts/xai-prompt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,wEAAwE;AAExE,SAAS,mBAAmB,CAAC,IAAc,EAAE,SAAwB;IACnE,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE5C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BP,qBAAqB;;;;EAIrB,oBAAoB;;;;EAIpB,mBAAmB;;;;EAInB,iBAAiB;;;;;;;EAOjB,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACtC,CAAC;AAED,wEAAwE;AAExE,MAAM,iBAAiB,GAAiB;IACtC,IAAI,EAAE,KAAK;IACX,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;IAErC,mBAAmB;IAEnB,8DAA8D;CAC/D,CAAC;AAEF,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/tools/redeploy-tools.d.ts

@@ -0,0 +1,30 @@
+/**
+ * gateway.redeploy — Self-update tool for the Jait gateway.
+ *
+ * Flow (blue-green for bare process, i.e. `npm install -g @jait/gateway`):
+ *   1. Pull the latest version:  npm install -g @jait/gateway@latest
+ *   2. Spawn a canary on PORT+1 to verify the new code boots correctly
+ *   3. Health-check the canary
+ *   4. If healthy → spawn a fresh gateway on the original port (detached),
+ *      kill the canary, then gracefully shut down the current process
+ *   5. If unhealthy → kill the canary, report failure, stay running
+ *
+ * For Docker Swarm the tool triggers `docker service update --image ...`
+ * which uses the stack's start-first rolling update policy.
+ */
+import type { ToolDefinition } from "./contracts.js";
+interface RedeployInput {
+    /** Version/tag to install. Defaults to "latest". */
+    version?: string;
+    /** Skip the canary health check (not recommended). */
+    skipCanary?: boolean;
+}
+interface RedeployDeps {
+    /** Current gateway port (from config) */
+    port: number;
+    /** Graceful shutdown callback — will be called when cutover succeeds */
+    shutdown: () => Promise<void>;
+}
+export declare function createRedeployTool(deps: RedeployDeps): ToolDefinition<RedeployInput>;
+export {};
+//# sourceMappingURL=redeploy-tools.d.ts.map

package/dist/tools/redeploy-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeploy-tools.d.ts","sourceRoot":"","sources":["../../src/tools/redeploy-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,cAAc,EAA2B,MAAM,gBAAgB,CAAC;AAE9E,UAAU,aAAa;IACrB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,UAAU,YAAY;IACpB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,cAAc,CAAC,aAAa,CAAC,CAsCpF"}

package/dist/tools/redeploy-tools.js

@@ -0,0 +1,191 @@
+/**
+ * gateway.redeploy — Self-update tool for the Jait gateway.
+ *
+ * Flow (blue-green for bare process, i.e. `npm install -g @jait/gateway`):
+ *   1. Pull the latest version:  npm install -g @jait/gateway@latest
+ *   2. Spawn a canary on PORT+1 to verify the new code boots correctly
+ *   3. Health-check the canary
+ *   4. If healthy → spawn a fresh gateway on the original port (detached),
+ *      kill the canary, then gracefully shut down the current process
+ *   5. If unhealthy → kill the canary, report failure, stay running
+ *
+ * For Docker Swarm the tool triggers `docker service update --image ...`
+ * which uses the stack's start-first rolling update policy.
+ */
+import { execSync, spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+export function createRedeployTool(deps) {
+    return {
+        name: "gateway.redeploy",
+        description: "Self-update the Jait gateway. Pulls the latest version via npm, " +
+            "verifies it in a canary process, then performs a zero-downtime " +
+            "switchover. The current process shuts down after the new one is confirmed healthy. " +
+            "This tool requires human consent.",
+        tier: "standard",
+        category: "gateway",
+        source: "builtin",
+        parameters: {
+            type: "object",
+            properties: {
+                version: {
+                    type: "string",
+                    description: 'Version/tag to install (default: "latest")',
+                },
+                skipCanary: {
+                    type: "boolean",
+                    description: "Skip the canary health check (not recommended)",
+                },
+            },
+        },
+        async execute(input, context) {
+            const tag = input.version ?? "latest";
+            const log = context.onOutputChunk ?? console.log;
+            // ── Detect runtime mode ─────────────────────────────────────
+            const isDocker = existsSync("/.dockerenv") || existsSync("/run/.containerenv");
+            if (isDocker) {
+                return dockerRedeploy(tag, log);
+            }
+            return npmRedeploy(tag, input.skipCanary ?? false, deps, log);
+        },
+    };
+}
+// ── npm (bare process) redeploy ──────────────────────────────────────
+async function npmRedeploy(tag, skipCanary, deps, log) {
+    const pkg = `@jait/gateway@${tag}`;
+    // 1. Get current version before updating
+    let oldVersion = "unknown";
+    try {
+        const pkgJson = JSON.parse(execSync("node -e \"process.stdout.write(require('@jait/gateway/package.json').version)\"", {
+            encoding: "utf8",
+            timeout: 10_000,
+        }));
+        oldVersion = pkgJson;
+    }
+    catch {
+        // non-critical
+    }
+    // 2. Install the latest version
+    log(`⬇ Installing ${pkg}...\n`);
+    try {
+        execSync(`npm install -g ${pkg}`, {
+            encoding: "utf8",
+            timeout: 120_000,
+            stdio: "pipe",
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { ok: false, message: `npm install failed: ${msg}` };
+    }
+    // 3. Read new version
+    let newVersion = "unknown";
+    try {
+        newVersion = execSync("node -e \"process.stdout.write(require('@jait/gateway/package.json').version)\"", { encoding: "utf8", timeout: 10_000 });
+    }
+    catch {
+        // non-critical
+    }
+    log(`✓ Installed @jait/gateway ${newVersion} (was ${oldVersion})\n`);
+    if (!skipCanary) {
+        // 4. Canary — start the new version on PORT+1
+        const canaryPort = deps.port + 1;
+        log(`🐤 Starting canary on port ${canaryPort}...\n`);
+        const canary = spawn("jait", ["--port", String(canaryPort)], {
+            stdio: "ignore",
+            detached: true,
+            env: { ...process.env, PORT: String(canaryPort), __JAIT_CLI: "1" },
+        });
+        canary.unref();
+        // 5. Wait for canary health (up to 30s)
+        const healthy = await waitForHealth(`http://127.0.0.1:${canaryPort}`, 30_000);
+        if (!healthy) {
+            // Kill canary and abort
+            try {
+                process.kill(-canary.pid, "SIGTERM");
+            }
+            catch { /* ignore */ }
+            return {
+                ok: false,
+                message: `Canary failed health check on port ${canaryPort}. Update installed but NOT activated. Current gateway is still running.`,
+                data: { oldVersion, newVersion, canaryPort },
+            };
+        }
+        log(`✓ Canary healthy on port ${canaryPort}\n`);
+        // 6. Kill the canary (it was just a test)
+        try {
+            process.kill(-canary.pid, "SIGTERM");
+        }
+        catch { /* ignore */ }
+        // Brief wait for port release
+        await sleep(1_000);
+    }
+    // 7. Spawn the new gateway on the original port (detached, survives parent exit)
+    log(`🔄 Spawning new gateway on port ${deps.port}...\n`);
+    const fresh = spawn("jait", ["--port", String(deps.port)], {
+        stdio: "ignore",
+        detached: true,
+        env: { ...process.env, PORT: String(deps.port), __JAIT_CLI: "1" },
+    });
+    fresh.unref();
+    // 8. Shut down the current process
+    log(`✓ New gateway spawned (PID ${fresh.pid}). Shutting down current process...\n`);
+    // Give the response time to be sent before shutdown
+    setTimeout(() => {
+        deps.shutdown().catch(() => process.exit(0));
+    }, 500);
+    return {
+        ok: true,
+        message: `Gateway updated ${oldVersion} → ${newVersion}. New process (PID ${fresh.pid}) is starting on port ${deps.port}. This instance is shutting down.`,
+        data: { oldVersion, newVersion, pid: fresh.pid },
+    };
+}
+// ── Docker Swarm redeploy ────────────────────────────────────────────
+async function dockerRedeploy(tag, log) {
+    // Detect the service name from Docker labels or hostname
+    let serviceName = "jait_gateway";
+    try {
+        const hostname = execSync("hostname", { encoding: "utf8" }).trim();
+        // In Docker Swarm the hostname is usually the task slot ID,
+        // but DOCKER_SERVICE_NAME env or container labels may be present
+        serviceName = process.env["DOCKER_SERVICE_NAME"] ?? serviceName;
+        log(`Docker service: ${serviceName} (host: ${hostname})\n`);
+    }
+    catch { /* ignore */ }
+    const image = `ghcr.io/jakobwl/jait-gateway:${tag}`;
+    log(`🐳 Triggering rolling update to ${image}...\n`);
+    try {
+        // The stack's update_config has order: start-first, so Docker will
+        // start the new container, health-check it, then stop the old one
+        execSync(`docker service update --image ${image} --with-registry-auth ${serviceName}`, { encoding: "utf8", timeout: 300_000, stdio: "pipe" });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { ok: false, message: `Docker service update failed: ${msg}` };
+    }
+    return {
+        ok: true,
+        message: `Rolling update to ${image} triggered. Docker Swarm will start-first, health-check, then drain the old container.`,
+        data: { image, serviceName },
+    };
+}
+// ── Helpers ──────────────────────────────────────────────────────────
+async function waitForHealth(url, timeoutMs) {
+    const start = Date.now();
+    const healthUrl = `${url}/health`;
+    while (Date.now() - start < timeoutMs) {
+        try {
+            const res = await fetch(healthUrl, { signal: AbortSignal.timeout(3_000) });
+            if (res.ok)
+                return true;
+        }
+        catch {
+            // not ready yet
+        }
+        await sleep(1_000);
+    }
+    return false;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=redeploy-tools.js.map

package/dist/tools/redeploy-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeploy-tools.js","sourceRoot":"","sources":["../../src/tools/redeploy-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiBrC,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,kEAAkE;YAClE,iEAAiE;YACjE,qFAAqF;YACrF,mCAAmC;QACrC,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,4CAA4C;iBAC1D;gBACD,UAAU,EAAE;oBACV,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,gDAAgD;iBAC9D;aACF;SACF;QAED,KAAK,CAAC,OAAO,CAAC,KAAoB,EAAE,OAAoB;YACtD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC;YACtC,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC;YAEjD,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC;YAE/E,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,UAAmB,EACnB,IAAkB,EAClB,GAA0B;IAE1B,MAAM,GAAG,GAAG,iBAAiB,GAAG,EAAE,CAAC;IAEnC,yCAAyC;IACzC,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,QAAQ,CAAC,iFAAiF,EAAE;YAC1F,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,MAAM;SAChB,CAAC,CACH,CAAC;QACF,UAAU,GAAG,OAAO,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,gCAAgC;IAChC,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,QAAQ,CAAC,kBAAkB,GAAG,EAAE,EAAE;YAChC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,OAAO;YAChB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,GAAG,EAAE,EAAE,CAAC;IAC9D,CAAC;IAED,sBAAsB;IACtB,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CACnB,iFAAiF,EACjF,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,GAAG,CAAC,6BAA6B,UAAU,SAAS,UAAU,KAAK,CAAC,CAAC;IAErE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,8CAA8C;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACjC,GAAG,CAAC,8BAA8B,UAAU,OAAO,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE;YAC3D,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,IAAI;YACd,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE;SACnE,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,wCAAwC;QACxC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,oBAAoB,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;QAE9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,wBAAwB;YACxB,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACrE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,sCAAsC,UAAU,yEAAyE;gBAClI,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE;aAC7C,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,4BAA4B,UAAU,IAAI,CAAC,CAAC;QAEhD,0CAA0C;QAC1C,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACrE,8BAA8B;QAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,iFAAiF;IACjF,GAAG,CAAC,mCAAmC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;QACzD,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,IAAI;QACd,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE;KAClE,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,mCAAmC;IACnC,GAAG,CAAC,8BAA8B,KAAK,CAAC,GAAG,uCAAuC,CAAC,CAAC;IAEpF,oDAAoD;IACpD,UAAU,CAAC,GAAG,EAAE;QACd,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,EAAE,GAAG,CAAC,CAAC;IAER,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,mBAAmB,UAAU,MAAM,UAAU,sBAAsB,KAAK,CAAC,GAAG,yBAAyB,IAAI,CAAC,IAAI,mCAAmC;QAC1J,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;KACjD,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,KAAK,UAAU,cAAc,CAC3B,GAAW,EACX,GAA0B;IAE1B,yDAAyD;IACzD,IAAI,WAAW,GAAG,cAAc,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,4DAA4D;QAC5D,iEAAiE;QACjE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,WAAW,CAAC;QAChE,GAAG,CAAC,mBAAmB,WAAW,WAAW,QAAQ,KAAK,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAExB,MAAM,KAAK,GAAG,gCAAgC,GAAG,EAAE,CAAC;IACpD,GAAG,CAAC,mCAAmC,KAAK,OAAO,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,mEAAmE;QACnE,kEAAkE;QAClE,QAAQ,CACN,iCAAiC,KAAK,yBAAyB,WAAW,EAAE,EAC5E,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CACtD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,GAAG,EAAE,EAAE,CAAC;IACxE,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,qBAAqB,KAAK,wFAAwF;QAC3H,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,SAAiB;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,CAAC;IAElC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3E,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;QACD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/tools/registry.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Tool Registry — Sprint 3.5
+ *
+ * Central registry for all tool definitions. Tools are registered
+ * by name and executed through a unified interface.
+ */
+import type { ToolDefinition, ToolContext, ToolResult, ToolTier, ToolCategory } from "./contracts.js";
+import type { AuditWriter } from "../services/audit.js";
+/** Summary of a tool for the settings UI and discovery endpoints */
+export interface ToolInfo {
+    name: string;
+    description: string;
+    tier: ToolTier;
+    category: ToolCategory;
+    source: "builtin" | "mcp";
+    parameterCount: number;
+}
+export declare class ToolRegistry {
+    private readonly tools;
+    register(tool: ToolDefinition): void;
+    get(name: string): ToolDefinition | undefined;
+    list(): ToolDefinition[];
+    listNames(): string[];
+    has(name: string): boolean;
+    /** List tools filtered by tier */
+    listByTier(tier: ToolTier): ToolDefinition[];
+    /** List tools filtered by category */
+    listByCategory(category: ToolCategory): ToolDefinition[];
+    /** Search tools by name, description, or category (fuzzy keyword match) */
+    search(query: string): ToolDefinition[];
+    /** Get tool info summaries for all tools (lightweight, no execute fn) */
+    listInfo(): ToolInfo[];
+    /** Get tool info filtered to only enabled tools for a user */
+    listInfoFiltered(disabledTools?: Set<string>): ToolInfo[];
+    /**
+     * Get tools that should be sent in the initial LLM payload.
+     * Core tools always, standard tools unless user disabled them.
+     */
+    listForLLM(disabledTools?: Set<string>): ToolDefinition[];
+    /**
+     * Check if a tool is executable (registered and not disabled).
+     * Even discovered external tools can be executed if they're registered.
+     * The disabled check only gates what's sent to the LLM, not execution.
+     */
+    isExecutable(name: string, disabledTools?: Set<string>): boolean;
+    /**
+     * Execute a tool by name with audit logging.
+     */
+    execute(name: string, input: unknown, context: ToolContext, audit?: AuditWriter): Promise<ToolResult>;
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/tools/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/tools/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAIxD,oEAAoE;AACpE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,EAAE,SAAS,GAAG,KAAK,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAE3D,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAIpC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C,IAAI,IAAI,cAAc,EAAE;IAIxB,SAAS,IAAI,MAAM,EAAE;IAIrB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,kCAAkC;IAClC,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,cAAc,EAAE;IAI5C,sCAAsC;IACtC,cAAc,CAAC,QAAQ,EAAE,YAAY,GAAG,cAAc,EAAE;IAIxD,2EAA2E;IAC3E,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE;IASvC,yEAAyE;IACzE,QAAQ,IAAI,QAAQ,EAAE;IAWtB,8DAA8D;IAC9D,gBAAgB,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,QAAQ,EAAE;IAIzD;;;OAGG;IACH,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,cAAc,EAAE;IAUzD;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO;IAMhE;;OAEG;IACG,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,UAAU,CAAC;CAmEvB"}

package/dist/tools/registry.js

@@ -0,0 +1,148 @@
+/**
+ * Tool Registry — Sprint 3.5
+ *
+ * Central registry for all tool definitions. Tools are registered
+ * by name and executed through a unified interface.
+ */
+import { uuidv7 } from "../lib/uuidv7.js";
+import { validateToolInput } from "./validate.js";
+export class ToolRegistry {
+    tools = new Map();
+    register(tool) {
+        this.tools.set(tool.name, tool);
+    }
+    get(name) {
+        return this.tools.get(name);
+    }
+    list() {
+        return [...this.tools.values()];
+    }
+    listNames() {
+        return [...this.tools.keys()];
+    }
+    has(name) {
+        return this.tools.has(name);
+    }
+    /** List tools filtered by tier */
+    listByTier(tier) {
+        return this.list().filter((t) => (t.tier ?? "standard") === tier);
+    }
+    /** List tools filtered by category */
+    listByCategory(category) {
+        return this.list().filter((t) => (t.category ?? "external") === category);
+    }
+    /** Search tools by name, description, or category (fuzzy keyword match) */
+    search(query) {
+        const lower = query.toLowerCase();
+        const keywords = lower.split(/\s+/).filter(Boolean);
+        return this.list().filter((t) => {
+            const haystack = `${t.name} ${t.description} ${t.category ?? ""} ${t.tier ?? ""}`.toLowerCase();
+            return keywords.every((kw) => haystack.includes(kw));
+        });
+    }
+    /** Get tool info summaries for all tools (lightweight, no execute fn) */
+    listInfo() {
+        return this.list().map((t) => ({
+            name: t.name,
+            description: t.description,
+            tier: t.tier ?? "standard",
+            category: t.category ?? "external",
+            source: t.source ?? "builtin",
+            parameterCount: Object.keys(t.parameters.properties ?? {}).length,
+        }));
+    }
+    /** Get tool info filtered to only enabled tools for a user */
+    listInfoFiltered(disabledTools) {
+        return this.listInfo().filter((t) => !disabledTools?.has(t.name));
+    }
+    /**
+     * Get tools that should be sent in the initial LLM payload.
+     * Core tools always, standard tools unless user disabled them.
+     */
+    listForLLM(disabledTools) {
+        return this.list().filter((t) => {
+            if (disabledTools?.has(t.name))
+                return false;
+            const tier = t.tier ?? "standard";
+            // Core and standard go in the initial payload
+            // External (MCP) tools must be discovered via tools.search
+            return tier === "core" || tier === "standard";
+        });
+    }
+    /**
+     * Check if a tool is executable (registered and not disabled).
+     * Even discovered external tools can be executed if they're registered.
+     * The disabled check only gates what's sent to the LLM, not execution.
+     */
+    isExecutable(name, disabledTools) {
+        if (!this.tools.has(name))
+            return false;
+        if (disabledTools?.has(name))
+            return false;
+        return true;
+    }
+    /**
+     * Execute a tool by name with audit logging.
+     */
+    async execute(name, input, context, audit) {
+        const tool = this.tools.get(name);
+        if (!tool) {
+            return { ok: false, message: `Unknown tool: ${name}` };
+        }
+        const actionId = context.actionId || uuidv7();
+        // ── Input validation (fast-reject bad LLM arguments) ──
+        const validation = validateToolInput(tool.parameters, input);
+        if (!validation.valid) {
+            const errorMsg = `Input validation failed: ${validation.errors.join("; ")}`;
+            audit?.write({
+                sessionId: context.sessionId,
+                actionId,
+                actionType: "tool.validation_error",
+                toolName: name,
+                inputs: input,
+                outputs: { errors: validation.errors },
+                status: "failed",
+            });
+            return { ok: false, message: errorMsg };
+        }
+        // Log start
+        audit?.write({
+            sessionId: context.sessionId,
+            actionId,
+            actionType: "tool.execute",
+            toolName: name,
+            inputs: input,
+            status: "executing",
+        });
+        try {
+            const result = await tool.execute(input, { ...context, actionId });
+            // Log result
+            audit?.write({
+                sessionId: context.sessionId,
+                actionId: uuidv7(), // separate audit entry for completion
+                actionType: "tool.result",
+                toolName: name,
+                inputs: input,
+                outputs: result.data,
+                status: result.ok ? "completed" : "failed",
+                parentActionId: actionId,
+            });
+            return result;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            audit?.write({
+                sessionId: context.sessionId,
+                actionId: uuidv7(),
+                actionType: "tool.error",
+                toolName: name,
+                inputs: input,
+                outputs: { error: message },
+                status: "failed",
+                parentActionId: actionId,
+            });
+            return { ok: false, message };
+        }
+    }
+}
+//# sourceMappingURL=registry.js.map