@moor-sh/mcp 0.27.0 → 0.27.2

package/dist/index.js

@@ -0,0 +1,2157 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/index.ts
+import { McpServer, StdioServerTransport } from "@modelcontextprotocol/server";
+
+// ../contract/src/client.ts
+class MoorApiError extends Error {
+  status;
+  body;
+  constructor(status, message, body = "") {
+    super(message);
+    this.name = "MoorApiError";
+    this.status = status;
+    this.body = body;
+  }
+}
+function createMoorApiClient(options) {
+  const baseUrl = normalizeBaseUrl(options.baseUrl);
+  const apiKey = options.apiKey;
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  async function request(method, path, body, init) {
+    const hasBody = body !== undefined;
+    const headers = new Headers(init?.headers);
+    headers.set("Authorization", `Bearer ${apiKey}`);
+    if (!headers.has("Accept"))
+      headers.set("Accept", "application/json");
+    if (hasBody && !headers.has("Content-Type"))
+      headers.set("Content-Type", "application/json");
+    const res = await fetchImpl(joinUrl(baseUrl, path), {
+      ...init,
+      method,
+      headers,
+      body: hasBody ? JSON.stringify(body) : init?.body
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      throw new MoorApiError(res.status, parseErrorMessage(text, res.status), text);
+    }
+    if (res.status === 204)
+      return;
+    return await res.json();
+  }
+  return {
+    get: (path, init) => request("GET", path, undefined, init),
+    post: (path, body, init) => request("POST", path, body, init),
+    put: (path, body, init) => request("PUT", path, body, init),
+    delete: (path, init) => request("DELETE", path, undefined, init)
+  };
+}
+function normalizeBaseUrl(baseUrl) {
+  return baseUrl.replace(/\/+$/, "");
+}
+function joinUrl(baseUrl, path) {
+  if (path.startsWith("/"))
+    return `${baseUrl}${path}`;
+  return `${baseUrl}/${path}`;
+}
+function parseErrorMessage(body, status) {
+  if (body) {
+    try {
+      const parsed = JSON.parse(body);
+      if (isJsonObject(parsed) && "error" in parsed) {
+        const error = parsed.error;
+        if (typeof error === "string")
+          return error;
+        return JSON.stringify(error);
+      }
+    } catch {
+      return body;
+    }
+    return body;
+  }
+  return `HTTP ${status}`;
+}
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// ../contract/src/validators.ts
+function validateGithubUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`github_url is not a valid URL: ${url}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`github_url must use https (got protocol "${parsed.protocol}")`);
+  }
+  const host = parsed.hostname;
+  if (host !== "github.com" && host !== "www.github.com") {
+    throw new Error(`github_url must use github.com or www.github.com (got "${host}")`);
+  }
+}
+function validateGithubRepoUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`github_url is not a valid URL: ${url}`);
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(`github_url must use https (got protocol "${parsed.protocol}")`);
+  }
+  if (parsed.search) {
+    throw new Error(`github_url must not contain query parameters (got "${parsed.search}")`);
+  }
+  if (parsed.hash) {
+    throw new Error(`github_url must not contain a URL fragment (got "${parsed.hash}")`);
+  }
+  const host = parsed.hostname;
+  if (host !== "github.com" && host !== "www.github.com") {
+    throw new Error(`github_url must use github.com or www.github.com (got "${host}")`);
+  }
+  if (!/^\/[^/]+\/[^/]+?(\.git)?\/?$/.test(parsed.pathname)) {
+    throw new Error(`github_url must point to /owner/repo (with optional .git); got "${parsed.pathname}"`);
+  }
+}
+var CRON_FIELDS = [
+  { name: "minute", min: 0, max: 59 },
+  { name: "hour", min: 0, max: 23 },
+  { name: "day-of-month", min: 1, max: 31 },
+  { name: "month", min: 1, max: 12 },
+  { name: "day-of-week", min: 0, max: 6 }
+];
+var CRON_PART_PATTERNS = [
+  /^\*$/,
+  /^(\d+)$/,
+  /^(\d+)-(\d+)$/,
+  /^\*\/(\d+)$/,
+  /^(\d+)-(\d+)\/(\d+)$/
+];
+function validateCronSchedule(schedule) {
+  const parts = schedule.trim().split(/\s+/);
+  if (parts.length !== 5) {
+    return `schedule must have exactly 5 space-separated fields (got ${parts.length})`;
+  }
+  for (let i = 0;i < 5; i++) {
+    const field = CRON_FIELDS[i];
+    const err = validateCronField(parts[i], field.min, field.max, field.name);
+    if (err)
+      return err;
+  }
+  return null;
+}
+function validateCronField(field, min, max, name) {
+  if (field === "*")
+    return null;
+  if (/[?LW#]/i.test(field))
+    return `${name}: ?, L, W, # are not supported`;
+  if (/[a-zA-Z]/.test(field)) {
+    return `${name}: month/day names are not supported, use numeric values`;
+  }
+  for (const part of field.split(",")) {
+    if (part === "")
+      return `${name}: empty list element`;
+    const match = CRON_PART_PATTERNS.map((re) => part.match(re)).find((m) => m !== null);
+    if (!match)
+      return `${name}: invalid expression "${part}"`;
+    const groups = match.slice(1);
+    if (groups.length === 1 && match[0].startsWith("*/")) {
+      const step = Number(groups[0]);
+      if (step <= 0)
+        return `${name}: step must be a positive integer (got "${groups[0]}")`;
+    } else if (groups.length === 1) {
+      const n = Number(groups[0]);
+      if (n < min || n > max)
+        return `${name}: ${n} out of bounds [${min}-${max}]`;
+    } else if (groups.length === 2) {
+      const a = Number(groups[0]);
+      const b = Number(groups[1]);
+      if (a < min || b > max)
+        return `${name}: range ${a}-${b} out of bounds [${min}-${max}]`;
+      if (a > b)
+        return `${name}: range ${a}-${b} is descending`;
+    } else if (groups.length === 3) {
+      const a = Number(groups[0]);
+      const b = Number(groups[1]);
+      const step = Number(groups[2]);
+      if (a < min || b > max)
+        return `${name}: range ${a}-${b} out of bounds [${min}-${max}]`;
+      if (a > b)
+        return `${name}: range ${a}-${b} is descending`;
+      if (step <= 0)
+        return `${name}: step must be a positive integer (got "${groups[2]}")`;
+    }
+  }
+  return null;
+}
+// src/tools/cleanup.ts
+import { z } from "zod";
+
+// src/tail-utf8.ts
+function tailUtf8(s, maxBytes) {
+  const bytes = new TextEncoder().encode(s);
+  const storedBytes = bytes.length;
+  if (storedBytes <= maxBytes)
+    return { tail: s, storedBytes, trimmed: false };
+  if (maxBytes === 0)
+    return { tail: "", storedBytes, trimmed: true };
+  let start = storedBytes - maxBytes;
+  while (start < storedBytes && (bytes[start] & 192) === 128)
+    start++;
+  return {
+    tail: new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(start)),
+    storedBytes,
+    trimmed: true
+  };
+}
+
+// src/format.ts
+function formatBytes(bytes) {
+  if (!Number.isFinite(bytes) || bytes <= 0)
+    return "0 B";
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  const i = Math.min(units.length - 1, Math.floor(Math.log(bytes) / Math.log(1024)));
+  const val = bytes / 1024 ** i;
+  return `${val.toFixed(val < 10 ? 1 : 0)} ${units[i]}`;
+}
+function renderDrainState(s) {
+  if (!s.enabled)
+    return ["drain: OFF"];
+  const lines = [`drain: ON (reason: ${s.reason ?? "(none)"})`];
+  if (s.started_at)
+    lines.push(`  started_at:  ${s.started_at}`);
+  if (s.expires_at)
+    lines.push(`  expires_at:  ${s.expires_at} (auto-clear)`);
+  if (s.clear_after_version) {
+    lines.push(`  clear_after_version: ${s.clear_after_version} (auto-clear on matching boot version)`);
+  }
+  return lines;
+}
+function deriveRunStatus(row) {
+  if (!row.finished_at)
+    return "running";
+  return row.exit_code === 0 ? "success" : "failed";
+}
+function deriveRunType(row) {
+  if (row.cron_name)
+    return `cron(${row.cron_name})`;
+  return "build_or_manual";
+}
+function formatMsShort(ms) {
+  if (ms == null)
+    return "\u2014";
+  if (ms < 1000)
+    return `${ms}ms`;
+  const s = Math.floor(ms / 1000);
+  if (s < 60)
+    return `${s}s`;
+  const m = Math.floor(s / 60);
+  return `${m}m${s % 60}s`;
+}
+function appendStream(lines, name, raw, totalBytes, cap) {
+  if (!raw && totalBytes === 0)
+    return;
+  if (!raw) {
+    lines.push(`${name}_total_bytes=${totalBytes}`);
+    return;
+  }
+  const { tail, storedBytes, trimmed: mcpTrimmed } = tailUtf8(raw, cap);
+  const apiTrimmed = totalBytes > storedBytes;
+  let header;
+  if (mcpTrimmed && apiTrimmed) {
+    header = `${name} (showing last ${tail.length} chars of ${storedBytes} stored bytes; ${totalBytes} total bytes seen):`;
+  } else if (mcpTrimmed) {
+    header = `${name} (showing last ${tail.length} chars of ${storedBytes} total bytes):`;
+  } else if (apiTrimmed) {
+    header = `${name} (tail of ${storedBytes} stored from ${totalBytes} total bytes seen):`;
+  } else {
+    header = `${name}:`;
+  }
+  lines.push(header);
+  if (cap > 0)
+    lines.push(tail);
+}
+function formatMs(ms) {
+  if (ms < 1000)
+    return `${ms}ms`;
+  const s = Math.floor(ms / 1000);
+  if (s < 60)
+    return `${s}s`;
+  const m = Math.floor(s / 60);
+  const rs = s % 60;
+  if (m < 60)
+    return `${m}m${rs}s`;
+  const h = Math.floor(m / 60);
+  const rm = m % 60;
+  return `${h}h${rm}m${rs}s`;
+}
+
+// src/tools/cleanup.ts
+function registerCleanupTools(server, client2) {
+  const { apiResponse, readErrorMessage } = client2;
+  server.registerTool("moor_cleanup_plan", {
+    title: "Cleanup Plan (dry-run)",
+    description: "Dry-run: list Docker resources that are safe to delete on this host. v1 covers build cache (host-wide prune) and dangling images (per-ID). Returns candidates with reclaimable bytes. Pass the same candidate list to moor_cleanup_execute to actually delete. No state is kept between plan and execute \u2014 execute re-validates eligibility against current Docker state.",
+    inputSchema: z.object({
+      scope: z.array(z.enum(["build_cache", "dangling_image"])).optional().describe("Subset of categories to plan. Defaults to all v1 categories.")
+    })
+  }, async ({ scope }) => {
+    const res = await apiResponse.post("/api/server/cleanup/plan", { scope });
+    if (!res.ok)
+      throw new Error(`plan failed: ${res.status} ${await readErrorMessage(res)}`);
+    const data = await res.json();
+    if (data.candidates.length === 0) {
+      return { content: [{ type: "text", text: "Nothing to clean up." }] };
+    }
+    const lines = [
+      `${data.candidates.length} candidate(s), total reclaimable: ${formatBytes(data.total_reclaimable_bytes)}.`,
+      "Pass the candidates_json block below back to moor_cleanup_execute to delete.",
+      ""
+    ];
+    for (const c of data.candidates) {
+      if (c.category === "build_cache") {
+        lines.push(`build_cache [${c.label}] \u2014 ${formatBytes(c.reclaimable_bytes)} reclaimable (host-wide prune)`);
+      } else {
+        const tags = c.repo_tags.length > 0 ? ` tags=${c.repo_tags.join(",")}` : "";
+        lines.push(`dangling_image [${c.label}] id=${c.id} ${formatBytes(c.reclaimable_bytes)}${tags}`);
+      }
+    }
+    lines.push("", "candidates_json:", JSON.stringify(data.candidates, null, 2));
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_cleanup_execute", {
+    title: "Cleanup Execute",
+    description: "Delete the candidates returned by moor_cleanup_plan. Server uses only the identifying fields (category + id where applicable) and re-validates eligibility against current Docker state immediately before each delete \u2014 Docker state can change between plan and execute. Reclaimable byte estimates from plan are ignored; the server reports the actual freed bytes. Every execute writes an audit row.",
+    inputSchema: z.object({
+      candidates: z.array(z.union([
+        z.object({ category: z.literal("build_cache") }).passthrough(),
+        z.object({ category: z.literal("dangling_image"), id: z.string().min(1) }).passthrough()
+      ])).min(1).describe("Candidates from moor_cleanup_plan. Extra fields are ignored server-side.")
+    })
+  }, async ({ candidates }) => {
+    const res = await apiResponse.post("/api/server/cleanup/execute", { candidates });
+    if (!res.ok)
+      throw new Error(`execute failed: ${res.status} ${await readErrorMessage(res)}`);
+    const data = await res.json();
+    const lines = [
+      `audit_id=${data.audit_id} total_reclaimed=${formatBytes(data.total_reclaimed_bytes)}`,
+      ""
+    ];
+    for (const r of data.results) {
+      const status = r.error ? `ERROR: ${r.error}` : "ok";
+      if (r.category === "build_cache") {
+        lines.push(`build_cache: reclaimed=${formatBytes(r.reclaimed_bytes)} ${status}`);
+      } else {
+        lines.push(`dangling_image id=${r.id} reclaimed=${formatBytes(r.reclaimed_bytes)} ${status}`);
+      }
+    }
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+}
+
+// src/tools/credentials.ts
+import { z as z2 } from "zod";
+function registerCredentialTools(server, client2) {
+  const { apiResponse, readErrorMessage } = client2;
+  server.registerTool("moor_dns_check", {
+    title: "Check Domain DNS",
+    description: "Resolves a domain's A record and reports whether it matches the server's public IP. Useful before pointing a project's domain at the server.",
+    inputSchema: z2.object({
+      domain: z2.string().min(1).describe("Domain to check, e.g. app.example.com")
+    })
+  }, async ({ domain }) => {
+    const res = await apiResponse.post("/api/dns-check", { domain });
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const data = await res.json();
+    const lines = [
+      `Domain: ${domain}`,
+      `Resolves: ${data.resolves ? "yes" : "no"}`,
+      `Resolved IP: ${data.ip ?? "(none)"}`,
+      `Server IP: ${data.serverIp ?? "(unknown)"}`
+    ];
+    if (data.ip && data.serverIp) {
+      lines.push(`Match: ${data.ip === data.serverIp ? "yes" : "no"}`);
+    }
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  function renderCredentialLine(c) {
+    return `id=${c.id} ${c.hostname} user=${c.username} kind=${c.secret.kind} updated=${c.updated_at}`;
+  }
+  server.registerTool("moor_registry_credentials_list", {
+    title: "List Registry Credentials",
+    description: "List all stored Docker registry credentials. Returns metadata only - the raw secret value is never returned by any read path. Each row carries `secret: { configured: true, kind }` where kind is derived from known token prefixes (github_classic_pat, github_fine_grained_pat) or 'unknown'."
+  }, async () => {
+    const res = await apiResponse.get("/api/server/registry-credentials");
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const data = await res.json();
+    const text = data.rows.length === 0 ? "No registry credentials configured. The pull path falls back to anonymous for every registry." : data.rows.map(renderCredentialLine).join(`
+`);
+    return {
+      content: [{ type: "text", text }],
+      structuredContent: { rows: data.rows }
+    };
+  });
+  server.registerTool("moor_registry_credential_get", {
+    title: "Get Registry Credential",
+    description: "Get a single stored registry credential by id. Returns metadata only - the raw secret is never returned. Use this before moor_registry_credential_delete to confirm the hostname you intend to delete.",
+    inputSchema: z2.object({
+      id: z2.number().int().positive().describe("Credential id (from moor_registry_credentials_list)")
+    })
+  }, async ({ id }) => {
+    const res = await apiResponse.get(`/api/server/registry-credentials/${id}`);
+    if (res.status === 404)
+      throw new Error(`credential id=${id} not found`);
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const row = await res.json();
+    return {
+      content: [{ type: "text", text: renderCredentialLine(row) }],
+      structuredContent: row
+    };
+  });
+  server.registerTool("moor_registry_credential_add", {
+    title: "Add Registry Credential",
+    description: "Store a credential for a Docker registry. The pull path will attach X-Registry-Auth to /images/create whenever an image ref matches this hostname. Hostname must be the bare host as it appears in the image ref (e.g. ghcr.io, docker.io, localhost:5000) - no scheme, no path. Note: the secret value passes through the MCP client and tool-call transport, same security model as moor_env_set; rotate via moor_registry_credential_update if it has been exposed.",
+    inputSchema: z2.object({
+      hostname: z2.string().describe("Bare registry host as parsed from an image ref. Examples: ghcr.io, docker.io, localhost:5000, registry.example.com:5000. No scheme, no path."),
+      username: z2.string().describe("Registry username. For GHCR with a classic PAT, use your GitHub username."),
+      secret: z2.string().describe("Registry password or token. For GHCR, a classic PAT with read:packages is the documented path. Visible to the MCP client on input.")
+    })
+  }, async ({ hostname, username, secret }) => {
+    const res = await apiResponse.post("/api/server/registry-credentials", {
+      hostname,
+      username,
+      secret
+    });
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const row = await res.json();
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Added credential for ${row.hostname} (id=${row.id}, kind=${row.secret.kind}).`
+        }
+      ],
+      structuredContent: row
+    };
+  });
+  server.registerTool("moor_registry_credential_update", {
+    title: "Update Registry Credential",
+    description: "Rotate username and/or secret on an existing credential. Hostname is intentionally not patchable - changing the lookup key on an existing row would silently break the pull path. To change hostnames, delete and re-create. Requires at least one of username or secret. Note: the secret value passes through the MCP client on input - same security model as moor_env_set.",
+    inputSchema: z2.object({
+      id: z2.number().int().positive().describe("Credential id to update"),
+      username: z2.string().optional().describe("New username (optional)"),
+      secret: z2.string().optional().describe("New secret (optional). Visible to the MCP client on input.")
+    })
+  }, async ({ id, username, secret }) => {
+    if (username === undefined && secret === undefined) {
+      throw new Error("must provide at least one of username or secret to update");
+    }
+    const patch = {};
+    if (username !== undefined)
+      patch.username = username;
+    if (secret !== undefined)
+      patch.secret = secret;
+    const res = await apiResponse.put(`/api/server/registry-credentials/${id}`, patch);
+    if (res.status === 404)
+      throw new Error(`credential id=${id} not found`);
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const row = await res.json();
+    const rotated = [];
+    if (username !== undefined)
+      rotated.push("username");
+    if (secret !== undefined)
+      rotated.push("secret");
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Updated credential id=${id} (${row.hostname}): rotated ${rotated.join(" + ")}. kind=${row.secret.kind}.`
+        }
+      ],
+      structuredContent: row
+    };
+  });
+  server.registerTool("moor_registry_credential_delete", {
+    title: "Delete Registry Credential",
+    description: "Delete a stored registry credential. Requires confirm_hostname to match the resolved row's hostname exactly - guards against deleting the wrong row from a stale id. After deletion, pulls for that registry fall back to anonymous. Irreversible.",
+    inputSchema: z2.object({
+      id: z2.number().int().positive().describe("Credential id to delete"),
+      confirm_hostname: z2.string().describe("Must equal the credential row's hostname exactly. Resolved via moor_registry_credential_get and compared before deletion.")
+    })
+  }, async ({ id, confirm_hostname }) => {
+    const getRes = await apiResponse.get(`/api/server/registry-credentials/${id}`);
+    if (getRes.status === 404)
+      throw new Error(`credential id=${id} not found`);
+    if (!getRes.ok)
+      throw new Error(`Failed to fetch credential: ${getRes.status} ${await readErrorMessage(getRes)}`);
+    const row = await getRes.json();
+    if (confirm_hostname !== row.hostname) {
+      throw new Error(`confirm_hostname "${confirm_hostname}" does not match resolved hostname "${row.hostname}". Refusing to delete.`);
+    }
+    const delRes = await apiResponse.delete(`/api/server/registry-credentials/${id}`);
+    if (!delRes.ok)
+      throw new Error(`Failed to delete: ${delRes.status} ${await readErrorMessage(delRes)}`);
+    return {
+      content: [{ type: "text", text: `Deleted credential for ${row.hostname} (id=${id}).` }],
+      structuredContent: { deleted: { id, hostname: row.hostname } }
+    };
+  });
+  function renderSourceCredentialLine(c) {
+    const checked = c.last_check_status ? ` last_check=${c.last_check_status}` : "";
+    return `id=${c.id} ${c.hostname} label=${c.label} user=${c.username} kind=${c.secret.kind} state=${c.state}${checked}`;
+  }
+  server.registerTool("moor_source_credentials_list", {
+    title: "List Source Credentials",
+    description: "List all stored Git source credentials (HTTPS PATs). Returns metadata only - the raw secret value is never returned by any read path. Multiple credentials can share a hostname (e.g. two github.com rows for different orgs); use label to disambiguate."
+  }, async () => {
+    const res = await apiResponse.get("/api/server/source-credentials");
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const data = await res.json();
+    const text = data.rows.length === 0 ? "No source credentials configured. Public repos work anonymously." : data.rows.map(renderSourceCredentialLine).join(`
+`);
+    return {
+      content: [{ type: "text", text }],
+      structuredContent: { rows: data.rows }
+    };
+  });
+  server.registerTool("moor_source_credential_get", {
+    title: "Get Source Credential",
+    description: "Get a single source credential by id. Returns metadata only. Use this before moor_source_credential_delete to confirm the label you intend to delete.",
+    inputSchema: z2.object({
+      id: z2.number().int().positive().describe("Credential id (from moor_source_credentials_list)")
+    })
+  }, async ({ id }) => {
+    const res = await apiResponse.get(`/api/server/source-credentials/${id}`);
+    if (res.status === 404)
+      throw new Error(`source credential id=${id} not found`);
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const row = await res.json();
+    return {
+      content: [{ type: "text", text: renderSourceCredentialLine(row) }],
+      structuredContent: row
+    };
+  });
+  server.registerTool("moor_source_credential_add", {
+    title: "Add Source Credential",
+    description: "Store a Git source credential (HTTPS PAT) for a private repo host. v1 supports HTTPS PATs only; SSH deploy keys may be added in a future version. Hostname must be the bare host as parsed from a Git URL (github.com, gitlab.com, etc.) - no scheme, no path. Multiple credentials can share a hostname; the (hostname, label) pair is unique. For GitHub: use a fine-grained PAT with `Contents: read` (username `x-access-token`), or a classic PAT with `repo` scope. Note: the secret value passes through the MCP client and tool-call transport on input, same security model as moor_env_set.",
+    inputSchema: z2.object({
+      hostname: z2.string().describe("Bare Git host: github.com, gitlab.com, etc. No scheme, no path."),
+      label: z2.string().describe("Operator-supplied label for disambiguation when multiple credentials share a host (e.g. 'personal', 'work-org', 'acme-clients'). Trimmed at storage."),
+      username: z2.string().describe("Git username. For GitHub fine-grained PATs, use 'x-access-token'. For classic PATs, your GitHub username works too."),
+      secret: z2.string().describe("Git token (PAT). Visible to the MCP client on input; rotate via moor_source_credential_update if exposed."),
+      expires_at: z2.string().nullable().optional().describe("Operator-supplied expiry timestamp (PAT expiry from GitHub). Optional; helps rotation reminders.")
+    })
+  }, async ({ hostname, label, username, secret, expires_at }) => {
+    const body = { hostname, label, username, secret };
+    if (expires_at !== undefined)
+      body.expires_at = expires_at;
+    const res = await apiResponse.post("/api/server/source-credentials", body);
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const row = await res.json();
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Added source credential for ${row.hostname} label="${row.label}" (id=${row.id}, kind=${row.secret.kind}).`
+        }
+      ],
+      structuredContent: row
+    };
+  });
+  server.registerTool("moor_source_credential_update", {
+    title: "Update Source Credential",
+    description: "Rotate username, secret, label, or expires_at on an existing source credential. Hostname is intentionally not patchable - changing the lookup key on an existing row would silently break in-flight builds. To change hostname, delete and recreate. Requires at least one of username, secret, label, or expires_at.",
+    inputSchema: z2.object({
+      id: z2.number().int().positive().describe("Credential id to update"),
+      username: z2.string().optional().describe("New username (optional)"),
+      secret: z2.string().optional().describe("New secret (optional). Visible to the MCP client on input."),
+      label: z2.string().optional().describe("New label (optional). Trimmed at storage."),
+      expires_at: z2.string().nullable().optional().describe("New expiry; null to clear")
+    })
+  }, async ({ id, username, secret, label, expires_at }) => {
+    if (username === undefined && secret === undefined && label === undefined && expires_at === undefined) {
+      throw new Error("must provide at least one of username, secret, label, or expires_at");
+    }
+    const patch = {};
+    if (username !== undefined)
+      patch.username = username;
+    if (secret !== undefined)
+      patch.secret = secret;
+    if (label !== undefined)
+      patch.label = label;
+    if (expires_at !== undefined)
+      patch.expires_at = expires_at;
+    const res = await apiResponse.put(`/api/server/source-credentials/${id}`, patch);
+    if (res.status === 404)
+      throw new Error(`source credential id=${id} not found`);
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const row = await res.json();
+    const fields = [];
+    if (username !== undefined)
+      fields.push("username");
+    if (secret !== undefined)
+      fields.push("secret");
+    if (label !== undefined)
+      fields.push("label");
+    if (expires_at !== undefined)
+      fields.push("expires_at");
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Updated source credential id=${id} (${row.hostname}, ${row.label}): rotated ${fields.join(" + ")}. kind=${row.secret.kind}.`
+        }
+      ],
+      structuredContent: row
+    };
+  });
+  server.registerTool("moor_source_credential_delete", {
+    title: "Delete Source Credential",
+    description: "Delete a stored source credential. Requires confirm_label to match the resolved row's label exactly - protects against deleting the wrong credential on a host that has several (e.g. two github.com rows). Refused with credential_in_use if any project still references this credential. Irreversible.",
+    inputSchema: z2.object({
+      id: z2.number().int().positive().describe("Credential id to delete"),
+      confirm_label: z2.string().describe("Must equal the credential row's label exactly. Resolved via moor_source_credential_get and compared before deletion.")
+    })
+  }, async ({ id, confirm_label }) => {
+    const getRes = await apiResponse.get(`/api/server/source-credentials/${id}`);
+    if (getRes.status === 404)
+      throw new Error(`source credential id=${id} not found`);
+    if (!getRes.ok)
+      throw new Error(`Failed to fetch credential: ${getRes.status} ${await readErrorMessage(getRes)}`);
+    const row = await getRes.json();
+    if (confirm_label !== row.label) {
+      throw new Error(`confirm_label "${confirm_label}" does not match resolved label "${row.label}". Refusing to delete.`);
+    }
+    const delRes = await apiResponse.delete(`/api/server/source-credentials/${id}?confirm_label=${encodeURIComponent(row.label)}`);
+    if (delRes.status === 409) {
+      const body = await delRes.json();
+      throw new Error(`credential_in_use: ${body.projects.length} project(s) still reference id=${id}: ${body.projects.join(", ")}`);
+    }
+    if (!delRes.ok)
+      throw new Error(`Failed to delete: ${delRes.status} ${await readErrorMessage(delRes)}`);
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Deleted source credential ${row.hostname}/${row.label} (id=${id}).`
+        }
+      ],
+      structuredContent: { deleted: { id, hostname: row.hostname, label: row.label } }
+    };
+  });
+  server.registerTool("moor_source_credential_check", {
+    title: "Check Source Credential Access",
+    description: "Run a real `git ls-remote` against the repo URL to verify access. Without source_credential_id, probes anonymously first; if private and exactly one credential matches the host, auto-selects it. With source_credential_id, tests that exact credential. With branch, tests the specific branch (branch_not_found is distinct from auth failure). Discovers default_branch via HEAD symref when no branch is provided. Side effect: updates last_checked_at and last_check_status on the credential row; flips state to failed on a credentialed rejection.",
+    inputSchema: z2.object({
+      github_url: z2.string().describe("HTTPS Git repo URL: https://host/owner/repo (optional .git). No query, no fragment, no embedded credentials."),
+      branch: z2.string().optional().describe("Specific branch to verify. Omit to discover the default branch."),
+      source_credential_id: z2.number().int().positive().optional().describe("Pin a specific credential. Required when multiple credentials match the host.")
+    })
+  }, async ({ github_url, branch, source_credential_id }) => {
+    const body = { github_url };
+    if (branch !== undefined)
+      body.branch = branch;
+    if (source_credential_id !== undefined)
+      body.source_credential_id = source_credential_id;
+    const res = await apiResponse.post("/api/server/source-credentials/check", body);
+    const json = await res.json();
+    if (res.ok) {
+      const def = json.default_branch ? ` default_branch=${json.default_branch}` : "";
+      const head = json.head_sha ? ` head_sha=${String(json.head_sha).slice(0, 12)}` : "";
+      const auto = json.auto_selected_credential_id ? ` auto_selected=${json.auto_selected_credential_id}` : "";
+      return {
+        content: [{ type: "text", text: `reachable${def}${head}${auto}` }],
+        structuredContent: json
+      };
+    }
+    return {
+      content: [
+        {
+          type: "text",
+          text: `check failed: code=${json.code}${json.reason ? ` reason=${json.reason}` : ""}`
+        }
+      ],
+      structuredContent: json,
+      isError: true
+    };
+  });
+}
+
+// src/tools/env.ts
+import { z as z3 } from "zod";
+function registerEnvTools(server, client2) {
+  const { apiResponse, resolveProject, readErrorMessage } = client2;
+  server.registerTool("moor_env_list", {
+    title: "List Environment Variables",
+    description: "List all environment variables set for a project.",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID")
+    })
+  }, async ({ project }) => {
+    const p = await resolveProject(project);
+    const res = await apiResponse.get(`/api/projects/${p.id}/envs`);
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status}`);
+    const vars = await res.json();
+    if (vars.length === 0)
+      return { content: [{ type: "text", text: "No environment variables set." }] };
+    const text = vars.map((v) => `${v.key}=${v.value}`).join(`
+`);
+    return { content: [{ type: "text", text }] };
+  });
+  server.registerTool("moor_env_set", {
+    title: "Set Environment Variables",
+    description: "Set environment variables for a project. Merges with existing vars. Automatically restarts the container if running.",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID"),
+      vars: z3.record(z3.string(), z3.string()).describe('Key-value pairs to set, e.g. { "DATABASE_URL": "postgres://..." }')
+    })
+  }, async ({ project, vars }) => {
+    const p = await resolveProject(project);
+    const existingRes = await apiResponse.get(`/api/projects/${p.id}/envs`);
+    if (!existingRes.ok)
+      throw new Error(`Failed to get envs: ${existingRes.status}`);
+    const existing = await existingRes.json();
+    const merged = new Map(existing.map((v) => [v.key, v.value]));
+    for (const [key, value] of Object.entries(vars)) {
+      merged.set(key, value);
+    }
+    const allVars = Array.from(merged, ([key, value]) => ({ key, value }));
+    const setRes = await apiResponse.put(`/api/projects/${p.id}/envs`, allVars);
+    if (!setRes.ok)
+      throw new Error(`Failed to set envs: ${await readErrorMessage(setRes)}`);
+    const keys = Object.keys(vars).join(", ");
+    let text = `Set ${keys} on ${p.name}.`;
+    if (p.status === "running") {
+      await apiResponse.post(`/api/projects/${p.id}/stop`);
+      const startRes = await apiResponse.post(`/api/projects/${p.id}/start`);
+      if (!startRes.ok)
+        throw new Error(`Set vars but failed to restart: ${await readErrorMessage(startRes)}`);
+      text += " Container restarted.";
+    }
+    return { content: [{ type: "text", text }] };
+  });
+  server.registerTool("moor_cron_create", {
+    title: "Create Cron",
+    description: "Creates a cron schedule on a project. Schedule is a 5-field crontab string with numeric values only (no jan/sun/etc.). Day-of-week uses 0=Sunday through 6=Saturday; 7 is not accepted.",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID"),
+      name: z3.string().min(1).describe("Human-readable name for the cron"),
+      schedule: z3.string().describe('5-field crontab, e.g. "0 3 * * *" for 03:00 daily'),
+      command: z3.string().min(1).describe("Shell command to run inside the project's container")
+    })
+  }, async ({ project, name, schedule, command }) => {
+    const err = validateCronSchedule(schedule);
+    if (err)
+      throw new Error(`Invalid schedule: ${err}`);
+    const p = await resolveProject(project);
+    const res = await apiResponse.post(`/api/projects/${p.id}/crons`, {
+      name,
+      schedule,
+      command
+    });
+    if (!res.ok)
+      throw new Error(`Failed to create cron: ${await readErrorMessage(res)}`);
+    const cron = await res.json();
+    return { content: [{ type: "text", text: JSON.stringify(cron, null, 2) }] };
+  });
+  server.registerTool("moor_cron_update", {
+    title: "Update Cron",
+    description: "Updates a cron's fields by id. Schedule is validated if provided.",
+    inputSchema: z3.object({
+      cron_id: z3.number().int().positive().describe("Cron ID"),
+      name: z3.string().min(1).optional(),
+      schedule: z3.string().optional(),
+      command: z3.string().min(1).optional(),
+      enabled: z3.boolean().optional().describe("Enable or disable the cron")
+    })
+  }, async ({ cron_id, name, schedule, command, enabled }) => {
+    if (schedule !== undefined) {
+      const err = validateCronSchedule(schedule);
+      if (err)
+        throw new Error(`Invalid schedule: ${err}`);
+    }
+    const body = {};
+    if (name !== undefined)
+      body.name = name;
+    if (schedule !== undefined)
+      body.schedule = schedule;
+    if (command !== undefined)
+      body.command = command;
+    if (enabled !== undefined)
+      body.enabled = enabled ? 1 : 0;
+    if (Object.keys(body).length === 0) {
+      throw new Error("Provide at least one field to update");
+    }
+    const res = await apiResponse.put(`/api/crons/${cron_id}`, body);
+    if (!res.ok)
+      throw new Error(`Failed to update cron: ${await readErrorMessage(res)}`);
+    const cron = await res.json();
+    return { content: [{ type: "text", text: JSON.stringify(cron, null, 2) }] };
+  });
+  server.registerTool("moor_cron_delete", {
+    title: "Delete Cron",
+    description: "Deletes a cron by id.",
+    inputSchema: z3.object({
+      cron_id: z3.number().int().positive().describe("Cron ID")
+    })
+  }, async ({ cron_id }) => {
+    const res = await apiResponse.delete(`/api/crons/${cron_id}`);
+    if (!res.ok)
+      throw new Error(`Failed to delete cron: ${await readErrorMessage(res)}`);
+    return { content: [{ type: "text", text: `Deletion requested for cron ${cron_id}.` }] };
+  });
+  server.registerTool("moor_cron_run", {
+    title: "Run Cron Now",
+    description: "Triggers a cron to run immediately. Requires the project's container to be running.",
+    inputSchema: z3.object({
+      cron_id: z3.number().int().positive().describe("Cron ID")
+    })
+  }, async ({ cron_id }) => {
+    const res = await apiResponse.post(`/api/crons/${cron_id}/run`);
+    if (!res.ok) {
+      const text = await readErrorMessage(res);
+      let message = text;
+      try {
+        const parsed = JSON.parse(text);
+        if (isJsonObject(parsed) && typeof parsed.error === "string")
+          message = parsed.error;
+      } catch {}
+      throw new Error(message);
+    }
+    return { content: [{ type: "text", text: `Triggered cron ${cron_id}.` }] };
+  });
+  server.registerTool("moor_env_delete", {
+    title: "Delete Environment Variables",
+    description: "Removes one or more environment variables from a project. Restarts the container only if at least one key was actually deleted AND the project was running.",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID"),
+      keys: z3.array(z3.string().min(1)).min(1).describe("Env var keys to remove")
+    })
+  }, async ({ project, keys }) => {
+    const p = await resolveProject(project);
+    const existingRes = await apiResponse.get(`/api/projects/${p.id}/envs`);
+    if (!existingRes.ok)
+      throw new Error(`Failed to get envs: ${existingRes.status}`);
+    const existing = await existingRes.json();
+    const existingKeys = new Set(existing.map((v) => v.key));
+    const toDelete = keys.filter((k) => existingKeys.has(k));
+    const missing = keys.filter((k) => !existingKeys.has(k));
+    if (toDelete.length === 0) {
+      const existingList = [...existingKeys].sort().join(", ") || "(none)";
+      return {
+        content: [
+          {
+            type: "text",
+            text: `No matching keys on ${p.name}. Existing keys: ${existingList}`
+          }
+        ]
+      };
+    }
+    for (const key of toDelete) {
+      const res = await apiResponse.delete(`/api/projects/${p.id}/envs/${encodeURIComponent(key)}`);
+      if (!res.ok)
+        throw new Error(`Failed to delete ${key}: ${await readErrorMessage(res)}`);
+    }
+    let text = `Deleted ${toDelete.join(", ")} from ${p.name}.`;
+    if (missing.length > 0)
+      text += ` (Not present: ${missing.join(", ")}.)`;
+    if (p.status === "running") {
+      await apiResponse.post(`/api/projects/${p.id}/stop`);
+      const startRes = await apiResponse.post(`/api/projects/${p.id}/start`);
+      if (!startRes.ok) {
+        throw new Error(`Deleted vars but failed to restart: ${await readErrorMessage(startRes)}`);
+      }
+      text += " Container restarted.";
+    }
+    return { content: [{ type: "text", text }] };
+  });
+  server.registerTool("moor_volume_list", {
+    title: "List Project Volumes",
+    description: "List the named Docker volumes attached to a project. Each entry includes the logical name (per-project handle), the in-container target path, and the actual Docker volume name (for `docker volume ls` / `docker volume inspect` outside moor).",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID")
+    })
+  }, async ({ project }) => {
+    const p = await resolveProject(project);
+    const res = await apiResponse.get(`/api/projects/${p.id}/volumes`);
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const rows = await res.json();
+    if (rows.length === 0) {
+      return { content: [{ type: "text", text: `No volumes attached to ${p.name}.` }] };
+    }
+    const lines = rows.map((v) => `id=${v.id}  name=${v.name}  target=${v.target}  docker_name=${v.docker_name}`);
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_volume_add", {
+    title: "Add Project Volume",
+    description: "Attach a named Docker volume to a project. The volume is created lazily by Docker on first container start; moor stores the mount config (logical name, in-container target, and the generated docker_name like moor-<project>-<name>). Takes effect on container recreate (next moor_rebuild / moor_restart / moor_deploy / moor_project run) \u2014 already-running containers keep their existing mounts.",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID"),
+      name: z3.string().min(1).describe("Logical volume name (unique per project; alphanumeric/_/-)"),
+      target: z3.string().min(1).describe("Absolute in-container mount path (e.g. /var/lib/postgresql/data)")
+    })
+  }, async ({ project, name, target }) => {
+    const p = await resolveProject(project);
+    const res = await apiResponse.post(`/api/projects/${p.id}/volumes`, { name, target });
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const created = await res.json();
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Attached volume to ${p.name}: id=${created.id}, name=${created.name}, target=${created.target}, docker_name=${created.docker_name}. Mount applies on next container recreate.`
+        }
+      ]
+    };
+  });
+  server.registerTool("moor_volume_remove", {
+    title: "Remove Project Volume Mount",
+    description: "Detach a named volume from a project's mount config. The underlying Docker volume (and its data) is intentionally preserved \u2014 to actually delete the data, use moor_project_delete with purge_volumes:true, or run `docker volume rm <docker_name>` manually. Takes effect on next container recreate.",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID"),
+      volume_id: z3.number().int().positive().describe("Volume ID from moor_volume_list")
+    })
+  }, async ({ project, volume_id }) => {
+    const p = await resolveProject(project);
+    const res = await apiResponse.delete(`/api/projects/${p.id}/volumes/${volume_id}`);
+    if (res.status === 404)
+      throw new Error(`Volume ${volume_id} not found on project ${p.name}`);
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const body = await res.json();
+    return { content: [{ type: "text", text: body.message }] };
+  });
+  server.registerTool("moor_file_set", {
+    title: "Set Project File",
+    description: "Declare a file to inject into a project's container. moor writes it via a tar archive PUT right before the container starts, on every recreate, honoring the octal mode (e.g. 0600 for a TLS key). Identified by path \u2014 setting the same path again updates its content/mode rather than duplicating. Provide exactly one of content (inline) or env_ref (the name of a project env var to source content from at create time, so a secret stays in the env store instead of plaintext here). Takes effect on next container recreate (moor_rebuild / moor_restart / moor_deploy / moor_project run).",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID"),
+      path: z3.string().min(1).describe("Absolute in-container destination path, e.g. /etc/ssl/cert.pem"),
+      content: z3.string().optional().describe("Inline file contents. Provide exactly one of content or env_ref."),
+      env_ref: z3.string().optional().describe("Name of a project env var to source the contents from at create time. Keeps secrets (keys, certs) in the env store instead of plaintext here. Provide exactly one of content or env_ref."),
+      mode: z3.string().optional().describe("Octal permission string applied in the tar header, e.g. '0600'. Default '0644'.")
+    })
+  }, async ({ project, path, content, env_ref, mode }) => {
+    const p = await resolveProject(project);
+    const body = { path };
+    if (content !== undefined)
+      body.content = content;
+    if (env_ref !== undefined)
+      body.env_ref = env_ref;
+    if (mode !== undefined)
+      body.mode = mode;
+    const res = await apiResponse.post(`/api/projects/${p.id}/files`, body);
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const saved = await res.json();
+    const verb = res.status === 201 ? "Added" : "Updated";
+    return {
+      content: [
+        {
+          type: "text",
+          text: `${verb} file on ${p.name}: id=${saved.id}, path=${saved.path}, mode=${saved.mode}, source=${saved.source}${saved.env_ref ? ` (env_ref=${saved.env_ref})` : ""}. Written into the container on next recreate.`
+        }
+      ]
+    };
+  });
+  server.registerTool("moor_file_list", {
+    title: "List Project Files",
+    description: "List the declarative files configured for a project. Each entry shows the in-container path, octal mode, and how content is sourced (inline or env). Raw inline content is never returned (it may be large, and env-sourced content lives in the env store).",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID")
+    })
+  }, async ({ project }) => {
+    const p = await resolveProject(project);
+    const res = await apiResponse.get(`/api/projects/${p.id}/files`);
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const rows = await res.json();
+    if (rows.length === 0) {
+      return { content: [{ type: "text", text: `No files configured for ${p.name}.` }] };
+    }
+    const lines = rows.map((f) => `id=${f.id}  path=${f.path}  mode=${f.mode}  source=${f.source}${f.env_ref ? `  env_ref=${f.env_ref}` : ""}`);
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_file_remove", {
+    title: "Remove Project File",
+    description: "Remove a declared file from a project's injection set. The file stops being written on future container recreates; a copy already present in a running container is not deleted until the next recreate. Takes effect on next container recreate.",
+    inputSchema: z3.object({
+      project: z3.string().describe("Project name or ID"),
+      file_id: z3.number().int().positive().describe("File ID from moor_file_list")
+    })
+  }, async ({ project, file_id }) => {
+    const p = await resolveProject(project);
+    const res = await apiResponse.delete(`/api/projects/${p.id}/files/${file_id}`);
+    if (res.status === 404)
+      throw new Error(`File ${file_id} not found on project ${p.name}`);
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Removed file ${file_id} from ${p.name}. Applies on next container recreate.`
+        }
+      ]
+    };
+  });
+}
+
+// src/tools/exec.ts
+import { z as z4 } from "zod";
+function registerExecTools(server, client2) {
+  const { apiResponse, resolveProject, readErrorMessage } = client2;
+  server.registerTool("moor_exec", {
+    title: "Execute Command",
+    description: "Run a shell command inside a project's running container. Bounded by a per-call timeout (default 10 min, max 1 h). For jobs that may exceed an hour, use moor_exec_async.",
+    inputSchema: z4.object({
+      project: z4.string().describe("Project name or ID"),
+      command: z4.string().describe("Shell command to execute"),
+      timeout_ms: z4.number().int().min(1000).max(3600000).optional().describe("Max time in milliseconds before the exec is aborted. Default 600000 (10 min). Max 3600000 (1 h).")
+    })
+  }, async ({ project, command, timeout_ms }) => {
+    const p = await resolveProject(project);
+    const body = { command };
+    if (timeout_ms !== undefined)
+      body.timeout_ms = timeout_ms;
+    const res = await apiResponse.post(`/api/projects/${p.id}/exec`, body);
+    if (res.status === 504) {
+      const t = await res.json();
+      let detail;
+      if (t.killed) {
+        detail = `Process tree terminated (container pid ${t.killed_pid}).`;
+      } else if (t.killed_pid !== null) {
+        detail = `Kill attempted on container pid ${t.killed_pid} but ${t.live_remaining} descendant process(es) still running inside the container.`;
+      } else {
+        detail = "Process kill could not locate the running process \u2014 it may still be running inside the container.";
+      }
+      throw new Error(`Exec timed out after ${t.timeout_ms}ms. ${detail}`);
+    }
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const result = await res.json();
+    let text = "";
+    if (result.stdout)
+      text += result.stdout;
+    if (result.stderr)
+      text += `
+[stderr] ${result.stderr}`;
+    text += `
+[exit code: ${result.exitCode}]`;
+    return { content: [{ type: "text", text }] };
+  });
+  server.registerTool("moor_exec_async", {
+    title: "Start Async Exec",
+    description: "Run a long-lived command inside a project's container, returning immediately with a run_id. Use moor_exec_status to poll for output and exit code; moor_exec_stop to terminate. Bounded by an optional timeout_ms (default 86400000 = 24h; min 60000 = 1 min; max 86400000). The recorded output is tail-truncated to the last 64 KiB per stream; stdout_total_bytes and stderr_total_bytes report the full pre-truncation byte count.",
+    inputSchema: z4.object({
+      project: z4.string().describe("Project name or ID"),
+      command: z4.string().min(1).describe("Shell command to execute"),
+      timeout_ms: z4.number().int().min(60000).max(86400000).optional().describe("Safety timeout in milliseconds. When exceeded, the process tree is terminated and the run is marked timed_out. Default 86400000 (24h). Min 60000. Max 86400000.")
+    })
+  }, async ({ project, command, timeout_ms }) => {
+    const p = await resolveProject(project);
+    const body = { command };
+    if (timeout_ms !== undefined)
+      body.timeout_ms = timeout_ms;
+    const res = await apiResponse.post(`/api/projects/${p.id}/exec/async`, body);
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const data = await res.json();
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Started async exec on ${p.name}. run_id=${data.run_id}. Use moor_exec_status to poll; moor_exec_stop to terminate.`
+        }
+      ]
+    };
+  });
+  server.registerTool("moor_exec_status", {
+    title: "Get Async Exec Status",
+    description: "Return the current state of an async exec run: state, exit code (when finished), running tail of stdout/stderr (default 8 KiB each inline; the API stores up to 64 KiB), total bytes seen, duration, and any error message. State is one of: running, exited, stopped, timed_out, error. Pass tail_bytes to control how many bytes of each stream are returned inline (0 to 65536; default 8192). The API's 64 KiB-per-stream storage cap is unchanged \u2014 tail_bytes only controls what the MCP tool returns to keep responses under typical agent token limits.",
+    inputSchema: z4.object({
+      run_id: z4.number().int().positive().describe("Run ID returned by moor_exec_async"),
+      tail_bytes: z4.number().int().min(0).max(65536).optional().describe("Max bytes of each stream (stdout, stderr) returned inline. Default 8192. Max 65536 (the API storage cap). Set to 0 for metadata-only.")
+    })
+  }, async ({ run_id, tail_bytes }) => {
+    const cap = tail_bytes ?? 8192;
+    const res = await apiResponse.get(`/api/exec/${run_id}`);
+    if (res.status === 404)
+      throw new Error(`run_id ${run_id} not found`);
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const data = await res.json();
+    const lines = [];
+    lines.push(`run_id=${data.id} state=${data.state} duration=${formatMs(data.duration_ms)}` + (data.exit_code !== null ? ` exit_code=${data.exit_code}` : ""));
+    lines.push(`command: ${data.command}`);
+    if (data.killed_pid)
+      lines.push(`killed_pid: ${data.killed_pid}`);
+    if (data.error_message)
+      lines.push(`error: ${data.error_message}`);
+    appendStream(lines, "stdout", data.stdout, data.stdout_total_bytes, cap);
+    appendStream(lines, "stderr", data.stderr, data.stderr_total_bytes, cap);
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_exec_stop", {
+    title: "Stop Async Exec",
+    description: "Terminate a running async exec by run_id. Walks the descendant process tree inside the container and sends SIGTERM then SIGKILL. Always transitions the run to a terminal state: state=stopped on clean termination (all descendants gone), state=error if any descendant survived OR if the kill handle was lost (moor restart, missing pidfile). Stop is NOT retry-safe \u2014 the kill script removes the pidfile after every attempt, and reparented survivors are unreachable from the original PID.",
+    inputSchema: z4.object({
+      run_id: z4.number().int().positive().describe("Run ID returned by moor_exec_async")
+    })
+  }, async ({ run_id }) => {
+    const res = await apiResponse.post(`/api/exec/${run_id}/stop`);
+    if (res.status === 404)
+      throw new Error(`run_id ${run_id} not found`);
+    const data = await res.json();
+    return {
+      content: [
+        {
+          type: "text",
+          text: `run_id=${run_id} state=${data.state} ${data.message}`
+        }
+      ]
+    };
+  });
+}
+
+// src/tools/projects.ts
+import { z as z5 } from "zod";
+function registerProjectTools(server, client2) {
+  const { apiResponse, resolveProject, readErrorMessage, readSSE } = client2;
+  server.registerTool("moor_status", {
+    title: "List Projects",
+    description: "List all projects managed by Moor. `status` is moor's recorded state (only changes on explicit start/stop/build/cancel). `live_status` is Docker's view at last successful inspect; differences (e.g. recorded='running' live='error') mean moor missed an external change like a host docker stop, crash, or OOM kill. `live_error` non-null means the most recent inspect failed and the live_* values are the last successful snapshot, not necessarily current."
+  }, async () => {
+    const res = await apiResponse.get("/api/projects");
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status}`);
+    const projects = await res.json();
+    const summary = projects.map((p) => ({
+      name: p.name,
+      status: p.status,
+      live_status: p.live_status ?? null,
+      live_exit_code: p.live_exit_code ?? null,
+      live_checked_at: p.live_checked_at ?? null,
+      live_error: p.live_error ?? null,
+      source: p.docker_image || p.github_url || null,
+      domain: p.domain
+    }));
+    return { content: [{ type: "text", text: JSON.stringify(summary, null, 2) }] };
+  });
+  server.registerTool("moor_project_get", {
+    title: "Get Project",
+    description: "Returns the full record for a project (source, branch, dockerfile, domain, status, container id, restart policy).",
+    inputSchema: z5.object({
+      project: z5.string().describe("Project name or ID")
+    })
+  }, async ({ project }) => {
+    const p = await resolveProject(project);
+    return { content: [{ type: "text", text: JSON.stringify(p, null, 2) }] };
+  });
+  server.registerTool("moor_project_create", {
+    title: "Create Project",
+    description: "Creates a new project. Provide exactly one of github_url or docker_image. Does not build or start; call moor_rebuild to bring it up, or use moor_deploy to create and start in one step.",
+    inputSchema: z5.object({
+      name: z5.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, "name must start with an alphanumeric character; allowed chars: a-z, A-Z, 0-9, _, -").describe("Project name (used as the container name suffix: moor-<name>)"),
+      github_url: z5.string().optional().describe("github.com URL; mutually exclusive with docker_image"),
+      docker_image: z5.string().optional().describe("Docker image reference (e.g. nginx:latest); mutually exclusive with github_url"),
+      branch: z5.string().optional().describe("Git branch (default: main, for github_url projects)"),
+      dockerfile: z5.string().optional().describe("Dockerfile path within the repo (default: Dockerfile)"),
+      domain: z5.string().optional().describe("Public domain to route to this container via Caddy"),
+      domain_port: z5.number().int().positive().optional().describe("Container port Caddy should forward to (required if domain is set)"),
+      restart_policy: z5.enum(["no", "on-failure", "always", "unless-stopped"]).optional().describe("Docker restart policy (default: unless-stopped)"),
+      memory_limit_mb: z5.number().int().min(6).optional().describe("Max RAM in MB (also caps swap to the same value so the container can't burn through host swap). Min 6 (Docker's floor), max host total memory. Omit for unbounded. Takes effect on container recreate (next moor_rebuild / moor_restart / moor_deploy / moor_project run)."),
+      cpus: z5.number().min(0.001).optional().describe("Max CPU cores. Fractional values OK (e.g. 0.5 = half a core). Min 0.001 (anything smaller rounds to Docker NanoCpus=0, which means unlimited \u2014 use omit for that). Max host core count. Takes effect on container recreate."),
+      volumes: z5.array(z5.object({
+        name: z5.string().min(1).describe("Logical volume name (unique per project)"),
+        target: z5.string().min(1).describe("Absolute in-container mount path (e.g. /var/lib/postgresql/data)")
+      })).optional().describe("Named Docker volumes to attach. Each entry creates a per-project volume (stored as moor-<project>-<name>) and mounts it at the given target on next container recreate. Data survives container/project rebuilds unless explicitly purged via project delete with purge_volumes=true."),
+      source_credential_id: z5.number().int().positive().nullable().optional().describe("For github_url projects: pin the source credential row (from moor_source_credential_add) the build path should use. Build synthesizes the credentialed clone URL in memory; the secret is never stored on the project. Ignored when docker_image is set; save-time validation is structural only (id exists)."),
+      command: z5.array(z5.string()).nullable().optional().describe(`Override the image's default command (Docker Cmd) as an argv array, e.g. ["tunnel","run"]. Lets a stock image run a custom command with no throwaway Dockerfile. Omit to keep the image default; pass [] or null to clear a previously-set override. Applies on container recreate.`),
+      entrypoint: z5.array(z5.string()).nullable().optional().describe("Override the image's ENTRYPOINT as an argv array. Omit to keep the image default; pass [] or null to clear. Applies on container recreate.")
+    })
+  }, async (input) => {
+    const sources = (input.github_url ? 1 : 0) + (input.docker_image ? 1 : 0);
+    if (sources !== 1) {
+      throw new Error("Provide exactly one of github_url or docker_image");
+    }
+    if (input.github_url)
+      validateGithubUrl(input.github_url);
+    const { volumes, ...createBody } = input;
+    const res = await apiResponse.post("/api/projects", createBody);
+    if (!res.ok)
+      throw new Error(`Failed to create project: ${await readErrorMessage(res)}`);
+    const project = await res.json();
+    const volumeFailures = [];
+    const volumeCreated = [];
+    if (volumes && volumes.length > 0) {
+      for (const v of volumes) {
+        const vRes = await apiResponse.post(`/api/projects/${project.id}/volumes`, v);
+        if (vRes.ok)
+          volumeCreated.push(v.name);
+        else
+          volumeFailures.push({ name: v.name, error: await readErrorMessage(vRes) });
+      }
+    }
+    const lines = [JSON.stringify(project, null, 2)];
+    if (volumeCreated.length > 0) {
+      lines.push(`
+Created volumes: ${volumeCreated.join(", ")}`);
+    }
+    if (volumeFailures.length > 0) {
+      lines.push(`
+Volume failures (project was still created): ${volumeFailures.map((f) => `${f.name}: ${f.error}`).join("; ")}`);
+    }
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_project_update", {
+    title: "Update Project",
+    description: "Updates project metadata. Does NOT rebuild or restart the container. Domain or domain_port changes apply to Caddy immediately. Resource-limit changes (memory_limit_mb, cpus) take effect on the next container recreate (moor_rebuild / moor_restart / moor_deploy / moor_project run) \u2014 an already-running container keeps its existing limits.",
+    inputSchema: z5.object({
+      project: z5.string().describe("Project name or ID to update"),
+      name: z5.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, "name must start alphanumeric; allowed: a-z A-Z 0-9 _ -").optional(),
+      github_url: z5.string().optional(),
+      docker_image: z5.string().optional(),
+      branch: z5.string().optional(),
+      dockerfile: z5.string().optional(),
+      domain: z5.string().optional(),
+      domain_port: z5.number().int().positive().optional(),
+      restart_policy: z5.enum(["no", "on-failure", "always", "unless-stopped"]).optional(),
+      memory_limit_mb: z5.number().int().min(6).nullable().optional().describe("Max RAM in MB. Pass null to clear (return to unbounded). Min 6, max host total memory. Takes effect on container recreate."),
+      cpus: z5.number().min(0.001).nullable().optional().describe("Max CPU cores (fractional OK; min 0.001). Pass null to clear. Max host core count. Takes effect on container recreate."),
+      source_credential_id: z5.number().int().positive().nullable().optional().describe("Pin (or unlink, by passing null) the source credential the build path should use for this github_url project. Switching to docker_image force-clears the id regardless of input. Save-time validation is structural only; host-mismatch / not-active is enforced at build time."),
+      command: z5.array(z5.string()).nullable().optional().describe(`Override the image's default command (Docker Cmd) as an argv array, e.g. ["tunnel","run"]. Pass [] or null to clear the override and return to the image default. Takes effect on container recreate.`),
+      entrypoint: z5.array(z5.string()).nullable().optional().describe("Override the image's ENTRYPOINT as an argv array. Pass [] or null to clear. Takes effect on container recreate.")
+    })
+  }, async (input) => {
+    const { project, ...updates } = input;
+    if (Object.keys(updates).length === 0) {
+      throw new Error("Provide at least one field to update");
+    }
+    if (updates.github_url && updates.docker_image) {
+      throw new Error("Cannot set both github_url and docker_image in the same update");
+    }
+    if (updates.github_url)
+      validateGithubUrl(updates.github_url);
+    const p = await resolveProject(project);
+    const res = await apiResponse.put(`/api/projects/${p.id}`, updates);
+    if (!res.ok)
+      throw new Error(`Failed to update project: ${await readErrorMessage(res)}`);
+    const updated = await res.json();
+    return { content: [{ type: "text", text: JSON.stringify(updated, null, 2) }] };
+  });
+  server.registerTool("moor_project_delete", {
+    title: "Delete Project",
+    description: "Stops and removes the container, then deletes the project record. Requires confirm_name to match the resolved project name exactly. Irreversible. Named Docker volumes are preserved by default (data survives so a recreated project can remount them); pass purge_volumes: true to also delete the underlying Docker volumes \u2014 that deletion is also irreversible.",
+    inputSchema: z5.object({
+      project: z5.string().describe("Project name or ID to delete"),
+      confirm_name: z5.string().describe("Must equal the resolved project's name. Guards against deleting the wrong project."),
+      purge_volumes: z5.boolean().optional().default(false).describe("Also delete the underlying Docker volumes (their data). Default false: project gone, volumes (and their data) preserved. The volume metadata is cleaned up either way; this flag only controls whether the data goes too.")
+    })
+  }, async ({ project, confirm_name, purge_volumes }) => {
+    const p = await resolveProject(project);
+    if (confirm_name !== p.name) {
+      throw new Error(`confirm_name "${confirm_name}" does not match resolved project name "${p.name}". Refusing to delete.`);
+    }
+    const qs = purge_volumes ? "?purge_volumes=true" : "";
+    const res = await apiResponse.delete(`/api/projects/${p.id}${qs}`);
+    if (!res.ok) {
+      const text = await readErrorMessage(res);
+      let message = text;
+      try {
+        const parsed = JSON.parse(text);
+        if (isJsonObject(parsed) && typeof parsed.message === "string") {
+          message = parsed.message;
+        }
+      } catch {}
+      throw new Error(`Failed to delete project: ${message}`);
+    }
+    if (res.status === 204) {
+      return { content: [{ type: "text", text: `Deleted project ${p.name} (id=${p.id}).` }] };
+    }
+    const body = await res.json();
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Deleted project ${p.name} (id=${p.id}). Purged ${body.volumes_purged ?? 0} Docker volume(s).`
+        }
+      ]
+    };
+  });
+  server.registerTool("moor_deploy", {
+    title: "Deploy Project",
+    description: "Create-or-update a project end to end: metadata, env vars (merged into existing), and an optional build/run. Default fails if the project already exists; pass update_existing: true to upsert. When run: true (default), waits for the full Docker build/pull and start, which can take minutes for large images. Errors are tagged by the failing step ([create], [update], [set_env], or [run]) and do not roll back earlier steps.",
+    inputSchema: z5.object({
+      name: z5.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, "name must start alphanumeric; allowed chars: a-z A-Z 0-9 _ -").describe("Project name (also the container suffix: moor-<name>)"),
+      github_url: z5.string().optional().describe("GitHub repo URL: host must be github.com or www.github.com, path must be /owner/repo (optional .git). Mutually exclusive with docker_image."),
+      docker_image: z5.string().optional().describe("Docker image reference (e.g. nginx:latest). Mutually exclusive with github_url."),
+      branch: z5.string().optional().describe("Git branch (API default: main)"),
+      dockerfile: z5.string().optional().describe("Dockerfile path in the repo (API default: Dockerfile)"),
+      domain: z5.string().optional().describe("Public domain to route via Caddy"),
+      domain_port: z5.number().int().positive().optional().describe("Container port Caddy should forward to"),
+      restart_policy: z5.enum(["no", "on-failure", "always", "unless-stopped"]).optional().describe("Docker restart policy (API default: unless-stopped)"),
+      memory_limit_mb: z5.number().int().min(6).nullable().optional().describe("Max RAM in MB (also caps swap to the same value). Min 6, max host total memory. Pass null on update to clear. Limits apply on container recreate, which deploy always does when run: true."),
+      cpus: z5.number().min(0.001).nullable().optional().describe("Max CPU cores. Fractional OK (e.g. 0.5; min 0.001). Max host core count. Pass null on update to clear."),
+      volumes: z5.array(z5.object({
+        name: z5.string().min(1),
+        target: z5.string().min(1)
+      })).optional().describe("Named Docker volumes to attach. Each entry becomes a per-project volume (stored as moor-<project>-<name>) and mounts at the given target on container recreate. On update_existing, additions only \u2014 no removals. Data survives container/project rebuilds unless explicitly purged via moor_project_delete with confirm_name (purge_volumes is a separate flag)."),
+      env: z5.record(z5.string(), z5.string()).optional().describe("Env vars to MERGE into existing project envs. Omit to leave envs untouched. Pass {} for an explicit no-op. Use moor_env_delete to remove keys."),
+      source_credential_id: z5.number().int().positive().nullable().optional().describe("For github_url projects: pin the source credential row (created via moor_source_credential_add). Build path synthesizes the credentialed clone URL in memory; secret never gets stored on the project row. Pass null to detach without switching source type. Ignored when docker_image is set. Save-time validation is structural only (id exists); host-mismatch / not-active is enforced at build time so configuration can survive transient credential outages."),
+      command: z5.array(z5.string()).nullable().optional().describe('Override the image default command (Docker Cmd) as an argv array, e.g. ["tunnel","run"]. Lets a stock image (e.g. cloudflare/cloudflared) run a custom command with no throwaway Dockerfile. Omit to keep the image default; pass [] or null to clear. Applies on the recreate the run step performs.'),
+      entrypoint: z5.array(z5.string()).nullable().optional().describe("Override the image ENTRYPOINT as an argv array. Omit to keep the image default; pass [] or null to clear. Applies on container recreate."),
+      files: z5.array(z5.object({
+        path: z5.string().min(1).describe("Absolute in-container destination path, e.g. /etc/ssl/cert.pem"),
+        content: z5.string().optional().describe("Inline file contents. Provide exactly one of content or env_ref."),
+        env_ref: z5.string().optional().describe("Name of a project env var to source the contents from at create time, so a secret (TLS key, token) lives in the env store rather than in plaintext here. Provide exactly one of content or env_ref."),
+        mode: z5.string().optional().describe("Octal permission string for the tar header, e.g. '0600'. Default '0644'.")
+      })).optional().describe("Declarative files to inject into the container before it starts, written on every recreate (additions/updates only \u2014 moor_deploy never removes files; use moor_file_remove). Each file's path identifies it; re-deploying the same path updates its content. Honors the octal mode in the tar header (e.g. 0600 for a key)."),
+      run: z5.boolean().optional().default(true).describe("Build/pull and start after create/update. Default true. Setting false leaves the container untouched; if envs changed while the container is running, the change will not apply until the next run/restart."),
+      update_existing: z5.boolean().optional().default(false).describe("Allow updating a project that already exists. Default false (create-only).")
+    })
+  }, async (input) => {
+    if (input.github_url)
+      validateGithubRepoUrl(input.github_url);
+    if (input.github_url && input.docker_image) {
+      throw new Error("Cannot set both github_url and docker_image");
+    }
+    if (input.run !== false) {
+      const drainRes = await apiResponse.get("/api/server/drain");
+      if (drainRes.ok) {
+        const { state } = await drainRes.json();
+        if (state.enabled) {
+          throw new Error(`[drain] moor is draining (reason: ${state.reason ?? "(none)"}; expires_at: ${state.expires_at}). Refusing deploy before any project create/update side effects. Use moor_drain_disable to re-enable, or retry after expiry. Pass run: false if you only need metadata changes.`);
+        }
+      }
+    }
+    const listRes = await apiResponse.get("/api/projects");
+    if (!listRes.ok)
+      throw new Error(`Failed to list projects: ${listRes.status}`);
+    const projects = await listRes.json();
+    const existing = projects.find((p) => p.name === input.name);
+    if (existing && !input.update_existing) {
+      throw new Error(`Project "${input.name}" already exists. Pass update_existing: true to update it.`);
+    }
+    if (!existing) {
+      const sources = (input.github_url ? 1 : 0) + (input.docker_image ? 1 : 0);
+      if (sources !== 1) {
+        throw new Error("Provide exactly one of github_url or docker_image");
+      }
+    }
+    const normalizedDomain = input.domain === undefined ? undefined : input.domain.trim().toLowerCase() || null;
+    if (normalizedDomain) {
+      const conflict = projects.find((p) => p.domain && p.domain.trim().toLowerCase() === normalizedDomain && p.id !== existing?.id);
+      if (conflict) {
+        throw new Error(`Domain "${normalizedDomain}" is already used by project "${conflict.name}" (id=${conflict.id}). Refusing before Caddy reload.`);
+      }
+    }
+    let projectId;
+    let projectName;
+    if (!existing) {
+      const createBody = {
+        name: input.name,
+        github_url: input.github_url,
+        docker_image: input.docker_image,
+        branch: input.branch,
+        dockerfile: input.dockerfile,
+        domain: normalizedDomain,
+        domain_port: input.domain_port,
+        restart_policy: input.restart_policy,
+        memory_limit_mb: input.memory_limit_mb,
+        cpus: input.cpus,
+        source_credential_id: input.source_credential_id,
+        command: input.command,
+        entrypoint: input.entrypoint
+      };
+      const res = await apiResponse.post("/api/projects", createBody);
+      if (!res.ok)
+        throw new Error(`[create] ${await readErrorMessage(res)}`);
+      const created = await res.json();
+      projectId = created.id;
+      projectName = created.name;
+    } else {
+      const updateBody = {};
+      if (input.github_url !== undefined)
+        updateBody.github_url = input.github_url;
+      if (input.docker_image !== undefined)
+        updateBody.docker_image = input.docker_image;
+      if (input.branch !== undefined)
+        updateBody.branch = input.branch;
+      if (input.dockerfile !== undefined)
+        updateBody.dockerfile = input.dockerfile;
+      if (normalizedDomain !== undefined)
+        updateBody.domain = normalizedDomain;
+      if (input.domain_port !== undefined)
+        updateBody.domain_port = input.domain_port;
+      if (input.restart_policy !== undefined)
+        updateBody.restart_policy = input.restart_policy;
+      if (input.memory_limit_mb !== undefined)
+        updateBody.memory_limit_mb = input.memory_limit_mb;
+      if (input.cpus !== undefined)
+        updateBody.cpus = input.cpus;
+      if (input.source_credential_id !== undefined)
+        updateBody.source_credential_id = input.source_credential_id;
+      if (input.command !== undefined)
+        updateBody.command = input.command;
+      if (input.entrypoint !== undefined)
+        updateBody.entrypoint = input.entrypoint;
+      if (Object.keys(updateBody).length > 0) {
+        const res = await apiResponse.put(`/api/projects/${existing.id}`, updateBody);
+        if (!res.ok)
+          throw new Error(`[update] ${await readErrorMessage(res)}`);
+      }
+      projectId = existing.id;
+      projectName = existing.name;
+    }
+    if (input.volumes && input.volumes.length > 0) {
+      let existingVolumes = null;
+      for (const v of input.volumes) {
+        const vRes = await apiResponse.post(`/api/projects/${projectId}/volumes`, v);
+        if (vRes.ok)
+          continue;
+        const text = await readErrorMessage(vRes);
+        if (vRes.status !== 409) {
+          throw new Error(`[volumes] failed to add ${v.name}: ${text}`);
+        }
+        if (existingVolumes === null) {
+          const listRes2 = await apiResponse.get(`/api/projects/${projectId}/volumes`);
+          if (!listRes2.ok) {
+            throw new Error(`[volumes] could not resolve 409 on ${v.name}: failed to list existing volumes: ${await readErrorMessage(listRes2)}`);
+          }
+          existingVolumes = await listRes2.json();
+        }
+        const match = existingVolumes.find((e) => e.name === v.name);
+        if (!match) {
+          throw new Error(`[volumes] conflict adding ${v.name}: ${text} (no existing volume by that name; check for target collision)`);
+        }
+        if (match.target !== v.target) {
+          throw new Error(`[volumes] conflict adding ${v.name}: existing target "${match.target}" differs from requested "${v.target}". moor_deploy does not change mount targets; use moor_volume_remove + moor_volume_add explicitly.`);
+        }
+      }
+    }
+    if (input.files && input.files.length > 0) {
+      for (const f of input.files) {
+        const fRes = await apiResponse.post(`/api/projects/${projectId}/files`, f);
+        if (!fRes.ok) {
+          throw new Error(`[files] failed to set ${f.path}: ${await readErrorMessage(fRes)}`);
+        }
+      }
+    }
+    const envEntries = input.env ? Object.entries(input.env) : [];
+    const envProvided = envEntries.length > 0;
+    if (envProvided) {
+      const existingRes = await apiResponse.get(`/api/projects/${projectId}/envs`);
+      if (!existingRes.ok) {
+        throw new Error(`[set_env] Failed to read envs: ${existingRes.status}`);
+      }
+      const existingEnvs = await existingRes.json();
+      const merged = new Map(existingEnvs.map((v) => [v.key, v.value]));
+      for (const [k, v] of envEntries)
+        merged.set(k, v);
+      const allVars = Array.from(merged, ([key, value]) => ({ key, value }));
+      const putRes = await apiResponse.put(`/api/projects/${projectId}/envs`, allVars);
+      if (!putRes.ok)
+        throw new Error(`[set_env] ${await readErrorMessage(putRes)}`);
+    }
+    let runLogs = "";
+    let runStructuredError;
+    if (input.run) {
+      const runRes = await apiResponse.post(`/api/projects/${projectId}/run`);
+      if (!runRes.ok)
+        throw new Error(`[run] ${await readErrorMessage(runRes)}`);
+      const { logs, error, structuredError } = await readSSE(runRes);
+      runLogs = logs;
+      if (structuredError) {
+        runStructuredError = structuredError;
+      } else if (error) {
+        throw new Error(`[run] ${error}`);
+      }
+    }
+    const lines = [];
+    lines.push(existing ? `Updated project ${projectName} (id=${projectId}).` : `Created project ${projectName} (id=${projectId}).`);
+    if (envProvided) {
+      lines.push(`Merged ${envEntries.length} env var(s): ${envEntries.map(([k]) => k).join(", ")}.`);
+    }
+    if (!input.run) {
+      if (envProvided && existing?.status === "running") {
+        lines.push("Note: project is running; env changes will not take effect until the next run or restart.");
+      }
+    } else {
+      lines.push("");
+      lines.push("Build/run output:");
+      lines.push(runLogs || "(no output)");
+    }
+    if (runStructuredError) {
+      lines.push("");
+      lines.push(`Failed: code=${runStructuredError.code} message=${runStructuredError.message}`);
+      return {
+        content: [{ type: "text", text: lines.join(`
+`) }],
+        structuredContent: { ...runStructuredError, project_id: projectId },
+        isError: true
+      };
+    }
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+}
+
+// src/tools/runs.ts
+import { z as z6 } from "zod";
+function registerRunTools(server, client2) {
+  const { apiResponse, resolveProject, readErrorMessage, readSSE } = client2;
+  server.registerTool("moor_logs", {
+    title: "Get Container Logs",
+    description: "Get recent logs from a project's container. Annotates output with state: ok (container running), exited (container is stopped but Docker still has logs), no_container (project never started), or missing (container_id is set but Docker doesn't have it). Throws only on docker_error (Docker daemon 5xx / unreachable) so an operator can distinguish infrastructure failure from app silence \u2014 pre-#74 the tool returned empty logs for all of these.",
+    inputSchema: z6.object({
+      project: z6.string().describe("Project name or ID"),
+      lines: z6.number().optional().default(100).describe("Number of log lines to retrieve")
+    })
+  }, async ({ project, lines }) => {
+    const p = await resolveProject(project);
+    const res = await apiResponse.get(`/api/projects/${p.id}/logs?tail=${lines}`);
+    if (res.status === 502) {
+      const data2 = await res.json().catch(() => ({}));
+      throw new Error(`Docker error: ${data2.error ?? "unknown"}`);
+    }
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const data = await res.json();
+    switch (data.state) {
+      case "no_container":
+        return {
+          content: [{ type: "text", text: "(project hasn't been started yet \u2014 no container)" }]
+        };
+      case "missing":
+        return {
+          content: [
+            {
+              type: "text",
+              text: "(container_id was recorded but Docker doesn't have it; moor may need to recreate the project)"
+            }
+          ]
+        };
+      case "exited":
+        return {
+          content: [
+            {
+              type: "text",
+              text: `${data.logs || "(no logs captured)"}
+
+(container is exited; logs above are from before)`
+            }
+          ]
+        };
+      default:
+        return {
+          content: [{ type: "text", text: data.logs || "(no logs)" }]
+        };
+    }
+  });
+  server.registerTool("moor_rebuild", {
+    title: "Rebuild Project",
+    description: "Rebuild a project from source (git pull + docker build) and restart the container. Returns the build output when it finishes. While a build is in flight, the most recent moor_runs entry has finished_at=null \u2014 call moor_run_get on its id to tail the live output. Use moor_rebuild for code, Dockerfile, or base-image changes. For env vars / resource limits / port / volume / restart-policy changes, or to recover a crashed container from the existing image, use moor_restart \u2014 it skips the build and is much faster.",
+    inputSchema: z6.object({
+      project: z6.string().describe("Project name or ID"),
+      no_cache: z6.boolean().optional().default(false).describe("Build without Docker cache")
+    })
+  }, async ({ project, no_cache }) => {
+    const p = await resolveProject(project);
+    const query = no_cache ? "?nocache=true" : "";
+    const res = await apiResponse.post(`/api/projects/${p.id}/run${query}`);
+    if (!res.ok)
+      throw new Error(`[run] ${await readErrorMessage(res)}`);
+    const { logs, error, structuredError } = await readSSE(res);
+    if (structuredError) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: `rebuild failed: code=${structuredError.code} message=${structuredError.message}`
+          }
+        ],
+        structuredContent: structuredError,
+        isError: true
+      };
+    }
+    if (error)
+      throw new Error(error);
+    return { content: [{ type: "text", text: logs || "Rebuild complete." }] };
+  });
+  server.registerTool("moor_restart", {
+    title: "Restart Project",
+    description: "Stop and recreate a project's container from its existing image. Does NOT pull from git or rebuild \u2014 uses the existing image_tag. Right tool for: applying changed env vars / resource limits / ports / volumes / restart policy, recovering a crashed container, or simply bouncing the process. Wrong tool for: code or Dockerfile changes (use moor_rebuild \u2014 those need a new image).",
+    inputSchema: z6.object({
+      project: z6.string().describe("Project name or ID")
+    })
+  }, async ({ project }) => {
+    const p = await resolveProject(project);
+    const stopRes = await apiResponse.post(`/api/projects/${p.id}/stop`);
+    if (!stopRes.ok)
+      throw new Error(`Failed to stop: ${await readErrorMessage(stopRes)}`);
+    const startRes = await apiResponse.post(`/api/projects/${p.id}/start`);
+    if (!startRes.ok)
+      throw new Error(`Failed to start: ${await readErrorMessage(startRes)}`);
+    return { content: [{ type: "text", text: `${p.name} restarted.` }] };
+  });
+  server.registerTool("moor_runs", {
+    title: "List Project Run History",
+    description: "Paginated list of cron runs and build runs for a project. Returns one compact line per run (id, type, status, exit code, duration, output byte counts, timestamps) \u2014 stdout/stderr bodies are NOT included to avoid blowing token budgets on large build outputs. Use moor_run_get(run_id) to fetch the stored output for a single run (cron rows store full output; build/manual rows store at most a 64 KiB tail with the original total bytes recorded separately).",
+    inputSchema: z6.object({
+      project: z6.string().describe("Project name or ID"),
+      page: z6.number().int().positive().optional().default(1).describe("Page number (20 runs per page). Default 1.")
+    })
+  }, async ({ project, page }) => {
+    const p = await resolveProject(project);
+    const res = await apiResponse.get(`/api/projects/${p.id}/runs?include_output=false&page=${page}`);
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const data = await res.json();
+    if (data.runs.length === 0) {
+      return {
+        content: [{ type: "text", text: `No runs recorded for ${p.name}.` }]
+      };
+    }
+    const lines = [];
+    lines.push(`${p.name}: ${data.runs.length} run(s) on page ${page}, ${data.total} total. Use moor_run_get(run_id) for stored output (build/manual rows are tail-truncated; total bytes shown below).`);
+    for (const r of data.runs) {
+      const type = deriveRunType(r);
+      const status = deriveRunStatus(r);
+      const exit = r.exit_code != null ? ` exit=${r.exit_code}` : "";
+      const cmd = r.cron_command ? ` cmd="${r.cron_command}"` : "";
+      const outTotal = r.stdout_total_bytes ?? r.stdout_bytes;
+      const errTotal = r.stderr_total_bytes ?? r.stderr_bytes;
+      lines.push(`id=${r.id} ${type} ${status}${exit} dur=${formatMsShort(r.duration_ms)} stdout=${outTotal}B stderr=${errTotal}B started=${r.started_at}${cmd}`);
+    }
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_run_get", {
+    title: "Get Run Detail",
+    description: "Fetch one cron or build run with its stdout and stderr. Output is tail-truncated (default 8 KiB per stream; max 65536) to keep responses under typical agent token limits. Use tail_bytes=0 for metadata-only.",
+    inputSchema: z6.object({
+      run_id: z6.number().int().positive().describe("Run ID returned by moor_runs"),
+      tail_bytes: z6.number().int().min(0).max(65536).optional().describe("Max bytes of each stream returned inline. Default 8192. Max 65536. Set to 0 for metadata-only.")
+    })
+  }, async ({ run_id, tail_bytes }) => {
+    const cap = tail_bytes ?? 8192;
+    const res = await apiResponse.get(`/api/runs/${run_id}`);
+    if (res.status === 404)
+      throw new Error(`run_id ${run_id} not found`);
+    if (!res.ok)
+      throw new Error(`Failed: ${await readErrorMessage(res)}`);
+    const r = await res.json();
+    const lines = [];
+    const type = deriveRunType(r);
+    const status = deriveRunStatus(r);
+    const exit = r.exit_code != null ? ` exit_code=${r.exit_code}` : "";
+    lines.push(`run_id=${r.id} ${type} ${status}${exit} duration=${formatMsShort(r.duration_ms)}`);
+    if (r.cron_command)
+      lines.push(`cron_command: ${r.cron_command}`);
+    lines.push(`started_at: ${r.started_at}`);
+    if (r.finished_at)
+      lines.push(`finished_at: ${r.finished_at}`);
+    const stdoutStr = r.stdout ?? "";
+    const stderrStr = r.stderr ?? "";
+    const enc = new TextEncoder;
+    const stdoutTotal = r.stdout_total_bytes ?? enc.encode(stdoutStr).length;
+    const stderrTotal = r.stderr_total_bytes ?? enc.encode(stderrStr).length;
+    appendStream(lines, "stdout", stdoutStr, stdoutTotal, cap);
+    appendStream(lines, "stderr", stderrStr, stderrTotal, cap);
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_run_stop", {
+    title: "Stop or Cancel a Run",
+    description: "Stops an active cron run or cancels an active build/pull run (from moor_rebuild / moor_deploy). Closing the connection to the Docker build/pull endpoint aborts the daemon-side job. Cancellation is only valid during the build/pull streaming phase \u2014 once the build finishes and container start has begun, the call returns not_cancellable. Returns one of: cancelled, cancelled_cron, not_cancellable, already_finished, not_active, not_found. These are all expected outcomes, not errors \u2014 the tool throws only on unexpected server failures.",
+    inputSchema: z6.object({
+      run_id: z6.number().int().positive().describe("Run ID from moor_runs")
+    })
+  }, async ({ run_id }) => {
+    const res = await apiResponse.post(`/api/runs/${run_id}/stop`);
+    let data;
+    try {
+      data = await res.json();
+    } catch {
+      throw new Error(`run_id=${run_id} server error: ${res.status} ${res.statusText}`);
+    }
+    if (typeof data.result === "string") {
+      return { content: [{ type: "text", text: `run_id=${run_id} ${data.result}` }] };
+    }
+    throw new Error(`run_id=${run_id} unexpected response: status=${res.status} body=${JSON.stringify(data)}`);
+  });
+}
+
+// src/tools/server.ts
+import { z as z7 } from "zod";
+function registerServerTools(server, client2) {
+  const { apiResponse, resolveProject, readErrorMessage } = client2;
+  server.registerTool("moor_stats", {
+    title: "Server Stats",
+    description: "Get server resource usage: load, memory, per-filesystem disk usage (the filesystems the moor container can see, plus any operator-configured monitored host disks via MOOR_MONITORED_DISKS), Docker disk by category (images/containers/volumes/build cache) with reclaimable bytes, and container counts. Note: cpu.percent is load-derived (load avg \xF7 cores), not instantaneous CPU; use the `load` field for the same signal with explicit naming."
+  }, async () => {
+    const res = await apiResponse.get("/api/server/stats");
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status}`);
+    const s = await res.json();
+    const lines = [
+      `Host: ${s.hostname}`,
+      `OS: ${s.os}`,
+      `Uptime: ${s.uptime}`,
+      `CPU: ${s.cpu.percent}% (${s.cpu.cores} cores) \u2014 load-derived, not instantaneous`
+    ];
+    if (s.load) {
+      lines.push(`Load (1m): ${s.load.one_min.toFixed(2)} on ${s.load.cores} cores (${s.load.normalized_percent}%)`);
+    }
+    lines.push(`Memory: ${s.memory.used} / ${s.memory.total} (${s.memory.percent}%)`);
+    const disks = s.disks?.length ? s.disks : [{ mount: "/", ...s.disk }];
+    for (const d of disks) {
+      const name = d.label ? `${d.label} (${d.mount})` : `Disk ${d.mount}`;
+      lines.push(`${name}: ${d.used} / ${d.total} (${d.percent}%)`);
+    }
+    lines.push(`Containers: ${s.containers.running} running / ${s.containers.total} total`);
+    if (s.docker) {
+      const d = s.docker;
+      lines.push("Docker disk:", `  Images: ${formatBytes(d.images.bytes)} (${formatBytes(d.images.reclaimable_bytes)} reclaimable, ${d.images.unused_count}/${d.images.count} unused)`, `  Containers: ${formatBytes(d.containers.bytes)} (${formatBytes(d.containers.reclaimable_bytes)} reclaimable, ${d.containers.stopped_count}/${d.containers.count} stopped)`, `  Volumes: ${formatBytes(d.volumes.bytes)} (${formatBytes(d.volumes.reclaimable_bytes)} reclaimable, ${d.volumes.unused_count}/${d.volumes.count} unused)`, `  Build cache: ${formatBytes(d.build_cache.bytes)} (${formatBytes(d.build_cache.reclaimable_bytes)} reclaimable, ${d.build_cache.count} entries)`);
+    }
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_drain_status", {
+    title: "Drain Status",
+    description: "Read-only: current drain state (enabled, reason, expires_at, clear_after_version) plus counts of active work the operator should wait on before an update. active_work uses the same counter as moor_update_status so the two never disagree."
+  }, async () => {
+    const res = await apiResponse.get("/api/server/drain");
+    if (!res.ok)
+      throw new Error(`drain status failed: ${res.status} ${await readErrorMessage(res)}`);
+    const s = await res.json();
+    const lines = renderDrainState(s.state);
+    lines.push(`active: builds=${s.active_work.builds_in_flight} execs=${s.active_work.execs_in_flight} crons=${s.active_work.crons_in_flight} terminals=${s.active_work.terminals_open}`);
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_drain_enable", {
+    title: "Enable Drain Mode",
+    description: "Refuse new builds, deploys, execs, manual cron runs, and terminal upgrades with a 503 carrying { reason, expires_at, hint }. Existing in-flight work runs to completion \u2014 drain does NOT kill anything. Scheduled cron ticks during drain write a synthetic 'skipped due to drain' run row instead of executing. Read-only routes (status, logs, runs) keep working. Default TTL is 30 minutes; set ttl_minutes to override. clear_after_version is the updater's hook \u2014 when set, the drain auto-clears on boot if the running moor version matches.",
+    inputSchema: z7.object({
+      reason: z7.string().optional().describe("Freeform reason shown in every refusal response (e.g. 'preparing for 0.34 upgrade')."),
+      ttl_minutes: z7.number().optional().describe("Auto-clear after this many minutes. Default 30. Clamped to [0.05 min, 7 days]."),
+      clear_after_version: z7.string().optional().describe("Optional: on next boot, if the running moor version equals this value, auto-clear the drain. Typically set by the updater path; safe for manual use too.")
+    })
+  }, async ({ reason, ttl_minutes, clear_after_version }) => {
+    const res = await apiResponse.post("/api/server/drain/enable", {
+      reason,
+      ttl_minutes,
+      clear_after_version
+    });
+    if (!res.ok)
+      throw new Error(`drain enable failed: ${res.status} ${await readErrorMessage(res)}`);
+    const s = await res.json();
+    return { content: [{ type: "text", text: renderDrainState(s.state).join(`
+`) }] };
+  });
+  server.registerTool("moor_drain_disable", {
+    title: "Disable Drain Mode",
+    description: "Explicit operator action to clear drain immediately. Does not kill or restart anything \u2014 just removes the gate so new builds/deploys/execs/cron triggers/terminal upgrades succeed again."
+  }, async () => {
+    const res = await apiResponse.post("/api/server/drain/disable", {});
+    if (!res.ok)
+      throw new Error(`drain disable failed: ${res.status} ${await readErrorMessage(res)}`);
+    const s = await res.json();
+    return { content: [{ type: "text", text: renderDrainState(s.state).join(`
+`) }] };
+  });
+  server.registerTool("moor_db_backup", {
+    title: "DB Backup (snapshot)",
+    description: "Take a SQLite snapshot of moor.db via VACUUM INTO. The file lands next to the main DB as moor.db.backup-<epoch-ms>. Retention is enforced after each snapshot (keeps the 7 most recent by default; older ones are pruned). After this returns, moor_update_status' db_backup.age_seconds will read close to 0. Use before a manual `docker compose pull moor && up -d` if you don't have MOOR_DB_BACKUP_INTERVAL_HOURS scheduled."
+  }, async () => {
+    const res = await apiResponse.post("/api/server/backup", {});
+    if (!res.ok)
+      throw new Error(`db backup failed: ${res.status} ${await readErrorMessage(res)}`);
+    const r = await res.json();
+    const mb = (r.sizeBytes / (1024 * 1024)).toFixed(2);
+    return {
+      content: [
+        {
+          type: "text",
+          text: `Snapshot written: ${r.path}
+size: ${r.sizeBytes}B (${mb} MB)
+duration: ${r.durationMs}ms`
+        }
+      ]
+    };
+  });
+  server.registerTool("moor_project_stats", {
+    title: "Project Container Stats (live)",
+    description: "Live container stats for one project: CPU percent, memory (excluding page cache, same accounting as `docker stats`), network and block I/O totals, PID count. Single Docker stats snapshot \u2014 CPU uses the cpu_stats/precpu_stats delta the daemon already includes. Stopped or never-started projects return running=false with zeroed counters (no 404).",
+    inputSchema: z7.object({
+      project: z7.string().describe("Project name or ID")
+    })
+  }, async ({ project }) => {
+    const p = await resolveProject(project);
+    const res = await apiResponse.get(`/api/projects/${p.id}/container-stats`);
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const s = await res.json();
+    if (!s.running) {
+      return {
+        content: [{ type: "text", text: `${p.name}: not running (zeroed counters returned).` }]
+      };
+    }
+    const memLimit = s.memory_limit_bytes > 0 ? formatBytes(s.memory_limit_bytes) : "unlimited";
+    const lines = [
+      `${p.name}: CPU ${s.cpu_percent}% | Memory ${formatBytes(s.memory_bytes)} / ${memLimit} (${s.memory_percent}%) | PIDs ${s.pids}`,
+      `Network: rx ${formatBytes(s.network_rx_bytes)} / tx ${formatBytes(s.network_tx_bytes)}`,
+      `Block I/O: read ${formatBytes(s.block_read_bytes)} / write ${formatBytes(s.block_write_bytes)}`
+    ];
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_project_history", {
+    title: "Project History (stored)",
+    description: "Stored resource history + lifecycle events for one project over a time window \u2014 answers 'what was going on with this project around this case?' (NOT live: use moor_project_stats for a current snapshot). Resource samples are taken ~every minute; CPU is averaged across each interval and network/block reported as rates, both computed from raw counters and reset-aware. Events come from the Docker event stream (start/die/oom/kill/restart) and moor's own state changes. Window defaults to the last `hours` (24); pass from_ms/to_ms (epoch ms) for an exact window. A gap warning means events may be incomplete in that window.",
+    inputSchema: z7.object({
+      project: z7.string().describe("Project name or ID"),
+      hours: z7.number().optional().describe("Lookback window in hours (default 24). Ignored if from_ms/to_ms are given."),
+      from_ms: z7.number().optional().describe("Window start, epoch milliseconds"),
+      to_ms: z7.number().optional().describe("Window end, epoch milliseconds")
+    })
+  }, async ({ project, hours, from_ms, to_ms }) => {
+    const p = await resolveProject(project);
+    const to = to_ms ?? Date.now();
+    const from = from_ms ?? to - (hours ?? 24) * 3600000;
+    const res = await apiResponse.get(`/api/projects/${p.id}/stats/history?from=${from}&to=${to}`);
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const h = await res.json();
+    const s = h.summary;
+    const windowH = Math.round((h.to_ms - h.from_ms) / 3600000 * 10) / 10;
+    const lines = [
+      `${p.name} history \u2014 window ~${windowH}h${s.has_gap ? "  [\u26A0 event gap recorded: events may be incomplete]" : ""}`,
+      `Samples: ${s.sample_count} total, ${s.running_sample_count} running`,
+      `CPU: avg ${s.cpu_percent_avg ?? "n/a"}% / max ${s.cpu_percent_max ?? "n/a"}%`,
+      `Memory: max ${s.mem_bytes_max !== null ? formatBytes(s.mem_bytes_max) : "n/a"}`,
+      `Network: in ${formatBytes(s.net_rx_bytes_total)} / out ${formatBytes(s.net_tx_bytes_total)}`
+    ];
+    const counts = Object.entries(s.event_counts);
+    if (counts.length > 0) {
+      lines.push(`Events: ${counts.map(([a, n]) => `${a} ${n}`).join(", ")}`);
+    }
+    const recent = h.events.slice(-8);
+    if (recent.length > 0) {
+      lines.push("Recent events:");
+      for (const e of recent) {
+        lines.push(`  ${new Date(e.occurred_at_ms).toISOString()} ${e.action} (${e.source})`);
+      }
+    }
+    if (s.sample_count === 0 && h.events.length === 0) {
+      lines.push("(no stored history in this window)");
+    }
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+}
+
+// src/tools/update.ts
+import { z as z8 } from "zod";
+
+// src/update-audit-render.ts
+var DEFAULT_LOG_TAIL_BYTES = 4096;
+var MAX_LOG_TAIL_BYTES = 16384;
+function shortDigest(s) {
+  if (!s)
+    return "(none)";
+  const m = s.match(/^(?:[^@]+@)?sha256:([0-9a-f]{64})$/);
+  if (!m)
+    return s;
+  const hex = m[1];
+  return `sha256:${hex.slice(0, 7)}\u2026${hex.slice(-7)}`;
+}
+function fmtDuration(ms) {
+  if (ms == null)
+    return "\u2014";
+  if (ms < 1000)
+    return `${ms}ms`;
+  const s = Math.round(ms / 1000);
+  if (s < 60)
+    return `${s}s`;
+  const m = Math.floor(s / 60);
+  const rem = s % 60;
+  return `${m}m${rem}s`;
+}
+function tailLog(s, maxBytes) {
+  if (s == null)
+    return "";
+  if (maxBytes <= 0) {
+    const enc2 = new TextEncoder;
+    return `[...${enc2.encode(s).length} bytes elided (tail_bytes=0)]`;
+  }
+  const enc = new TextEncoder;
+  const bytes = enc.encode(s);
+  if (bytes.length <= maxBytes)
+    return s;
+  const dropped = bytes.length - maxBytes;
+  const tail = new TextDecoder("utf-8", { fatal: false }).decode(bytes.subarray(dropped));
+  return `[...${dropped} earlier bytes truncated]
+${tail}`;
+}
+function renderAuditRow(row, opts = {}) {
+  const tail = Math.min(opts.tail_bytes ?? DEFAULT_LOG_TAIL_BYTES, MAX_LOG_TAIL_BYTES);
+  const lines = [
+    `audit_id=${row.id} state=${row.state} duration=${fmtDuration(row.duration_ms)} started=${row.started_at}`,
+    `  from: ${shortDigest(row.from_digest)} \u2192 to: ${shortDigest(row.to_digest)}`
+  ];
+  if (row.prev_image_id)
+    lines.push(`  prev_image_id: ${shortDigest(row.prev_image_id)}`);
+  if (row.backup_path)
+    lines.push(`  backup: ${row.backup_path}`);
+  if (row.error_log)
+    lines.push(`  error_log: ${tailLog(row.error_log, tail)}`);
+  if (row.rollback_error) {
+    lines.push(`  rollback_error: ${tailLog(row.rollback_error, tail)}`);
+  }
+  return lines.join(`
+`);
+}
+function renderAuditList(rows, opts = {}) {
+  if (rows.length === 0) {
+    return "no update attempts recorded yet. Run moor_update_apply to start one.";
+  }
+  return rows.map((r) => renderAuditRow(r, opts)).join(`
+
+`);
+}
+
+// src/tools/update.ts
+function registerUpdateTools(server, client2) {
+  const { apiResponse, readErrorMessage } = client2;
+  server.registerTool("moor_update_status", {
+    title: "Update status / preflight",
+    description: "Report moor's current version + image digest, the latest available digest on GHCR, active in-flight work counts, DB backup recency, and a safe_to_update boolean. update_available is null (not false) when either the local repo_digest or the registry digest is unknown \u2014 never lies by comparing across identifier spaces. unsafe_reasons is a human-readable array; render inline rather than re-deriving from booleans. Read-only diagnostic \u2014 does NOT perform any update."
+  }, async () => {
+    const res = await apiResponse.get("/api/server/update-status");
+    if (!res.ok)
+      throw new Error(`Failed: ${res.status} ${await readErrorMessage(res)}`);
+    const s = await res.json();
+    const lines = [];
+    lines.push(`moor ${s.current.version} (image_id: ${s.current.image_id ?? "unknown"})`);
+    lines.push(`repo_digest: ${s.current.repo_digest ?? "(none \u2014 locally built or stale inspect)"}`);
+    if (s.available.update_available === true) {
+      lines.push(`update AVAILABLE \u2192 latest: ${s.available.latest_digest}`);
+    } else if (s.available.update_available === false) {
+      lines.push(`up to date (latest: ${s.available.latest_digest})`);
+    } else {
+      const why = s.available.registry_error ? `registry unreachable: ${s.available.registry_error}` : s.current.repo_digest === null ? "no local repo_digest (built locally?)" : "comparison unavailable";
+      lines.push(`update availability unknown \u2014 ${why}`);
+    }
+    lines.push(`active: builds=${s.active_work.builds_in_flight} execs=${s.active_work.execs_in_flight} crons=${s.active_work.crons_in_flight} terminals=${s.active_work.terminals_open}`);
+    if (s.safe_to_update) {
+      lines.push("safe_to_update: YES");
+    } else {
+      lines.push("safe_to_update: NO");
+      for (const r of s.unsafe_reasons)
+        lines.push(`  - ${r}`);
+    }
+    lines.push(`recommended: ${s.recommended_command}`);
+    return { content: [{ type: "text", text: lines.join(`
+`) }] };
+  });
+  server.registerTool("moor_update_apply", {
+    title: "Apply moor update (transient respawner)",
+    description: "Update moor in-place via a transient respawner container. Runs preflight, enables drain, takes a fresh DB backup, then launches a one-shot Compose-aware respawner that pulls + re-creates the moor service. The respawner writes a marker file when done; this tool returns the audit_id immediately so the caller can poll via moor_update_audit. Outcomes: success | failed (pull failed pre-replacement) | rolled_back (up/health failed, automatic rollback succeeded) | rollback_failed (rollback also failed \u2014 manual recovery needed) | crashed (no marker after 30-min grace). Bypass is per-blocker: pass {bypass:['active_work']} to interrupt in-flight builds/execs/crons via the existing shutdown coordinator; {bypass:['unknown_digest']} when the registry comparison was inconclusive. Backup is mandatory and not bypassable.",
+    inputSchema: z8.object({
+      target_digest: z8.string().regex(/^sha256:[0-9a-f]{64}$/, "target_digest must be sha256:<64 hex>").optional().describe("Pin the update to this exact image digest. Default: the registry's current `:latest` digest from moor_update_status."),
+      bypass: z8.array(z8.enum(["active_work", "unknown_digest"])).optional().describe("Per-blocker bypass. `active_work` accepts that in-flight builds/execs/crons will be interrupted via the shutdown coordinator. `unknown_digest` accepts proceeding when the registry comparison is inconclusive (locally-built image, GHCR unreachable). Backup is mandatory and not in this list.")
+    })
+  }, async (input) => {
+    const res = await apiResponse.post("/api/server/update/apply", input ?? {});
+    if (res.status === 202) {
+      const { audit_id } = await res.json();
+      return {
+        content: [
+          {
+            type: "text",
+            text: `Update started: audit_id=${audit_id}. Respawner is running async. Poll moor_update_audit to watch the outcome, or moor_update_status to watch the version. Possible terminal states:
+    - success         (new image healthy)
+    - failed          (pull failed before moor was replaced)
+    - rolled_back     (up/health failed; automatic rollback succeeded; drain stays on)
+    - rollback_failed (up/health failed AND rollback failed; manual recovery)
+    - crashed         (no marker after 30-min grace; respawner died)
+  Recovery: rolled_back means moor is on the previous image again; the failed update is captured in error_log. rollback_failed or crashed mean an operator should investigate (likely manual docker compose up).`
+          }
+        ]
+      };
+    }
+    const body = await res.json().catch(() => ({}));
+    const code = body.error?.code ?? `HTTP ${res.status}`;
+    const reason = body.error?.reason ?? "no detail";
+    const extra = body.error?.unsafe_reasons ? `
+unsafe_reasons:
+  - ${body.error.unsafe_reasons.join(`
+  - `)}` : "";
+    throw new Error(`moor_update_apply refused [${code}]: ${reason}${extra}`);
+  });
+  server.registerTool("moor_update_audit", {
+    title: "Update history (audit log)",
+    description: "Read-only: recent moor_update_apply attempts and their outcomes. Each row shows audit_id, state (success | failed | rolled_back | rollback_failed | in_progress | crashed), duration, digest deltas, backup path, and any error logs. error_log preserves the ORIGINAL apply failure (never overwritten by rollback step details); rollback_error is set only on rollback_failed. Default tail is 4 KiB per log field; pass tail_bytes=0 to omit log bodies entirely (keeps the metadata line and replaces the body with a sized marker), or up to 16384 to read more.",
+    inputSchema: z8.object({
+      limit: z8.number().int().min(1).max(200).optional().describe("How many most-recent attempts to return. Default 20, max 200."),
+      tail_bytes: z8.number().int().min(0).max(MAX_LOG_TAIL_BYTES).optional().describe("Max bytes of error_log and rollback_error returned inline per row. Default 4096 (4 KiB). 0 to omit log bodies entirely; 16384 max.")
+    })
+  }, async ({ limit, tail_bytes }) => {
+    const qs = new URLSearchParams;
+    if (limit !== undefined)
+      qs.set("limit", String(limit));
+    const path = qs.toString() ? `/api/server/update/audit?${qs.toString()}` : "/api/server/update/audit";
+    const res = await apiResponse.get(path);
+    if (!res.ok)
+      throw new Error(`update audit failed: ${res.status} ${await readErrorMessage(res)}`);
+    const { rows } = await res.json();
+    return {
+      content: [{ type: "text", text: renderAuditList(rows, { tail_bytes }) }]
+    };
+  });
+}
+
+// src/index.ts
+var config = {
+  baseUrl: (process.env.MOOR_URL || "").replace(/\/$/, ""),
+  apiKey: process.env.MOOR_API_KEY || ""
+};
+if (!config.baseUrl || !config.apiKey) {
+  console.error("MOOR_URL and MOOR_API_KEY environment variables are required");
+  process.exit(1);
+}
+async function rawResponseRequest(callClient) {
+  let rawResponse;
+  const fetchRawResponse = async (input, init) => {
+    rawResponse = await globalThis.fetch(input, init);
+    return new Response(null, { status: 204 });
+  };
+  const client2 = createMoorApiClient({
+    ...config,
+    fetch: fetchRawResponse
+  });
+  await callClient(client2);
+  if (!rawResponse)
+    throw new Error("No response received");
+  return rawResponse;
+}
+{
+  let probeRes;
+  try {
+    probeRes = await rawResponseRequest((client2) => client2.get("/api/projects", { signal: AbortSignal.timeout(5000) }));
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(`Cannot reach moor at ${config.baseUrl}: ${msg}`);
+    console.error("Check MOOR_URL and that moor is running (and tunneled, if remote).");
+    process.exit(1);
+  }
+  if (probeRes.status === 401) {
+    console.error(`Authentication failed against ${config.baseUrl}.`);
+    console.error("Check MOOR_API_KEY matches the value in moor's .env on the server.");
+    process.exit(1);
+  }
+  if (probeRes.status === 503) {
+    console.error(`moor at ${config.baseUrl} returned 503.`);
+    console.error("Likely cause: MOOR_INITIAL_PASSWORD not configured. Set it and restart moor.");
+    process.exit(1);
+  }
+  if (!probeRes.ok) {
+    console.error(`moor at ${config.baseUrl} returned ${probeRes.status} on startup probe.`);
+    process.exit(1);
+  }
+}
+var apiResponse = {
+  get: (path) => rawResponseRequest((client2) => client2.get(path)),
+  post: (path, body) => rawResponseRequest((client2) => client2.post(path, body)),
+  put: (path, body) => rawResponseRequest((client2) => client2.put(path, body)),
+  delete: (path) => rawResponseRequest((client2) => client2.delete(path))
+};
+async function readErrorMessage(res) {
+  const text = await res.text();
+  return parseErrorMessage(text, res.status);
+}
+async function resolveProject(name) {
+  const res = await apiResponse.get("/api/projects");
+  if (!res.ok)
+    throw new Error(`Failed to list projects: ${res.status}`);
+  const projects = await res.json();
+  const match = projects.find((p) => p.name === name || String(p.id) === name);
+  if (!match)
+    throw new Error(`Project "${name}" not found`);
+  return match;
+}
+async function readSSE(res) {
+  const reader = res.body?.getReader();
+  if (!reader)
+    return { logs: "" };
+  const decoder = new TextDecoder;
+  let buffer = "";
+  let currentEvent = "";
+  let logs = "";
+  let error;
+  let structuredError;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done)
+      break;
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split(`
+`);
+    buffer = lines.pop() || "";
+    for (const line of lines) {
+      if (line.startsWith("event: ")) {
+        currentEvent = line.slice(7).trim();
+      } else if (line.startsWith("data: ")) {
+        const data = JSON.parse(line.slice(6));
+        if (currentEvent === "log")
+          logs += data;
+        else if (currentEvent === "error")
+          error = data;
+        else if (currentEvent === "structured-error")
+          structuredError = data;
+        currentEvent = "";
+      }
+    }
+  }
+  return { logs, error, structuredError };
+}
+var server = new McpServer({
+  name: "moor",
+  version: "0.1.0"
+});
+var client2 = { apiResponse, resolveProject, readErrorMessage, readSSE };
+registerProjectTools(server, client2);
+registerRunTools(server, client2);
+registerExecTools(server, client2);
+registerEnvTools(server, client2);
+registerCredentialTools(server, client2);
+registerServerTools(server, client2);
+registerUpdateTools(server, client2);
+registerCleanupTools(server, client2);
+var transport = new StdioServerTransport;
+await server.connect(transport);